Core concepts
Everything you do in the console is a Kubernetes-style object. The console is a view over those objects, and the same objects are reachable with kubectl.
Workspace and namespace
- A workspace is your organization, for example tapsifood. Each workspace has its own API server; nothing in one workspace can see another. The API is kubectl-compatible; it is not a Kubernetes cluster for running your workloads.
- A namespace is a project inside a workspace, for example default or production. Machines, disks, bucket claims and addresses live in namespaces.
| Scope | What lives there | Examples |
|---|---|---|
| Workspace | Shared infrastructure and org-wide settings | VPC, Subnet, S3Bucket, WorkspaceMembership, PublicIP, billing |
| Namespace | Workloads and the claims they hold | VirtualMachine, PersistentVolumeClaim, PrivateIP, PublicIPClaim, S3BucketClaim, NamespaceMembership |
A namespace reaches a workspace asset only through a grant or a claim: a Subnet lists the namespaces allowed to use it, a PersistentVolumeClaim binds a PersistentVolume, and an S3BucketClaim creates a bucket for one namespace.
Catalog
Zone, MachineType, MachineImage and StorageClass are the platform catalog. They are the same in every workspace and read-only (create returns 405 MethodNotAllowed).
| Kind | Current values |
|---|---|
| Zone | thr-az2 (region thr) |
| MachineType | ex811 … ex816 |
| MachineImage | ubuntu-24-04, ubuntu-26-04, debian-12, debian-13 |
| StorageClass | ssd |
❯ kubectl get zones,machinetypes,machineimages
spec, status and conditions
- spec is what you asked for; status is what exists. The platform never rewrites your spec.
- status.phase is a one-word summary for display (Pending, Ready, Available, Error, Bound, Released). status.conditions[] is the contract: Ready plus kind-specific conditions, each with a reason and message.
- A create can succeed and then stay at Ready=False (address conflict, missing grant, quota limit). That is not an error response; the object exists and its condition says why.
- If status.observedGeneration is lower than metadata.generation, the controller has not caught up with your latest edit yet.
References, immutability and safe deletion
Objects reference each other by name (subnetRef: {name: app-a}). Some fields are fixed once set: a machine’s image, placement and SSH keys, a subnet’s CIDR, a claim’s storage class. To change one, create a new object.
A VPC with subnets, a subnet with addresses, an attached disk, a bound public address or an image in use refuses to delete until its dependents are gone; kubectl delete waits or is refused with the reason.