►
From YouTube: Extending Kubernetes Scheduler for Multi-Cluster and Multi-Cloud Workloads - Illya Chekrygin
Description
Join us for Kubernetes Forums Seoul, Sydney, Bengaluru and Delhi - learn more at kubecon.io
Don't miss KubeCon + CloudNativeCon 2020 events in Amsterdam March 30 - April 2, Shanghai July 28-30 and Boston November 17-20! Learn more at kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects
Extending Kubernetes Scheduler for Multi-Cluster and Multi-Cloud Workloads - Illya Chekrygin, Upbound
Kubernetes did a great job implementing a rich and flexible scheduler for Pods. Today we are extending Pod scheduling for Multi-Cluster environments, expanding and optimizing it even further for non-Kubernetes workloads and resources. At this talk, we will explore options and possibilities when it comes to scheduling Kubernetes Pods across multiple clusters. In addition, we will examine the benefits, pitfalls, and future for extending the Kubernetes scheduler to Multi-Cloud managed resources and workloads beyond traditional Kubernetes Deployments and Stateful Sets.
https://sched.co/NrnP
A
Okay,
so
looks
like
we're
good
point
to
start
alright
good
afternoon
everybody,
my
name
is
Ilya
jackregan
I'm
found
an
engineer
at
abound:
I'm
also
lead
bin
trainer
on
crossplane
project.
It's
open
source
project
we
started
at
about
about
eight
months
ago,
and
we
open
source
right
before
cube
con
in
Seattle
last
December,
and
today,
I
want
to
talk
to
you
about
extending
kubernetes
to
orchestrate
and
support
resources
managed
by
public
cloud
providers.
A
All
right,
so,
over
the
last
decade
we
have
witnessed
the
emergence
of
cloud
computing
as
predominant
IT
paradigm
cloud
computing
enables
organization
to
focus
on
the
core
business
competencies
and
quickly
respond
to
changing
demands
without
expending
significant
resources
on
infrastructure.
In
maintenance
organizations
can
take
instantly,
take
advantage
of
the
world
class
services
across
infrastructure,
and
they
can
do
so
with
the
scale
the
businesses
globally,
with
efficient
paper
use
model.
A
Yet,
despite
its
predominance,
the
cloud
computing
remains
completely
under
control
of
small
set
of
cloud
providers.
Amazon,
Microsoft
and
Google
are
at
the
front
of
the
race
and
compete
aggressively
for
market
share
in
talent,
and
while
these
providers
themselves
are
heavy
adopters
of
open
source
technologies,
the
cloud
computing
remains
predominantly
proprietary
and
close
source.
A
Each
cloud
provider
offers
a
walled
garden
of
proprietary
services
that
are
designed
to
lock
in
and
keep
the
customers
in.
Maximize
utilization
of
this
specific
law
provide
infrastructure,
and,
while
your
own
services,
when
you
write
your
services,
they
typically
run
in
VMs
containers,
service,
functions
or
otherwise
portable
more
frequently,
they
depend
on
platform
resources,
like
databases,
message
queues,
big
data,
AI,
machine
learning
and
so
forth.
A
The
very
resources
that
cloud
providers
offer
as
a
managed
services
and
what
make
managers
is
so
appealing
is
that
you
don't
have
to
worry
about
a
lot
of
this
task
like
provisioning,
deploying
scaling
doing
disaster
recovery,
backing
up
in
others,
all
the
tasks
that
are
required
to
run
production,
great
services,
the
cloud
providers.
They
will
take
all
responsibility
for
all
those
tasks
and
they
even
give
us
la
to
guarantee
uptime
and
delivery
of
your
own
services.
In
return,
you
will
pay
typically,
above
and
beyond,
to
what
normal
costing
hosting
charges
are
and
effectively.
A
Typically,
when
cloud
providers
adopt
open
source
technologies,
they
will
offer
the
same
services.
For
example,
right
here,
you'll
see
my
sequel,
offer
virtual
problems
by
every
cloud
provider
in
size,
shape
and
form.
However,
the
service
name
and
wire
protocol
could
be
the
only
common
thing.
The
way
you
provision
scale
and
maintain
that
service
could
be
specific
for
given
cloud
provider
and
when
you
look
an
overlap
instead
of
the
services
provided
by
different
cloud
providers,
you
can
derstand
why
there
is
ever
growing
demand
for
being
multi
cloud
and
what
is
missing.
