Multi-Tenancy CLI Reference

Commands for managing tenants in a multi-tenant OpenFlows deployment. For an overview of the tenant model, see the main multi-tenancy guide.

Adding a Tenant

Use the CLI to create a tenant. The command creates the Coder group, provisions the tenant NEXUS workspace, and registers the Redis namespace. After creation, the tenant can start polling GitHub issues immediately.

bash

./scripts/prod.sh tenant owner/repo --name my-team

The command performs the following steps:

Validates that the Coder deployment is reachable and that the caller has permission to create groups.
Creates the Coder group my-team if it does not exist.
Creates the NEXUS service account and provisions the workspace openflows-nexus-my-team.
Registers the namespace ns:my-team: in Redis.
Binds the repository owner/repo to the tenant.
Writes the tenant configuration to orchestration/tenants/my-team.json.

Removing a Tenant

Removing a tenant is destructive. It stops all workers, tears down the NEXUS workspace, and optionally archives or deletes the Redis keyspace. The CLI asks for confirmation unless the --force flag is provided.

bash

# Archive data and remove the tenant
./scripts/prod.sh tenant remove my-team --archive

# Delete data immediately without confirmation
./scripts/prod.sh tenant remove my-team --force

Removing a tenant does not close open PRs

The tenant removal command stops new work and tears down the controller. It does not close or merge in-flight PRs. Review any pending PRs before removing a tenant, or transfer them to another tenant manually.

Isolating a Tenant

Isolation is a soft pause. It suspends all worker slots, stops NEXUS from polling GitHub, and prevents new workspace provisioning. Existing workspaces are not destroyed, but they are marked as suspended and will not receive new tasks. Isolation is useful for maintenance, incident response, or compliance holds.

bash

# Isolate a tenant
./scripts/prod.sh tenant isolate my-team

# Resume normal operation
./scripts/prod.sh tenant resume my-team

Isolation sets the ns:{tenant}:isolated flag in Redis. NEXUS checks this flag on every poll cycle. If it is set, NEXUS skips discovery and assignment for that tenant. Worker slots already assigned to a ticket are allowed to finish their current segment, but they are not given new work.

CLI Commands Summary

bash

# Create a tenant
./scripts/prod.sh tenant owner/repo --name my-team

# Remove a tenant (with confirmation)
./scripts/prod.sh tenant remove my-team

# Remove a tenant without confirmation
./scripts/prod.sh tenant remove my-team --force

# Isolate a tenant (suspends all workers)
./scripts/prod.sh tenant isolate my-team

# Resume a previously isolated tenant
./scripts/prod.sh tenant resume my-team

# List all tenants
./scripts/prod.sh tenant list

Tenant configuration is hot-reloaded

Adding or removing a tenant does not require a global controller restart. The NEXUS workspace for the tenant starts immediately; the Redis namespace is created on first write. Existing tenants continue to operate unchanged.