Organize Kubernetes resources into namespaces

martinothamar commented 5 months ago

Status

Accepted - 19.09.2025

Decision

We should always follow best practices for Kubernetes namespaces.

To be concrete, this means:

All clusters
- A namespace per infrastructure component (this is already partially in place) Examples are Traefik ingress, linkerd, monitoring stack (these are already namespaced)
Apps clusters
- A namespace per application (app) in the apps clusters
- KubernetesWrapper should be in its own namespace
- Other applications, like PDF generator, Gitea Actions runners, Grafana, etc. should also be in separate namespace
Platform clusters
- A namespace per product

Context

While working on Maskinporten integration and automation in Altinn 3, we also discussed more general improvements around resource organisation in app clusters. This was something that had been discussed before in the Platform team.

Currently most resources are located in the default namespace of our clusters. Namespaces are practical in applying separation at various levels

Logical - it would be more practical to see all config per app/product if there was 1 namespace per app/product
Network - network policies typically use namespace as part of selectors
RBAC - namespace is typically used as the anchoring for applying access control rules Role vs ClusterRole

Consequences

Easier/possible to apply separation and isolation between workloads and configuration
Need -A or similar to make cross-app queries and similar
Service discovery/DNS resolution between apps changes - svc.cluster.local -> namespace.svc.cluster.local

martinothamar commented 5 months ago

cc @sduranc @bengtfredh - it's been a little while since we talked about this, but we agreed that I would post an ADR so here we are 😄 feel free to correct and/or rewrite as needed