added allowedStorageClasses

content/crds-api-reference/tenant.md

@@ -71,6 +71,10 @@ spec:
           annotations:
             specific-annotation: specific-dev-value
   desc: "This is a sample tenant setup for the v1beta3 version."
+  storageClasses:
+    allowed:
+      - staging
+      - dev
 ```
 
 ## Access Control
@@ -121,3 +125,14 @@ Controls the creation and management of namespaces within the tenant:
 `desc` provides a human-readable description of the tenant, aiding in documentation and at-a-glance understanding of the tenant's purpose and configuration.
 
 > ⚠️ If same label or annotation key is being applied using different methods provided, then the highest precedence will be given to `namespaces.metadata.specific` followed by `namespaces.metadata.common` and in the end would be the ones applied from `openshift.project.labels`/`openshift.project.annotations` in `IntegrationConfig`
+
+## Storage
+
+```yaml
+storageClasses:
+  allowed:
+    - staging-fast
+    - shared
+```
+
+* `allowed` can be used to limit a tenant to only being able to create PersistentVolumeClaims for StorageClasses in the list. If `storageClass` is not specified for a PersistentVolumeClaim, the default StorageClass (if set) will be evaluated as any other class name. If the default StorageClass is not set, the evaluation will be deferred until a default StorageClass is set. `""` is evaluated as any other class name, so if you are using it to manually bind to PersistentVolumes while using StorageClass filtering you need to add  an empty string `""` to the tenants allow-list or it will get filtered.

theme_override/mkdocs.yml

@@ -64,6 +64,8 @@ nav:
       - Offboarding:
           - how-to-guides/offboarding/uninstalling.md
   - Explanation:
+      - Tenant Policies:
+        - explanation/tenant-policies/networking.md
       - explanation/logs-metrics.md
       - explanation/template.md
       - explanation/console.md