[EPIC] - Tenant Isolation #876
Description
Description
Isolation between organizations is done via Kubernetes namespaces in the Greenhouse cluster.
This imposes difficulties:
- CRDs cannot be upgraded for individual organizations but for the whole cluster
- Organizations do not have full permissions on Workload resources in their namespace
- Greenhouse RBAC uses mapped subjects, which may not be unique between org namespaces
- Workload running in central cluster may be misconfigured & resources intensive
The ADR cloudoperators/documentation#1 started the discussion and should be considered.
Objectives
- ADR
- ... tdb
Acceptance Criteria
- Criterion 1
- Criterion 2
- Criterion 3
Dependencies
- Dependency 1
- Dependency 2
- Dependency 3
Additioinal Notes
No response