Back to Details

gke-multitenancy

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

GKE Multi-Tenancy

GKE 多租户

This reference covers enterprise multi-tenancy patterns on GKE, including namespace isolation, RBAC planning, resource quotas, and network segmentation.
MCP Tools: 
apply_k8s_manifest
, 
get_k8s_resource
, 
check_k8s_auth
, 
describe_k8s_resource
, 
delete_k8s_resource
本参考文档涵盖了GKE上的企业级多租户模式，包括命名空间隔离、RBAC规划、资源配额和网络分段。
MCP 工具： 
apply_k8s_manifest
, 
get_k8s_resource
, 
check_k8s_auth
, 
describe_k8s_resource
, 
delete_k8s_resource

When to Use

使用场景

  • Multiple teams sharing a single GKE cluster
  • Isolating workloads by environment (dev/staging/prod) within one cluster
  • Implementing least-privilege access control
  • Cost allocation across teams or projects
  • 多个团队共享单个GKE集群
  • 在一个集群内按环境（开发/预发布/生产）隔离工作负载
  • 实现最小权限访问控制
  • 跨团队或项目进行成本分配

Multi-Tenancy Models

多租户模式

ModelIsolationComplexityCost
Namespace-per-teamSoft (RBAC +LowLowest (shared
: : Network : : cluster) :
: : Policy) : : :
Namespace-per-environmentSoftLowLow
Node pool-per-teamMediumMediumMedium
: : (dedicated : : :
: : compute) : : :
Cluster-per-teamHard (fullHighHighest
: : isolation) : : :
Golden path recommendation: Start with namespace-per-team for cost efficiency. Escalate to stronger isolation only when compliance requires it.
模式隔离度复杂度成本
按团队划分命名空间软隔离（RBAC +低最低（共享集群）
: : 网络策略） : : :
: : : : :
按环境划分命名空间软隔离低低
按团队划分节点池中等隔离（专用计算资源）中等中等
: : : : :
: : : : :
按团队划分集群硬隔离（完全隔离）高最高
: : : : :
: : : : :
推荐最佳路径：为了成本效益，从按团队划分命名空间开始。仅当合规要求时，才升级到更强的隔离模式。

Namespace Isolation Setup

命名空间隔离设置

1. Create Namespaces

1. 创建命名空间

bash
kubectl create namespace team-a
kubectl create namespace team-b
kubectl label namespace team-a team=a
kubectl label namespace team-b team=b
bash
kubectl create namespace team-a
kubectl create namespace team-b
kubectl label namespace team-a team=a
kubectl label namespace team-b team=b

2. RBAC Configuration

2. RBAC 配置

Principle: Grant minimal permissions per namespace. Never bind to 
system:authenticated
.
yaml
undefined
原则：为每个命名空间授予最小权限。切勿绑定到
system:authenticated
。
yaml
undefined

Namespace-scoped role for a team

团队的命名空间级角色

apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: team-a-developer namespace: team-a rules:
  • apiGroups: ["", "apps", "batch"] resources: ["pods", "deployments", "services", "configmaps", "jobs"] verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: team-a-developers namespace: team-a subjects:
  • kind: Group name: "team-a@example.com" # Google Group apiGroup: rbac.authorization.k8s.io roleRef: kind: Role name: team-a-developer apiGroup: rbac.authorization.k8s.io

**RBAC best practices:** Use Google Groups for subject bindings. Prefer
namespace-scoped Roles over ClusterRoles. See the `gke-security` skill for full
RBAC hardening guidance.
apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: team-a-developer namespace: team-a rules:
  • apiGroups: ["", "apps", "batch"] resources: ["pods", "deployments", "services", "configmaps", "jobs"] verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: team-a-developers namespace: team-a subjects:
  • kind: Group name: "team-a@example.com" # Google 群组 apiGroup: rbac.authorization.k8s.io roleRef: kind: Role name: team-a-developer apiGroup: rbac.authorization.k8s.io

