Sign in

Order a cluster vend (admin)

Changed on

Templates an eks-fleet Cluster CR from the input and commits it to the clusters GitOps repo; the vended cluster auto-registers when it comes up.

post/cluster-orders

Request

  • Base URL: /api/v1 (relative, and the document was published on a file host, not at the API’s origin)
  • URL: /api/v1/cluster-orders
  • Auth: HTTP bearer

Request body

namestring required
accountstring required
regionstring required
teamstring required
environment'development' | 'staging' | 'production'
cluster_versionstring
endpoint_public_accessboolean

Clusters vend with a private API endpoint (the eks-fleet default). Setting this true requires a non-empty endpoint_public_access_cidrs allowlist — orders that opt into public access without one are rejected with 400 (mirroring the Cluster XRD's CEL rule).

endpoint_public_access_cidrsstring[]

CIDR allowlist scoping who can reach the public endpoint (e.g. 203.0.113.0/24). Required (non-empty) when endpoint_public_access is true; each entry must parse as a CIDR.

observability_tier'floor' | 'full'

floor (the default) is CloudWatch alone; full adds the in-cluster LGTM stack and Amazon Managed Prometheus/Grafana, and requires the managed-monitoring substrate to exist for this cluster. Tenant workloads are identical either way — only the destinations differ.

ttl_daysinteger

Days-to-live for an ephemeral cluster. 0 (the default) is persistent; above 0 the hub reaper tears the cluster down that many days after creation.

vend_role_arnstring

The fleet-vend role for a cross-account vend. Setting it requires both permissions-boundary ARNs below — the vend mints IAM in the workload account, and the Cluster XRD refuses one that does not cap what it can mint.

cluster_permissions_boundary_arnstring

Boundary the cluster's IAM roles are minted with. Published to SSM by landing-zone at /eks-fleet/<environment>/fleet-vend/vend_permissions_boundary_arn.

operator_permissions_boundary_arnstring

Boundary the agent-platform operator role is minted with. Same value and SSM source as cluster_permissions_boundary_arn.

data_kms_key_arnstring

The spoke's data CMK, used to encrypt the model-artifacts and eval-reports buckets at rest. A prerequisite referenced by ARN — the vend does not create it.

Response

Provision enqueued

idstring required
org_idstring required
namestring required
environmentstring required
teamstring required
operation'provision' | 'deprovision' | 'unwedge' required
status'pending' | 'committed' | 'failed' | 'active' | 'deprovisioned' required
git_commit_shastring required
errorstring required
spec_jsonobject required

The clusterspec input the CR was templated from.

cluster_idstring nullable required
created_bystring required
created_atstring date-time required
completed_atstring date-time nullable required
vend_phasesobject required

Regressible map keyed by phase (committed, tofu_running, active, ...). Only portal-side phases advance locally; substrate phases need the in-cluster watcher.

Changes

  • faa6d80c3ce9Revision changes
    • warning

      the / request property's min was set to 0.00

    • warning

      the / request property's min was set to 1.00

    • warning

      the / request property's min was set to 1.00

    • warning

      the / request property's min was set to 0.00

  • 58656a617c2fRevision changes
    • warning

      removed the request property /

    • warning

      removed the request property /

    • warning

      removed the request property /

    • info

      added the new optional request property

    • info

      added the new optional request property

    • info

      added the new optional request property /

    • info

      added the new optional request property /

    • info

      added the new optional request property /

    • info

      added the new optional request property

    • info

      added the new optional request property

    • info

      added the new optional request property

    • info

      added the new optional request property