►
Description
Join us for Kubernetes Forums Seoul, Sydney, Bengaluru and Delhi - learn more at kubecon.io
Don't miss KubeCon + CloudNativeCon 2020 events in Amsterdam March 30 - April 2, Shanghai July 28-30 and Boston November 17-20! Learn more at kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects
Intro to the Kubernetes Working Group for Multi-tenancy - Tasha Drew, VMware
This introduction will go over what the multi-tenancy working group has been working on and how new contributors can become engaged. New users and contributors are encouraged to attend if multi-tenancy in core Kubernetes is something you are interested in or are working on implementing at your own organization.
https://sched.co/Uaj3
A
So
a
quick
question
who
in
here
has
participated
in
the
multi-tenancy
working
group
already
awesome
a
lot
of
new
people.
That's
perfect!
This
is
an
intro
overview.
We
will
have
a
deep
dive
overview
tomorrow,
and
so
that
is
something
I
would
super
recommend
if
anything
that
we
talk
of
here
is
of
interest
for
maybe
a
live
demo
I,
don't
know,
but
yeah
cool,
so
how
many
people
here
have
participated
in
the
upstream
kubernetes
community
before
ok,
so
so
just
to
give
a
quick
overview.
A
So
this
is
the
multi-tenancy
working
group
for
kubernetes,
and
so
some
of
the
questions
that
we
seek
to
identify
as
a
working
group
is:
why
do
people
want
multi-tenancy?
What
do
they
want
out
of
a
multi-tenant
control,
plane
data
plane?
What
do
they
think
of
as
a
tenant?
In
a
lot
of
cases,
we
see
clusters
that
are
being
shared
internally
between
a
bunch
of
different
teams,
maybe
a
bunch
of
different
organizations.
A
But
then
we
also
talk
to
people
who
are
maybe
running
kubernetes
control
plane
as
a
multi
tenant
service
that
they're
selling
to
end-users,
and
they
need
significantly
different
controls
at
that
point,
depending
on
what
level
of
access
they're
going
to
give
to
the
API
control
plane.
So
as
as
a
working
group,
we
have
done
pretty
extensive
definitions
on
all
of
these
terms
before,
and
so
we
have
a
ton
of
documentation
if
people
want
to
check
it
out,
but
these
are
really
what
we're
looking
at.
A
So
what
do
people
want
out
of
multi-tenancy
when
people
say
that
they
want
multi-tenancy?
What
do
they
mean?
What
do
they
think
a
tenant
is
what
are
their
different
use
cases?
We
have
a
really
great
use
case
dock
that
a
bunch
of
different
SIG's
have
found
very
valuable
to
them,
because
they
can
just
kind
of
look
and
see
all
of
the
various
use
cases
that
people
are
trying
to
solve
for.
A
The
way
to
sort
of
think
of
that
is
it's
multi,
it's
tenancy
that
we
are
seeking
to
achieve
in
an
environment
of
some
level
of
trust.
So,
for
example,
perhaps
I
have
a
shared
kubernetes
control,
plane
and
everyone
who
has
access
to
it
is
an
employee
of
this
company
and
has
some
sort
of
vested
interest
in
not
aggressively
hacking
or
doing
denial-of-service
attacks
on
their
co-workers
because
they
would
get
fired.
So
that's
sort
of
like
what
we
think
of
as
soft
multi-tenancy,
and
then
we
also
talked
a
lot
about
hard
multi-tenancy
and
hard.
A
Multi-Tenancy
is
no
trust.
You
need
complete
lockdown.
You
probably
need
separate
API
control
planes,
four
separate
tenants
and
there's
you
need.
You
know
complete
storage,
isolation,
Network
isolation,
and
so
those
are
sort
of
the
two
degrees
of
tenancy
that
we
talk
a
lot
about
so
we're
so
that's
kind
of
what
we
do.
We
have
a
lot
of
talks
you
can
check
out
if
you're
interested
in
participating
in
the
working
group,
you
can
find
us
on
the
kubernetes
slack.
So
kubernetes
has
its
own
open-source
slack,
which
is
distinct
from
the
CNCs
slack.
A
You
can
join
at
this
really
easy
to
remember
URL,
so
just
slack
thought
kto
and
then
we
have
our
own
channel
a
bunch
of
people
in
the
channel.
Talk
about
multi-tenancy,
ask
questions
post
links
to
what
they're
working
on
it's
really
pretty
chatty,
not
super
chatty,
if
you're
not
into
that,
but
the
right
level
of
chat,
and
so
we
also
have
a
Google
Group.
