Cloudeka User

Represents your (or a teammate's) access grant to the platform. Creating or reconciling one provisions a ServiceAccount, RBAC bindings, and a token Secret used to build a kubeconfig—it is the object behind the access described in Introduction.

kubectl get user -n <your-namespace>
kubectl get user -n <your-namespace> -o yaml

Field	Meaning
spec.rateLimit	Your API rate limit
spec.expiredAt	Your access expiry date (YYYY-MM-DD) — after this, your token stops working
spec.privileges.clusterRole	ClusterRoles bound to your access
spec.privileges.role	Namespaced Roles bound to your access

Requesting access or a renewal

CloudekaUser objects are provisioned by the platform team as part of onboarding or renewal—you don't self-service create these. If your spec.expiredAt is approaching or has passed, contact platform support for a renewal before your token stops authenticating.

If you do manage users yourself

Where platform policy allows a tenant admin to provision sub-users directly, note the validation rules enforced on create or update:

Rule	Rejection you'll see
expiredAt must be YYYY-MM-DD	"Invalid date format for expiry date … Format is YYYY-MM-DD"
Every clusterRole entry must reference an existing ClusterRole	"Cannot find cluster role …"
Every role entry must reference an existing Role in its namespace	"Cannot find role …"