Managed (Tenant) Kubernetes on Cozystack

OIDC authentication for kubectl

Mon, 01 Jan 0001 00:00:00 +0000

Tenant Kubernetes clusters can authenticate kubectl users through OIDC instead of the shared static admin kubeconfig. Each user then has their own identity, per-user audit, and RBAC that can be revoked by disabling the account — not by rotating a shared certificate.

The identity model is deliberately per-cluster rather than per-tenant: each tenant Kubernetes cluster gets its own OIDC audience, and a token minted for cluster A is rejected by cluster B’s apiserver. That gives you cross-cluster isolation without provisioning a Keycloak realm per tenant. The full rationale (why per-cluster audience and not per-tenant realm; how it relates to Keycloak Organizations; what BYO-OIDC looks like) is in the design proposal.

GPU Sharing with HAMi

Mon, 01 Jan 0001 00:00:00 +0000

HAMi (Heterogeneous AI Computing Virtualization Middleware) is a CNCF Sandbox project that enables fractional GPU sharing in Kubernetes. Instead of dedicating an entire GPU to a single workload, HAMi lets containers request specific amounts of GPU memory and compute cores.

This guide covers GPU sharing for containers in tenant Kubernetes clusters. For GPU passthrough to virtual machines on the management cluster, see GPU Passthrough.

How it works

HAMi sits between the Kubernetes scheduler and the NVIDIA GPU driver:

Backups with the Velero addon

Mon, 01 Jan 0001 00:00:00 +0000

The velero addon of the Managed Kubernetes application installs Velero inside a tenant Kubernetes cluster. Combined with a tenant Bucket, it lets tenant users back up workloads to S3 and restore them later.

This guide is for the tenant-side Velero addon, which runs inside a tenant Kubernetes cluster and is operated by the tenant user.

For the platform-level Velero used by cluster administrators to back up VMInstance/VMDisk resources from the management cluster, see Velero Backup Configuration.

How to relocate etcd replicas in tenant clusters

Mon, 01 Jan 0001 00:00:00 +0000

Tenant Kubernetes clusters are using their own etcd clusters, not the one that is used by the management cluster. Such etcd clusters are deployed in tenants and are available to managed Kubernetes clusters deployed in the tenant and its sub-tenants.

Replicas of a tenant etcd cluster can be relocated between nodes for maintenance reasons. Currently, management operations for tenant etcd clusters are not automated, but such a task can be done manually.