So
for
people
who
haven't
participated
in
the
kubernetes
upstream
community
before
we're
a
very
google
group
oriented,
we
do
all
have
github
x'
where
the
code
lives.
A
But
if
you
join
the
google
group-
and
you
can
just
go
to
groups
like
google
dot
and
you
can
search
for
whatever
working
group
cig
you're
interested
in
and
you
will
see
the
working
you'll
see
the
google
group
and
you
can
join
it
very
easily.
You
can
click
join
and
then
you'll
start
getting
the
mailing
list,
but
you'll
also
get
all
the
calendar
invitation.
So
if
you're
like
I
know
you
people
are
meeting
without
me,
why,
like?
How
come
you
never
invite
me
to
anything?
Join
the
Google
group?
A
You
will
be
invited
to
literally
everything
so
right
now
in
the
in
our
group,
we
have
a
biweekly
meeting,
it's
Tuesday
at
11
a.m.
Pacific
time.
We
do
record
all
of
our
meetings,
they're
all
on
YouTube.
We
have
a
playlist
and
we
have
a
github
repo
for
all
of
the
code
for
the
proof
of
concepts
and
incubator
projects
that
we're
working
on
that
we're
gonna
go
over
as
part
of
this
presentation
so
yeah
and
if
there's
any
questions
about
how
to
get
started
or
how
to
get
involved.
A
When
you
go
to
our
github
link,
that's
at
the
bottom
of
this
doc.
We
have
a
links
MD
that
has
links
to
literally
everything.
So
if
you're
ever,
like
oh
I,
heard
you
once
did
this
thing,
the
link
is
in
that
is
in
that
page.
So
who
are
we
and
why
are
we
doing
this?
So
there's
me
I'm
Tasha.
All
of
these
apps
are
our
slack
handles
so
I'm
a
product
line
manager
at
VMware,
I
work
on
project
Pacific.
A
If
people
have
heard
of
project
Pacific
I
also
work
on
tansu
for
SD,
DC
and
kubernetes
stuff,
specifically
on
vSphere,
my
co-chair
is
Sanjeev
Rampal.
He
is
a
principal
engineer
at
Cisco
and
he
will
be
doing
a
deep
dive
on
all
of
these
projects
tomorrow.
We
also
have
our
project
leads
and
we're
lucky
enough
to
have
two
of
them
in
the
room
with
us
today
and
I
might
ask
them
to
go
over
their
project,
since
obviously
they
can
do
that
in
a
pretty
awesome
way
and
I
may
have
stolen
their
slides
to
make
this
deck.
A
So
it's
rude
to
present
other
people's
slides
in
front
of
them
right,
but
we
have
Adrian
Ludwig,
he's
working
on
the
hierarchical
namespace
controller.
We
call
that
HNC
and
everyone
always
hears
agency
and
then
thinks
that
we
have
this
really
sweet
agency
project.
So
it's
just
HNC
and
I,
don't
know,
maybe
we'll
call
it
agency
as
an
I'd
joke,
so
we're
gonna
go
over
that
a
little
bit.
Adrienne's
gonna
get
up
and
talk
through
that.
We
also
have
fake
woh.
Here
he's
been
working
on
a
project.
B
So
yeah
we're
working
on
the
hierarchical,
namespace,
controller
and
I.
Think
almost
anybody,
who's
ever
looked
at
namespaces
had
said.
Why
do
I
only
get
a
flat
list?
Why
can
I
not
put
them
inside
of
another
one,
but
it's
always
been
considered
to
be
very
difficult
to
try
to
put
that
into
kubernetes
itself,
rightly
so.
B
Here
what
you
can
see
is
that
I've
put
some
policies.
Some
are
back
policies
for
my
site,
reliability,
engineers
into
my
org,
and
maybe
some
network
policies
and
at
the
ORA
global.
Then,
at
the
team
level
I've
got
some
are
back
policies
for
the
team
members
and
maybe
a
different
network
policy
for
the
services
in
that
team
as
well,
and
what
you
want
is
you
want
them
to
cascade
down
sort
of
like
inheritance
in
C++
or
Java?
B
So
what
the
agency
does
is
it
lets?
You
define
this
singleton
custom
resource
called
the
hierarchy
config
and
you
put
it
in
the
team
namespace
and
you
point
it
at
the
org
namespace
and
those
policy
objects
get
magically
copied
down,
and
then
you
can
do
the
same
thing,
and
so,
even
though
you
haven't
actually
defined
any
policy
objects
in
your
service
namespaces
they
all
get
propagated
in
and
of
course,
if
you
change
the
hierarchy,
the
new
objects
will
get
well,
the
old
objects
will
be
deleted,
the
new
ones
will
be
copied
in.
