hierarchical-namespaces
multi-tenancy
Our great sponsors
hierarchical-namespaces | multi-tenancy | |
---|---|---|
8 | 5 | |
581 | 952 | |
7.4% | - | |
6.6 | 0.0 | |
9 days ago | 12 months ago | |
Go | Go | |
Apache License 2.0 | Apache License 2.0 |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
hierarchical-namespaces
-
Efficient Cluster Management with Kubernetes’ Hierarchical Namespaces
HNC_VERSION=v1.1.0 HNC_VARIANT=default kubectl apply -f https://github.com/kubernetes-sigs/hierarchical-namespaces/releases/latest/download/hnc-manager.yaml
-
Amazon EC2 Enhances Defense in Depth with Default IMDSv2
Kubernetes has a lot of limitations from a multi tenancy perspective.
It's functional, but I think it's not as polished as the rest of Kubernetes which is why Kubernetes has a multi tenancy SIG that spawned the hierarchical namespace controller (https://github.com/kubernetes-sigs/hierarchical-namespaces) and virtual clusters (https://github.com/kubernetes-sigs/cluster-api-provider-nest...)
-
Automatically deploy objects after namespace creation
Kyverno's a great option. Depending on the usecase you might want to consider https://github.com/kubernetes-sigs/hierarchical-namespaces as well (disclaimer: I'm the original author) - it's good if groups of related namespaces need related objects.
-
Multitenancy with Hierarchical namespaces
❯ HNC_VERSION=v1.0.0 ❯ kubectl apply -f https://github.com/kubernetes-sigs/hierarchical-namespaces/releases/download/${HNC_VERSION}/default.yaml namespace/hnc-system created customresourcedefinition.apiextensions.k8s.io/hierarchyconfigurations.hnc.x-k8s.io created customresourcedefinition.apiextensions.k8s.io/hncconfigurations.hnc.x-k8s.io created customresourcedefinition.apiextensions.k8s.io/subnamespaceanchors.hnc.x-k8s.io created role.rbac.authorization.k8s.io/hnc-leader-election-role created clusterrole.rbac.authorization.k8s.io/hnc-admin-role created clusterrole.rbac.authorization.k8s.io/hnc-manager-role created clusterrole.rbac.authorization.k8s.io/hnc-proxy-role created rolebinding.rbac.authorization.k8s.io/hnc-leader-election-rolebinding created clusterrolebinding.rbac.authorization.k8s.io/hnc-manager-rolebinding created clusterrolebinding.rbac.authorization.k8s.io/hnc-proxy-rolebinding created secret/hnc-webhook-server-cert created service/hnc-controller-manager-metrics-service created service/hnc-webhook-service created deployment.apps/hnc-controller-manager created mutatingwebhookconfiguration.admissionregistration.k8s.io/hnc-mutating-webhook-configuration created validatingwebhookconfiguration.admissionregistration.k8s.io/hnc-validating-webhook-configuration created # Install helper plugin ❯ kubectl krew install hns
-
Is it anti-pattern to have multiple environments under a single namespace?
I would say it’s an anti-pattern since using a namespace for multiple environments will be a pain. Not sure what you mean by CRDs though. There is an addon that gives you namespace hierarchies. I.e. each team gets a namespace and they can have sub-namespaces for environments. Check it out: https://github.com/kubernetes-sigs/hierarchical-namespaces
-
Ask r/kubernetes: What are you working on this week?
Looking into the Hierarchical Namespace Controller to see if it can simplify our heavily multi-tenanted clusters. So far so good!
-
RBAC and limited namespace access
HNC is designed for these kinds of scenarios: https://github.com/kubernetes-sigs/hierarchical-namespaces
-
Introduction to Multi-Tenancy in Kubernetes
Project HNC
multi-tenancy
-
Kubernetes: Virtual Clusters As Development Environments
Alternatives: The concept of virtual clusters is rather new, so only few solutions for it exist. However, there are also open-source proof-of-concepts for a virtual cluster technology, such as k3v or the project from the Kubernetes multi-tenancy SIG.
-
create a configmap when a new namespace get created
This seems like a pretty good fit for HNC. You can restrict users to only create subnamespaces, and then ensure that the configmaps in the parent namespaces get propagated to the children.
-
Virtual Clusters For Kubernetes - Benefits & Use Cases
Virtual Kubernetes clusters are still a very new topic, but they are already available today. The multi-tenancy working group has presented an experimental solution in this area. k3v by Darren Shepherd is another proof of concept implementation in the open-source community.
-
Kubernetes Failure Stories
In a way this reminds me of Kubernetes Virtual Clusters. Each virtual cluster has its own tenant control plane, namespaces. Multiple virtual clusters exist in a super cluster.
https://github.com/kubernetes-sigs/multi-tenancy/tree/master...
-
Best Practice: Should each collection of resources be in their own namespace?
As a side note, hierarchical namespaces are coming, which makes things even more flexible: https://github.com/kubernetes-sigs/multi-tenancy/tree/master/incubator/hnc
What are some alternatives?
vcluster - vCluster - Create fully functional virtual Kubernetes clusters - Each vcluster runs inside a namespace of the underlying k8s cluster. It's cheaper than creating separate full-blown clusters and it offers better multi-tenancy and isolation than regular namespaces.
fluent-bit - Fast and Lightweight Logs and Metrics processor for Linux, BSD, OSX and Windows
capsule - Multi-tenancy and policy-based framework for Kubernetes.
Kyverno - Kubernetes Native Policy Management
rbac-manager - A Kubernetes operator that simplifies the management of Role Bindings and Service Accounts.
helmfile - Deploy Kubernetes Helm Charts
namespace-configuration-operator - The namespace-configuration-operator helps keeping configurations related to Users, Groups and Namespaces aligned with one of more policies specified as a CRs
k3s - Lightweight Kubernetes [Moved to: https://github.com/k3s-io/k3s]
cluster-api-provider-nested - Cluster API Provider for Nested Clusters
5-minute-production-app
secrets-store-csi-driver - Secrets Store CSI driver for Kubernetes secrets - Integrates secrets stores with Kubernetes via a CSI volume.
synator - Synator Kubernetes Secret and ConfigMap synchronizer