Multi-tenancy using Config Controller

Multi-tenancy Using Config Controller

When we setup the landing zone using Config Controller, we also would want an easy segregation of access to different teams based on their role and requirement to manage resources.

As continuation to what we said in here : https://medium.com/google-cloud/landing-zone-in-gcp-using-config-connector-and-config-controller-b7cb0055c9af

Our team put forward the solution of multi-tenancy in Config Controller. A central administrator manages the centralised infrastructure for the organisation and enforces policies on the cluster and on all namespaces in the organization. The application operators, who are responsible for managing their deployments, apply configs to the applications in the namespaces that they work on.

We can configure more than one source of truth by creating a RootSync and RepoSync Objects. Namespace-scoped sources of truth are optional and can contain namespace-scoped configs synced to a particular namespace across clusters. You can delegate the setup and control of a namespace-scoped source of truth to non-administrative users.

1. Create a root-sync object as below:

# root-sync.yaml
apiVersion: configsync.gke.io/v1beta1
kind: RootSync
metadata:
  name: ROOT_SYNC_NAME
  namespace…