Skip to content
nanohypenanohype

7 · Identity & isolation

Isolation is a spectrum, not a boolean. Two orthogonal dials — where the control-plane CRs live, and how hard the workload boundary is.

7 · Identity & isolation — Isolation is a spectrum, not a boolean. Two orthogonal dials — where the control-plane CRs live, and how hard the workload boundary is.

How a tenant gets an identity and what stops it reaching another tenant's things. Pod Identity binds a ServiceAccount to a role; the role's policies are generated from the tenant's own declaration.

The isolation claim rests on generated policy rather than reviewed policy. A scoped datastore policy is derived from `spec.datastores`, so a tenant cannot be granted something it did not declare — and where a resource cannot be resolved exactly, the operator emits no grant at all rather than a broad one.

Drawn from its model, and rendered by the atlas project innanohype/.github.