gke-multitenancy

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

GKE Multi-Tenancy

GKE 多租户

This reference covers enterprise multi-tenancy patterns on GKE, including namespace isolation, RBAC planning, resource quotas, and network segmentation.

MCP Tools:

apply_k8s_manifest

get_k8s_resource

check_k8s_auth

describe_k8s_resource

delete_k8s_resource

本参考文档涵盖了GKE上的企业级多租户模式，包括命名空间隔离、RBAC规划、资源配额和网络分段。

MCP 工具：

apply_k8s_manifest

get_k8s_resource

check_k8s_auth

describe_k8s_resource

delete_k8s_resource

When to Use

使用场景

Multiple teams sharing a single GKE cluster
Isolating workloads by environment (dev/staging/prod) within one cluster
Implementing least-privilege access control
Cost allocation across teams or projects

多个团队共享单个GKE集群
在一个集群内按环境（开发/预发布/生产）隔离工作负载
实现最小权限访问控制
跨团队或项目进行成本分配

Multi-Tenancy Models

多租户模式

Model	Isolation	Complexity	Cost
Namespace-per-team	Soft (RBAC +	Low	Lowest (shared
: : Network : : cluster) :
: : Policy) : : :
Namespace-per-environment	Soft	Low	Low
Node pool-per-team	Medium	Medium	Medium
: : (dedicated : : :
: : compute) : : :
Cluster-per-team	Hard (full	High	Highest
: : isolation) : : :

Golden path recommendation: Start with namespace-per-team for cost efficiency. Escalate to stronger isolation only when compliance requires it.

模式	隔离度	复杂度	成本
按团队划分命名空间	软隔离（RBAC +	低	最低（共享集群）
: : 网络策略） : : :
: : : : :
按环境划分命名空间	软隔离	低	低
按团队划分节点池	中等隔离（专用计算资源）	中等	中等
: : : : :
: : : : :
按团队划分集群	硬隔离（完全隔离）	高	最高
: : : : :
: : : : :

推荐最佳路径：为了成本效益，从按团队划分命名空间开始。仅当合规要求时，才升级到更强的隔离模式。

Namespace Isolation Setup

命名空间隔离设置

1. Create Namespaces

1. 创建命名空间

bash

kubectl create namespace team-a
kubectl create namespace team-b
kubectl label namespace team-a team=a
kubectl label namespace team-b team=b

bash

kubectl create namespace team-a
kubectl create namespace team-b
kubectl label namespace team-a team=a
kubectl label namespace team-b team=b

2. RBAC Configuration

2. RBAC 配置

Principle: Grant minimal permissions per namespace. Never bind to

system:authenticated

yaml

undefined

原则：为每个命名空间授予最小权限。切勿绑定到

system:authenticated

。

yaml

undefined

Namespace-scoped role for a team

团队的命名空间级角色

apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: team-a-developer namespace: team-a rules:

apiGroups: ["", "apps", "batch"] resources: ["pods", "deployments", "services", "configmaps", "jobs"] verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]

apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: team-a-developers namespace: team-a subjects:

kind: Group name: "team-a@example.com" # Google Group apiGroup: rbac.authorization.k8s.io roleRef: kind: Role name: team-a-developer apiGroup: rbac.authorization.k8s.io


**RBAC best practices:** Use Google Groups for subject bindings. Prefer
namespace-scoped Roles over ClusterRoles. See the `gke-security` skill for full
RBAC hardening guidance.

apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: team-a-developer namespace: team-a rules:

apiGroups: ["", "apps", "batch"] resources: ["pods", "deployments", "services", "configmaps", "jobs"] verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]

apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: team-a-developers namespace: team-a subjects:

kind: Group name: "team-a@example.com" # Google 群组 apiGroup: rbac.authorization.k8s.io roleRef: kind: Role name: team-a-developer apiGroup: rbac.authorization.k8s.io


