multi-tenancy
hierarchical-namespaces
multi-tenancy | hierarchical-namespaces | |
---|---|---|
5 | 8 | |
952 | 583 | |
- | 2.6% | |
0.0 | 6.6 | |
12 months ago | 5 days ago | |
Go | Go | |
Apache License 2.0 | Apache License 2.0 |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
multi-tenancy
-
Kubernetes: Virtual Clusters As Development Environments
Alternatives: The concept of virtual clusters is rather new, so only few solutions for it exist. However, there are also open-source proof-of-concepts for a virtual cluster technology, such as k3v or the project from the Kubernetes multi-tenancy SIG.
-
create a configmap when a new namespace get created
This seems like a pretty good fit for HNC. You can restrict users to only create subnamespaces, and then ensure that the configmaps in the parent namespaces get propagated to the children.
-
Virtual Clusters For Kubernetes - Benefits & Use Cases
Virtual Kubernetes clusters are still a very new topic, but they are already available today. The multi-tenancy working group has presented an experimental solution in this area. k3v by Darren Shepherd is another proof of concept implementation in the open-source community.
-
Kubernetes Failure Stories
In a way this reminds me of Kubernetes Virtual Clusters. Each virtual cluster has its own tenant control plane, namespaces. Multiple virtual clusters exist in a super cluster.
https://github.com/kubernetes-sigs/multi-tenancy/tree/master...
-
Best Practice: Should each collection of resources be in their own namespace?
As a side note, hierarchical namespaces are coming, which makes things even more flexible: https://github.com/kubernetes-sigs/multi-tenancy/tree/master/incubator/hnc
hierarchical-namespaces
-
Efficient Cluster Management with Kubernetes’ Hierarchical Namespaces
HNC_VERSION=v1.1.0 HNC_VARIANT=default kubectl apply -f https://github.com/kubernetes-sigs/hierarchical-namespaces/releases/latest/download/hnc-manager.yaml
-
Amazon EC2 Enhances Defense in Depth with Default IMDSv2
Kubernetes has a lot of limitations from a multi tenancy perspective.
It's functional, but I think it's not as polished as the rest of Kubernetes which is why Kubernetes has a multi tenancy SIG that spawned the hierarchical namespace controller (https://github.com/kubernetes-sigs/hierarchical-namespaces) and virtual clusters (https://github.com/kubernetes-sigs/cluster-api-provider-nest...)
-
Automatically deploy objects after namespace creation
Kyverno's a great option. Depending on the usecase you might want to consider https://github.com/kubernetes-sigs/hierarchical-namespaces as well (disclaimer: I'm the original author) - it's good if groups of related namespaces need related objects.
-
Multitenancy with Hierarchical namespaces
❯ HNC_VERSION=v1.0.0 ❯ kubectl apply -f https://github.com/kubernetes-sigs/hierarchical-namespaces/releases/download/${HNC_VERSION}/default.yaml namespace/hnc-system created customresourcedefinition.apiextensions.k8s.io/hierarchyconfigurations.hnc.x-k8s.io created customresourcedefinition.apiextensions.k8s.io/hncconfigurations.hnc.x-k8s.io created customresourcedefinition.apiextensions.k8s.io/subnamespaceanchors.hnc.x-k8s.io created role.rbac.authorization.k8s.io/hnc-leader-election-role created clusterrole.rbac.authorization.k8s.io/hnc-admin-role created clusterrole.rbac.authorization.k8s.io/hnc-manager-role created clusterrole.rbac.authorization.k8s.io/hnc-proxy-role created rolebinding.rbac.authorization.k8s.io/hnc-leader-election-rolebinding created clusterrolebinding.rbac.authorization.k8s.io/hnc-manager-rolebinding created clusterrolebinding.rbac.authorization.k8s.io/hnc-proxy-rolebinding created secret/hnc-webhook-server-cert created service/hnc-controller-manager-metrics-service created service/hnc-webhook-service created deployment.apps/hnc-controller-manager created mutatingwebhookconfiguration.admissionregistration.k8s.io/hnc-mutating-webhook-configuration created validatingwebhookconfiguration.admissionregistration.k8s.io/hnc-validating-webhook-configuration created # Install helper plugin ❯ kubectl krew install hns
-
Is it anti-pattern to have multiple environments under a single namespace?
I would say it’s an anti-pattern since using a namespace for multiple environments will be a pain. Not sure what you mean by CRDs though. There is an addon that gives you namespace hierarchies. I.e. each team gets a namespace and they can have sub-namespaces for environments. Check it out: https://github.com/kubernetes-sigs/hierarchical-namespaces
-
Ask r/kubernetes: What are you working on this week?
Looking into the Hierarchical Namespace Controller to see if it can simplify our heavily multi-tenanted clusters. So far so good!
-
RBAC and limited namespace access
HNC is designed for these kinds of scenarios: https://github.com/kubernetes-sigs/hierarchical-namespaces
-
Introduction to Multi-Tenancy in Kubernetes
Project HNC
What are some alternatives?
fluent-bit - Fast and Lightweight Logs and Metrics processor for Linux, BSD, OSX and Windows
vcluster - vCluster - Create fully functional virtual Kubernetes clusters - Each vcluster runs inside a namespace of the underlying k8s cluster. It's cheaper than creating separate full-blown clusters and it offers better multi-tenancy and isolation than regular namespaces.
Kyverno - Kubernetes Native Policy Management
capsule - Multi-tenancy and policy-based framework for Kubernetes.
helmfile - Deploy Kubernetes Helm Charts
rbac-manager - A Kubernetes operator that simplifies the management of Role Bindings and Service Accounts.
k3s - Lightweight Kubernetes [Moved to: https://github.com/k3s-io/k3s]
namespace-configuration-operator - The namespace-configuration-operator helps keeping configurations related to Users, Groups and Namespaces aligned with one of more policies specified as a CRs
5-minute-production-app
cluster-api-provider-nested - Cluster API Provider for Nested Clusters
synator - Synator Kubernetes Secret and ConfigMap synchronizer
secrets-store-csi-driver - Secrets Store CSI driver for Kubernetes secrets - Integrates secrets stores with Kubernetes via a CSI volume.