On Wednesday 17 April 2024 08:05:19 PM (+07:00), Waines, Greg wrote: hey there ... thanks for the interest in starlingx. Wrt 'mutli-tenancy' in StarlingX … first question back to you, is whether your question is about StarlingX K8S or StarlingX OpenStack ? If you're talking about StarlingX OpenStack … then I'm sure you know that OpenStack is very strong wrt multi-tenancy throughout all of its services. And there is tons of documentation available on OpenStack multi-tenancy. StarlingX's OpenStack services are vanilla upstream OpenStack services … so all the multi-tenancy features are available. If you're talking about StarlingX K8S … then I suspect you also know that K8S is not as strong on multi-tenancy. StarlingX really has not done anything 'extra' wrt K8S multi-tenancy than what is provided inherently with K8S e.g. Control Plane / API / Access Control K8S Namespace per Tenant can be used as a grouping of pods and resources owned by a particular tenant K8S RBAC Policies for a particular Namespace allows control over what users can access the pods/resources in a namespace … owned by a tenant Resource sharing LimitRanger := enforce min/max resource (cpu, mem, disk) per Pod in namespace, ResourceQuota := limit aggregate resource consumption per namespace Pod Affinity/AntiAffinity := keeps pods scheduled together/apart Pod Priority := pick a winner when there isn’t enough to go around Container Runtime Isolation Kata Container support [NOW] Secure container runtime with lightweight virtual machines, Stronger workload isolation - networking, I/O and memory, Utilizes hardware-enforced isolation with virtualization VT extensions, HOWEVER, a number of restrictions wrt capabilities supported by Kata Containers. Pod Admission Controls can also be used to control access of Tenants’ pods to security-sensitive resources (e.g. host networking, root privileges, etc.) Networking Runtime Isolation K8S CNI Network Policies (Calico with starlingx) can restrict/allow communications between Tenant Namespaces at an L3/L4 granularity Service Meshes (like ‘istio’, integrated as a System Application in starlingx) can restrict/allow communications between Tenant Namespaces at an L7 granularity There are a few potential ways to do multi-tenancy in k8s on starlingx, we have used vcluster, gardener, and kiosk in the past to achieve these to list a few of the other alternatives you have some choice, i would recommend going through the below links to see which fits your requirement best Cluster per tenant model Cluster API <https://www.spectrocloud.com/blog/cluster-api-and-kubernetes-cluster-management> Kamaji <https://github.com/clastix/kamaji> Gardener <https://gardener.cloud/docs/> Palette <https://www.spectrocloud.com/why-palette> using virtual control planes vCluster <https://www.vcluster.com/> Capsule <https://github.com/clastix/capsule> Kiosk <https://github.com/loft-sh/kiosk> We (StarlingX) have had discussions about exploring work being done in the CNCF Working Group on Multi-tenancy, https://github.com/kubernetes-retired/multi-tenancy . i.e. to explore work going on in ‘Virtual Clusters’ project and ‘Hierarchical namespaces’ project. But … DOH … just noticed that this group has been ‘archived’ as of June/2023 . Not sure what happened … will have to look into this. let me know your thoughts on multi-tenancy for starlingx, Greg. -----Original Message----- From: moulayhakim3@yahoo.com <moulayhakim3@yahoo.com> Sent: Tuesday, April 16, 2024 4:13 AM To: starlingx-discuss@lists.starlingx.io Subject: multenancy starlingx version 8 CAUTION: This email comes from a non Wind River email account! Do not click links or open attachments unless you recognize the sender and know the content is safe. I am writing to inquire about the possibility of implementing multitenancy on our StarlingX platform to manage customer spaces and resources more effectively. We are keen on exploring this option to enhance our infrastructure management capabilities and better serve our customers. Could you please provide insights into whether StarlingX supports multitenancy features out-of-the-box? If so, could you also share any resources or documentation available to guide us through the implementation process? Additionally, if multitenancy is not directly supported by StarlingX, are there any recommended plugins or third-party solutions that we could integrate to achieve this functionality? -- Sent with Vivaldi Mail. Download Vivaldi for free at vivaldi.com