The k8s-dashboard is currently available in staging, thanks to @mecampbellsoup putting together the chart, configuration, and his PR in the upstream that adds a feature to the dashboard that lets you configure a namespace header (in our case x-consumer-permissions), and a namespace regex that would extract the authorized namespaces from the header values, which makes the dashboard work in our multi-tenant environment, where a tenant has access to a few namespaces but not all namespaces.
There are still a few issues that need to be worked out before we can consider putting this into production (#1 #2 #3 #4), but before time and energy are invested into addressing those issues it would be good to have a discussion to understand whether or not we want to include this in production.
Pros:
The dashboard is an open source project that has implemented a fair amount of functionality (viewing and searching resources), that we can integrate into our multi-tenant environment for a relatively low cost of configuration
if done right (confusing parts mitigated/removed), it is a value-add for customers, especially for those that aren't familiar with kubectl.
Cons:
There is still some work that needs to be done, and it's not yet clear if the fixes would leverage a one-off fix that is only applicable to the dashboard, or if they would leverage a greater fix that could have other uses (e.g. auth proxy for tenant cluster)
This work is targeting the legacy model which is not a priority compared to NGCP
Questions to explore:
How valuable do we think it would be to customers? If we release it, how would we measure that?
To what extent can we repurpose/leverage the work done here for NGCP?
pmowrer
commented
6 months ago
The k8s-dashboard is currently available in staging, thanks to @mecampbellsoup putting together the chart, configuration, and his PR in the upstream that adds a feature to the dashboard that lets you configure a namespace header (in our case x-consumer-permissions), and a namespace regex that would extract the authorized namespaces from the header values, which makes the dashboard work in our multi-tenant environment, where a tenant has access to a few namespaces but not all namespaces.
There are still a few issues that need to be worked out before we can consider putting this into production (#1 #2 #3 #4), but before time and energy are invested into addressing those issues it would be good to have a discussion to understand whether or not we want to include this in production.
Pros:
Cons:
Questions to explore: