Kubernetes Operator

Use the thoth-operator when you want Kubernetes-native, GitOps-friendly reconciliation of Thoth control-plane tenant configuration.

Source repository

• GitHub: github.com/atensecurity/thoth-operator

What it reconciles

• Tenant settings
• MDM provider configuration
• Pack assignments
• Policy sync triggers
• Optional governance evidence backfill jobs
• Optional decision-field backfill jobs

Recommended deployment pattern

Choose one owner for each configuration surface and avoid competing reconciliation:

1. Use Terraform/Pulumi providers for account-level and long-lived platform resources.
2. Use thoth-operator for cluster-local tenant bootstrap and day-2 reconciliation.
3. Use optional backfill blocks in ThothTenant when you need to recover evidence completeness after rollout changes.

Endpoint model

By default, the operator derives tenant endpoint URLs as:

https://grid.<tenant_id>.<apex_domain>

Set apiBaseURL to the supplied GovAPI endpoint when your environment uses an explicit base URL. Confirm derived routing with your administrator before using the fallback. The SDK runtime URL is a separate endpoint.

Next steps

1. Quickstart
2. CRD Reference
3. Public runbook