Tenants

A tenant is an isolated team or customer in a cluster. Each tenant has its own:

• Nodes. A node belongs to one tenant, chosen by its join token or by the operator who accepts it.
• Plugins. Installing a plugin installs it on that tenant's nodes only. Agent names are unique per tenant.
• Secrets. A secret sealed for one tenant cannot be opened for another.
• Temporal namespace, with the same name as the tenant. Jobs of one tenant never share a namespace with another's.
• Usage. Cost is recorded per tenant.

Every cluster starts with the tenant default. Create more with:

orchestrator-zero tenant create acme --display-name "Acme Inc."
orchestrator-zero tenant list

Most commands take --tenant, which defaults to default. Servers register a Temporal namespace for every tenant at start and every 30 seconds after.

Accounts have a role in each tenant: reader, operator, admin or owner, and the permission to see what the tenant's jobs read and wrote is separate from the role. See Web UI. Operator certificates, which the CLI uses, manage every tenant.