Table of Contents
Note: Work in Progress
...
- Support for provisioning ASD-based CNFs using an external K8s Manager
- Instantiate and optionally overwrite the values of an application
- Terminate Delete an application and optionally remove all relevant Persistent Volume Claims and Persistent Volumes
- Change application details using the change package function, which allows to change the deployment version of the CNF thru an upgrade or rollback (stretch goal)
- Leverage and enhance SO capabilities and adding new capabilities for ASD- and Helm-based CNF orchestration
- Orchestrator shall support the capability to use the deployment parameters from ASD for the application or CNF deployment. These deployment parameter values shall correspond to the parameters defined in the “lifecycleParameters” section(s) of the ASD.
- Orchestrator shall support the capability to construct a values file from instance specific parameter values provided at deployment time, and default values supplied in the chart.
- Orchestrator shall support the capability to perform a chart render into concrete K8S resource descriptions.
- Container resource management for determining placement for CNF application on certain K8S cluster(s), orchestrator shall support the capability to parse the workload descriptors and extract those values.
...
JIRA: Jira Legacy server System Jira serverId 4733707d-2057-3a0f-ae5e-4fd8aff50176 key REQ-1043
Epic
...
SO and its sub-components, CNFM, CNF Adapter, shall support ASD-based CNF lifecycle orchestration (deployment and configuration)
...
Jira Legacy | ||||||
---|---|---|---|---|---|---|
|
...
User Story
...
SDC Controller,
CatalogDB Adapter,
CatalogDB
...
SO shall get the ASD-based CNF package (SDC Service CSAR) from SDC and store its metadata to SO Catalog DB.
Pre Condition:
- SO SDC Controller, CatalogDB Adapter and CatalogDB component instances are running and ready to get SDC notifications
Post Condition:
- SO Catalog DB contains the ASD-based CNF package metadata and artifacts
...
Concepts
- K8S CISM Cluster: Container Infrastructure Service Manager Cluster performs the same function as VIM Zone but operates on containerized application level.
- CNF: Cloud Native Network Function. Containerized VNF is designed to be deployed in the cloud as a container. CNF is a better fit for microservice architecture due to the deployment size.
- Kubernetes: Kubernetes (K8s) is an open-source system for automating deployment, scaling and management of containerized applications
- POD: A Pod is a group of one or more containers (such as Docker containers), with shared storage/network, and a specification for how to run the containers.
Scope
In Scope
See the Epic and User Stories.
Out of Scope
TBD
Epic
Epic | Description | JIRA | priority | |||||||
---|---|---|---|---|---|---|---|---|---|---|
SO and its sub-components, CNFM, CNF Adapter, shall support ASD-based CNF lifecycle orchestration | SO and its sub-components, CNFM, CNF Adapter, shall support ASD-based CNF lifecycle orchestration (deployment and configuration) |
|
| 1 |
- Task: When SO gets a package notification from DMaaP, SO SDC Controller queries SDC for the ASD-based CNF Service CSAR that embeds the ASD-based CNF Resource VF.
User Story
Function | Affected Component | User Story & Description | JIRA | Priority | PoC Scope Y/N |
---|---|---|---|---|---|
SO shall get the ASD-based CNF package from SDC and store its metadata to SO Catalog DB | ASDC Controller, CatalogDB Adapter, CatalogDB | SO shall get the ASD-based CNF package |
(SDC Service CSAR) from SDC and store its metadata to SO Catalog DB |
. |
|
API Handler,
RequestDB Adapter,
RequestDB,
SO BPMN Infra,
AAI
SO shall process ASD model info and decide ASD provisioning flows
Pre Condition:
- SO CatalogDB contains ASD Model metadata
- Resource VF TOSCA.metadata "ASD" entry_definition_type
- SO Client provides parameters based on the ASD lifecycleParameter list
- ASD LCM Restful Protocols will be used for request/response messages and protocols (ASD LCM RESTful Protocols for SO CNF Manager ) and its swagger file (ASD LCM RESTful Protocols for SO CNF Manager)
Post Condition:
Pre Condition:
Post Condition:
|
|
|
1 | |||||
For ASD-based CNF |
- Create new BPMN workflows for ASD-based CNF workflows
- Design to invoke SO CNF Manager
- Configure SO MacroFlows for ASD-based CNF workflows
Task:
provisioning, SO shall process model info, decide flows and invoke SO CNFM for AS LCM | API Handler, RequestDB Adapter, RequestDB, SO BPMN Infra, AAI SO CNFM | Enhance SO API Handler and BPMN Infra workflow(s) for AS LCM
|
|
Task:
|
|
note: leverage
|
Task:
- SO shall delegate ASD-based CNF orchestration to SO CNFM
- Pass input parameters including ASD reference Id, LifecycleParameter, etc.
