Namespace-per-Team

Namespace-per-Team An architecture diagram generated by Archify. Team A · group: team-a-admins · Teams (SSO groups) Team A group: team-a-admins Team B · group: team-b-admins · Teams (SSO groups) Team B group: team-b-admins Platform Team · group: myorg:platform-team · Teams (SSO groups) Platform Team group: myorg:platform-team Project: team-a · sourceRepos: team-a-* · ArgoCD · AppProject Project: team-a sourceRepos: team-a-* Project: team-b · sourceRepos: team-b-* · ArgoCD · AppProject Project: team-b sourceRepos: team-b-* Project: platform · cluster-wide resources allowed · ArgoCD · AppProject Project: platform cluster-wide resources allowed Namespace: team-a · allowed deployment scope · Namespaces on allowed clusters Namespace: team-a allowed deployment scope Namespace: team-b · allowed deployment scope · Namespaces on allowed clusters Namespace: team-b allowed deployment scope monitoring · logging · shared platform namespaces · Namespaces on allowed clusters monitoring · logging shared platform namespaces app role app role app role can deploy to can deploy to can deploy to Teams (SSO groups) ArgoCD · AppProject Namespaces on allowed clusters Legend Namespace scope AppProject SSO group

What an AppProject does

  • • Groups Applications logically
  • • Restricts source repos, target clusters/namespaces, and resource kinds
  • • Defines project-specific roles and permissions

Additional isolation controls

  • • Platform administrators pre-provision namespaces
  • • Kubernetes RBAC, Pod Security, NetworkPolicy and quotas are separate