3 ms·
My org is using namespaces for tenant isolation. Works quite well.
by halbritt 8y ago
My org is using namespaces for tenant isolation. Works quite well.
- geerlingguy 8y agoNamespaces++. Unless you’re just running one app in a Kubernetes cluster (where default == that app), namespaces solve a plethora of problems.
- halbritt 8y agoResource limits, network policy boundaries, etc.
- smarterclayton 8y agoThat’s what we designed them for :) I do think we’ve not explored enough of the per namespace policy stuff though - i’d like both podpreset and a reasonably simple scheduling policy (toleration + node selector control to replace the annotation based system) to make it in, as well as a simpler namespace initialization path so you can more easily lock down the contents of a namespace without having to proxy the create namespace API call.
- halbritt 8y agoBy podreset are you referring to something like poddisruptionbudget? Because it'd be neat to define that on a per namespace basis.
- smarterclayton 8y agoPodPreset went alpha with service catalog but hasn’t made it out to beta yet. It makes certain forms of injection / rules easier (you must use a standard log dir, you should use the provided HTTP_PROXY vars, etc). https://kubernetes.io/docs/concepts/workloads/pods/podpreset/ https://kubernetes.io/docs/concepts/workloads/pods/podpreset... Being able to limit a user to only being able to edit one pod preset or scheduling policy (via rbac name access) would provide some useful flexibility for splitting control between admin and namespace user.
- halbritt 8y agoOkay, I get what your point. I'm still living in the world where operating a platform for the benefit of a set of developers entails building and operating a set of services that abstracts the details of the infrastructure sufficiently that these things don't matter.