TeaCollection

The collection of one published release: the versioned set of artifacts (SBOMs, VEX documents, attestations) TEA serves for it. TEA gives a collection the UUID of its release, so a collection exists only for a release a CI pipeline has already published, and plan fails until it has been. Declaring the collection makes sure it exists and gives a TeaAccessPolicy something to name, such as an embargo on one release. The artifacts are runtime data: CI adds them, and each addition moves the collection’s version on, which status reports and which is not a change to this document. A collection this document creates starts at version 1 with the update reason INITIAL_RELEASE; one CI created first is adopted as it is. Removing the document deletes the collection while it has never held an artifact; otherwise the collection stays with its release and only the config management of it ends.

apiVersion	vulnetix.com/v1
kind	TeaCollection
Group	TEA
Status	Served. The config engine plans and applies it.
Objects per tenant	many, keyed by metadata.name
Token and role	An owner or admin session, or a vmt_ config management token with the owner or admin role that lists TeaCollection in its kinds. See Management tokens.
Applied after	TeaProduct, TeaComponent (deleted before them)
Terraform resource	vulnetix_tea_collection, imported by name (see Terraform and OpenTofu)
CLI	vulnetix config apply, CLI v3.168.0 and later.
Pinned schema	v1.15.0/TeaCollection.schema.json
Newest schema	latest/TeaCollection.schema.json
First released in	v1.6.0
Print the built-in copy	vulnetix config schema TeaCollection

Minimal

Only the fields the kind requires. From examples/TeaCollection/minimal.yaml.

YAML

# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/TeaCollection.schema.json
apiVersion: vulnetix.com/v1
kind: TeaCollection
metadata:
  name: acme-payments-2-4-0
spec:
  product: acme-payments
  release: 2.4.0

HCL (resource vulnetix_tea_collection)

# Only the arguments the kind requires. From config-schemas examples/TeaCollection/minimal.yaml.

resource "vulnetix_tea_collection" "acme_payments_2_4_0" {
  name    = "acme-payments-2-4-0"
  product = "acme-payments"
  release = "2.4.0"
}

CLI (applies it)

export VULNETIX_CONFIG_TOKEN=vmt_...   # a config management token
vulnetix config apply -f - --manager gitops:acme/platform --auto-approve <<'EOF'
# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/TeaCollection.schema.json
apiVersion: vulnetix.com/v1
kind: TeaCollection
metadata:
  name: acme-payments-2-4-0
spec:
  product: acme-payments
  release: 2.4.0
EOF

Advanced

Every field the kind supports, with a when expression where it takes one. From examples/TeaCollection/advanced.yaml.

YAML

# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/TeaCollection.schema.json
# A collection belongs to a product release or to a component release.
apiVersion: vulnetix.com/v1
kind: TeaCollection
metadata:
  name: acme-payments-2-4-0
  annotations:
    note: Embargoed until the advisory is published; see the TeaAccessPolicy of the same name.
spec:
  product: acme-payments
  release: 2.4.0
---
apiVersion: vulnetix.com/v1
kind: TeaCollection
metadata:
  name: payments-api-2-4-0
spec:
  component: payments-api
  release: 2.4.0

HCL (resource vulnetix_tea_collection)

# Every argument the kind supports. From config-schemas examples/TeaCollection/advanced.yaml.

resource "vulnetix_tea_collection" "acme_payments_2_4_0" {
  name    = "acme-payments-2-4-0"
  product = "acme-payments"
  release = "2.4.0"
  annotations = {
    note = "Embargoed until the advisory is published; see the TeaAccessPolicy of the same name."
  }
}

resource "vulnetix_tea_collection" "payments_api_2_4_0" {
  name      = "payments-api-2-4-0"
  component = "payments-api"
  release   = "2.4.0"
}

CLI (applies it)

export VULNETIX_CONFIG_TOKEN=vmt_...   # a config management token
vulnetix config apply -f - --manager gitops:acme/platform --auto-approve <<'EOF'
# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/TeaCollection.schema.json
# A collection belongs to a product release or to a component release.
apiVersion: vulnetix.com/v1
kind: TeaCollection
metadata:
  name: acme-payments-2-4-0
  annotations:
    note: Embargoed until the advisory is published; see the TeaAccessPolicy of the same name.
spec:
  product: acme-payments
  release: 2.4.0
---
apiVersion: vulnetix.com/v1
kind: TeaCollection
metadata:
  name: payments-api-2-4-0
spec:
  component: payments-api
  release: 2.4.0
EOF

Fields

Paths use dots for nesting and [] for the items of a list. Required means required whenever the parent object is present. A default is what the server uses when the field is left out.

Field	Type	Required	Default	Allowed values	Description
apiVersion	string	yes		exactly vulnetix.com/v1	The document format version. Every kind in this release is vulnetix.com/v1.
kind	string	yes		exactly TeaCollection	Always TeaCollection.
metadata	object	yes		no other keys
metadata.name	string	yes		pattern ^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$	The object’s name, unique per kind within a tenant. It is the natural key: plan, apply, export and the Terraform provider all address an object by kind and name.
metadata.org	string	no		format uuid	The tenant (organization UUID) the document belongs to. When set, plan and apply refuse to run against any other tenant.
metadata.labels	object	no		map of string to string (length 0 to 256); keys match ^[a-z0-9]([a-z0-9._/-]{0,61}[a-z0-9])?$	Free key/value labels. Stored with the object, never interpreted by the server.
metadata.annotations	object	no		map of string to string (length 0 to 4096)	Free key/value notes for people and tools, such as a ticket link.
spec	object	yes		no other keys
spec.product	string	no		pattern ^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$	The metadata.name of a TeaProduct, for the collection of one of its product releases.
spec.component	string	no		pattern ^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$	The metadata.name of a TeaComponent, for the collection of one of its component releases.
spec.release	string	yes		pattern ^\S+$; length 1 to 256	The release’s version, exactly as CI published it, such as 2.4.0.

Rules

Conditions the schema enforces beyond each field’s own type. vulnetix config validate and the engine’s plan report a document that breaks one.

On	Rule
spec	Exactly one of product or component is set.

Applying this kind

• Command. vulnetix config apply -f <file>; the CLI line above says from which release. Plan first with vulnetix config plan: it shows each object as create, update, delete or no change, with a planHash that apply then holds to. Apply writes in one transaction.
• Manager. Each object records the manager that applied it (terraform, console or gitops:<repo>). --prune deletes only objects its own manager owns. See The manager and the config engine.
• Order. Applied after TeaProduct and TeaComponent, so a document that refers to one by metadata.name can be in the same apply. Deleted before them.
• Status. Applied, Unchanged or Deleted, with no other status fields. The phases the engine reports are explained under status phases.

How apply treats it

This is the collection of a release that CI has published, declared so that a TeaAccessPolicy can name it. Plan refuses a release that does not exist.

Terraform and OpenTofu

The resource is vulnetix_tea_collection in the vulnetix/resolve provider. Its arguments are the spec in snake case, beside name, labels and annotations from metadata. The Minimal and Advanced HCL are above. The provider’s own reference is vulnetix_tea_collection.

Import an object that already exists by its name:

# Import an existing TeaCollection by its name (metadata.name).
terraform import vulnetix_tea_collection.acme_payments_2_4_0 acme-payments-2-4-0

Install, authentication and how state is read: Terraform and OpenTofu.

Check a file with vulnetix config validate -f <file>. See Validate documents. In an editor, start the file with the schema comment.