A Workload is a self-service feature for creating Kubernetes resources using the Helm charts available to the team from the catalog.

Authentication and authorization labels

Platform workloads that participate in platform-managed access control use two pod labels together:

• otomi.io/auth: platform selects pods targeted by the Istio RequestAuthentication resource that validates JWTs against Keycloak.
• otomi.io/auth-policy: <tier> selects pods targeted by an Istio AuthorizationPolicy with action ALLOW. The label value names the access tier for the workload, such as platform, platform-admin, platform-team, or monitoring-<teamId>.

The otomi.io/auth-policy value describes who may access the workload, not the identity of the workload itself. Multiple workloads can share the same tier label so they can reuse the same AuthorizationPolicy.

Gateway-level authentication policies use targetRefs on the Gateway. Tier-based authorization uses pod label selectors so one policy can target the intended workloads across namespaces.

View workloads

To view a list of workloads belonging to your team, click on Workloads in the main menu of the App Platform Console while in the Team view. The resulting table lists each workload alongside the following details:

Create a workload

Before creating a workload from the developer catalog, we'll need the repository and the tag of the image you would like to use.

1. Go to the list of Builds and add the repository of the build to use to your clipboard. Remember the tag.

2. Go to Workloads in the left menu and click on Create Workload.

3. Select a template from the catalog to use.

4. Add a Name for the workload.

5. (Optional) Configure the Auto image updater. Default is Disabled.

   The Auto Image Updater will (based on the update strategy) automatically update the container images of a workload.

   Select the update strategy. Choose between:

   • Digest: Inspects a single tag in the registry for changes, and updates the image on any change to the previous state. Requires to provide a repository and a tag.

   • Semver: Update based on semantic versions. Example: v1.0 would allow the image to be updated to any patch version within the 1.0 minor release.

   There are 2 other properties available: imageParameter and tagParameter. Change the parameters in case your Helm application contains more than one image in the manifests or uses another parameters to define which image to render in the manifests.

6. In the workload values, change the following parameters:

   YAML

   image:
     repository: <paste from clipboard>
     tag: latest

7. Click Submit.

After a few minutes, all the needed Argo CD resources (one applicationSet per Workload) to deploy your workload will be created. In the workloads list, click on the Application link of your workload to see the status of your workload.

The values of a workload can be changed at any time. Changes will automatically be deployed.