►
From YouTube: Kubernetes Working Group Multitenancy 20190423
Description
Agenda: Discuss Tenancy CRD
Notes:
- Demo by Yisui Hu (@easeway)
- Review of open questions raised by prototype
- Kubernetes Tenant CRD (includes overview of CRD and open questions): https://docs.google.com/document/d/1hpJX5O_siMmNGMvIHvz8Pm7XOjJLz5g57XWrgwWarFw/edit#heading=h.c0uts5ftkk58
-- Leave comments here for suggested approaches to open questions etc
- All code and links to docs etc can always be found in the github repo: https://github.com/kubernetes-sigs/multi-tenancy/
- Tenancy CRD proof of concept: https://github.com/kubernetes-sigs/multi-tenancy/tree/master/poc/tenant-controller
-- Open issues here for suggested features, extensions, changes, etc
Notes and agenda doc for all meetings: https://docs.google.com/document/d/1fj3yzmeU2eU8ZNBCUJG97dk_wC7228-e_MmdcmTNrZY/edit#
A
B
B
Tasha,
let
us
know
when
we
can
start:
okay,
I
guess
is
audience
having
trouble,
so
we'll
go
ahead
and
get
started
because
they
see
the
recording
thing
here.
So
so
one
of
the
action
items
from
past
meetings
was
to
kind
of
start
prototyping
a
tenant
resource,
a
custom
resource
and
some
ideas
had
been
thrown
around
in
the
team.
So
you
see
has
been
driving
prototyping
of
a
custom
resource
I've
supported
a
little
bit,
but
this
is
mace
mostly
work
done
by
issuing.
C
Yes,
let
me
share
a
screen,
so,
according
to
last
meeting,
we
have
presents
this
Tennessee
Adi
proposal,
I'm
not
going
to
go
in
through
this
again.
So
this
time,
I'm
going
to
show
a
demo
which
we
built
a
10
controller,
it
watch
the
trans
ERT
and
creates
namespace
and
set
up
our
back
for
the
tenants
users
and,
according
to
this
proposal,
we
also
introduced
the
namespace
template.
C
So
when
attendees
I
want
to
create
10,
Academy
want
to
create
a
tenant
and
they
can
choose
a
name,
speed
template
which
defines
a
few
predefined
policy
artists
to
be
publishing
to
the
namespace
and
I
list.
A
few
questions
when
I
implement
this
a
prototype
and
I
think
we
can
have
a
discussion
when
the
demo
is
over.
So
let
me
switch
to
the
demo.
C
C
So,
let's
first
take
a
look
at
a
tenant
CRD,
as
shown
as
a
very
simple
kinetic
resource
continent.
Specimen
name
and
specify
a
list
of
ten
data
means
any
one.
A
namespace
called
an
S
one.
So
today,
in
current
implementation,
we
will
create
a
final
namespace
with
a
tent
name
as
prefix
and
probably
that's
not
good
design,
and
we
can
change
our
later.
But
in
this
demo
you
will
see
the
namespace
are
prefixed
with
tenant,
tenant,
name
and.
C
C
C
Servicios
binds
the
the
team
on
enemy
to
the
enemy
in
class
Road,
which
is
named
Smith
enemy,
who
has
fought
Prevage
inside
namespace
and
when
a
tenant
objects
created.
Yes,
additional
cluster
robonyan
created
to
grant
the
tarantella
mean
the
update
and
delete
on
the
king
of
yourself.
So
if
we
check
the
Castro
binding.
C
C
It
is
grants
additional
are
provided
to
get
updated,
pageant
elite.
The
specific
tent
object
so
with
that
other
10
enemies
will
not
be
able
to
like
delete
or
change
anything
which
doesn't
they
don't
they
don't
own
and
next
step.
If
the
tenant
enemy
want
to
add
a
new
name
space
and
as
see
they
probably
want
to
change
the
tend
object
by
adding
a
new
namespace
called
NS
and
the
same
time,
they
want
to
apply
the
name.