B
B
So,
for
example,
you
can
use
a
label
selector
to
say,
allow
ingress
from
all
namespaces
that
are
labeled
with
team,
a
or
team
one
in
this
case
I'll
just
skip
by
this
very
quickly,
but
basically
we,
the
way
it
works
is
that
we
keep
an
in-memory
view
of
what
the
hierarchy
is,
and
we
have
one
controller
that
reconciles
the
hierarchy
itself.
Another
controller
that
reconciles
all
of
the
objects,
and
then
we
also
have
a
bunch
of
admission
web
books
to
make
sure
that
you
don't
shoot
yourself
in
the
foot.
B
Please
come
and
talk
to
me
if
you're
interested
in
using
this.
The
number
one
thing
we
need
right
now
is
for
people
to
use
this
and
see
if
it
meets
their
use
cases.
The
only
non
truth
was
actually
on
the
slide,
but
the
one
last
thing
that
it
can
do
for
you
is
that
if
you
want
to
create
sub
namespaces-
and
you
don't
have
cluster
level
namespace
creation
privileges,
it
can
allow
you
to
do
that
as
well.
So
you
can
create
sub
namespaces
under
something
that
you
already
have
admin
access
to.
That's
the
agency
thanks.
C
Sorry,
I'm
not
up
to
much
time
so
I
probably
won't
go
through
too
much
details
about
this
project,
but
I
can
share
some
high
level
idea.
Why
do
you
want
you
have
this,
because,
given
that
the
current
recommendation
has
no
namespace
to
do
certain
level
of
isolation,
the
main
problems
that
we
face
it
even
like
I
mentioned
wheezing
or
organization-
it
is
trustworthy,
environment,
sometimes
York
queries.
A
best
server
can
be
denounced
service
attacks,
but
some
people
are
intentionally
probably
pictures
because
they
just
implement
a
very
stupid
controller.
C
So
because
the
current
the
kubernetes
Cobra
is
no
design
we
denied
it
is
not
either
for
multi-tenancy.
So
there
is
a
lot
of
missing.
Paula
are
very
strictly
no
isolation
from
the
control
plane
perspective,
so
we
you
are
about.
We
only
start
this
kind
of
project
like
using
the
virtual
closet
to
do
very
strong
isolation
under
control
plants,
actually
try
to
save
our
sre
members
life.
So
because
we
see
some
cases
there
is
really.
C
You
can
hit
a
case
that
it
is
very
difficult
to
recover
for
where
fader
state,
if
you
don't
very
strong
isolation,
so
our
idea
here
is
I.
Think
I
can
skip
this,
so
basically
our
basic
idea
is
we
in
our
multi-tenancy.
More,
though
is
we
will
give
each
tenant
a
user
a
very
dedicated,
API
server,
so
they
will
share
the
resource
for
this
from
the
same
resource
provider,
which
we
call
super
master,
which
is
the
you
know,
kubernetes
cluster,
which
provide
actually
pod
resource
the
I.
C
The
kind
of
Co
idea
is,
we
have
a
bunch
of
the
CRTs
like
controllers:
do
you
kind
of
resource
syncing?
Basically,
each
tenant
user
operates
its
own
dedicated
control
plane.
There
is
a
sinker
kind
of
controller,
keep
copying
the
pod
objects--
from
the
tenant
master
to
the
super
master
and
a
super
master
use
a
unified
scheduler
to
do
the
provision
a
so.
This
is
the
overall
idea
of
having
dedicated
API
server
for
the
ten
user
to
achieve
kind
of
much
much
I
would
say
much
better.
C
Okay,
another
part
of
worker
witches
are
not
to
evacuate.
You
re
Baba's
proposal
is
us
is
in
general.
After
that,
are
we
in
tiring
or
multi-tenancy
working
group
trying
to
solve
it's
trying
to
define
a
kind
of
tenant
model
for
people
to
easily
config
kind
of
so
I?
Think
I,
think
why
do
in
the
working
group
that
is
a
problem
is
what
is
right
away
for
a
tenant
I
mean
to
create
a
name
space
which
is
a
very
critical
classical
resource.
C
So
what
is
the
best
way
to
assign
writing
our
bank
commissions
for
telling
me
do
create
ROS
namespace,
but
that's
we
have
a
long
debate
of
how
to
actually
do
that
and
we
come
up
with
design.
