Accurate

Accurate is a Kubernetes controller for soft multi-tenancy environments.

Accurate resembles Hierarchical Namespace Controller (HNC). It propagates resources between namespaces and allows tenant users to create/delete sub-namespaces.

Features

• Resource propagation between namespaces
  • Any namespace-scoped resource can be propagated.
  • ⚠️ Generated resources can be automatically checked and propagated. (DEPRECATED)
• Inheriting labels and annotations from parent namespaces
• Template namespaces
• SubNamespace custom resource for tenant users
• kubectl plugin

Comparison to Hierarchical Namespace Controller (HNC)

Both Accurate and HNC aim the same goal -- to provide better namespace usability on soft multi-tenancy Kubernetes environments.

Accurate is more accurate than HNC in propagating resources because Accurate adopts an opt-in manner while HNC adopts an opt-out manner. With Accurate, only resources annotated with accurate.cybozu.com/propagate will be propagated. With HNC, all resources will be propagated except for ones that are specially annotated.

Suppose you want to propagate only a Secret for pulling private images. With HNC, this can be quite difficult because Secrets are often generated from another resource. Such generated Secrets are often not possible to have custom annotations. As a consequence, such Secrets would be propagated to sub-namespaces, which may cause security problems.

There are many other differences between Accurate and HNC. Please check them in the documentation.

Demo

Run and try Accurate on a kind (Kubernetes-In-Docker) cluster as follows:

1. Prepare a Linux box running Docker.

2. Checkout this repository.

   $ git clone https://github.com/cybozu-go/accurate

3. Install aqua.

   $ go install github.com/aquaproj/aqua/v2/cmd/aqua@latest

   cf. https://aquaproj.github.io/docs/install

4. Go to e2e directory, setup shell variables, and execute make start.

   $ cd e2e
   $ PATH=$(cd ..; pwd)/bin:$PATH
   $ KUBECONFIG=$(pwd)/.kubeconfig
   $ export KUBECONFIG
   $ make start

5. Create a root namespace and a sub-namespace using kubectl accurate.

   $ kubectl create ns root1
   $ kubectl accurate ns set-type root1 root
   $ kubectl accurate sub create sub1 root1
   $ kubectl accurate list
   $ kubectl accurate ns describe root1
   $ kubectl accurate ns describe sub1

6. Create a Secret in root1 and see it will be propagated to sub1.

   $ kubectl -n root1 create secret generic s1 --from-literal=foo=bar
   $ kubectl -n root1 annotate secrets s1 accurate.cybozu.com/propagate=update
   $ sleep 1
   $ kubectl -n sub1 get secrets

7. Stop the kind cluster.

   $ make stop

Documentation

Read the documentation at https://cybozu-go.github.io/accurate/ .