So
a
template
called
restricted
or
let's
take
a
look
at
the
name
of
a
template.
C
It's
a
very
single
object.
It
defines
a
list
of
policy
objects.
So
in
this
restrict
name
is
a
template.
It
has
a
row
bindings
to
all
the
system,
all
the
sims
counting
the
namespace
to
use
restrictive
particular
policy,
and
it
also
defines
a
network
policy
by
default.
It
will
block
or
the
ingress
and
egress
and
traffic
between
the
namespace
in
other
other
namespaces.
C
C
C
C
E
F
C
So
this
is
the
demo
and
let's
go
back
to
some
questions.
We
met
there
during
this
building
of
this
prototype,
so
the
first
a
spouse
is
a
namespace
name.
So
how
do
we
determine
the
namespace
name?
There's
a
few
opinions
about
if
the
actual
namespace
name
should
be
specified,
intent
object,
or
are
we
prefix
the
namespace,
with
name
with
the
tent
name?
So
this
is
a
question
you
to
be
discussed
and
the
second
is
more
complicated
to
when
changes
happen
to
the
tent
object.
Alternate
names
with
template.
C
So
if
the
namespace
template
is
updated
after
tennis
is
created,
what
will
happen?
A
simplest
model
is
basically
we
do
nothing.
So
the
change
of
name
is
paid.
Template
will
affect
the
newly
created
namespaces,
but
not
the
existing
ones,
and
this
approach
so
makes
it
difficult
to
like
update
the
policy
in
existing
namespaces
and.
C
And
we
also
need
a
mechanism
to
figure
out
if
the
namespace
has
already
been
populated
in
the
case
of
the
restart
of
controller
and
a
second.
Basically,
we
can
watch
names,
be
template
and
update
all
namespace
immediately,
including
both
the
new
new
laquida
ones
and
existing
ones,
and
that
will
probably
introduce
unexpected
breakage
because,
like
some
of
us,
a
change
will
affect
the
exiting
workloads
and
combines
that
both
solutions,
we
can
probably
use
a
special
label
on
the
policy
objects
defined
in
the
name.
C
And
other
question
is
about
if
the
tend
objects
being
updated,
for
example,
there's
a
very
dangerous
operation.
If
you
identify
update,
attend
object
by
removing
a
namespace
form
list
which
is
unintentional
and
control
moves
forward
to
delete
the
namespace,
which
will
probably
cause
very
same
expensive
cause
to
recover
the
objects
already
in
creating
namespace
and
how
we
can
manage
that
in
a
better
way.
So
far,
there
will
be
more
questions
regarding
this
approach
and
Tennessee
ID
and
we'd
like
to
hear
more
feedback
from
from
people.
G
Question
well,
first
of
this
is
awesome,
and
this
is
exactly
what
I
was
hoping
to
see
for
for
discussing
the
updates
to
namespaces
in
general.
What
about
the
other
way
around?
Do
we
or
should
we
care
about
somebody
changing
the
parameters
of
a
namespace
that
is
under
a
tenant?
And
you
know
it
worrying
about
directing
changes
if
we
override
it?
G
If
we
take,
you
know,
options
B
or
C,
we
might
override
or
have
to
somehow
merge
changes
from
that
perspective
and,
if
not,
if
we
want
to
lock
down
the
namespace
to
not
let
anyone
change
its
permissions
outside
of
a
tenant
permission,
how
I
guess?
How
could
we
reconcile
that
other
than
I
guess
watch
the
tenant
for
any
change,
then
immediately
we're
birthing
back.
Have
you
given
any
thought
to
that
or
it
kind
of
what
your
thinking
on
that
so.
C
C
G
C
A
A
So
it
looks
very
the
the
tenant
controller
stuff
looks
really
cool.
It
also
looks
like
it
would
augment
what
I've
been
doing
really
nicely
if
we
could,
like
plumb
up
one
of
the
tenant
templates
to
be
able
to
launch
a
helmet
art.
