Tenant auto creation

Tenant Onboarding Automation - Swimlane Flow Diagram

Issue Reference: enclaive/emcp-be#2279


Swimlane: Full Tenant Provisioning Flow


State Machine: Tenant Provisioning Lifecycle


Service Responsibility Matrix


Retry Strategy Summary

Phase
Retry Target
Trigger
Strategy
Max Attempts
Backoff
On Exhaustion

Phase 2

Keycloak API

Connection timeout / 5xx

Simple retry

2

3s fixed

STEP_FAILED ── admin notified

Phase 3

Vault API

Connection timeout / 5xx

Simple retry

2

3s fixed

STEP_FAILED ── admin notified

Phase 4

Cloudflare API

429 rate limit / 5xx

Exponential backoff

3

2s → 4s → 8s

STEP_FAILED ── admin can retry

Phase 4

Cloudflare API

409 conflict (exists)

Skip (idempotent)

-

-

Treat as success

Phase 5

GitHub API

403 / 5xx

Simple retry

2

5s fixed

STEP_FAILED ── manual PR needed

Phase 6

Health check

Endpoint not ready

Polling

20

15s interval

TIMEOUT ── admin can retry

Any

Admin retry

Button click

Resume from failed step

Unlimited

-

Admin decides


Missing Steps Added (vs Original List)

Your Step
What Was Added

Keycloak created

+ OIDC client registration, admin user creation, role assignment, theme & email config, token lifespans, password policy

Vault created

+ Identity engine, KV-v2 engine, K8s auth role for pod injection, access policies, agent sidecar config

Domains created

+ Redis Streams dispatch (BE → WR), per-environment DNS (prod/staging/dev), idempotent duplicate handling

DNS → Git Action

+ Branch creation, Helm values.yaml modification per env, auto-approve validation, squash merge

Deployment

+ ArgoCD sync detection, cert-manager TLS provisioning, structured health check polling

Completed

+ Billing setup, theme sync, settings sync, tenant-events stream (→ finops-service), audit log with actor tracking

(new)

+ Client-side validation, subdomain uniqueness check, env prefix generation, SSE progress updates, retry from failed step

Last updated

Was this helpful?