mcpField
G
gke-multi-tenancy

gke-multi-tenancy

github.com/googlecloudplatformCloud & DevOps16948 installsUpdated 3d ago
Repository

About gke-multi-tenancy

gke-multi-tenancy guides GKE teams in sharing clusters across tenants while enforcing governance. It focuses on namespace isolation, least-privilege RBAC, quotas, and network policies.

Key features

  1. 01Isolate tenants with namespaces
  2. 02Configure least-privilege RBAC
  3. 03Set resource quotas
  4. 04Use network policies for traffic isolation

Use cases

  1. 01Separate GKE workloads by team
  2. 02Limit user and service-account permissions
  3. 03Prevent one tenant from consuming excess resources

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/googlecloudplatform/gke-mcp --skill gke-multi-tenancy

After installing, type/gke-multi-tenancyin Claude Code to confirm it loaded.

Details

From the project README

GKE Multi-tenancy and Governance

This skill provides guidance on implementing multi-tenancy and governance in Google Kubernetes Engine (GKE) clusters.

Overview

Multi-tenancy allows you to share a single GKE cluster among multiple teams or applications securely. Governance ensures that policies and resource limits are enforced.

Workflows

1. Create Namespaces for Isolation

Namespaces provide a scope for names and are the primary unit of isolation in Kubernetes.

Steps:

  1. Create a namespace for each tenant.

Example Namespace Manifest:

apiVersion: v1
kind: Namespace
metadata:
  name: tenant-a
  labels:
    team: alpha
2. Configure RBAC for Least Privilege

Role-Based Access Control (RBAC) allows you to control who has access to what resources within a namespace.

Steps:

  1. Define a Role with specific permissions.
  2. Bind the Role to a user or group using a RoleBinding.

Example Role and RoleBinding Manifest:

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: tenant-a
  name: pod-reader
rules:
  - apiGroups: [""] # "" indicates the core API group
    resources: ["pods"]
    verbs: ["get", "watch", "list"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: read-pods
  namespace: tenant-a
subjects:
  - kind: User
    name: [email protected] # Name is case sensitive
    apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: Role
  name: pod-reader
  apiGroup: rbac.authorization.k8s.io
3. Enforce Resource Quotas

Resource quotas prevent a single tenant from consuming all resources in the cluster.

Example ResourceQuota Manifest:

apiVersion: v1
kind: ResourceQuota
metadata:
  name: tenant-a-quota
  namespace: tenant-a
spec:
  hard:
    requests.cpu: "2"
    requests.memory: 4Gi
    limits.cpu: "4"
    limits.memory: 8Gi

Best Practices

  1. Namespace Per Tenant: Always use separate namespaces for different teams or applications.
  2. Least Privilege RBAC: Grant only the permissions necessary for users and service accounts to do their jobs.
  3. Enforce Quotas: Use Resource Quotas to ensure fair sharing of cluster resources.
  4. Network Policies: Combine namespaces with Network Policies (see gke-workload-security) to restrict cross-tenant traffic.

Comments

Markdown supported