Yes,
that
are
just
raw
q
burning
these
objects
that
also
gives
the
ability
to
easily
upgrade
as
an
operator
the
namespaces
chart.
C
G
A
H
Guys,
I'm
wondering,
could
you
maybe
flip
things
around
instead,
instead
of
trying
to
auto
upgrade
a
namespace
after
we've
changed
the
template,
you
just
attach
a
namespace
version
to
a
namespace
template
version
to
each
namespace.
Then,
when
you
change
the
namespace
template,
you
can
see
which
namespaces
aren't
at
the
conversion.
You
can
add
a
couple
more
verbs.
You
know
like
lists
of
new
faces
that
aren't
add
the
current
version
and
then
maybe
the
explicit
upgrade.
H
C
And
that
that's
actually
interesting
I
have
think
about
that
approach
is
something
like
a
little
similar
to
level
building
control.
So,
if
you
think
I'm
still
unclear
about
that
is
probably
will
have
like
multiple
names
paid
templates.
If
we
want
to
preserve
the
content
of
the
previous
version
and
it's
less
straightforward
for
the
users
like
I,
just
want
to
pull
for
editing
site
I
just
want
to
update
this
namespace
template,
the
youth
experience
element
will
have
to
explicitly
figure
out
I'm
rolling
out
a
new
names
beta
version,
instead
of
like
update
an
existing
one.
D
C
Yeah
but,
but
definitely
that's
a
very
good,
interesting
approach
and
alternatively,
I
have
seen
bout
if
we
can
like
copy
over
the
name
is
face
template
content
and
put
that
in
the
status
of
the
CRD
of
like
a
tenancy
re
to
present,
which
template
is
being
used
for
this
namespace
and
even
name
of
a
template
itself
is
gets
changed.
We
can
still
find
out
the
the
old
version
of
the
of
the
content,
but
I
haven't
I,
haven't
synced
through
carefully
with
a
very
solid
proposal,
so
yeah.
That's
definitely
a
very
good
suggestion.
I
was.
G
Gonna
just
basically
say
the
same
thing:
I
just
went
I
guess
to
add
to
that
is
I
mean
pretty
much
every
other
kubernetes
resource
doesn't
have
you
know
an
idea
of
the
historical
state
of
what
you
know
of
what
it
was
previously
it's
just
like
it.
You
know
it's
an
apply.
You
override.
What
was
there
I?
Don't
know
if
that's
really
the
something
we
should
be
tackling
as
part
of
this
I
don't
know.
Yeah.
H
C
We
do
have
a
challenge
if
some
of
the
policy
office
gang
getting
removed
in
the
new
version
of
the
names
of
a
template,
so
we
should
be
clear
if
the
the
use
experience
will
be
like
when
we
refresh
the
policy.
Obviously
the
namespace
shall
approach
the
out-of-date
policy
obvious,
or
we
just
put
in
new
policy
objects
which
may
cause
conflict
with
with
or
which
you
may
have
as
a
side
effect
of
the
left.
Over
policy
objects.
C
G
I
almost
wonder
if
it's,
if
it's
easier
to
just
make
it
make
it
an
easy
process
to
just
spin
up,
lay
a
second
tenet
and
migrate,
your
things
over
and
and
make
the
communication
the
network
policies
between
two
tenants
easy
enough,
so
that
you
can
make
it
transparent
to
the
actual
underlying
services.
So
then,
you
can
have
two
tenants
for
two
different
templates
and
but
they
kind
of
act
as
one
and
we're
just
that.
We
need
template
or
tenants
of
tenants.
Then
right.
But
you
know
one
step
at
a
time.
Yeah.
C
G
G
But
so
the
namespaces
are
created
with
the
tenant
ID
as
part
of
the
namespace
right.
So
could
we
basically
so
the
namespace
that
was
created
was
tenant
one,
you
know,
name
stays
or
whatever
lieutenant
ahn
s
one.
