[Starlingx-discuss] User feedback and questions

[Ildiko Vancsa]

Hi Greg,

Thank you for the clarifications.

Please see a few more notes in line.

Best Regards,
Ildikó

———

Ildikó Váncsa
Director of Community
Open Infrastructure Foundation





> […]
>  
> * Feedback and questions so far
>   - As they have been looking into the platform, they didn’t seem to be able to find the level of multi-tenancy that they needed
>     + Does the platform support multiple tenants within one Kubernetes cluster and one StarlingX instance? Is there any documentation that describes the available tenant and user configurations within StarlingX?
> [Greg]
> In the context of StarlingX infrastructure management, there is absolutely no multiple tenant support.  
> There is one, and only one, tenant that manages the hosts and the services that make up the StarlingX Bare Metal Infrastructure Management.
>  
> In the context of the StarlingX Kubernetes cluster, … sort of, but nothing more than vanilla K8S gives you …
> 	• there is some documentation on how you can manage non-admin type k8s users, and groups of k8s users, in different namespaces, with restricted RBAC, restricted security policies and restricted resource management, etc. ( https://docs.starlingx.io/security/kubernetes/index-security-kub-81153c1254c3.html#manage-non-admin-type-users )
> 	• … all using common K8S mechanisms
> 	• … sort of a very soft multi-tenancy
> 	• … but we have not done anything else
> 	• areas that we would LIKE to look into for kubernetes multi-tenancy is to basically look at the projects under the Kubernetes Working Group for Multi-Tenancy ( https://github.com/kubernetes-sigs/multi-tenancy/   ), e.g.
> 	• Benchmarks: a set of benchmarks (i.e., compliance tests) to determine if your clusters are well-configured for multitenancy.
> 	• Hierararchical namespaces (aka HNC): allows namespaces to own each other, policy propagation between related namespaces, and delegated namespace creation. 
> 	• Virtual clusters: run multiple virtualized cluster on a single underlying cluster, allowing for hard(er) multitenancy.

[Ildiko]

I understand the infrastructure management constraints.

When it comes to Kubernetes, is there a way to utilize the multi-tenancy concept from OpenStack, without running the Kubernetes pieces and containers in virtual machines?

>   - The networking setup has been hard to figure out for StarlingX, they found that it's not very well documented.
>     + Is it in the roadmap to document the networking setup for StarlingX with more details?
>     + Would it be possible to automate the creation of networks for the platform? Especially for the virtual deployment option, since that is most commonly deployed by new users, who are evaluating the platform.
> [Greg]
> Would be interesting to have a discussion with them to understand their difficulty in understanding the platform networks.
> I.e. I’m assuming it is the ‘platform’ networks that they are having trouble understanding … i.e. https://docs.starlingx.io/_images/starlingx-deployment-options-controller-storage.png

[Ildiko]

We haven’t gone into deep details on this topic. They also had an intern working on setting StarlingX up, who might’v had less overall experience in networking that could’ve contributed to some of the challenges. Networking related questions are common on IRC too, so it is definitely an area that can benefit from more examples for people who are less experienced.

> […]