This repository provides a foundational structure and guidance for managing multi-tenant Kubernetes clusters using Flux v2. It targets platform administrators and tenant developers, enabling automated, GitOps-driven application deployment and lifecycle management for isolated tenant environments.

How It Works

The solution leverages Flux v2's GitOps capabilities to manage both cluster-wide infrastructure and tenant-specific deployments. A platform admin repository defines cluster configurations, infrastructure components (like Kyverno for policy enforcement), and tenant onboarding manifests. Tenant repositories contain application manifests, managed by Flux via GitRepository and Kustomization resources. Key to multi-tenancy is the use of dedicated service accounts and role bindings for each tenant, enforced by Flux's lockdown features and optional Kyverno policies to restrict cross-namespace references and remote Kustomize bases.

Quick Start & Requirements

• Install Flux CLI: Follow official Flux documentation.
• Prerequisites: kubectl, Git, GitHub account, and a Kubernetes cluster.
• Bootstrap: Use flux bootstrap github command, pointing to your forked repository and cluster context. Example: flux bootstrap github --context=your-staging-context --owner=${GITHUB_USER} --repository=${GITHUB_REPO} --branch=main --personal --path=clusters/staging.
• Tenant Onboarding: Utilize flux create tenant and flux create source git/kustomization commands to define tenant resources.
• Private Repositories: Requires Mozilla SOPS for encrypting credentials (SSH keys, tokens) stored in Git.
• Demo: The README includes steps to deploy a sample podinfo application.
• CI Testing: Includes GitHub Actions workflows for manifest validation (kubeconform) and end-to-end testing with Kind.

Highlighted Details

• Tenant Isolation: Implements control-plane level lockdown features to prevent cross-namespace references and restrict remote Kustomize bases.
• Policy Enforcement: Integrates with Kyverno for advanced policies, such as verifying Flux image provenance and restricting Git repository sources.
• Secret Management: Supports secure handling of private repository credentials using SOPS encryption for Git secrets.
• Reconciliation Hierarchy: Defines explicit dependencies between infrastructure components (e.g., Kyverno) and tenant workloads using Flux's dependsOn feature.

Maintenance & Community

This repository is part of the Flux project, a CNCF graduated project. Development is driven by the Flux community. Further details on community channels and roadmaps can be found on the main FluxCD website.

Licensing & Compatibility

The project is licensed under the Apache License 2.0. This permissive license allows for commercial use and integration with closed-source applications.

Limitations & Caveats

The provided setup assumes a specific Git repository structure and relies heavily on Flux v2's core controllers. While it offers robust multi-tenancy features, platform administrators must carefully configure service account permissions and potentially implement additional validation webhooks (e.g., via Kyverno or OPA Gatekeeper) to enforce mandatory serviceAccountName fields for tenant resources.