Regarding multi-tenancy: The CRD schema is global but versioned, so it's annoying-but-manageable with multiple tenants.
Controllers can be scoped to a namespace without requiring cluster-level permissions, no?
Controllers can be scoped to a namespace without requiring cluster-level permissions, no?
It means every controller for a CRD winds up installing another webhook. And having to test a variety of orderings. It's hard to get right.
> Controllers can be scoped to a namespace without requiring cluster-level permissions, no?
The difficulty is that Kubernetes RBAC is good at expressing rules "Role 'foo' can perform operation 'list' on kind 'Deployment'". But it's less capable of saying something like "Role 'foo' can perform operation 'list' on kind 'Deployment' which were created from kind 'CoolerDeployment'". It's also hard to delegate something, along the lines of "Role 'foo' can delegate ('create' over kind 'Deployment') within namespace 'bar'".
I think dissatisfaction with PodSecurityPolicy will cause Rego to worm its way into the core architecture over the coming years. It'll then eventually crowd out RBAC because you can impose (sort of, more or less) arbitrary rules. But none will dare call it ABAC.