TPI Storage#

TPI → TSTPI Storages

Defines how to reach a storage server. A TPIStorage configures access to the file server that TPIExport uploads the produced workbook to, and that TPIImport (or TPIImportDryRun) downloads the workbook from. Create your own TPIStorage for a file server you operate (with TLS and appropriate access controls in production).

Storage server#

TPI currently supports only HTTP(S). TPI uses GET to download files, PUT to upload files, and HEAD on the storage root path for the TPIStorage reachability probe. Other methods (POST, PATCH), WebDAV-only flows, multipart uploads, and similar patterns are not used by TPI.

Root path#

The full path of a workbook is the spec.rootPath joined with the spec.path from the TPI or TPIExport workflow. The root path can contain forward slashes as allowed by the CRD. The full path must resolve to a single file object on the storage server. The directory on the storage server that backs spec.rootPath must exist and be writable by the process that serves PUT (for example, nginx under its configured user/group). Otherwise exports can fail with 500.

Authentication#

TPIStorage supports two authentication mechanisms that can be used independently or combined: HTTP Basic authentication (application layer) and mutual TLS (transport layer).

HTTP Basic#

For HTTP Basic authentication, use a Kubernetes Basic authentication Secret in the same namespace as the TPIStorage, and set spec.http.basicAuthSecret to that Secret’s name. The EDA UI does not create this Secret — create it in the cluster yourself (for example with kubectl, oc, GitOps, or a manifest).

Example for creating the Secret with kubectl:

kubectl create secret generic tpi-storage-basic-auth \
    -n <NAMESPACE> \
    --type=kubernetes.io/basic-auth \
    --from-literal=username=myusername \
    --from-literal=password=mypassword

If basicAuthSecret is unset, the client sends no Authorization header. If the server still requires Basic authentication, requests fail with 401.

Mutual TLS (mTLS)#

For mTLS (TLS client authentication over HTTPS), reference a Kubernetes Secret in the same namespace as the TPIStorage from spec.http.https.clientTlsSecret. Enable spec.http.https on the TPIStorage. The EDA UI does not create this Secret — create it yourself (for example kubectl, oc, GitOps, or a manifest).

TPI requires the same data layout as a TLS Secret: tls.crt, tls.key, and optional ca.crt. That matches kubectl create secret tls and typical cert-manager Certificate-backed Secrets. When ca.crt is set, PEM-encoded CA certificate(s) are merged into the pool used to verify the server certificate (in addition to the system trust store), unless spec.http.https.skipVerify is true.

Example for creating the Secret with kubectl:

kubectl create secret generic tpi-storage-mtls \
    -n <NAMESPACE> \
    --type=kubernetes.io/tls \
    --from-file=tls.crt=client.pem \
    --from-file=tls.key=client-key.pem \
    --from-file=ca.crt=ca-chain.pem

Omit --from-file=ca.crt=... if you rely only on the system trust store (and skipVerify is false). When you do not need ca.crt, the Secret can be created with kubectl:

kubectl create secret tls tpi-storage-mtls \
    -n <NAMESPACE> \
    --cert=client.pem \
    --key=client-key.pem

If spec.http.https.clientTlsSecret is unset, the client does not present a client certificate. If https is unset, connections use plain HTTP and mTLS does not apply.

Dependencies#

The TPIStorage resource has no dependencies on other EDA resources.

Referenced resources#

A TPIStorage optionally references Kubernetes Secret resources in the same namespace:

• spec.http.basicAuthSecret -- for HTTP Basic authentication (see HTTP Basic)
• spec.http.https.clientTlsSecret -- for TLS client authentication (see Mutual TLS (mTLS))

Examples#

apiVersion: tpi.eda.nokia.com/v1
kind: TPIStorage
metadata:
  name: example-storage
  namespace: eda
spec:
  protocol: HTTP
  rootPath: examples/tpi
  http:
    hostname: tpi-storage.example.nokia.com
    port: 443
    basicAuthSecret: tpi-storage-basic-auth
    https:
      skipVerify: false

cat << 'EOF' | kubectl apply -f -
apiVersion: tpi.eda.nokia.com/v1
kind: TPIStorage
metadata:
  name: example-storage
  namespace: eda
spec:
  protocol: HTTP
  rootPath: examples/tpi
  http:
    hostname: tpi-storage.example.nokia.com
    port: 443
    basicAuthSecret: tpi-storage-basic-auth
    https:
      skipVerify: false

EOF

Custom Resource Definition#

To browse the Custom Resource Definition go to crd.eda.dev.