A
So,
where
the
cube
come
so
I'm
gonna
still
do
quickly
interested
kubernetes
in
case
not
everybody
very
familiar
with
kubernetes.
This
brief
couple
of
slides,
probably
not
necessary,
but
anyway,
so
kubernetes
is
open
source
container
acceleration
system
for
automating
application
deployment,
scaling
and
management.
It
was
originally
started
on
Google
in
June
2014,
and
actually
this
month
we
celebrate
fifth
anniversary
of
kubernetes
quickly.
Within
a
month,
other
big
company,
like
Microsoft
Red,
Hat,
IBM,
darker,
they
joined,
kubernetes,
community
and
community
became
grow,
grew
it
expand
rate.
A
They
have
first
major
GA
release
in
July
2015,
together
with
CNC
F
partnership
announcement
and
in
short
five
years,
kubernetes
became
de
facto
the
platform
to
run
containerized
workloads
and
services.
It
also
achieved
an
amazing
adoption
rate
among
cloud
providers.
It
became
virtually
ubiquitous
today.
Every
major
cloud
provider
offers
kubernetes
as
a
service.
With
the
last
of
latest
one
was
adopted
from
Airbus
web
services.
They
offer
it
ETS
in
2018.
A
A
So,
needless
to
say,
that
kubernetes
is
pretty
incredible
product.
It
revolutionized
the
orchestration
of
continuous
workloads
and
services
and
when
I
started
using
kubernetes
in
2015
I
was
sold
on
the
idea
by
that,
at
that
time,
all
I
kind
of
knew
and
care
about
was
running
containers
services
inside
the
containers.
It
took
me
some
time
to
realize
that
perhaps
the
best
feature
of
kubernetes
is
kubernetes
api
with
its
declarative
style,
so
when
user
expressed
what
they
want,
in
other
words
desire
state
of
your
system
versus
imperative
style.
A
Api
have
saying
that
this
is
the
steps
I
want
to
use
to
achieve
that
state.
It
is
level
based
which
enables
a
robust
behavior.
Even
if
you
miss
in
some
intermediate
state
changes,
it
is
complete
in
authoritative
and,
most
importantly,
it's
extensible
and
last
part
is
very
important
because
this,
in
fact,
that
what
I've
been
doing
for
last
couple
of
years,
I
was
working
on
the
extensibility
of
kubernetes
and
I
was
writing
companies
in
native
applications.
A
So
how
do
you
extend
kubernetes?
So
any
programs
that
reads
and
right
from
Cabrini's
api
can
provide
useful
automation
and
there
is
specific
pattern
for
writing
those
programs.
The
pattern
called
a
control
pattern.
Control
is
typically
read:
object
from
Cobra
ASAP
I
perform
some
operations
and
then
save
either
the
state
of
operations
or
state
of
an
object
back
to
kubernetes
api
custom
resources
are
extension
of
kubernetes
api
and
the
base
application
combined
with
customer
service
definition
or
CRD
together.
A
Basically,
it's
a
brace
application
is
CRD.
Combined
with
the
controller
and
operator
term
was
if
not
invented
was
introduced
by
korres
company
and
it
was
a
method
of
packaging
and
deploying
and
managing
kubernetes
applications.
The
operator
format
gives
software
developer
the
template,
which
will
tell
Cabrini's
how
to
deploy,
manage
the
application,
and
there
are
several
frameworks
to
choose
to
author
your
operator.
Most
popular
of
them
operate
a
sdk
and
cube
builder.
I
based
on
the
controller
runtime.
A
There
are
many
few
others,
some
of
them
very
similar
I'm
different,
like
meta
controller,
a
little
bash
controller
and
of
course,
you
can
use
client,
go
yourself
very
low-level
library
to
offer
your
own
operator
not
what's
right
in
from
scratch.
So
if
you
look
in
basic
structure
of
controller
pattern,
it's
kind
of
continuous
operation,
continuous
loop,
which
basically
retrieve
the
object,
replace
API,
compare
the
spec
of
an
object
to
actual
system
state.
If
they
the
same,
maybe
there's
nothing
needs
to
be
done
in
continue.
A
So
when
you
write
an
operator
typically,
you
extend
companies
types
so,
for
example,
the
most
common
pattern
will
be.
