CertGrid CertGrid
Hands-on Lab·Certified Kubernetes Security Specialist

Namespace Isolation for Multi-Tenancy

A namespace separates names and nothing else. This guide builds the six objects that turn one into a boundary, proves each of them from the outside and the inside, and finishes on the thing no combination of Kubernetes objects will separate.

Microservice Vulnerabilities Guide 22 of 40 Advanced

Written against the versions above. Every object here is standard Kubernetes - no operator, no policy engine and nothing installed. This is the template a platform team applies to every new tenant.

The cka6001 cluster: one control plane and 2 schedulable workers, on Cilium.
Server NameIP AddressOSRolesCPURAMHDD
CKA6001192.168.0.46Ubuntu 26.04 LTSControl Plane Node (tainted NoSchedule)2 Core4 GB50 GB
CKA6001-NODE01192.168.0.47Ubuntu 26.04 LTSWorker Node2 Core4 GB50 GB
CKA6001-NODE02192.168.0.48Ubuntu 26.04 LTSWorker Node2 Core4 GB50 GB

Before you start

  1. A namespace is not a boundary until you make it one

  2. The six objects that make one

  3. Test the boundary from both directions

  4. What a namespace still cannot separate

Official sources