- note: until SO CNFM is ready, use no-opt operations as a place holder
SO CNFM,
ASD Repository,
Helm Artifact Repository,
OOF,
AAI,
SDNC Adapter,
SDNC,
CDS,
CNF Adapter
SO CNFM shall process ASD-based CNF Lifecycle orchestration
Pre Condition:
- ASD and App onboarding package is stored in the Catalog Repository
- Helm Chart(s) are stored in the Helm Artifact Repository
AAI shall support CRUDQ of ASD-based CNF Resources
- Leverage existing AAI APIs
- Investigate any new AAI APIs for ASD-based CNF Resources (TBD)
Post Condition:
- ASD-based CNF is provisioned by SO CNFM
Note: PoC, ASD external CPDs will not be handled (TBD)
Note: ASD Repository, Helm Artifact Repository, Image Artifact Repository will be handled by another Epic, which is defined in Application Package Distribution
Post Condition:
|
| 2 | |||||||||
SO BPMN Infra shall trigger Create AS Instance workflow(s).
Post Condition:
|
| 2.1 | |||||||||
SO BPMN Infra shall trigger Instantiate AS Instance workflow(s).
Pre Condition:
Post Condition:
|
|
Task:
- SO CNFM shall support the capability to construct a values file from instance specific parameter values from SO and merge the values with default values from ASD Helm Chart values.
- SO CNFM shall store the generated values file for an instance to SO CNFM database
Task:
- SO CNFM shall transform ASD cloud artifacts with parameters to K8S resource description (e.g., helm template or helm install --dry-run)
Task:
- SO CNFM shall get placement information by passing K8 resources + ASD' + additional data to the Placement component such as OOF.
- Note: Use of OOF could be out-of-PoC-Scope (TBD)
- for PoC, it is allowed to choose predefined K8S Clusters
Task:
- SO CNFM shall make a placement decision based on the decision from the Placement component.
Task:
- Per DeploymentItem, SO CNFM shall send (with cluster id, parameter, cloud artifacts) to the SO CNF Adapter for the connection to K8S plugin
- Support Helm Template / Dry-run, Helm Install, Helm Uninstall and Helm Upgrade
- SO CNF Adapter APIs are being studied.
Task:
- SO CNFM shall update the CNF instance to AAI, by leveraging AAI APIs
|
Task: Create SO CNFM and make it available in ONAP
- Create SO CNFM as an SO sub-component, with NBI, Business Logic and SouthBound Plugin for 1) Helm Client or 2) CNF Adapter
- Make SO CNFM POD is deployable in OOM
- Register SO CNFM POD to AAI automatically
Task: Support for SO CNFM NBI API Handler
- SO CNFM shall support its NBI REST Apis to handle requests from SO.
- Create SO CNFM NBI API Handler sub-component based on ASD LCM Restful Protocols swagger (ASD LCM RESTful Protocols for SO CNF Manager)
- Support CRUDQ REST APIs
Task:
- SO CNFM shall support the capability to process input parameters from SO, and use the deployment parameters from ASD for the CNF deployment. Those deployment parameter values shall correspond to the parameters defined in the "lifecycleParameters" section(s) of the ASD.
Task:
- SO CNFM shall communicate with the ASD Repository to get ASD (descriptor) and artifacts from the ASD repository Manager.
Task:
- SO CNFM shall decompose ASD and get the associated DeploymentItems list
- Get HelmChart references from the DeploymentItems
- Get ASD from the Repository
- GET /api/asds/<name> (TBD)
Task:
- By leveraging the obtained HelmChart references, SO CNFM shall get associated Helm Charts from the Helm Repository Manager.
- GET /api/charts/<name>/<version>
Task: Create SO CNFM Instance Database Management
- Create SO CNFM Database tables
- Provides Database Access Objects (DAO) for CRUD for SO CNFM
2.2 | |||||||||||||
SO BPMN Infra shall trigger Delete AS Instance workflow(s).