We
have
a
POC
I,
think
it's
cannon
before
his
talent
controller,
which
one
so
then
we
we
come
up
with
a
new
desire,
which
is
we
call
version
two
and
I'm
pretty
much
in
charge
of
the
implementer.
What
version
two
your
tenant
controller
did
I
try
to
solve.
C
The
problem
is
how
to
do
the
namespace
self-service,
namespace
creation
for
the
you
know.
Tender
means
that's
and
make
sure
the
controller
solve
all
the
corner
cases
some
sort
of
box,
and
we
we
also
have
some
clients
integrator
visa
agency.
So
they
even
you
know
soft
SCADA,
you
know,
are
back
setting
populations
for
multiple
namespaces.
So
that's
our
kind
of
future
player
of
doing
the
combine
multiple
projects
but
I
think
the
details
will
be
covered
more
in.
A
A
You
can
just
use
that
on
its
own,
but
then
we
also
want
to
do
proof
of
concept
showing
you
how
you
would
use
these
tools
together
to
get
a
better
tenant
and
hierarchical,
namespace
controller
experience
and
then
same
with
virtual
clusters,
which
I
think
is
going
to
be
using
the
tenancy
controller
as
well.
So
again,
all
of
the
design
Doc's
are
online.
All
of
these
slides
are
in
PDF
form.
A
Don't
think
Jim
is
here,
but
he
and
his
team
have
been
doing
a
ton
of
work
which
you
can
check
out
in
the
design
doc
and
this
and
these
the
initial
sort
of
push
towards
these
benchmarks
is
now
and
also
in
our
github
repo.
So
what
he
has
done
with
his
team
is
create
these
different
levels
of
multi-tenancy
profile.
So
you
can
stand
up
your
cluster
and
then
run
the
benchmarks
against
your
cluster
and
then
see
what
configurations
you
may
be
missing
in
that
cluster.
A
And
so
the
idea
with
this
is,
let's
start
to
really
have
some
good
benchmarking
around
having
a
secure
having
a
secure,
Pro
profile
for
your
cluster
and
being
able
to
see
how
its
configured
as
it's
running
and
then
perhaps
in
the
future,
make
sure
that
it
stays
configured
in
that
secure
way.
And
this
becomes
really
important
for
us
as
the
multi-tenancy
working
group,
because
we
can
make
a
lot
of
tools
and
a
lot
of
recommendations
about
how
you
can
have
a
secure,
multi
tenant
cluster.
A
But
first
we
really
have
to
as
a
community
agree
on
what
that
means,
and
what
sort
of
the
knobs
and
dials
and
tubes
are
that
you're
going
to
use
to
configure
that
secure
cluster
to
begin
with,
so
these
benchmarks
are
in
active
development.
You
know
we're
making
a
lot
of
very
fast
progress
on
this,
and
then
this
becomes
a
tool
suite
that
we
can
use
potentially
with
something
like
conformance.
A
The
other
thing
that
we're
gonna
do
with
this
is
we're
going
to
submit
our
benchmarks
to
the
kubernetes
bug
bounty.
We
have
a
bunch
of
security
researchers
who
are
paid
to
hack
on
kubernetes
and
see
what
is
and
isn't
working
and
how
they
can
exploit
it.
So
once
we
have
these
secure
benchmarks,
we
will
submit
that
to
the
bug
bounty.
A
It
will
actually
help
them
a
lot
because
they've
been
asking
for
profiles
of
different
cluster
types
so
that
they
can
really
try
and
exploit
them
and
then
we'll
get
that
feedback
and
make
the
benchmarks
themselves
that
much
better.
So
those
are
the
four
major
projects
that
we
have
been
working
on
at
coop
con
this
week.
This
evening
we
are
going
to
have
a
panel
I.
A
A
If
anyone
would
like
to
check
it
out
tomorrow,
sanjeev
and
adrienne
and
other
guest
stars
will
be
presenting
a
deep
dive
that
I
hear
is
going
to
include
some
demos
of
the
various
projects
and
kind
of
ism
as
much
depth
as
we
can
possibly
get
into
in
the
1/2
1/2
hour,
plus
that
were
provided.
So
definitely
if
this
all
seems
interesting
to
you,
you
want
to
see
more.
A
D
A
So
so
it
depends
on
the
different
projects
and
sort
of
like
the
evolution
of
the
different
projects.
So,
for
example,
some
of
hierarchical
namespace
is
based
on
what
Google
anthos
is
doing
with
their
get
delivery
sort
of
workflow
and
how
you
spin
up
child
namespaces
and
having
this
hierarchical
structure
where
you're
copying
down
policy,
and
so
that
is
very
much
inherited
from
what
anthos
is
doing.