My
operator
will
create
additional
deployments
for
stateful
set
and
has
custom
logic
to
do
something
additionally,
which
you
normally
would
not
do
with
the
helm,
installation
in
others.
A
If
you
look
at
my
sequel
operator,
you'll,
see
like
up
to
five
will
probably
be
more
right
now
types
to
author
or
people
how
to
author,
they
my
sequel
operator
and
nowadays,
it's
almost
easier
to
name
open
source
technologies
which
offer
a
staple
set
solution
or
stateful
application
for
companies
who
don't
have
operator.
Basically,
if
any,
if
you
go
to
resource
like
what
is
it
operator
hub
that
IO,
it's
pretty
good
resource,
we
can
actually
list
all
the
operators
gradually.
A
You
can
actually
select
by
level
area
of
the
main
area
right
here
and
you
can
see
them
all.
It's
not
the
only
place.
I
also
recommend
to
go
check
out
the
awesome
operators
at
the
end
of
this
slide,
I
have
a
reference
link
and
the
slide
is
also
available
on
the
website
of
the
scheduler
companies.
Keep
Khan
scheduler
so
check
out
this
last
slide.
It
has
reference
to
all
links.
A
So
now,
if
you
can
provision
your
stateful
service,
it's
not
was
running
my
sequel
database
as
an
operator
kubernetes.
It's
kind
of
jump
to
this
question
so
do
I
really
need
to
use
many
sources
from
cloud
providers.
Do
I
really
need
to
use
RDS
from
AWS
or
cloud
SQL,
and
this
notion
has
very
appealing
aspect
when
you
run
your
proof,
data
and
database
service
and
the
same
kubernetes
cluster
you
autumn
will
have
this
ultimate
portability.
When
you're
on
stateless
service,
you
can
run
on
any
way.
You
can
run
the
laptop.
A
You
can
run
it
in
any
kubernetes
cluster
anywhere
in
mini
cube,
jaqui
on
Prem,
and
it's
easy
because
it
stateless
once
you
state
get
involved
now
you
decide
what
to
run
it.
However,
if
you
put
your
state
for
applications,
also
Cabernets
ultimately
have
this
portability.
You
can
run
as
well
anywhere.
However,
this
thing
has
the
ultimate
portability
is
a
goal.
It
has
some
problems
as
well,
some
of
them
temporarily.
Some
of
them
can
be
may
be
long
term.
A
A
What
happens
that
we
can
actually
take
the
same
operator
pattern
and
we
can
extend
it
not
necessarily
only
to
kubernetes
types.
We
can
take
operator
pattern
and
extend
it
to
types
outside
of
kubernetes.
So,
for
example,
just
like
I
can
use
a
pair
pattern,
create
stateful
set
for
my
sequel
using
kubernetes
api
I
can
take
the
same
concept
and
use
cloud
provider
API
and
cloud
provider
SDK
libraries
to
provision
services
on
the
cloud
provider.
A
So,
instead
of
doing
my
sequel
in
cluster
I
can
run
my
sequel
in
AWS,
use
an
ADA
bus
provider,
API
library
to
schedule
and
set
up
RDS
instances
or
Cloud
SQL
or
my
sequel
as
room
and
with
exactly
those
goals
in
mind.
We
started
and
introduced
the
cross
plane
project
we
offer.
As
I
mentioned
earlier,
we
open
source
it's
right
before
the
cube
con
in
September
in
Seattle
last
December
excuse
me
and
the
cross
plane
is
multi-cloud
control
plane.
A
A
single
cross
plane
enables
provisioning
and
full
lifecycle
management
of
services
and
infrastructure
across
wide
range
of
providers
and
region.
Speed
cross
plane
presents
a
declarative
management
style
API
that
will
cover
a
wide
range
of
portable
abstractions,
including
databases,
clusters
buckets
that's
what
we
initially
started
since
then.
We
edit
radius
clusters
and
we
work
in
in
adding
more
and
more
resources
and
crossplane
based
on
declarative
resource
model
of
kubernetes,
and
it
applies
many
concepts
from
continuation
to
multi-cloud
workload
in
resource
orchestration.
A
A
Crossplane
extents
could
be
a
nice
API
by
customers
for
definition
in
the
roads,
cross
plane
is
an
operator
and
each
manage
resources
is
represented
by
dedicated
CRD.
