Kvindo™ Cloud Docs
An Access Policy, the IAM User it is attached to, and that user's User Token — the three resources every other example silently depends on. kc resolves accessPolicyIds and userId by name (both are tagged reference fields sitting directly on spec) and orders the three documents itself, policy first and token last, so the order you type them in does not matter. No networking prerequisite: kc injects folderId: default for all three types.
The policy is the part worth reading closely. Evaluation is default-deny and deny always wins, so the document grants exactly what it lists and nothing else — here "manage VMs and volumes, never delete them". The reconciler parses spec.content on every apply; a malformed document fails the resource with Error while deserializing access policy from YAML instead of silently granting nothing. Once reconciled, read the token back with kc get token ci-runner-token -o json | jq -r .status.token.
Resource docs
More in this section