[RA2 Appendix]: Describe best practices for workload isolation with Kubernetes

[CsatariGergely]

In the Containers in Production track of OpenDev 2020 there was a discussion about the need to document the best practices for workload isolation in Kubernetes (see notes from line 150).

As the method of separation usually does not affect the workload's logic or deployment artefacts the documentation should be part of the appendix of RA2.

This issue is to initiate a discussion about the problem statement, use cases and solution details.

[CsatariGergely]

Problem statement: As a single Kubernetes cluster does not provide hard multitenancy, that is the CNF-s running in the same cluster should not trust each other, there is a need to define best practices for separation of trust domains.

Use cases:
1 Two CNF-s which are in the same trust domain (e.g.: they are from the same vendor) are running in a container infrastructure
2 Two CNF-s which are in different trust domains (e.g.: they are from different vendors) are running in a container infrastructure

Solutions details:

• Same/different Kubernetes clusters
• Network connection between clusters
• Network separation within a cluster
• Runtimes?
• Anything storage?
• Image signing?

[CsatariGergely]

#1059 is a related issue.

[tomkivlin]

I am moving this to the backlog as it came in after the M2 milestone and is unlikely to get addressed before 14th September.