So
today
we
support
through
cloud
providers,
AWS,
asher
and
google,
and
we
support,
as
I
mentioned
already,
resources
like
relational
databases,
radius
memory,
caches
clusters
themselves
and
buckets
in
addition
to
manage
resources
and
providers.
Crossplane
has
notion
of
the
risk,
resource
classes
and
resource
claims.
A
So
let's
say
first,
let's
take
a
look
at
the
cloud
provider
as
a
resource.
Here's
an
example
of
defining
cloud
provider
Yambol
for
crossplane.
You
can
see
it
has
a
two
parts.
First
part
is
the
secret,
which
contains
cloud
provider
credentials
and
second
part,
is
the
provider
which
has
a
reference
to
that
secret
and
maybe
have
additional
metadata
like
in
this
case.
It's
AWS
has
a
region
information.
Now
each
cloud
provider
has
a
Sierra
D
and
it
has
also
dedicate
control
or
may
have
dedicated
controller,
which
will
perform
additional
provider
validation.
A
Similarly,
to
provide
a
cross
plane
represents
every
single
managed
resource
by
a
dedicated
CD.
Each
CR
D
is
strongly
typed
using
cloud
provider
API
for
that
resource
and
we
try
to
kind
of
model
it
after
the
cloud
provider
API
and
each
type
has
a
dedicated
controller
which
is
responsible
for
provisioning,
validating
and
once
resource
comes
up
and
become
available
for
generating
connection
secrets,
so
it
can
be
consumed
from
the
applications.
A
It's
also
responsible
for
tracking
the
status,
and
if
it's
diverse
from
declaratives
declare
state,
it
will
attempt
to
make
adjustable
stage
just
like
similar
in
kubernetes.
When
you
create
a
deployment,
you
run,
let's
say
tell
deployment
run
with
three
paths.
If
would
say,
one
part
died
or
service
would
know,
died.
Companies
wanna
make
a
scheduled
new
path
so
similar
to
that
it
will
attempt
to
do
the
same,
active
reconciliation
against
resources.
A
So
if
something
changed
in
resource
it
will
try
it
automatically
in
extra
console
to
ratify
and
make
sure
the
changes
match
in
two
declaratives
declare
side,
and
this
is
the
example
of
my
sequel,
server
in
Azure
provider
notice
that
it
has
pretty
much
the
property
set.
It's
not
complete,
prop
reset
but
effectively
which
matches
as
your
API.
A
Resource
classes
and
resource
claims
so
developers
when
I'm
as
an
application
developer,
I
typically
don't
really
care
what
my
sequel
instance
I'm
using
squint-
not
sometimes
I-
do
here,
but
anywhere.
If
I'm
writing
my
application,
let's
say
WordPress
and
it
needs
to
consume.
My
sequel.
I
really
don't
need
to
know
it
comes
from
the
ADA
bus,
RDS
or
from
cloud
SQL
or
from
somewhere
else.
A
What
I
do
care
is
the
connection
string
and
credentials
so
I
can
connect
to
it
and
my
application
can
perform
a
business
logic
now
use
you
as
a
cloud
or
class
administrator
can
use
classes
which
modeled
very
closely.
Oh
inspired
by
kubernetes
storage
classes
and
storage
claims.
You
can
model
resource
class.
Providing
all
this
metadata
needed
to
provision
resource
and
claim
can
be
now
slimmed
down
and
had
very
limited
information.
A
So,
for
example,
here's
this
class
for
yes
for
standard
area,
my
sequel,
if
you
notice
it,
has
very
similar
properties
as
a
raw
resource
which
you
look
in
couple
slides
back
so
right
here.
This
is
the
actual
resource,
computers,
norm,
I
suppose
server,
and
this
is
class
for
that,
so
they
very
similar
in
terms
of
completeness
of
the
properties.
A
A
I'm
application
developer
can
use
this
claimants
and
hey,
give
me
my
sequel
in
this
cloud
provider
with
the
engine
version
5.7
you
as
a
cloud
administrator,
can't
define
what
it
means
to
provision
my
sequel
in
AWS,
for
example,
or
in
Azure
with
all
those
properties,
so
it
kind
of
creates
two
interesting
notions.
First
of
all,
it
has
separation
of
concerns.
I,
don't
know
all
these
details
of
infrastructure.
Moreover,
I
don't
know
the
credentials
to
provision
those
resources.