Pre Condition:
Post Condition:
|
| 2.3 | |||||||||||
ONAP Admin Creates Cloud Region(s) and Tenant(s) in AAI Note: use existing AAI admin interfaces (no SO code impact)
|
| 2.4 | |||||||||||
In BPMN Infra, create the Create AS Workflow(s) to launch SO CNFM for Create AS
Post Condition:
|
| 2.5 | |||||||||||
Enhance Instantiate AS Business Logic (Java code) to launch SO CNFM for Instantiate AS
Post Condition:
|
| 2.6 | |||||||||||
Enhance Delete AS Workflow(s) to launch SO CNFM for Delete AS
Post Condition:
|
| 2.7 | |||||||||||
SO CNFM shall process ASD-based CNF Lifecycle orchestration | SO CNFM, ASD Repository, Helm Artifact Repository, OOF, AAI, SDNC Adapter, SDNC | Create SO CNFM and make it available in ONAP
Post Condition:
|
| 3 | |||||||||
Create ASD LCM REST API Swagger
Post Condition:
|
| 3.1 | |||||||||||
Create SO CNFM NBI API Handler based on ASD LCM Restful Protocol swagger, no-ops
Post Condition:
|
| 3.2 | |||||||||||
Implement Create AS Business Logic in SO CNFM NBI Handler to invoke the Create AS workflows(s) Post Condition:
|
| 3.3 | |||||||||||
Implement Instantiate AS Business Logic in SO CNFM NBI Handler to invoke the Instantiate AS workflows(s) Post Condition:
|
| 3.4 | |||||||||||
Implement Delete AS Business Logic in SO CNFM NBI Handler to invoke Delete AS workflows(s) Post Condition:
|
| 3.5 | |||||||||||
Create SO CNFM Workflow(s) for Create AS
Post Condition:
|
| 3.6 | |||||||||||
Create SO CNFM Workflow(s) for Instantiate AS
Post Condition:
|
| 3.7 | |||||||||||
Create SO CNFM Workflow(s) for Delete AS
Post Condition:
|
| 3.8 | |||||||||||
SO CNFM accesses ASD Registry for getting ASD for Create AS
Post Condition:
|
(moved to London release) | 3.9 | |||||||||||
SO CNFM Processes ASD & Retrieves DeploymentItems
Note: for initial PoC, Helm Charts are received from SDC (tbd) Post Condition:
|
| 3.10 | |||||||||||
SO CNFM Input Parameter Handling and Instance-Level Helm Charts
Note: enhancedClusterCapbilities input parameter handling is a stretch goal. Post Condition:
|
| 3.11 | |||||||||||
Generate and replace values file based on instance variable
Post Condition:
|
(moved to London release) | 3.12 | |||||||||||
SO CNFM Transforms Enhanced Helm Charts to K8S Resource Description
Note: this transformation is for a placement decision. If the PoC placement logic is simple or predefined, this could be skipped. Post Condition:
|
(could be not part of the initial PoC) | 3.13 | |||||||||||
SO CNFM Gets an AS Placement Decision for a Target K8S Cluster
Post Condition:
|
(moved to London release) | 3.14 | |||||||||||
SO CNFM Supports Target K8S Clusters Registration
| TBD (registration is supported, but more to be enhanced in London; moved to London+) | 3.15 | |||||||||||
SO CNFM Supports Target K8S Clusters Deregistration
| TBD (moved to London) | 3.16 | |||||||||||
SO CNFM Provides a List of Registered K8S Clusters
| TBD (moved to London) | 3.17 | |||||||||||
SO CNFM Helm Client Process for AS Deployment
Post Condition:
|
| 3.18 | |||||||||||
Note: for the initial PoC, the SO CNF Adapter will not be used. | N/A | ||||||||||||
SO CNFM Updates the AS CNF Instance to AAI
Post Condition:
|
| 3.19 | |||||||||||
SO Client shall send requests for ASD-based CNF orchestration (note: E2E support is out of PoC scope |
SO Client,
SO,
SO BPMN,
CNFM
CNF Adapter
) | SO Client, SO, SO BPMN, SO CNFM | SO Client shall send requests for ASD-based CNF orchestration to SO
Pre Condition:
|
|
Post Condition:
|
|
Task:
- Provide CNF instance input parameters, based on the lifecycleParameters from the ASD DeploymentItem
- Provide asdExtCpd inputParamMappings for CNF deployment
- it is out of PoC scope
Task:
Use of CDS for instance parameter assignment is out of PoC scope (TBD)4 |
Overall Process
- Pre-Conditions
- SDC accepts onboarding App packages, including ASD and DeploymentItems models, Helm Charts, Images and other artifacts, what allows to keep decomposition of Service instance
- SO subscribes and receives package notifications from SDC
- ASD-Based CNF LCM Orchestration
- Based on the notifications, SO ASDC Controller queries for the App packages from SDC, and stores models and artifacts to SO Catalog Database
- MACRO workflow in SO is used for orchestration
- ASD supports multiple Helm Charts in CNF packages.
