Projects and multi-tenancy

Overview

One of the key challenges for implementing fleet management throughout an enterprise is balancing the competing concerns of gaining single-pane-of-glass management over your Kubernetes estate across multiple organizations or lines of business, and adhering to principals of least privilege and other security best practices that can easily be thrown by the wayside in implementing that degree of automation. In particular, these main concerns need to be satisfied to confidently implement fleet management:

1. Owners of a subset of resources cannot edit resources outside their domain
2. There is no single-store of credentials for the entire fleet (if one cluster is compromised that doesn't imply the entire enterprise is then compromised)
3. It is still seamless to create, destroy, and update any cluster within the fleet and maintain line-of-sight into what's running within them.

Plural allows you to maintain all three of these core concerns using a number of clever constructs, namely Projects (for segmenting resources w/in Plural under specific sets of bound policies), NamespaceCredentials for overriding the resources reconciled by our operator to specific configured credentials (making sure GitOps doesn't become implicit God-mode), and ServiceAccount which allows you to quickly provision assumable bot-accounts like Kubernetes service accounts which can then be fed into Terraform Stacks or NamespaceCredentials to seamlessly bound permissions throughout the system.

TLDR

If you would rather just see a live demo, feel free to browse the video below, it will go over this in the context of a working example in full detail:

Setup

The core of how tenancy is managed at scale is via Projects. An example of how this can be set up is below:

apiVersion: v1
kind: Namespace
metadata:
  name: gke-fleet
---
apiVersion: deployments.plural.sh/v1alpha1
kind: ServiceAccount
metadata:
  name: gke-fleet
spec:
  email: gke-fleet-fleet@plural.sh
  tokenSecretRef:
    name: gke-fleet-sa-token
    namespace: gke-fleet
---
apiVersion: deployments.plural.sh/v1alpha1
kind: Project
metadata:
  name: gke-fleet
  annotations:
    config.kubernetes.io/depends-on: deployments.plural.sh/ServiceAccount/gke-fleet
spec:
  name: gke-fleet
  description: resources for managing the gke-fleet fleet
  bindings:
    write:
    - userEmail: gke-fleet-fleet@plural.sh
---
apiVersion: deployments.plural.sh/v1alpha1
kind: NamespaceCredentials
metadata:
  name: gke-fleet
spec:
  namespaces:
  - gke-fleet
  secretRef:
    name: gke-fleet-sa-token
    namespace: gke-fleet