Those
could
be
stowed
away
in
the
protected
namespace.
A
Let's
say
crossplane
system
namespace,
to
which
I'm
as
application
developer,
don't
have
access
to
so
I
cannot
simply
go
ahead
and
provision
any
resources
near
Lully.
However,
crossplane
will
understand
the
claim
and
will
match
with
the
resource
class
and
provision
and
fulfill.
This
request
return
him
back
the
connection
secret.
A
A
So
now,
if
you
look
at
this
yamo
file
or
manifest
of
application,
if
I
will
need
to
deploy
this
against,
let's
say
a
different
cloud
provider.
Let's
pretend
that
it
was
defined
against
adarand
I
decided
to
deploy
it
against
AWS
very
little
need
to
change
in
this
yellow
file
I'm,
as
application
developer
in
fact,
may
even
use
the
same
class
name
if
they
were
just
defined
in
abstract
names.
You,
as
a
cloud
administrator,
now
need
to
furnish
all
the
resource
class
for
the
cloud
provider.
A
So
now
you
can
actually
define
classes
for
as
many
cloud
providers
as
we
support
and
I
can
apply
exactly
the
same,
manifest
file
and
provision
my
service
without
any
changes.
So
that's
actually
creates
this
very
powerful
concept
of
portability
of
my
application.
Now
I
can
run
and
deploy
it
in
any
cloud
provider
without
changes
to
manifest
itself.
A
So
if
that
would
be
not
enough,
so
there
is
more
to
that
in
addition
to
cloud
providers,
resources,
resource
classes
and
claims,
crossplane
provide
definition
and
support
for
workloads.
So
what
workload
does
is
basically
bring
this
all
together.
So
now,
in
one
concise
document,
I
can
define
my
payload
in
terms
of
deployments
or
services.
A
What
I
have
to
my
resources
and
string
it
all
together,
and
since
I
mentioned
earlier,
that
crossplane
is
capable
of
provisioning
kubernetes
clusters
now
I
can
run
crossplane
and
the
thing
Cobras
cluster,
let's
say
in
my
laptop
and
mini
cube
and
I,
define
workload
of
the
WordPress
application
and
I
can
provide
credentials
to
my
crossbow
insane
for
AWS,
Google
and
azure
and
say
go
ahead
and
deploy
it.
And
what
can
happen
if
that
cross
plane
will
say.
A
Oh
I
need
to
find
a
cluster
where
to
put
this
workload,
oh
I,
don't
have
any
so
go
ahead
and
schedule
one
and
it
actually
can
figure
out
which
the
schedule
today
cross
plane
supports
direct
scheduling
through
the
indication
of
case
schedule,
not
classes.
Specifically,
you
will
have
to
provide
class
the
selector
in
the
future.
We
can
have
a
course
based
scheduler.
In
other
words,
we
can
say:
oh,
where
is
it
cheaper
to
run
my
WordPress
today,
worse,
which
cloud
provider
gives
me
better
price
for
manage
database,
deploy
it
there
more
way.
A
If
you
run
in
conjunction
with
out
applications,
you
can
use
affinity,
anti
Finity
and
say
what
is
the
best
proximity
or
latency
to
deploy
applications
and
crossplane
will
fulfill
that,
and
if
there
is
no
matching
cluster,
it
can
go
ahead
and
provision
one
for
you.
So
last
in
this,
in
December
in
Seattle
I
did
the
demo.
You
can
still
find
it
on
YouTube,
where
basically
I
use
this
concept.
A
So
AB
our
mission
is
to
create
a
more
open
cloud
computing
platform
and
at
the
heart
of
every
cloud,
is
the
control
plane
and
we
hope
that
cross
plane
could
become
the
control
plane
for
open
cloud
with
open
control
plane.
You
can
anyone
can
add
a
new
API
and
extend
to
manage
any
open
source
or
even
commercial
resources.
A
Okay,
so
we
are
the
very
beginning
of
a
journey.
A
band
is
very
young
company.
We
started
about
January
2018,
so
cross
plane
is
very
young
project
as
well,
so
I
encourage
every
one
of
you
to
come
and
github
go
on
github
and
check
out
and
go
through
the
examples.
We
have
a
lot
of
walkthrough
exam
from
the
wordpress
from
specific
services
or
even
get
lab
example.
We
can
run
complete
enterprise,
great
deployment
of
gitlab
in
cloud
providers
of
a
choice.