- ASD instance will be decomposed to find its associated deployment item(s).
...
Gliffy | ||||||||||
---|---|---|---|---|---|---|---|---|---|---|
|
Future NS Consideration
The following diagram depict the NS connection of ASDs.
Gliffy | ||||
---|---|---|---|---|
|
AS LCM Restful API
Please refer to the section, ASD AS LCM RESTful Protocols for SO CNF Manager .
- Swagger file (ASD AS LCM RESTful Protocols for SO CNF ManagerManager#SwaggerFile)
Gliffy | ||||||||
---|---|---|---|---|---|---|---|---|
|
...
- <Instantiate an AS>
- BPMN Infra sends an AS instantiate request to SO CNFM with the asInstanceId as follows:
- POST .../as_instances/{asInstanceId}/instantiate (InstantiateAsRequest)
- InstantiateAsRequest
Attribute Name
Data Type
Cardinality
Description
asdExtCpdInputParams
ExtCpdParams
0..N contains ext cpd parameter instance-level value deploymentItems
DeploymentItems 1..N contains lifecycle parameters for deploymentItems additionalParams KeyValuesPairs 0..1 Additional input parameters for the instantiation process (this is a pace holder to hold any additional parameters which are needed by SO CNFM)
- SO CNFM retrieves the corresponding AsInstance from its DB; it is retrieve the "asdId" for the ASD query
- SO CNFM queries an ASD with the asdId from the ASD Repository; caches the retrieved ASD in the memory during the Instantiate operations
- SO CNFM reads thru the ASD DeploymentItems, and per deploymentItems, SO CNFM queries for the associated Helm Chart (1:1) from the Helm Chart Repository
- caches the retrieved Helm Charts in the memory during the Instantiate operations
- SO CNFM reads the deploymentItems.deploymentOrder. Based on the order sequence, SO CNFM processes the deploymentItems one by one For each, deployment item,
- SO CNFm creates vf-modules in AAI
- SO CNFM assignes vf-modules in SDNC From the InstantiateAsRequest, SO CNFM retrieves the deploymentItems
- The lifecycleParameterKeyValues contains a list of customizable attributes (key) in the values.yaml with instance-level values
- From the associated Helm Chart, SO CNFM gets the values.yaml
- SO CNFM creates a new values.yaml, based on the retrieved values.yaml + lifecycleParameterKeyValues
- ==== SO CNFM processes the asdExtCpdInputParam ==== TBD
- SO CNFM performs "helm template " to render K8S resource template(s)
- With the rendered k8S resource template(s), SO CNFM gets a placement decision from the Placement component (e.g., OOF)
- Currently, use of OOF is out of the scope from the initial PoC
- In the initial PoC, a simplified placement function will be used
- Based on the placement decision, SO CNFM determines the target K8S cluster
- Set the Helm command environment to connect to the target K8S cluster
- set .kube/{target K8S cluster name}.config
- SO CNFM invokes "helm install" command with the corresponding Helm Chart and a new values.yaml
- SO CNFM will have a few South-Bound plugin (helm client, CNF Adapter, others)
- in the initial PoC, the helm client will be used
- If successful, SO CNFM update the corresponding vf-module in the AAI
DeploymentItems
deploymentItemId Identifier 1 Identifies which deploymentItem lifecycleParameterKeyValues
KeyValuesPairs 0..N provides lifecycle parameter keys and values - BPMN Infra sends an AS instantiate request to SO CNFM with the asInstanceId as follows:
- <Postconditions>:
- each POD is a Ready status. This ensures that each POD can serve requests.
