telekom · valenok4000 · Jun 29, 2026 · Jun 30, 2026 · Jun 30, 2026 · Jun 30, 2026
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
@@ -368,4 +368,25 @@ jobs:
       run_check_generated_files: true
       ko_build_path: "cmd/main.go"
       coverage_threshold: 66
-      lint_fail_on_issues: true
+      lint_fail_on_issues: true
+
+  sftp:
+    name: SFTP
+    uses: ./.github/workflows/reusable-go-ci.yaml
+    with:
+      name: sftp
+      module: sftp
+      run_check_generated_files: true
+      ko_build_path: "cmd/sftp-operator/main.go"
+      coverage_threshold: 66
+      lint_fail_on_issues: true
+
+  file:
+    name: File
+    uses: ./.github/workflows/reusable-go-ci.yaml
+    with:
+      name: file
+      module: file
+      run_check_generated_files: true
+      ko_build_path: "cmd/file-operator/main.go"
+      lint_fail_on_issues: true
diff --git a/.goreleaser.yaml b/.goreleaser.yaml
@@ -217,6 +217,24 @@ builds:
     goarch:
       - amd64
       - arm64
+  - id: sftp-operator
+    dir: sftp
+    main: cmd/sftp-operator/main.go
+    binary: sftp-operator
+    goos:
+      - linux
+    goarch:
+      - amd64
+      - arm64
+  - id: file-operator
+    dir: file
+    main: cmd/file-operator/main.go
+    binary: file-operator
+    goos:
+      - linux
+    goarch:
+      - amd64
+      - arm64
 archives:
   - id: rover-ctl
     ids: [rover-ctl]
@@ -255,7 +273,7 @@ release:
 sboms:
   - artifacts: archive
 
-kos: 
+kos:
   - id: common-server
     build: common-server
     main: .
@@ -684,4 +702,4 @@ kos:
       - latest
       - "{{.Tag}}"
       - "{{if not .Prerelease}}stable{{end}}"
-    bare: true
+    bare: true
diff --git a/common/pkg/config/feature.go b/common/pkg/config/feature.go
@@ -49,6 +49,7 @@ var (
 	FeatureSecretManager Feature = NewFeature("secret_manager", true) // Secret Manager feature enabled by default
 	FeatureFileManager   Feature = NewFeature("file_manager", true)   // File Manager feature enabled by default
 	FeatureAiGateway     Feature = NewFeature("ai_gateway", false)    // AI Gateway (MCP) feature disabled by default
+	FeatureFile          Feature = NewFeature("file", true)
 )
 
 // SetFeatureEnabled sets the enabled state for a feature. Intended for tests.

diff --git a/docs/docs/architecture/file.mdx b/docs/docs/architecture/file.mdx
@@ -0,0 +1,45 @@
+---
+sidebar_position: 12
+---
+
+<!--
+SPDX-FileCopyrightText: 2025 Deutsche Telekom AG
+
+SPDX-License-Identifier: CC0-1.0
+-->
+
+# File Domain
+
+The File domain manages file-type exposure and subscription resources. It acts as the business-logic layer between Rover-style file declarations and runtime solutions such as SFTP.
+
+## Custom Resources
+
+<CRDReference domain="file" />
+
+## Reconciliation Flow
+
+```
+FileType registered
+    │
+    ├──▶ FileExposure selected as active provider
+    │       ├──▶ SFTP Instance created for the active provider zone
+    │       └──▶ Provider SSH public keys synced to the FileType SFTP User
+    │
+    ├──▶ SFTP User created for the active file type with an instanceRef
+    │
+    └──▶ FileSubscription created by a consumer
+            ├──▶ ApprovalRequest created from the active FileExposure approval strategy
+            └──▶ Subscription-owned SFTP User synced after approval is granted
+```
+
+FileExposure and FileSubscription resources reference a `FileType` by name with `spec.fileType`. SFTP-specific public keys are configured through `spec.sftp`, and `spec.zone` points at the ZoneServiceConfig used for provider-side SFTP access. ZoneServiceConfig resources hold the SFTP API managed-route configuration plus internal and external service endpoints, and they must have the same name and namespace as the corresponding admin Zone. The File operator reads the identity realm reference from that Zone, creates an identity client for the managed route, and projects the resolved endpoint, token endpoint, client ID, and client secret to the SFTP domain as an SFTPServiceConfig with the same name and namespace. The active FileExposure creates an SFTP Instance for that zone, and SFTP users reference that instance through `spec.instanceRef`.
+
+## Domain Interactions
+
+- **Rover domain** - File declarations can create FileType, FileExposure, and FileSubscription resources.
+- **SFTP domain** - The File operator creates User, Instance, and SFTPServiceConfig resources. Provider keys are stored on the FileType-owned SFTP User, while each granted FileSubscription owns a separate SFTP User with its subscriber keys.
+- **Approval domain** - FileExposure carries approval settings for subscription workflows. FileSubscription creates ApprovalRequest and Approval references, waits while approval is pending, provisions a subscriber SFTP User after approval is granted, and deletes it if approval is denied.
+
+## Related Pages
+
+- [Architecture: Rover Domain](./rover.mdx)
diff --git a/docs/docs/architecture/overview.md b/docs/docs/architecture/overview.md
@@ -100,3 +100,4 @@ Each domain is described in detail on its own page:
 | [PubSub](./pubsub.mdx) | Runtime layer for publish/subscribe messaging |
 | [Secret Manager](./secret-manager.mdx) | Centralized secret storage, references, and retrieval |
 | [ControlPlane API & Projector](./controlplane-api.mdx) | Read-only external access layer (CQRS) for the UI |
+| [SFTP](./sftp.mdx) | SFTP service provisioning and SSH public key synchronization |
diff --git a/docs/docs/architecture/rover.mdx b/docs/docs/architecture/rover.mdx
@@ -25,10 +25,26 @@ Users interact with the Rover domain through three paths:
 - **Application domain** — Creates Application resources.
 - **API domain** — Creates Api, ApiExposure, and ApiSubscription resources.
 - **Event domain** — Creates EventExposure and EventSubscription resources.
+- **File domain (SFTP)** — Creates the SFTP user (shared space) from a `FileSpecification` and registers producer/consumer SSH public keys for `fileType` exposures and subscriptions. Gated behind the `file` feature flag.
 - **Gateway domain** — Configures traffic management settings.
 - **Identity domain** — Configures authentication settings.
 - **Approval domain** — Integrates approval requirements for exposures.
 