Could
we
take
that
ten
and
eight
and
it's
one
and
migrated
to
a
new
tenant
and
have
both
of
those
tenants
reconcile
and
one
not
think
it
was
deleted
accidentally
and
try
to
recreate
it,
etc?
I
don't
know
if
that
is
I
clear.
The
question
other
sounds
confusing
in
my
hand,
so.
B
Issues
or
you
can
write
comments
on
this
talk
in
Google
Docs
and
the
DNC
code
is
then
open
comments
over
there.
I
think.
A
lot
of
these
questions
have
to
do
with
modification
of
namespace
attributes
after
creation,
which
may
be
a
additional
level
of
problem
that
we
can
differ
for
now.
Perhaps
going
back
to
some
of
the
basic
questions
which
you
see
listed
earlier.
Firstly,
the
naming
right
is
everybody.
B
Is
there
consensus
that
we
should
basically
let
the
creator
of
the
tenant
pick
namespaces
to
begin
with,
and
we
don't
do
the
concatenation
or
do
we
feel
like
we
need
to
do
some
kind
of
versus
what
is
the
feeling
about
making
the
names
unique
within
the
controller
versus
letting
the
creator
of
the
name?
Creator
of
the
tenant
have
the
responsibility
of
picking
unique
names
faces.
I
When
I
really
want
to
echo
that
that
it
would,
they
would
really
really
help
if,
if,
if
the
tenancy
controller
was
was
for
the
main
spaces,
had
the
name
had
the
name
of
the
tenant
prefix
and
then
to
avoid
it.
It's
an
odd
thing,
but
to
avoid
a
security
hole,
you'd
also
need
to
ensure
that
no
one
could
create
a
namespace
that
had
that
same,
that's
kind
of
that
that
had
a
tenant
prefix
without
being
that
tenant.
B
Right
well,
the
one
thing
to
think
about
with
that
is
in.
In
some
cases.
One
would
imagine
that
people
who
been
writing
their
applications
across
multiple
namespaces
have
actually
encoded
the
namespace
names
into
the
application
manifests,
so
they
wouldn't
be
able
to
run
in
an
environment
where
we
have
actually,
you
know
modified.
The
namespace
name
is
by
prefixing
the
tenant
name
into
it.
So.
F
Setting
the
namespaces
in
a
more
dynamic
way
should
be
considered
good
style,
I
would
assume
and
having
the
developer
force.
The
namespace
name
is
something
that
I
would
actually
actively
fight
it's.
It
should
be.
The
last
word
should
be
with
the
cluster
admin
or
somebody
that
has
depth
to
eat.
With
that
responsibility
like
the
tenant
admin.
A
B
So
one
other
possibility
is
again
just
like
you
mentioned
about
the
reconcile
being
optional.
We
could
have
the
namespace
embedding
also
the
optional
meaning
that
when
you're
creating
in
tenant,
you
could
either
say
allow
appending
or
whatever
you
know,
make
make
namespace
unique,
whatever
or
as
essentially
a
flag
during
the
tenant
creation,
or
just
use
the
namespaces
that
the
tenant
creator
provided
without
doing
any
changes,
in
which
case
the
namespace
tenant
creator
has
already
installed.
B
F
E
B
E
We
have
a
global
namespace,
for
example,
like
by
having
a
tenant
name,
say:
shorten
and
/or
:.
On
top
of
that,
there's
no
names
if
there's
a
names,
their
namespaces
not
belong
to
any
tenant.
We
default
put
into
this
or
default
or
global
namespace
to
kind
of
at
least
you
know
distinguish
I'm,
not
sure
how
important
it
is,
but
just
to
just
to
be
safe,
I'm
curious
how
people
think
about
any
alternatives.
Yeah.
H
G
I
think
that
the
tenant
name
stays
this
kind
of
had
to
be
unique
in
any
way
front.
