Managing a Multi-Tenanted Kubernetes Cluster in Production
summary
Describes running many customers on one cluster by assigning each tenant a namespace-per-tenant boundary, enforcing compute and object quotas, and authenticating via certificates, service accounts and OpenID Connect (Apigee SSO). Authorization uses an external webhook (not RBAC) tied to existing permission backends. Network isolation relies on Calico network policies with a default-deny and a Congress controller that auto-creates policies, plus a custom nginx-based router for managed cross-tenant and external ingress; prototypes run in production but DNS and RBAC gaps remain.
AI-written summary · about
chapters (24)
- 0:00Intro
- 0:22Multi-tenanted? What do you mean?
- 1:25What is Authentication
- 1:43Why does Authentication Matter?
- 1:55How does Kubernetes do Authentication?
- 2:08User Certificates
- 2:33Authentication Results (Certificates)
- 2:59Service Account Tokens
- 5:23What is Authorization?
- 5:41Why does Authorization Matter?
- 6:45Attribute Based Access Control
- 7:37Role Based Access Control
- 9:04Webhook Request and Response
- 11:20How do we enforce Namespacing?
- 12:04Resource Quotas
- 12:51Computer Resource Quota
- 13:19Object Count Quota
- 15:15Enforcement Agents
- 16:40How do we enforce Network Security?
- 17:30Inter-Cluster
- 18:56Ingress Resource (Host Based)
- 21:39Managed Communication
- 22:20Contact
- 25:53How do we handle this?
related talks
37mMulti-Tenancy in Kubernetes: Best Practices Today, and Future Directions
01h 00mArchitecting multi-tenant PaaS offerings
16mKubernetes Multi-Cluster and Multi-Tenancy With RBAC and KubeFed
05mNamespace Multi-Tenancy, But All The Problems Related To It
40mMulti-tenancy in Kubernetes
40mPanel Discussion: Multi-Tenancy in Kubernetes: Current State and Future Roadmap
38mMulti-Tenancy WG Deep Dive
38mMulti-Tenancy Support & Security Modeling with RBAC and Namespaces