+## File Types (SFTP)
+
+Rover can configure an external SFTP file-transfer service without changing the customer-facing Rover file:
+
+- A `FileSpecification` (`metadata.name` must equal `spec.type`) provisions an SFTP user with a default shared space.
+- A `fileType` **exposure** (producer) or **subscription** (consumer) with `variant: sftp` and one or more `publicKeys` registers those SSH keys on the matching SFTP user.
+
+Validation rules enforced by the Rover webhook:
+
+- `fileType` exposures/subscriptions are only allowed on the `cetus` and `canis` zones.
+- `variant: sftp` is optional.
+- At least one public key is required; both the key `label` and `key` value must be unique per `fileType`.
+
+Because file transfer happens directly over SFTP, a Rover that only exposes/subscribes to file types yields a **logical** Application (`needsClient` and `needsConsumer` are `false`). If the same Rover also has an API or event subscription, a client is still required.
+
 ## Related Pages
 
 - [User Journey: Onboarding](../user-journey/onboarding.md)

diff --git a/docs/docs/architecture/sftp.mdx b/docs/docs/architecture/sftp.mdx
@@ -0,0 +1,52 @@
+---
+sidebar_position: 14
+---
+
+<!--
+SPDX-FileCopyrightText: 2025 Deutsche Telekom AG
+
+SPDX-License-Identifier: CC0-1.0
+-->
+
+# SFTP Domain
+
+The SFTP domain manages SSH key-based access to the SFTP Service. It translates Kubernetes resources into SFTP Tardis API calls, provisions service users for SFTP instances, and keeps the public keys for those users synchronized from the declared `User` resources.
+
+## Custom Resources
+
+<CRDReference domain="sftp" />
+
+## Resource Model
+
+SFTP resources follow a simple dependency chain:
+
+```mermaid
+graph TD
+    SFTPServiceConfig["SFTPServiceConfig<br/>SFTP Tardis API access"]
+    Instance["Instance<br/>SFTP service user"]
+    User["User<br/>SSH public keys"]
+
+    SFTPServiceConfig --> Instance
+    Instance --> User
+```
+
+- A **SFTPServiceConfig** defines the SFTP Tardis API endpoint and OAuth2 client credentials for a zone.
+- An **Instance** references an SFTPServiceConfig and represents one SFTP service user in the external service.
+- A **User** references an Instance and contributes one or more SSH public keys to that instance.
+
+## Reconciliation Flow
+
+The SFTPServiceConfig controller validates the configured API credentials by creating or refreshing an SFTP service client. The Instance controller then uses that client to create or update the SFTP service user in the external service.
+
+When User resources change, the Instance controller collects all Users that reference the Instance, canonicalizes their SSH public keys, deduplicates them by fingerprint, and updates the public key set for the SFTP service user.
+After a successful key sync, the Instance status records the observed per-User `Processing` condition. The User controller watches those Instance status changes, mirrors the relevant `Processing` condition onto each User, and derives the User `Ready` condition from it.
+
+## Domain Interactions
+
+- **Secret Manager** — SFTPServiceConfig can resolve SFTP Tardis client secrets from Secret Manager references during reconciliation.
+- **SFTP Tardis API** — The SFTP operator creates, updates, and deletes SFTP service users and synchronizes their public keys through this external API.
+
+## Related Pages
+
+- [Architecture Overview](./overview.md)
+- [Reference: API](../reference/api.md)
diff --git a/docs/docs/developer-journey/local-development.md b/docs/docs/developer-journey/local-development.md
@@ -154,7 +154,7 @@ Every operator directory exposes a consistent set of Make targets:
 