Well,
I
mean
it
if
we
could
lock
down
the
security
of
not
allowing
other
tenants
to
add
or
create
namespaces
under
that,
then
the
network
policies
you
could
use
the
dependent
IDs
to
handle
network
policies
and
and
if
the
the
tenant
ID
is
within
the
namespace,
and
that
means
all
of
the
services,
their
DNS
and
trees
will
have
the
tenant
ID
with
it,
which
I
don't
know.
If
that's
a
good
or
a
bad
thing,.
F
I
think
that's
a
good
thing,
because
we've,
where
I
worked
before
I
built
a
continent
just
Lester,
and
we
had
the
case
of
automatically
deleting
cube
system
because
we've
messed
up
the
configuration
if
the
tenant
name
is
always
rependa
than
that
case.
It's
simply
avoided.
So
we
don't
nuke
the
clusters.
D
C
D
Like
a
cryptographic,
hash,
I,
don't
know
you
just
have
a
set
of
private
keys
that
the
tenant
controller
knows
about
that
are
authorized
to
create
letters
associated
with
tenants
and
then
any
namespaces
that
have
like
an
interpretation
that
has
been
contains.
The
content
of
the
namespace
that's
signed,
or
something
right
with
that
private
key
invalidate.
B
B
B
A
Think
that's
fine
initially,
so
I
was
puzzling
over
the
they're
having
a
list
of
namespaces
in
the
tenant
and
and
the
the
issues
that
can
cause
with
you
know,
editing
the
document
and
dropping
one.
Maybe
the
the
solution
is
to
have
separate
object,
have
a
tenant,
namespace
object,
which
is
a
request
by
a
tenant
for
a
namespace,
and
then
that
document
triggers
the
actual
namespace
creation
and
then
your
decoupled
from
editing
a
single
document.
Every
time
you
want
a
new
object,
a
new
namespace.
A
A
D
B
One
other
thing
to
keep
in
mind
here
is
that
the
namespace
template
contents
are
essentially
completely
open,
meaning
a
namespace
template
is
whatever
whatever
series
of
policies
you
want
to
put
in
there
right,
we
may
have
talked
about
documenting
a
curated
set
of
namespace
templates,
but
that
would
just
be
his
sample
references.
So
really
a
namespace
template
can
be
anything.
Somebody
could
choose
a
namespace
template
based
on
using
pod
security
policies.
Somebody
else
could
choose
a
similar,
namespace
template
but
implemented
using
open
policy
agent.
So
the
actual.
B
C
B
G
I
My
my
thinking
is
documented
references.
You
know
a
reference.
A
reference
or
examples
is
always
really
helpful,
because
sorry
I
always
speak
entirely
from
security
perspective,
but
I
think
a
reference
I
think
reference
or
examples
are
really
really
helpful,
especially
because
without
them,
people
will
use
whatever
they
find
on
Stack,
Overflow
and.
I
B
B
B
K
K
What
are
the
documents
we
have
to
refer
because
I
was
looking
for
the
respect
I
couldn't
able
to
find
it
so
I
just
forget
here
to
find
where
the
documents
all
these
documents
and
one
more
question
is
on
the
resource
quota
right
so
in
the
I
was
just
skimming
through
the
tenancy
RDS,
so
a
tenant
can
be
in
multiple
namespace
or
from
the
resource
Kota.
The
resource
Kota
is
per
namespace
variety.
B
D
C
Additional
with
additional
logic,
which
counts
the
total
number
of
resources
and
there's
even
more
complicated
case
where
you
they
have
different
requirements
on
how
the
tenant
decoder
can
be
split
into
namespaces,
and
sometimes
we
can
move
dynamically
move
some
quota
between
namespaces.
When
some
namespaces
is
our
exhorting
code,
however,
others
still
have
Kota
mm-hmm,
so
that
would
be
a
very
interested
problem
and
require
additional
work.
In
the
admission
my
book
and
also
a
separate
CRE,
okay.