A
The
tenancy
ID
has
gone
through
sort
of
two
evolutions,
so
the
first
evolution
was
proposed
and
we
built
it
out
and
I
think
that
was
probably
based,
maybe
a
little
bit
on
gke,
and
then
we
really
realized
that,
with
the
architectural
direction
we
were
going
in,
like
wasn't
gonna
work.
So
we
kind
of
learned
a
lot
from
that
and
now
I
would
say
it's
just
a
new
evolution
of
how
we
think
we
can
achieve
what
people
are
trying
to
do.
A
A
tenancy
virtual
clusters
obviously
is
from
what
Alibaba
is
using
in
production
today
and
then
the
tenancy.
The
benchmarking
project
is
based
a
lot
on
what
the
narada
team
I
think
has
seen
as
they
provide
enterprise
kubernetes
to
various
customers.
So
each
one
really
has
sort
of
its
foundation
and
what
people
are
doing
for
their
customers
and
various
projects,
internal
or
external,
and
then
it
kind
of
evolves
in
a
in
the
direction
in
perhaps
a
different
direction,
because
it's
not
custom-built
for
that
solution.
Yeah.
A
E
F
A
So
that
so
the
the
tools
that
we're
evolving
are
not
mapped
to
the
benchmarks.
So
it's
like
we're
providing
tools.
Various
tools
are
being
evolved
to
sort
of
take
on
different
aspects
of
what
people
are
trying
to
do
to
share
clusters
between
teams
and
that's
kind
of
the
genesis
of
each
of
the
open-source
projects,
and
then
the
benchmarks
themselves
are
more
focused
on
NIST
and
other
security
benchmarks.
Yeah
question.
A
B
A
So
the
question
is:
are
any
of
these
projects
mapping
to
what
we're
doing
in
project
Pacific,
which
is
a
vSphere
projects
that
I
work
on
so
right
now,
I
joined
the
multi-tenancy
working
group
because,
obviously
project
Pacific
is
a
multi-tenant
kubernetes
cluster
and
we
wanted
to
see
if
we
could
work
with
the
community
to
upstream
a
lot
of
what
we're
doing
to
really
lock
down
the
infrastructure
layer
of
project
Pacific
over
the
ESXi
clusters.
But
when
I
joined
I
realized
that
people
weren't
quite
ready
for
that.
A
A
What
I
wanted
to
do
is
actually
really
reflect
it
in
the
benchmarking
piece,
because
what
I
wanted
to
do
is
suggest
that
we
have
secure
profiles
for
clusters
and
then
that
we
have
secure
conformant
clusters
and
so
that
work
I
think
is
going
to
align
really
nicely
and
then,
as
far
as
the
hierarchical
namespace
and
the
tenancy
controller
I
think
those
are
probably
the
tools
that
we'll
look
at
incorporating
and
so
what
we're
doing
and
for
a
virtual
cluster.
That
architecture
is
very
similar
to
what
we're
doing
in
some
ways.
A
B
Oh
sorry,
to
repeat
the
question:
how
do
we
make
sure
that
you
provision
the
same
namespaces
in
in
all
of
the
different
clusters?
The
answer
is
that
that
is,
to
a
certain
extent
out
of
scope.
We
do
talk
a
lot
about
multiple
clusters,
but
they
do
have
their
own
separate
sake,
so
we
don't
want
to
step
on
their
toes,
although
we
we
talked
to
them
as
well.
B
B
Now
we
are
designing
this
so
that
it
can
be
used
with
any
kind
of
get
ops
flow,
so
you
could
use
it
with
flex
or
any
other
number
of
or
ACM
I
should
mention
any
of
these
tools
that
can
sync
manifests
to
a
variety
of
different
clusters:
make
sure
that
they're
all
upgraded
in
a
sane
fashion,
but
that's
not
built
into
this.
This
is
a
new
cluster.
Only.
A
Okay.
Well,
as
I
mentioned,
a
super
active
slack
channel
jump
in
ask
questions.
Check
out
our
links,
provide
your
use
cases.
We
would
love
to
hear
them
and
yeah.
If
there
are,
you
know
pieces
of
multi-tenancy
that
you're
interested
in
that
you
see
us
not
addressing
we'd
like
to
you
know,
start
to
address
those
as
well,
so
yeah
we'd
love
to
work
more
with
you
also
I
have
multi-tenancy
buttons.
If
anyone
needs
a
button
notice,
a
lot
of
people
are
tragically
under
buttoned
here
so
yeah.
Let
me
know.