K8s - how do I get seperate namespace for each department?

DevOps Kubernetes
#1

Hi all, currently I’m running as IT administrator in my company.
I have requirements regarding k8s is that
• Have to seperate namespace for each department
• Dont allow users / tenant to see or run query again master nodes for example like kubectl get nodes - should hide the master
Any thoughts how to do this especially no 2? Tried many things but don’t work. Thanks

#2

You just use standard rbac here. Tenant users should only have Roles which grant permission to things in their namespace. A node is not a namespaced resource

#3

Thanks for no 1 . But yes, i’m having trouble with no 2. I’m thinking about changing the source code, but that will be much effort

#4

You don’t want them to run commands against nodes like kubectl get nodes then don’t grant them permission to non-Namespaced resources like nodes.

#5

This is all standard RBAC built into Kubernetes.

#6

And why are you responding from two different accounts?

#7

Because my departement is responsible for the kubernetes infra and the others only using it.

#8

Noted for this. Let me check this one. Thanks for the answer