Tenant Admission

Mon, 01 Jan 0001 00:00:00 +0000

Tenant Admission #

The operator’s half of creating a tenant. The operator admits a name; the tenant then declares everything else itself, through the Deevnet API ( ADR-0015). The tenant’s half is Tenant Operations.

Admission is the only substrate act a new tenant needs. The operator never edits an inventory file to make a tenant, and the tenant never holds a Proxmox credential, a vault password or an index.

Before you start #


The API	`https://api.mobile.deevnet.net:8080`, reachable from the Builder
The operator token	`vault_deevnet_api_token`, in the inventory’s `deevnet_api` group vault
The site CA	`ansible-collection-deevnet.mgmt/.openbao/site-ca.pem` on the control node
The provider	the tenant installs `deevnet/deevnet` 0.4.x itself with `install-provider.sh` from the tenant downloads ( Before You Start). No role installs it. Before a meetup, check the downloads tree is current: the provider repo’s `make stage`, the image factory’s `make pi-backend-publish`, then `deevnet.mgmt site.yml --tags tenant-downloads`

1. Admit the name #

curl -sS --cacert site-ca.pem \
 -H "Authorization: Bearer $OPERATOR_TOKEN" \
 -H 'Content-Type: application/json' \
 -d '{"name":"mabell"}' \
 https://api.mobile.deevnet.net:8080/v1/admissions

{ "name": "mabell", "enrollment_token": "s.…", "expires_at": "2026-09-26T…Z" }


The name	`^[a-z][a-z0-9]{0,7}$` — it becomes a PVE SDN zone ID, a DNS label and a state-store user
The token	single-use, expires after `DEEVNET_ENROLLMENT_TTL` (72h by default)
A name already registered	answers `409`. Admission creates nothing; it only authorizes

2. Hand over three things #

The tenant needs exactly these, and nothing else from the substrate:

Substrate Operations on Deevnet IoTaaS

Tenant Admission

Tenant Admission #

Before you start #

1. Admit the name #

2. Hand over three things #