**RBAC 最佳实践**：使用Google群组作为主题绑定。优先选择命名空间级Role而非ClusterRole。有关完整的RBAC强化指南，请参阅`gke-security`技能。

3. Resource Quotas

3. 资源配额

Prevent any single team from consuming all cluster resources:

yaml

apiVersion: v1
kind: ResourceQuota
metadata:
  name: team-a-quota
  namespace: team-a
spec:
  hard:
    requests.cpu: "10"
    requests.memory: "20Gi"
    limits.cpu: "20"
    limits.memory: "40Gi"
    pods: "50"
    services: "10"
    persistentvolumeclaims: "10"

防止单个团队消耗所有集群资源：

yaml

apiVersion: v1
kind: ResourceQuota
metadata:
  name: team-a-quota
  namespace: team-a
spec:
  hard:
    requests.cpu: "10"
    requests.memory: "20Gi"
    limits.cpu: "20"
    limits.memory: "40Gi"
    pods: "50"
    services: "10"
    persistentvolumeclaims: "10"

4. LimitRanges

Set default and maximum resource constraints per container:

yaml

apiVersion: v1
kind: LimitRange
metadata:
  name: team-a-limits
  namespace: team-a
spec:
  limits:
  - type: Container
    default:
      cpu: "500m"
      memory: "512Mi"
    defaultRequest:
      cpu: "100m"
      memory: "128Mi"
    max:
      cpu: "4"
      memory: "8Gi"

[!IMPORTANT] Mandatory Defaults: When defining
min
or
max
limits in a
LimitRange
, you must also define corresponding
default
and
defaultRequest
values. If you set a
min
or
max
without defaults, any pod deployed without explicit resource requests/limits will be rejected by the admission controller.

为每个容器设置默认和最大资源约束：

yaml

apiVersion: v1
kind: LimitRange
metadata:
  name: team-a-limits
  namespace: team-a
spec:
  limits:
  - type: Container
    default:
      cpu: "500m"
      memory: "512Mi"
    defaultRequest:
      cpu: "100m"
      memory: "128Mi"
    max:
      cpu: "4"
      memory: "8Gi"

[!IMPORTANT] 强制默认值：在
LimitRange
中定义
min
或
max
限制时，您必须同时定义对应的
default
和
defaultRequest
值。如果您设置了
min
或
max
但未设置默认值，任何未明确指定资源请求/限制的Pod都会被准入控制器拒绝。

5. Network Isolation

5. 网络隔离

Apply default-deny per namespace (see the

gke-security

skill), then allow intra-team traffic:

yaml

undefined

为每个命名空间应用默认拒绝策略（请参阅

gke-security

技能），然后允许团队内部流量：

yaml

undefined

Allow same-namespace pods to talk + DNS

允许同一命名空间内的Pod通信 + DNS

apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: allow-same-namespace namespace: team-a spec: podSelector: {} ingress:

from:
- podSelector: {} egress:
to:
- podSelector: {}
to: # Allow DNS
- namespaceSelector: {} podSelector: matchLabels: k8s-app: kube-dns ports:
- protocol: UDP port: 53

undefined

apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: allow-same-namespace namespace: team-a spec: podSelector: {} ingress:

from:
- podSelector: {} egress:
to:
- podSelector: {}
to: # 允许DNS
- namespaceSelector: {} podSelector: matchLabels: k8s-app: kube-dns ports:
- protocol: UDP port: 53

undefined

Cost Allocation

成本分配

Labels for Cost Attribution

用于成本归因的标签

bash

undefined

bash

undefined

Label namespaces for billing

为命名空间添加计费标签

kubectl label namespace team-a cost-center=engineering kubectl label namespace team-b cost-center=data-science

undefined

kubectl label namespace team-a cost-center=engineering kubectl label namespace team-b cost-center=data-science

undefined

GKE Cost Allocation

GKE 成本分配

Enable GKE cost allocation to break down costs by namespace and label:

bash

gcloud container clusters update <CLUSTER_NAME> --region <REGION> \
  --enable-cost-allocation

View in Cloud Billing > GKE Cost Allocation.

启用GKE成本分配功能，按命名空间和标签细分成本：

bash

gcloud container clusters update <CLUSTER_NAME> --region <REGION> \
  --enable-cost-allocation

在Cloud Billing > GKE成本分配中查看。