Tenant Onboarding

Tenant onboarding separates one-time GWEB platform provisioning from ongoing tenant self-service.

One-time GWEB provisioning

GWEB may provision or approve:

• tenant identity;
• OIDC configuration;
• tenant profile;
• environment registration;
• tenant namespace/environment mapping;
• application ownership;
• tenant role and capabilities;
• repository/CI registration;
• tenant connection or VPN configuration when required;
• environment policy;
• production-promotion policy;
• supported service-exposure capabilities.

Ongoing tenant workflow

After provisioning, an approved tenant can normally inspect its own tenant context with commands such as:

gwebc environment list
gwebc app list --environment dev
gwebc deploy status
gwebc deploy plan <application> --environment dev

GEDU examples can make the tenant profile explicit:

gwebc --profile gedu environment list
gwebc --profile gedu app list --environment dev

The exact rights available depend on the tenant's role, delegated capabilities, application ownership, environment state, and platform policy.

Tenant self-service boundary

Approved tenants can manage supported tenant-facing operations through gwebc without receiving unrestricted Kubernetes administration.

Tenant self-service may include:

• environment and application inspection;
• approved dev/preprod deployment mutation;
• deployment status/history;
• controlled promotion requests;
• tenant domain/service-exposure workflows;
• tenant-safe connection/VPN workflows when enabled.

What tenants do not receive

Normal tenant access does not include:

• Kubernetes cluster-admin credentials;
• GWEB platform-administrator tooling;
• internal broker/controller credentials;
• direct internal database access;
• authority over another tenant's namespaces;
• unrestricted production mutation;
• direct GWEB cloud-provider credentials.