 | Target | Description |
 |--------|-------------|
-| `manifests` | Generate CRDs, RBAC, and webhook manifests |
+| `manifests` | Generate CRDs, RBAC, and webhook manifests where configured |
 | `generate` | Generate DeepCopy methods |
 | `fmt` | Run `go fmt` |
 | `vet` | Run `go vet` |

diff --git a/docs/docs/overview/components.md b/docs/docs/overview/components.md
@@ -98,6 +98,7 @@ Domain operators are the core building blocks of the Control Plane. Each operato
 | [Identity](../architecture/identity.mdx) | Manages identity providers, realms, and service-account clients through Keycloak. Provides authentication and authorization for all platform interactions. |
 | [Event](../architecture/event.mdx) | Handles event publishing and subscribing, including cross-zone meshing. An optional feature that bridges user configuration (Rover) with the PubSub runtime. |
 | [PubSub](../architecture/pubsub.mdx) | The runtime configuration layer for publish/subscribe messaging via Horizon. Managed exclusively by the Event domain. |
+| [SFTP](../architecture/sftp.mdx) | Manages SFTP service instances and SSH public keys, synchronizing Kubernetes resources with the external SFTP service. |
 
 ## Services
 

diff --git a/docs/docs/reference/api.md b/docs/docs/reference/api.md
@@ -31,7 +31,8 @@ Most users do not create these resources directly. Instead, they write a single
 | [Organization](#organization) | `organization.cp.ei.telekom.de/v1` | 2 |
 | [PubSub](#pubsub) | `pubsub.cp.ei.telekom.de/v1` | 3 |
 | [Rover](#rover) | `rover.cp.ei.telekom.de/v1` | 3 |
-| | **Total** | **34** |
+| [SFTP](#sftp) | `sftp.cp.ei.telekom.de/v1` | 3 |
+| | **Total** | **37** |
 
 ---
 
@@ -189,6 +190,20 @@ The primary user-facing interface for declarative application configuration.
 
 ---
 
+### SFTP
+
+**API Group:** `sftp.cp.ei.telekom.de/v1` · [Architecture →](../architecture/sftp.mdx)
+
+SFTP service provisioning and SSH public key synchronization.
+
+| Kind | Description |
+| ---- | ----------- |
+| **SFTPServiceConfig** | Configures zone-specific SFTP Tardis API access and OAuth2 client credentials. |
+| **Instance** | Represents an SFTP service instance and provisions a corresponding SFTP service user through the configured SFTPServiceConfig. |
+| **User** | Declares SSH public keys for an SFTP user and attaches them to an Instance. |
+
+---
+
 ## REST API
 
 In addition to the Kubernetes CRDs, the Control Plane exposes two REST APIs.

diff --git a/docs/docs/reference/json-schemas.md b/docs/docs/reference/json-schemas.md
@@ -177,6 +177,16 @@ The following tables list all available schemas, grouped by domain. Click a sche
 
 ---
 
+### SFTP
+
+| Kind | Schema |
+| ---- | ------ |
+| **Instance** | [`instance_v1.json`](pathname:///schemas/sftp.cp.ei.telekom.de/instance_v1.json) |
+| **User** | [`user_v1.json`](pathname:///schemas/sftp.cp.ei.telekom.de/user_v1.json) |
+| **SFTPServiceConfig** | [`sftpserviceconfig_v1.json`](pathname:///schemas/sftp.cp.ei.telekom.de/sftpserviceconfig_v1.json) |
+
+---
+
 ## Schema Index
 
 A machine-readable index of all available schemas is published at [`schemas/index.json`](pathname:///schemas/index.json). This can be used by tooling to discover schemas programmatically.

diff --git a/docs/scripts/generate-crd-data.mjs b/docs/scripts/generate-crd-data.mjs
@@ -30,6 +30,7 @@ const DOMAINS = [
   "organization",
   "pubsub",
   "rover",
+  "sftp",
 ];
 
 // ─────────────────────────────────────────────────────────────────────────────

diff --git a/docs/scripts/generate-crd-schemas.mjs b/docs/scripts/generate-crd-schemas.mjs
@@ -37,6 +37,7 @@ const DOMAINS = [
   "organization",
   "pubsub",
   "rover",
+  "sftp",
 ];
 
 // ─────────────────────────────────────────────────────────────────────────────

diff --git a/file/.gitignore b/file/.gitignore
@@ -0,0 +1,35 @@
+# Copyright 2026 Deutsche Telekom IT GmbH
+#
+# SPDX-License-Identifier: Apache-2.0
+
+# Binaries for programs and plugins
+*.exe
+*.exe~
+*.dll
+*.so
+*.dylib
+bin/*
+Dockerfile.cross
+
+# Test binary, built with `go test -c`
+*.test
+
+# Output of the go coverage tool, specifically when used with LiteIDE
+*.out
+
+# Go workspace file
+go.work*
+
+# Kubernetes Generated files - skip generated files, except for vendored files
+!vendor/**/zz_generated.*
+
+# editor and IDE paraphernalia
+.idea
+.vscode
+*.swp
+*.swo
+*~
+
+# Test reports
+gotest.log
+ginkgo-junit.xml