Tenants, apps, and services

Everything you run sits in three levels. A role given at one level applies to everything below it.

Level	Id	What it is
Tenant	tnt_...	An organization. It owns a directory: users, roles, app registrations, service principals, and sign-in rules. The audit log belongs to it too
App	app_...	A group of resources in a tenant, for example one product. Apps nest: an app’s views include the apps below it
Service	service_...	One thing that runs in an app. An app service runs one Compose file. A key vault is a service too

The console’s app switcher picks the app you act in. The CLI uses --app, or platform app use <id>. With nothing chosen, the CLI uses app_default.

Renaming

Ids never change. Every name can.

What	Console	CLI
Tenant	IAM → Domains and sign-up → Tenant name	platform tenant rename <tenant-id> <name>
App	Apps, open the app, Name
Service	The service page, Rename	platform service rename <id> <name>

Renaming moves nothing. Sign-in addresses use the tenant id. The cluster namespace and the registry list of an app service use the service id. The domains, the deploy hook, and the running pods stay as they are. Renaming a tenant needs the Admin role on it.

Domains

An app service gets traffic only on the domains set on its Domains tab. Each domain names a hostname, a path, a port, and the Compose service that receives the traffic.

Names under m12p.com need no DNS work.

• Use one label: shop.m12p.com, shop-help.m12p.com. The certificate covers one label, so help.shop.m12p.com fails in the browser.
• Each name belongs to one app. Saving a name another app uses is refused.
• Names the platform serves itself are reserved: api, auth, cloud, developers, minio, registry, and headlamp.
• A name under the older m12p.net redirects to the same label under m12p.com.

Names on your own domain have to point at the platform host in DNS before they work.

To move an app to a new name, add the new domain first, deploy, and check it. Then remove the old one and deploy again. If the app signs people in, add the new callback to its app registration first. See Sign-in for your app.