In
fact,
get
la
partnership
was
very
important
for
us.
A
We
kind
of
working
closely
with
them
as
a
real
world
application
example
to
vet
and
prove
our
design
concepts
and
constructs
in
cross
plane.
With
that
again
check
it
out
give
us
your
feedback,
submit
PRS,
open
issues,
and
it
was
privileged
to
talk
to
you
today.
Thank
you
very
much
for
your
attention.
A
B
A
So
today
Crossman
supports
the
scheduler
through
cluster
selectors.
So
in
your
workload
you
will
say:
select
cluster
based
on
criteria
so
just
like
in
the
common
label
selector,
you
can
say:
select
web
provider
equals
AWS,
for
example,
so
you
will
actually
have
to
specify
that's
the
way
it
works.
Today
you
can
eat,
or
even
you
can
say,
if
you
name
your
clusters,
not
exactly
as
cattle.
You
can
say,
deploy
in
that
green
cluster
tomorrow
in
the
future,
you
can
say:
okay
define
the
cluster
way
cheaper
to
run,
so
you
can
create
schedule.
A
We
can
work
in
the
kradin
of
schedule,
which
can
be
cost.
Optimized
find
the
cheaper
cluster
to
provision
this
workload
so
notice.
If
I'm
using
readies
database,
the
cluster
which
cloud
provider
gives
me
better
rate
or
lowest
price
to
run
radius,
then
you
can
actually
put
your
workload
in
that
cloud
provider.
So.
A
Yes,
while
crossplane
work,
scheduling
more
closely,
Jules
is
similar
to
Federation
in
a
sense
of
propagation.
We
shared
a
lot
of
concepts
and
we
kind
of
learn
lessons
from
Federation
how
to
propagate
our
resources.
The
model
is
slightly
different
in
Federation
you
will
have
a
control
plane
where
you
deploy
your
source
here
and
it
will
be
propagated.
Based
on
your
labels,
annotations
or
template
ization
to
cross
plant
have
slightly
different
objective.
A
We're
saying
that
we're
not
going
to
do
propagation
to
multiple
clusters
will
have
specific
cluster
deployment
only
because
again,
right
now
we're
not
pursuing
yet
the
model
where
we're
going
to
have
one
application
instance
distributed
across
multiple
clusters,
because
that
involves
also
solving
the
networking
layer
underneath
that,
in
other
words,
we'll
never
deploy.
My
wordpress
in
Google,
Cloud
and
ADA
based
I
want
to
make
sure
that
they
can
use
the
same
database.
Something
like
that.
So
that's
a
bit
more
challenging
problem
to
solve
working
that
and
probably
in
the
future.
C
A
So
exactly
so,
this
is
very
similar
to
the
sense,
not
maybe
from
perspective
propagation.
But
yes,
so
when
we
schedule
the
data
databases
in
different
clusters,
data
right
now,
I'm
not
going
to
be
saying-
and
if
you
want
to
do
that,
you
probably
need
to
find
your
technology
provider
which
allows
you
this
global
multi
cluster
data
syncing,
because
again
it's
involving
solving
network
problem
in
the
future.
C
A
That's
a
good
question:
well
we're
not
really
in
the
the
main
of
solvent
storage.
Technology.
However,
abound
founders
are
the
same
people
who
started
root
project,
which
is
very
close,
dealing
with
the
actual
storage
providers
for
companies
clusters.
So
in
the
future
we
can
provision
root,
enable
cluster
which
have
different
storage,
backends
cloud
daily
backends.
So
that's
again
that
in
the
works,
so
we
don't
have
anything
right
now.
Thank.
C
D
A
That's
it,
you
can
potentially
reuse
the
same
class
to
deploy
workloads
as
well
kind
of
similar
with
Federation,
where
you
share
the
same
cluster
as
your
crossbar
control,
pink
luster.
But
ultimately
you
probably
want
to
select
cluster,
which
has
very
limited
permissions,
because,
typically,
when
you
deploy
your
application,
it
implies
some
level
of
elevated
credentials
or
permissions
in
that
cluster.
So
what
we
typically
recommend
right
now
is
to
have
a
very
linked
cluster.
We
have
a
clean
separation
concerns
which
namespace
can
be
used
by
developer,
Gatien
developer,
which
names
can
be
used
by
administrators.