Multi-Tenancy Configuration for Flux v2

[vijayansarathy]

Hi,
When we use the CLI command flux create tenant to generate RBAC manifests for tenant isolation, it generates RBAC settings for a ServiceAccount named <NAMESPACE> and a Kubernetes User named gotk:<NAMESPACE>:reconciler. In the proposal on Multi-Tenancy Strategies, it says that the reconciliation will run under the User gotk:<NAMESPACE>:reconciler. However, I see that only the ServiceAccount is referenced in the spec.serviceAccountName field of a Kustomization resource. Is the User not impersonated at all during the reconciliation step? Just trying to better understand how things work under the hood.
Thanks,
Viji

[stefanprodan]

The User is there to facilitate the work on that proposal, but it's not used by Flux in any way. Currently the impersonation works only for service accounts, see https://github.com/fluxcd/flux2-multi-tenancy

[vijayansarathy]

Thanks for the clarification. I have been to get multi-tenancy working well based on the steps outlined in https://github.com/fluxcd/flux2-multi-tenancy. I was wondering about how one would go about setting this up so that each tenant is allowed access to deploy to a set of namespaces. I suppose impersonating a User during reconciliation would work as it is not scoped to a namespace. But, I will still have to create GitRepository and Kustomization resources per each namespace, correct?

[stefanprodan]

I suppose impersonating a User during reconciliation would work as it is not scoped to a namespace.

The scope is defined by a role binding which is a namespaced object.

I was wondering about how one would go about setting this up so that each tenant is allowed access to deploy to a set of namespaces.

Add a new binding that grants access to a tenant service account to all namespaces that it needs to manage.