[EPIC] - Tenant Isolation

[IvoGoman]

Description

Isolation between organizations is done via Kubernetes namespaces in the Greenhouse cluster.

This imposes difficulties:

• CRDs cannot be upgraded for individual organizations but for the whole cluster
• Organizations do not have full permissions on Workload resources in their namespace
• Greenhouse RBAC uses mapped subjects, which may not be unique between org namespaces
• Workload running in central cluster may be misconfigured & resources intensive

The ADR cloudoperators/documentation#1 started the discussion and should be considered.

Objectives

• ADR
• ... tdb

Acceptance Criteria

• Criterion 1
• Criterion 2
• Criterion 3

Dependencies

• Dependency 1
• Dependency 2
• Dependency 3

Additioinal Notes

No response

[github-actions]

This issue is stale because it has been open for 90 days with no activity.