Implementing namespace multi-tenancy
Clusters deployed for multiple stakeholders, or tenants, should be divided up by namespace. This is the boundary that was designed in Kubernetes from the very beginning. When deploying namespaces, there are generally two ClusterRoles that are assigned to users in the namespace:
admin: This aggregatedClusterRoleprovides access to every verb and nearly every resource that ships with Kubernetes, making theadminuser the ruler of their namespace. The exception to this is any namespace-scoped object that could affect the entire cluster, such asResourceQuotas.edit: Similar toadmin, but without the ability to create RBACRolesorRoleBindings.
It’s important to note that the admin ClusterRole can’t make changes to the namespace object by itself. Namespaces are cluster-wide resources, so they can only be assigned permissions via a ClusterRoleBinding.
Depending on your strategy for multi-tenancy, the admin...