- Some of the PODs will not reach the Ready status until a day 1 configuration is applied
- The PODs still need verification of containers with a specific ContainerState
AS LCM APIs
Create an AS Identifier
In order for an application (CNF) to be eligible for instantiation, a CNF identifier must be created to identify the application service as a unique instance.
An AS instance supports multiple deployment items (helm charts). So, the AS instance id could be used for helm release names as the prefix.
Query AS Instance Identifiers
To list all AS instances, make a GET request to SO CNFM.
GET .../aslcm/v1/as_instances
Query an AS instance by Instance ID
To query a specific AS instance by its instance ID, make a GET request to SO CNFM.
GET .../aslcm/v1/as_instances/{asInstanceId}
Instantiate an AS
- To instantiate an AS, make a poST request to SO CNFM. The target cluster name is included in the requrest parameter.
POST .../as_instances/{asInstanceId}/instantiate
- if some of the parameters required for instantiation are complex and cannot fit into the additionalParams section of the JSON request body (TBD).
Upgrading an AS
This operation is referred to as the changing of an AS package.
POST .../as_instances/{asInstanceId}/change_aspkg
Terminate an AS Instance
This operation terminates an AS instance.
POST .../as_instances/{asInstnaceId}/terminate (TerminateAsRequest)
Note: for PoC, GRACEFUL termination type is not supported.
Delete an AS Identifier
This operation deletes an AS Identifier.
DELETE .../as_instances/{as_instanceId}
Note: optionally, Delete an AS Identifier could clean up resources of an AS Instance, e.g., Persistent Volumes (PVs)
===========
Register K8S Clusters (checking if AAI can be used)
any additional parameters which are needed by SO CNFM)
- SO CNFM retrieves the corresponding AsInstance from its DB; it is retrieve the "asdId" for the ASD query
- SO CNFM queries an ASD with the asdId from the ASD Repository; caches the retrieved ASD in the memory during the Instantiate operations
- SO CNFM reads thru the ASD DeploymentItems, and per deploymentItems, SO CNFM queries for the associated Helm Chart (1:1) from the Helm Chart Repository
- caches the retrieved Helm Charts in the memory during the Instantiate operations
- SO CNFM reads the deploymentItems.deploymentOrder. Based on the order sequence, SO CNFM processes the deploymentItems one by one
- For each, deployment item,
- SO CNFm creates vf-modules in AAI
- SO CNFM assignes vf-modules in SDNC
- From the InstantiateAsRequest, SO CNFM retrieves the deploymentItems
DeploymentItems
deploymentItemId Identifier 1 Identifies which deploymentItem lifecycleParameterKeyValues
KeyValuesPairs 0..N provides lifecycle parameter keys and values - The lifecycleParameterKeyValues contains a list of customizable attributes (key) in the values.yaml with instance-level values
- From the associated Helm Chart, SO CNFM gets the values.yaml
- SO CNFM creates a new values.yaml, based on the retrieved values.yaml + lifecycleParameterKeyValues
- ==== SO CNFM processes the asdExtCpdInputParam ==== TBD
- SO CNFM performs "helm template " to render K8S resource template(s)
- With the rendered k8S resource template(s), SO CNFM gets a placement decision from the Placement component (e.g., OOF)
- Currently, use of OOF is out of the scope from the initial PoC
- In the initial PoC, a simplified placement function will be used
- Based on the placement decision, SO CNFM determines the target K8S cluster
- Set the Helm command environment to connect to the target K8S cluster
- set .kube/{target K8S cluster name}.config
- SO CNFM invokes "helm install" command with the corresponding Helm Chart and a new values.yaml
- SO CNFM will have a few South-Bound plugin (helm client, CNF Adapter, others)
- in the initial PoC, the helm client will be used
- SO CNFM Helm Client will select a target Kubernetes cluster
- e.g., helm install <release> <chart> --kubeconfig ~/.kubeconfigs/<cluster_name>.kubeconfig
- in the initial PoC, the target cluster is selected by the user and its name will be passed thru the user params (in SO) and additionalParams (in SO-CNFM)
- If successful, SO CNFM update the corresponding vf-module in the AAI
- <Postconditions>:
- each POD is a Ready status. This ensures that each POD can serve requests.
