Publish a provider version
Cluster admins only (`platform.admin`). Creates or replaces the version the definition names (format `harthelm/provider-v2`, `schemas/provider.schema.json`; the format of 1.0 is still taken): 201 for a new version, 200 for a replaced one. The definition is checked against the schema and the rules it cannot express (unique plan ids, at most one default plan, every plan sets exactly the resource parameters within their bounds, defaults and enums valid, required names exist, secrets are strings, `connection` names existing properties, only `rest` backends and no `capabilities.backup`): 422 with pointers into `/definition`. Harthelm dumps only the databases of its built-in providers; a REST backend backs up its own instances. A version with instances keeps them; a change that no longer accepts an instance's settings shows as its status `invalid-provider`. 409 `provider-builtin` for the name of a built-in provider (the chart's `marketplace.builtin` values configure those). Audited as `provider.publish`.
openapi/harthelm.yaml at v1.5.0__Host-harthelm_session<token>Browser session of the UI (12 h idle, 7 days absolute). State-changing requests also need the header
Harthelm-CSRF: 1 and a matching Origin.
name*stringThe provider's name; the definition's name must be the same.
^[a-z][a-z0-9-]{0,62}$application/json- body
definition*A provider definition in the format harthelm/provider-v2 as published (schemas/provider.schema.json, which
has the full rules); keys are the file's (camelCase). The console builds the create form from fields.config
and fields.secrets (react-jsonschema-form) and the details drawer from fields.details. Publishing also takes
the format of 1.0 (harthelm/provider-v1: configSchema, secretsSchema, detailsSchema, teamSingleton,
x-update-constraint) and stores it as v2.
teams?array<>Offer it only to these teams; absent offers it to every team.
1 <= itemsenabled?booleantruebackend_secret?stringREST providers: the bearer secret core sends to the backend (Authorization: Bearer <secret>), sealed in the
database. Absent keeps the stored one; an empty string removes it.
length <= 4096The replaced version.
application/json- response
name*ProviderNameValue^[a-z][a-z0-9-]{0,62}$version*ProviderVersionValue^[1-9][0-9]{0,5}$source*ProviderSourcebuiltin: comes with the binary and the chart's marketplace.builtin values; api: published by a cluster admin.
"builtin""api"enabled*booleanOffered for new instances; a disabled provider keeps its instances running.
available*booleanThe cluster has what the backend needs (the CNPG operator for the built-in PostgreSQL).
unavailable_reason?stringWhy not, when available is false.
teams?array<>The teams it is offered to; absent for every team.
backend_secret_set?booleanA REST provider has a bearer secret (the secret itself is never returned).
definition*A provider definition in the format harthelm/provider-v2 as published (schemas/provider.schema.json, which
has the full rules); keys are the file's (camelCase). The console builds the create form from fields.config
and fields.secrets (react-jsonschema-form) and the details drawer from fields.details. Publishing also takes
the format of 1.0 (harthelm/provider-v1: configSchema, secretsSchema, detailsSchema, teamSingleton,
x-update-constraint) and stores it as v2.
created_at*stringdate-timeupdated_at*stringdate-timecurl -X PUT 'https://console.example.com/api/v1/providers/string' \ -H 'Content-Type: application/json' \ -d '{ "definition": { "schema": "harthelm/provider-v2", "name": "string", "version": "string", "displayName": "string", "description": "string", "fields": { "config": {}, "secrets": {}, "details": {} }, "backend": {} }}'{ "name": "string", "version": "string", "source": "builtin", "enabled": true, "available": true, "unavailable_reason": "string", "teams": [ 1 ], "backend_secret_set": true, "definition": { "schema": "harthelm/provider-v2", "name": "string", "version": "string", "displayName": "string", "description": "string", "category": "string", "author": "string", "icon": "string", "documentationUrl": "string", "maturity": "ga", "onePerTeam": true, "labels": { "property1": "string", "property2": "string" }, "capabilities": { "pause": true, "backup": true, "rotate": true }, "fields": { "config": {}, "secrets": {}, "details": {} }, "connection": { "host": "string", "port": "string", "dsn": "string", "secret": "string" }, "resources": { "property1": { "kind": "cpu-millis", "title": "string", "description": "string", "minimum": 0, "maximum": 0, "readOnly": true, "x-hart-change": "grow-only" }, "property2": { "kind": "cpu-millis", "title": "string", "description": "string", "minimum": 0, "maximum": 0, "readOnly": true, "x-hart-change": "grow-only" } }, "plans": [ { "id": "string", "name": "string", "description": "string", "default": true, "resources": { "property1": 0, "property2": 0 }, "parameters": {} } ], "backend": { "builtin": "string", "rest": { "url": "string", "timeoutSeconds": 0 } } }, "created_at": "2019-08-24T14:15:22Z", "updated_at": "2019-08-24T14:15:22Z"}List managed-service providers
With `team` (needs `team.view`): the team's catalog, the enabled providers offered to the team; one the cluster cannot run (no CNPG operator for PostgreSQL) is listed with `available` false and the reason, so the console can show why. Without `team`: every provider version, disabled ones included (cluster admins only, 403 otherwise). Ordered by display name, then name and version.
Rotate secrets
Needs `team.managed_services`, for a bound instance also `landscape.manage` on its workspace (the values are revisions of its vault); the provider needs the `rotate` capability. Replaces the named secrets: `values` with the given values, `generate` with values the server generates (32 characters of letters and digits); a secret is in at most one of them. The values are never returned. For an instance bound to a landscape the new value is a new revision of the vault key its `harthelm.yml` references, so the next Sync keeps it; services that use `${{ services.<name>.dsn }}` or `.secret` roll with the new password without a Sync (one that names the vault key itself keeps its pinned revision until its next Sync). The status goes `updating` while the backend changes the password. 422 `update-constraint` at `/values/<k>` or `/generate/<i>` for a fixed secret, 422 for an unknown one or a value the schema refuses; 409 while the instance is paused or deleted.