multi-tenancy management

Overview

ack-sandbox-manager provides a set of E2B-compatible HTTP interfaces to manage API keys and Teams. Cluster administrators and tenants can use these interfaces to programmatically create API keys, query their associated Teams, and revoke unneeded keys.

These interfaces do not have a corresponding E2B SDK or Kubernetes Custom Resource Definitions (CRDs). You must call them directly over HTTP.

Before you begin

• In your target cluster, go to the Add-ons page. Confirm that ack-sandbox-manager v0.6.0 or later is installed. Then, on the component's Configuration page, apply the following settings:

  • Select the Whether to enable E2B_API_KEY authentication checkbox to enable API key authentication.

  • Configure the adminApiKey (administrator API key).

End-to-end example

1. Obtain the KubeConfig file for the cluster and use kubectl to connect to the cluster.

2. Install the JSON processor jq.

3. This script demonstrates the end-to-end process: a cluster administrator initializes the resource environment and tenant credentials, and then a tenant manages their Team's key lifecycle.

   #!/usr/bin/env bash
   set -euo pipefail
   
   ADMIN_KEY="${ADMIN_KEY:?required}"
   # Two protocols are supported. This example uses the native E2B protocol URL: https://api.your.domain.com
   # To use the Agent Sandbox private protocol, replace BASE_URL with https://your.domain.com/kruise/api.
   BASE_URL="${BASE_URL:-https://api.your.domain.com}"
   TEAM_NAMESPACE="team-a"
   
   # 1. The administrator creates the namespace for the Team in the cluster.
   kubectl create ns "${TEAM_NAMESPACE}"
   
   # 2. The administrator creates a tenant key for team-a. Record the plaintext key from the response.
   TENANT_KEY=$(curl -fsS -X POST \
     -H "X-API-KEY: ${ADMIN_KEY}" \
     -H "Content-Type: application/json" \
     -d "{\"name\":\"ci-runner\",\"teamName\":\"${TEAM_NAMESPACE}\"}" \
     "${BASE_URL}/api-keys" | jq -r '.key')
   
   # 3. The tenant lists their Team and existing keys.
   curl -fsS -H "X-API-KEY: ${TENANT_KEY}" "${BASE_URL}/teams"
   curl -fsS -H "X-API-KEY: ${TENANT_KEY}" "${BASE_URL}/api-keys"
   
   # 4. The tenant creates a sub-key for their Team (the teamName field is not required).
   SUB_KEY_ID=$(curl -fsS -X POST \
     -H "X-API-KEY: ${TENANT_KEY}" \
     -H "Content-Type: application/json" \
     -d '{"name":"my-sub-key"}' \
     "${BASE_URL}/api-keys" | jq -r '.id')
   
   # 5. The tenant deletes a sub-key from their Team.
   curl -fsS -X DELETE \
     -H "X-API-KEY: ${TENANT_KEY}" \
     "${BASE_URL}/api-keys/${SUB_KEY_ID}"

API reference

curl -fsS \
  -H "X-API-KEY: ${E2B_API_KEY}" \
  "https://api.your.domain.com/teams"

import os
import requests

resp = requests.get(
    "https://api.your.domain.com/teams",
    headers={"X-API-KEY": os.environ["E2B_API_KEY"]},
    timeout=10,
)
try:
    resp.raise_for_status()
except requests.HTTPError:
    print(resp.text)
    raise
print(resp.json())

[
  {
    "teamID": "550e8400-e29b-41d4-a716-446655449999",
    "name": "admin",
    "apiKey": "",
    "isDefault": true
  }
]

curl -fsS \
  -H "X-API-KEY: ${E2B_API_KEY}" \
  "https://api.your.domain.com/api-keys"

import os
import requests

resp = requests.get(
    "https://api.your.domain.com/api-keys",
    headers={"X-API-KEY": os.environ["E2B_API_KEY"]},
    timeout=10,
)
try:
    resp.raise_for_status()
except requests.HTTPError:
    print(resp.text)
    raise
for key in resp.json():
    print(key["id"], key["name"], key["mask"])

curl -fsS -X POST \
  -H "X-API-KEY: ${E2B_API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{"name": "ci-runner", "teamName": "team-a"}' \
  "https://api.your.domain.com/api-keys"

import os
import requests

resp = requests.post(
    "https://api.your.domain.com/api-keys",
    headers={
        "X-API-KEY": os.environ["E2B_API_KEY"],
        "Content-Type": "application/json",
    },
    json={"name": "ci-runner", "teamName": "team-a"},
    timeout=10,
)
try:
    resp.raise_for_status()
except requests.HTTPError:
    print(resp.text)
    raise
created = resp.json()
# You must save created["key"] immediately, as it cannot be retrieved again.
print(created["id"], created["key"])

API_KEY_ID="<uuid-from-list-api-keys>"
curl -fsS -X DELETE \
  -H "X-API-KEY: ${E2B_API_KEY}" \
  "https://api.your.domain.com/api-keys/${API_KEY_ID}"

import os
import requests

api_key_id = "<uuid-from-list-api-keys>"
resp = requests.delete(
    f"https://api.your.domain.com/api-keys/{api_key_id}",
    headers={"X-API-KEY": os.environ["E2B_API_KEY"]},
    timeout=10,
)
# A successful request returns 204 No Content.
try:
    resp.raise_for_status()
except requests.HTTPError:
    print(resp.text)
    raise

Error codes

The JSON error response body includes the code, message, and request_id fields to aid troubleshooting:

{
  "code": 403,
  "message": "You are not allowed to create an API key for another team",
  "request_id": "c42c84d8-8420-4194-b48d-5bc5c8fe4ed6"
}

Related documents

• Create an Agent Sandbox