Building Flux's Multi-Tenant API with K8s User Impersonation
summary
Flux builds a multi-tenant API by giving the controller permission to impersonate service accounts and groups so each applier acts as a per-object identity instead of stealing service-account tokens. The code is proposal 582, uses RBAC rolebindings that can be generated by the source object, and recommends sanitizing kubeconfigs and using the kubeconfig exec helper to avoid mounting creds. A live demo shows an initial Forbidden response and then success after impersonation; the GitHub PR has about 66 comments.
AI-written summary · about
chapters (7)
- 0:00Introduction
- 1:12Overview
- 5:27Service Accounts
- 9:54User Impersonation
- 14:05InCluster Identities
- 15:52Policy
- 19:58Conclusion
related talks
27mOrchestrating Multi-Tenancy Kubernetes Environments with Flux
26mFlux: Multi-tenancy Deep Dive
47mOne Repo to Rule Them All: Kubernetes Cluster Tenancy with Flux v2
39mCreating A Landlord for Multi-tenant K8s Using Flux, Gatekeeper, Helm, and Friends
34mKubeflow: Multi-Tenant, Self-Serve, Accelerated Platform for Practitioners
36mManaging Thousands of Clusters and Their Workloads with Flux
30mHow and When to Flux your Terraform
27mHow to Achieve (Actual) GitOps with Terraform and Flux