Creating A Landlord for Multi-tenant K8s Using Flux, Gatekeeper, Helm, and Friends
Talkat GitOpsCon Europe 2022 · on Tuesday, 2022-05-17· at 13:35· Joaquin Rodrigo Room I | Mall Level | Central Forum·
summary
Describes a GitOps platform that uses Flux v2 to give each tenant a per-tenant manifest repo and namespace, deploys a Helm-based landlord Helm chart that creates service accounts plus RoleBindings so Flux can only apply inside a namespace, and enforces pod security and domain rules via Gatekeeper admission policies (Rego). Node placement uses Karpenter provisioners plus Gatekeeper mutations to inject tolerations/nodeSelectors. Live demos show apps running, Gatekeeper blocks bad commits, and the setup scales to workshops of ~50 tenants.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 1:28Session Outline
- 2:10The Common Application Platform
- 2:54Separation of Concerns
- 6:01What Could Possibly Go Wrong?
- 7:31The Tenancy Spectrum
- 10:48The Goals of the Landlord
- 16:24The Manifest Repo
- 25:59Deline Parameterized GK Policies
- 32:54Defining Node Pools
related talks
27mOrchestrating Multi-Tenancy Kubernetes Environments with Flux
32mSecuring our clusters with gatekeeper and OPA
15mPlatform Engineering Done Right: Safe, Secure, & Scalable Multi-Tenant GitOps
26mFlux: Multi-tenancy Deep Dive
39mEnhance Your Kubernetes Experience with GitOps & Flux
32mIntroducing Flux Helm Operator, a GitOps Approach to Helm Operations
27mHow to Achieve (Actual) GitOps with Terraform and Flux
35mMultitenancy - Build Vs. “Buy”: Zcaler’s Journey