kubesphere-devops-tenant
Use when operating KubeSphere DevOps as a namespace-scoped tenant with limited permissions, without cluster-admin access, or when accessing DevOps through KubeSphere APIs only
npx skills add kubesphere/kubesphere --skill kubesphere-devops-tenant --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
What it does
Allows a namespace-scoped tenant with admin/operator rights in their own DevOpsProject namespace(s) to manage DevOps workflows using KubeSphere APIs only. It restricts access to Jenkins secrets and Jenkins APIs, and instructs the agent to authenticate via KubeSphere OAuth, then perform operations such as listing namespaces (as DevOps projects), triggering pipelines, creating pipelines, running and monitoring pipelines, and fetching logs and artifacts through the KubeSphere API endpoints. It emphasizes tenant isolation by returning 403 for access to other workspaces and requires using the tenant’s workspace scope for operations. It also documents quick reference commands to obtain and use OAuth tokens and to verify access via specific API endpoints.
How it works
- Authenticate as a tenant using KubeSphere OAuth (via endpoints shown in the quick reference).
- Use Kubernetes-like curl commands to call KubeSphere API endpoints under kapis/devops.kubesphere.io and related API groups (e.g., v1alpha3 for pipelines, v1alpha2 for runs).
- List accessible DevOps projects by issuing a GET to /kapis/devops.kubesphere.io/v1alpha3/workspaces/{workspace}/namespaces.
- Create and manage Pipelines in the tenant namespace using API calls, including creating Pipeline objects with apiVersion devops.kubesphere.io/v1alpha3 and kind Pipeline, and invoking runs via /runs endpoints.
- Trigger, list, and monitor PipelineRuns, and retrieve logs through tenant-scoped API endpoints without using Jenkins tokens or direct Jenkins API.
- When handling multi-branch pipelines, use the v1alpha3 endpoints for pipelines and guide branch selection through a three-step process (list branches, ask user for branch, trigger build with chosen branch).
When to use it
- Operating as a project admin/operator (not cluster admin)
- Working within tenant namespace boundaries
- No access to Jenkins secrets in kubesphere-devops-system
- Need to trigger pipelines via KubeSphere API
- Building automation for namespace-scoped users
- Developing tenant-facing tooling
What it can touch
- API endpoints under kapis/devops.kubesphere.io (e.g., v1alpha3 for pipelines, v1alpha2/v1alpha3 for runs and related resources)
- Namespaces representing DevOps projects (tenant-accessible workspaces)
- Secrets and Git credentials may be created in the tenant namespace for private repos (e.g., Secret of type credential.devops.kubesphere.io/basic-auth used in creating GitRepository credentials)
Caveats
- Token expiry is 7200 seconds (2 hours) for OAuth tokens.
- API versions: prefer v1alpha3 for pipelines and v1alpha2 was noted for runs but deprecated in favor of v1alpha3 when available.
- Tenant isolation enforces 403 Forbidden when accessing other workspaces.
- Requires explicit creation of credentials and GitRepositories for private repositories; pipelines must include kubesphere.io/creator annotation when created by a tenant.
- Multi-branch pipelines auto-discover branches from the repository; for private repositories, a credential must be created and referenced.
# KubeSphere DevOps Tenant Operations ## Overview This guide covers DevOps operations for **namespace-scoped tenants** who: - Have admin/operator permissions within their DevOpsProject namespace(s) - **Cannot** access `kubesphere-devops-system` (Jenkins secrets, tokens) - **Cannot** call Jenkins APIs directly - Must use **KubeSphere APIs** (`/kapis/devops.kubesphere.io/`) for all operations - Use **KubeSphere authentication** (OAuth tokens), not Jenkins tokens **Critical Distinction:** DevOps projects are **namespaces**, not DevOpsProject CRs. To list accessible DevOps projects: ```bash # Correct - lists namespaces (DevOps projects) tenant can access GET /clusters/{cluster}/kapis/devops.kubesphere.io/v1alpha3/workspaces/{workspace}/namespaces # Wrong - requires cluster-admin, returns 403 for tenants GET /clusters/{cluster}/apis/devops.kubesphere.io/v1alpha3/devopsprojects ``` ## When to Use - Operating as a project admin/operator (not cluster admin) - Working within tenant namespace boundaries - No access to Jenkins secrets in `kubesphere-devops-system` - Need to trigger pipelines via KubeSphere API - Building automation for namespace-scoped users - Developing tenant-facing tooling
- Overview
- When to Use
- Tenant vs Admin Permissions
- Authentication
- Quick Reference
- Get KubeSphere API Token
- Using Token with API
- Complete Working Example
- Step 1: Authenticate
- Step 2: Access Workspace Resources
- Step 3: Create and List Pipelines
- Step 4: Trigger and Monitor Run
- Step 5: Get Logs
- Key Findings
Correct - lists namespaces (DevOps projects) tenant can access
GET /clusters/{cluster}/kapis/devops.kubesphere.io/v1alpha3/workspaces/{workspace}/namespaces
Wrong - requires cluster-admin, returns 403 for tenants
GET /clusters/{cluster}/apis/devops.kubesphere.io/v1alpha3/devopsprojects
Exchange credentials for OAuth token (see core skill for details)
export KUBESPHERE_API="https://kubesphere-api.example.com"
export USERNAME="tenant-user"
export PASSWORD="tenant-password"
Get token
export API_TOKEN=$(curl -s -X POST "${KUBESPHERE_API}/oauth/token" \What does the kubesphere-devops-tenant skill do?
Use when operating KubeSphere DevOps as a namespace-scoped tenant with limited permissions, without cluster-admin access, or when accessing DevOps through KubeSphere APIs only
How do I install it?
Run `npx skills add kubesphere/kubesphere --skill kubesphere-devops-tenant --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From kubesphere/kubesphere, a repository with 17,016 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.