Deep Dive: Kubernetes WG for Multitenancy
summary
Working Group defines four architectures for multitenancy (A: multiple clusters on IaaS, B: single-cluster with a Tenant CRD and NamespaceTemplate, C: Kubernetes-on-Kubernetes, D: core API changes) and builds an Option B prototype that uses RBAC, OPA-style admission logic, network policies and pod security policies. The prototype enforces restricted vs privileged profile templates, lets any authenticated user self-service-create tenants, auto-creates namespaced resources (tenant-name prefix) and successfully blocks privileged containers under restricted profiles; cluster-scoped resources and tenant-wide quotas remain unresolved.
AI-written summary · about
chapters (11)
- 0:00Start
- 2:30What Is a Tenant
- 2:44Soft Multi-Tenancy
- 4:42Running Multiple Kubernetes Clusters on Top of Nis
- 6:21Does Community Support Multi-Tenancy
- 19:18Reference Profiles
- 19:53Demo
- 23:03Create a Namespace Template
- 26:37Namespaces
- 40:23Thoughts on Securing the Api Server
- 44:27Hard Multi-Tenancy within a Single Cluster
related talks
35mDeep Dive: Kubernetes Working Group for Multi-tenancy
37mMulti-Tenancy in Kubernetes: Best Practices Today, and Future Directions
23mKubernetes Working Group for Multi-Tenancy Project Overview
26mThe Future of Multi-Tenancy in Kubernetes
28mIntro to the Kubernetes Working Group for Multi-tenancy
24mMulti-Tenancy: Tips, Tricks, Tools And Tests
38mMulti-Tenancy WG Deep Dive
51mMulti-tenant Kubernetes