Multi-Tenancy WG Deep Dive
summary
Proposal defines a versioned security profile CRD that kubeadm can apply to set API-server flags, inject cluster-scoped PodSecurityPolicies, and auto-populate namespace network policies and rolebindings via an enforcer; demo installs Calico and shows automatic NetworkPolicy creation. A separate tenant operator idea introduces a tenant CRD plus a tenant resource quota admission controller that totals usage across namespaces to enforce limits. Real-world notes: one university cluster runs ~2,000 namespaces, ~12,000 roleBindings and ~5–6k pods; issues include emptyDir eviction (VM-backed volumes as a workaround), root-scoped CRD restrictions, API rate limiting, and node maintenance semantics.
AI-written summary · about
chapters (15)
- 0:00Introduction
- 2:08Security Profile
- 4:52Bootstrapping Rules
- 6:56Demo
- 10:42Mission Controller
- 12:03Resource Quota
- 13:30API Design
- 18:08API Machinery
- 18:40Dry Runs
- 19:58Motivation
- 22:52Intended Mode of Operation
- 23:26Tenant Definition
- 24:36Tenant Proposal
- 26:45Shared Code
- 30:12Googles experience
related talks
35mDeep Dive: Kubernetes Working Group for Multi-tenancy
26mIntro + Deep Dive: Kubernetes Policy WG
47mDeep Dive: Kubernetes WG for Multitenancy
29mManaging a Multi-Tenanted Kubernetes Cluster in Production
40mPanel Discussion: Multi-Tenancy in Kubernetes: Current State and Future Roadmap
23mKubernetes Working Group for Multi-Tenancy Project Overview
05mNamespace Multi-Tenancy, But All The Problems Related To It
01h 00mArchitecting multi-tenant PaaS offerings