**RBAC 最佳实践**：使用Google群组作为主题绑定。优先选择命名空间级Role而非ClusterRole。有关完整的RBAC强化指南，请参阅`gke-security`技能。

3. Resource Quotas

3. 资源配额

Prevent any single team from consuming all cluster resources:
yaml
apiVersion: v1
kind: ResourceQuota
metadata:
  name: team-a-quota
  namespace: team-a
spec:
  hard:
    requests.cpu: "10"
    requests.memory: "20Gi"
    limits.cpu: "20"
    limits.memory: "40Gi"
    pods: "50"
    services: "10"
    persistentvolumeclaims: "10"
防止单个团队消耗所有集群资源：
yaml
apiVersion: v1
kind: ResourceQuota
metadata:
  name: team-a-quota
  namespace: team-a
spec:
  hard:
    requests.cpu: "10"
    requests.memory: "20Gi"
    limits.cpu: "20"
    limits.memory: "40Gi"
    pods: "50"
    services: "10"
    persistentvolumeclaims: "10"

4. LimitRanges

4. LimitRanges

Set default and maximum resource constraints per container:
yaml
apiVersion: v1
kind: LimitRange
metadata:
  name: team-a-limits
  namespace: team-a
spec:
  limits:
  - type: Container
    default:
      cpu: "500m"
      memory: "512Mi"
    defaultRequest:
      cpu: "100m"
      memory: "128Mi"
    max:
      cpu: "4"
      memory: "8Gi"
[!IMPORTANT] Mandatory Defaults: When defining 
min
or 
max
limits in a 
LimitRange
, you must also define corresponding 
default
and 
defaultRequest
values. If you set a 
min
or 
max
without defaults, any pod deployed without explicit resource requests/limits will be rejected by the admission controller.
为每个容器设置默认和最大资源约束：
yaml
apiVersion: v1
kind: LimitRange
metadata:
  name: team-a-limits
  namespace: team-a
spec:
  limits:
  - type: Container
    default:
      cpu: "500m"
      memory: "512Mi"
    defaultRequest:
      cpu: "100m"
      memory: "128Mi"
    max:
      cpu: "4"
      memory: "8Gi"
[!IMPORTANT] 强制默认值：在
LimitRange
中定义
min
或
max
限制时，您必须同时定义对应的
default
和
defaultRequest
值。如果您设置了
min
或
max
但未设置默认值，任何未明确指定资源请求/限制的Pod都会被准入控制器拒绝。

5. Network Isolation

5. 网络隔离

Apply default-deny per namespace (see the 
gke-security
skill), then allow intra-team traffic:
yaml
undefined
为每个命名空间应用默认拒绝策略（请参阅
gke-security
技能），然后允许团队内部流量：
yaml
undefined

Allow same-namespace pods to talk + DNS

允许同一命名空间内的Pod通信 + DNS

apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: allow-same-namespace namespace: team-a spec: podSelector: {} ingress:
  • from:
    • podSelector: {} egress:
  • to:
    • podSelector: {}
  • to: # Allow DNS
    • namespaceSelector: {} podSelector: matchLabels: k8s-app: kube-dns ports:
    • protocol: UDP port: 53
undefined
apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: allow-same-namespace namespace: team-a spec: podSelector: {} ingress:
  • from:
    • podSelector: {} egress:
  • to:
    • podSelector: {}
  • to: # 允许DNS
    • namespaceSelector: {} podSelector: matchLabels: k8s-app: kube-dns ports:
    • protocol: UDP port: 53
undefined

Cost Allocation

成本分配

Labels for Cost Attribution

用于成本归因的标签

bash
undefined
bash
undefined

Label namespaces for billing

为命名空间添加计费标签

kubectl label namespace team-a cost-center=engineering kubectl label namespace team-b cost-center=data-science
undefined
kubectl label namespace team-a cost-center=engineering kubectl label namespace team-b cost-center=data-science
undefined

GKE Cost Allocation

GKE 成本分配

Enable GKE cost allocation to break down costs by namespace and label:
bash
gcloud container clusters update <CLUSTER_NAME> --region <REGION> \
  --enable-cost-allocation
View in Cloud Billing > GKE Cost Allocation.
启用GKE成本分配功能，按命名空间和标签细分成本：
bash
gcloud container clusters update <CLUSTER_NAME> --region <REGION> \
  --enable-cost-allocation
在Cloud Billing > GKE成本分配中查看。