Version: Next 🚧

Generated reference

This page is generated at build time from the crd-schemas JSON Schemas published by the waas repository, vendored at ref v0.2.0.

WorkspacePolicy

WorkspacePolicy is the self-service envelope for a user or group.

Namespaced · kubectl get workspacepolicies, short name wsp.

Every field of the manifest below carries its API documentation as YAML comments — the same text kubectl explain shows. Click a key to fold or unfold its subtree; # required and defaults are noted on the field line itself.

spec

apiVersion: waas.xorhub.io/v1alpha1
kind: WorkspacePolicy
metadata:
name: <name>
namespace: <namespace>
# WorkspacePolicySpec is the admin-defined envelope for self-service.
# Resolution rule (deliberate, keep in sync with pkg/policy): among all policies whose subjects match the user, the HIGHEST spec.priority wins and applies as a whole — no field merging between policies. Ties break on the lexicographically smallest name and surface a warning, because two same-priority matches are a configuration smell. A policy with no subjects matches every authenticated user: name one "default" with priority 0 as the restrictive fallback. No matching policy at all means DENY (fail closed).
spec: {…}
# Clipboard controls the clipboard bridge between the user's machine and their workspace sessions. Absent = both directions allowed. Enforced by the WebSocket proxy (instruction filtering, rights stamped into the connection token) — the portal only reflects it.
clipboard:
# CopyFromWorkspace permits copying FROM the workspace to the local clipboard (data exfiltration direction).
copyFromWorkspace: <boolean>
# PasteToWorkspace permits pasting the local clipboard INTO the workspace (data injection direction).
pasteToWorkspace: <boolean>
# Images is the subset of catalog entries (WorkspaceImage names) this policy allows. Empty = the whole enabled catalog (each image's own allowedGroups still applies).
images:
-  <string>
# Lifecycle bounds workspace longevity to fight accumulation.
lifecycle:
# IdleSuspendAfter pauses a workspace with no active session for this long (compute freed, home kept). Zero/absent = never.
idleSuspendAfter: <string>
# MaxLifetime deletes the workspace (home included) this long after creation. Zero/absent = never. Deletion is announced through the workspace's Events and status conditions.
maxLifetime: <string>
# Limits caps what the matched user can consume.
limits: {…}
# Aggregate caps the SUM across all of the user's workspaces (paused included for storage; compute of paused workspaces is released and therefore not counted).
aggregate:
cpu: <quantity>
memory: <quantity>
# Storage caps the sum of home volume sizes.
storage: <quantity>
# Defaults is the sizing the portal proposes when the user does not choose. Display-only: a per-image default (image.resources.default) takes precedence, and enforcement is unaffected either way.
defaults:
cpu: <quantity>
memory: <quantity>
# MaxRunningWorkspaces is the max simultaneously running (compute active) workspaces per user. Paused workspaces do not count: pausing frees a slot, resuming re-acquires one. Detached volumes do not count either.
maxRunningWorkspaces: <int32>  # min: 0
# MaxWorkspaces is the max simultaneous workspaces per user. Paused workspaces count: their home PVC still holds storage.
maxWorkspaces: <int32>  # min: 0
# PerWorkspace caps a single workspace. The effective cap is min(these, image.resources.max).
perWorkspace:
cpu: <quantity>
# Home caps the persistent home volume size.
home: <quantity>
memory: <quantity>
# Overrides bounds instantiation-time template overrides for the governed users, on top of each template's own allow-list.
overrides:
# AllowedFields the governed users may override when the template also allows them.
allowedFields:
-  env | securityContext | podSecurityContext | volumes | nodeSelector | tolerations | resources | protocol | protocolParams | schedule | placement | metadata
# Priority orders competing policies; higher wins. Convention: 0 = default fallback, 100–999 = group policies, 1000+ = per-user exceptions.
priority: <int32>  # min: 0
# RemoteWorkspaces opts the governed users into the Remote Workspaces feature: registering out-of-cluster machines (host/port/protocol + credentials Secret) and connecting to them through guacd. Absent or false = feature hidden and refused (fail closed).
remoteWorkspaces: <boolean>
# Subjects this policy applies to (OR). Empty = every authenticated user.
subjects:
-
# SubjectKind says what a policy subject name refers to.
kind: User | Group  # required
name: <string>  # required · minLength: 1

spec​

spec