# Kubesphere Devops Tenant

Use when operating KubeSphere DevOps as a namespace-scoped tenant with limited...

- Repository: https://github.com/kubesphere/kubesphere (17074 stars)
- Category: DevOps
- License: see repository
- Last updated: 2026-07-15
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add kubesphere/kubesphere --skill kubesphere-devops-tenant -g -a claude-code -y`
Codex: `npx skills add kubesphere/kubesphere --skill kubesphere-devops-tenant -g -a codex -y`
Cursor: `npx skills add kubesphere/kubesphere --skill kubesphere-devops-tenant -g -a cursor -y`
Gemini CLI: `npx skills add kubesphere/kubesphere --skill kubesphere-devops-tenant -g -a gemini-cli -y`

## Description

Use when operating KubeSphere DevOps as a namespace-scoped tenant with limited permissions, without cluster-admin access, or when accessing DevOps through KubeSphere APIs only

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# KubeSphere DevOps Tenant Operations

## Overview

This guide covers DevOps operations for **namespace-scoped tenants** who:
- Have admin/operator permissions within their DevOpsProject namespace(s)
- **Cannot** access `kubesphere-devops-system` (Jenkins secrets, tokens)
- **Cannot** call Jenkins APIs directly
- Must use **KubeSphere APIs** (`/kapis/devops.kubesphere.io/`) for all operations
- Use **KubeSphere authentication** (OAuth tokens), not Jenkins tokens

**Critical Distinction:** DevOps projects are **namespaces**, not DevOpsProject CRs. To list accessible DevOps projects:
```bash
# Correct - lists namespaces (DevOps projects) tenant can access
GET /clusters/{cluster}/kapis/devops.kubesphere.io/v1alpha3/workspaces/{workspace}/namespaces

# Wrong - requires cluster-admin, returns 403 for tenants
GET /clusters/{cluster}/apis/devops.kubesphere.io/v1alpha3/devopsprojects
```

## When to Use

- Operating as a project admin/operator (not cluster admin)
- Working within tenant namespace boundaries
- No access to Jenkins secrets in `kubesphere-devops-system`
- Need to trigger pipelines via KubeSphere API
- Building automation for namespace-scoped users
- Developing tenant-facing tooling

## Tenant vs Admin Permissions

| Capability | Tenant (Namespace) | Admin (Cluster) |
|------------|-------------------|-----------------|
| Access DevOpsProject | ✅ Own namespace(s) | ✅ All namespaces |
| Create/Edit Pipelines | ✅ In own namespace | ✅ Any namespace |
| View PipelineRuns | ✅ In own namespace | ✅ Any namespace |
| Access Jenkins Secret | ❌ No | ✅ `kubesphere-devops-system` |
| Direct Jenkins API | ❌ No | ✅ Full access |
| View Jenkins Console | ❌ No | ✅ Via NodePort |
| KubeSphere API | ✅ `/kapis/` | ✅ `/kapis/` |

## Authentication

Tenants authenticate via KubeSphere's OAuth, not Jenkins. See [kubesphere-core](../../core/kubesphere-core/SKILL.md) for complete OAuth authentication details.

### Quick Reference

The rest: https://github.com/kubesphere/kubesphere/blob/HEAD/skills/kubesphere-devops-tenant/SKILL.md