Non-shared Persistent Volumes

[Prageeth-Wickramaarachchi]

Where is non-shared persistent volume implementation done in order to obtain namespace isolation.

[devdattakulkarni]

Hi @Prageeth-Wickramaarachchi The implementation is part of the mutating-webhook code.
We have a test case that exercises this feature:
https://github.com/cloud-ark/kubeplus/blob/master/tests/tests.py#L60

In what context are you wondering about this question?

[Prageeth-Wickramaarachchi]

I need to know how the isolation is happening in the namespaces of the implementation

[devdattakulkarni]

Hi @Prageeth-Wickramaarachchi

For storage isolation, KubePlus checks the chart to see what storage class is being used by PVCs defined in the chart.
From multi-tenancy perspective, it is important that a storage class with reclaim policy of "delete" should be used.
If that is not the case, then KubePlus will reject registering such a chart.

Here is where that checking is happening:

• https://github.com/cloud-ark/kubeplus/blob/master/deploy/kubeconfiggenerator.py#L976
• The above method is called from the mutating-webhook's LintChart method in utils.go
  • https://github.com/cloud-ark/kubeplus/blob/master/mutating-webhook/utils.go#L986
• And LintChart is called from webhook.go
  • https://github.com/cloud-ark/kubeplus/blob/master/mutating-webhook/webhook.go#L1059