Organize Kubernetes resources into namespaces in app clusters

[martinothamar]

Status

Proposed

Context

While working on Maskinporten integration and automation in Altinn 3, we also discussed more general improvements around resource organisation in app clusters. This was something that had been discussed before in the Platform team.

Currently most resources are located in the default namespace of the app clusters. Namespaces are practical in applying separation at various levels

• Logical - it would be more practical to see all config per app if there was 1 namespace per app
• Network - network policies typically use namespace as part of selectors
• RBAC - namespace is typically used as the anchoring for applying access control rules Role vs ClusterRole

Decision

We suggest that there is a namespace

• Per Altinn application
• Per infrastructure component (this is already partially in place)
  • Examples are Traefik ingress, linkerd, monitoring stack (these are already namespaced)
  • kuberneteswrapper could be in its' own namespace

Consequences

• Easier/possible to apply separation and isolation between workloads and configuration
• Need -A or similar to make cross-app queries and similar
• Service discovery/DNS resolution between apps changes - svc.cluster.local -> namespace.svc.cluster.local

[martinothamar]

cc @sduranc @bengtfredh - it's been a little while since we talked about this, but we agreed that I would post an ADR so here we are 😄 feel free to correct and/or rewrite as needed

[HauklandJ]

Need -A or similar to make cross-app queries and similar

True, but this should be trivial for anyone working with k8s CLI.