Enabling Multi-Tenancy and Namespace Isolation in Kubernetes with NGINX

full-self-service-vs-a.yaml

apiVersion: k8s.nginx.org/v1
kind: VirtualServer
metadata:
  name: bookinfo
  namespace: A
spec:
  host: a.bookinfo.com
  upstreams:
  - name: productpageA
    service: productpageA
    port: 9080
  routes:
  - path: /
    action:
      pass: productpageA

full-self-service-vs-b.yaml

apiVersion: k8s.nginx.org/v1
kind: VirtualServer
metadata:
  name: bookinfo
  namespace: B
spec:
  host: b.bookinfo.com
  upstreams:
  - name: productpageB
    service: productpageB
    port: 9080
  routes:
  - path: /
    action:
      pass: productpageB

oidc-policy.yaml

apiVersion: k8s.nginx.org/v1
kind: Policy
metadata:
  name: okta-oidc-policy
  spec:
    oidc:
      clientID: <client_id>
      clientSecret: okta-oidc-secret
      authEndpoint: https://<your_okta_domain>/oauth2/v1/authorize
      tokenEndpoint: https://<your_okta_domain>/oauth2/v1/token
      jwksURI: https://<your_okta_domain>/oauth2/v1/keys

oidc-vs.yaml

apiVersion: k8s.nginx.org/v1
kind: VirtualServer
metadata:
  name: bookinfo-vs
spec:
  host: bookinfo.example.com
  tls:
    secret: bookinfo-secret
  upstreams:
  - name: backend
    service: productpage
    port: 9080
  routes:
  - path: /
    policies:
    - name: okta-oidc-policy
    action:
      pass: backend

restricted-self-service-vs.yaml

apiVersion: k8s.nginx.org/v1
kind: VirtualServer
metadata:
  name: example
spec:
  host: bookinfo.example.com
  routes:
  - path: /productpage-A
    route: A/ingress 
  - path: /productpage-B
    route: B/ingress

restricted-self-service-vsr-a.yaml

apiVersion: k8s.nginx.org/v1
kind: VirtualServerRoute
metadata:
  name: ingress 
  namespace: A
spec:
  host: bookinfo.example.com
  upstreams:
  - name: productpageA
    service: productpageA-svc
    port: 9080
  subroutes:
  - path: /productpage-A 
    action:
      pass: productpageA

restricted-self-service-vsr-b.yaml

apiVersion: k8s.nginx.org/v1
kind: VirtualServerRoute
metadata:
  name: ingress 
  namespace: B
spec:
  host: bookinfo.example.com
  upstreams:
  - name: productpageB
    service: productpageB-svc
    port: 9080
  subroutes:
  - path: /productpage-B 
    action:
      pass: productpageB

For a discussion of these files, see Enabling Multi-Tenancy and Namespace Isolation in Kubernetes with NGINX