> For the complete documentation index, see [llms.txt](https://docs.cloudeka.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.cloudeka.ai/guidance-for-enterprise/service-limit/crds/cloudeka-user.md).

# Cloudeka User

Represents **your (or a teammate's) access grant** to the platform. Creating or reconciling one provisions a ServiceAccount, RBAC bindings, and a token Secret used to build a kubeconfig—it is the object behind the access described in [Introduction](/guidance-for-enterprise/service-limit/introduction.md).

```bash
kubectl get user -n <your-namespace>
kubectl get user -n <your-namespace> -o yaml
```

| Field                         | Meaning                                                                       |
| ----------------------------- | ----------------------------------------------------------------------------- |
| `spec.rateLimit`              | Your API rate limit                                                           |
| `spec.expiredAt`              | Your access expiry date (`YYYY-MM-DD`) — after this, your token stops working |
| `spec.privileges.clusterRole` | ClusterRoles bound to your access                                             |
| `spec.privileges.role`        | Namespaced Roles bound to your access                                         |

## Requesting access or a renewal

[`CloudekaUser`](/guidance-for-enterprise/service-limit/crds/cloudeka-user.md) objects are provisioned by the platform team as part of onboarding or renewal—you don't self-service create these. If your `spec.expiredAt` is approaching or has passed, contact platform support for a renewal before your token stops authenticating.

## If you do manage users yourself

Where platform policy allows a tenant admin to provision sub-users directly, note the validation rules enforced on create or update:

| Rule                                                                | Rejection you'll see                                         |
| ------------------------------------------------------------------- | ------------------------------------------------------------ |
| `expiredAt` must be `YYYY-MM-DD`                                    | "Invalid date format for expiry date … Format is YYYY-MM-DD" |
| Every `clusterRole` entry must reference an existing ClusterRole    | "Cannot find cluster role …"                                 |
| Every `role` entry must reference an existing Role in its namespace | "Cannot find role …"                                         |