Managing Multi-Tenancy

kubectl create ns team-a
kubectl label ns team-a tenant=team-a env=prod

apiVersion: v1
kind: ResourceQuota
metadata: { name: quota, namespace: team-a }
spec:
  hard:
    requests.cpu: "20"
    requests.memory: 40Gi
    limits.cpu: "40"
    limits.memory: 80Gi
    persistentvolumeclaims: "20"
    count/deployments.apps: "30"

kubectl create rolebinding team-a-admin \
  --clusterrole=admin --group=team-a -n team-a

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata: { name: tenant-isolate, namespace: team-a }
spec:
  podSelector: {}
  policyTypes: [Ingress]
  ingress:
  - from:
    - namespaceSelector: { matchLabels: { tenant: team-a } }
    - namespaceSelector: { matchLabels: { name: kube-system } }

kubectl label ns team-a \
  pod-security.kubernetes.io/enforce=restricted \
  pod-security.kubernetes.io/enforce-version=latest

kubectl hns create dev -n team-a
kubectl hns tree team-a

kubectl get resourcequota -A
kubectl describe quota -n team-a