gke-multitenancy

This skill is a reference and configuration guide for planning and implementing multi-tenancy on Google Kubernetes Engine (GKE). It solves the problem of safely sharing a single cluster across multiple teams or environments while controlling access, resource consumption, network exposure, and cost. It presents a decision framework of multi-tenancy models, ranging from soft namespace-per-team isolation to hard cluster-per-team isolation, with a golden-path recommendation to start with namespace-per-team for cost efficiency and escalate only when compliance requires stronger boundaries.

The skill provides concrete, copyable configurations for each layer of isolation: creating and labeling namespaces, defining least-privilege namespace-scoped RBAC Roles and RoleBindings bound to Google Groups, setting ResourceQuotas to cap CPU, memory, pods, and other resources per team, defining LimitRanges with mandatory defaults and maximums per container, and applying default-deny NetworkPolicies with allow rules for intra-namespace traffic and DNS. It also covers cost allocation using namespace labels for billing attribution and enabling GKE cost allocation via gcloud. It references companion skills for deeper RBAC hardening and workload security. It lists read and apply MCP tools such as apply_k8s_manifest, get_k8s_resource, check_k8s_auth, describe_k8s_resource, and delete_k8s_resource.

It targets platform engineers, cluster administrators, and DevOps teams designing enterprise multi-tenant GKE platforms. Typical use cases include onboarding multiple teams onto a shared cluster, isolating dev, staging, and production within one cluster, enforcing least-privilege access, and attributing costs across teams or projects.