- Some of the PODs will not reach the Ready status until a day 1 configuration is applied
- The PODs still need verification of containers with a specific ContainerState
AS LCM APIs
Create an AS Identifier
In order for an application (CNF) to be eligible for instantiation, a CNF identifier must be created to identify the application service as a unique instance.
An AS instance supports multiple deployment items (helm charts). So, the AS instance id could be used for helm release names as the prefix.
Query AS Instance Identifiers
To list all AS instances, make a GET request to SO CNFM.
GET .../aslcm/v1/as_instances
Query an AS instance by Instance ID
To query a specific AS instance by its instance ID, make a GET request to SO CNFM.
GET .../aslcm/v1/as_instances/{asInstanceId}
Instantiate an AS
- To instantiate an AS, make a poST request to SO CNFM. The target cluster name is included in the requrest parameter.
POST .../as_instances/{asInstanceId}/instantiate
- if some of the parameters required for instantiation are complex and cannot fit into the additionalParams section of the JSON request body (TBD).
Upgrading an AS
This operation is referred to as the changing of an AS package.
POST .../as_instances/{asInstanceId}/change_aspkg
Terminate an AS Instance
This operation terminates an AS instance.
POST .../as_instances/{asInstnaceId}/terminate (TerminateAsRequest)
Note: for PoC, GRACEFUL termination type is not supported.
Delete an AS Identifier
This operation deletes an AS Identifier.
DELETE .../as_instances/{as_instanceId}
Note: optionally, Delete an AS Identifier could clean up resources of an AS Instance, e.g., Persistent Volumes (PVs)
The Delete operation may need to update AAI.
===========
Register K8S Clusters
This adds an ability for CNFM to register container managers like Kubernetes. that will allow to instantiate and deploy containerized CNFs.
Note: Kubernetes is advanced and commonly used CISM as of now, but in the future, adding other CISM types could be considered. for now Kubernetes is a reference implementation.
In order to make CNFM to be able to operate K8S Clusters we need introduce K8S Cluster registration, deregistration and querying features.
- As a user I want to be able to register and list CISM Cluster, which is already deployed.
- As a user I want to name the CISM Cluster and select it’s type.
- As for main information source of k8s cluster type configuration I want to use a kubectl configuration file to feed authentication information and connectivity point information.
- As a user I want to modify and transform information upon uploading (upload certificates, change or select username and credentials).
- As a user I want to be able to query all stored information for clusters both individual cluster information and filtered list by criteria(ie name, type, status, etc).
Information needed for registration
- CISM Cluster Name
- CISM Cluster type (Kubernetes)
- CISM Cluster Server URL
- Username to access API
- Option to populate connectivity details by uploading kubeconfig file
Kubeconfig contains connectivity details for the K8s cluster(hostname, port, apiRoot), which includes authentication details, too
- Certificate Authority
========
To instantiate an AS on an non-ONAP K8S cluster, a cluster configuration file that is specific to the cluster must be uploaded.
...
- to verify the connectdion to the target cluster, run the following command from the ONAP K8S cluster
- kubectl --kubeconfig ${PATH_TO_TARGET_CLUSTER_CONFIGURATION_FILE} get namespaces
Deregister K8S Clusters
...
To remove a cluster configruation file, create a DELETE request. .../aslcm/v1/clusterconfig/{configName}
...
- Helm Install
- Helm Uninstall
- Helm Upgrade
Note: Helm is a package manager. Managing how instances (helm release) of packages are run in an environment is a separate concern. For Helm release handling, we are considering additional tools and mechanisms.
Component Communication Security
...
Assumption & Requirements (from cloud.google.com)
source: https://cloud.google.com/kubernetes-engine/docs/best-practices/enterprise-multitenancy
The best practices in this guide are based on a multi-tenant use case for an enterprise environment, which has the following assumptions and requirements:
- The organization is a single company that has many tenants (two or more application/service teams) that use Kubernetes and would like to share computing and administrative resources.
- Each tenant is a single team developing a single workload.
- Other than the application/service teams, there are other teams that also utilize and manage clusters, including platform team members, cluster administrators, auditors, etc.
- The platform team owns the clusters and defines the amount of resources each tenant team can use; each tenant can request more.
- Each tenant team should be able to deploy their application through the Kubernetes API without having to communicate with the platform team.
- Each tenant should not be able to affect other tenants in the shared cluster, except via explicit design decisions like API calls, shared data sources, etc.
Access Control
TBD
Network Policies
...