We already learned how to leverage Kubernetes namespaces to create clusters within a cluster. When combined with RBAC, we can create namespaces and give users permissions to use them without exposing the whole cluster. Still, one thing is missing.
We can, let's say, create a test namespace and allow users to create objects without permitting them to access other namespaces. Even though that is better than allowing everyone full access to the cluster, such a strategy would not prevent people from bringing the whole cluster down or affecting the performance of applications running in other namespaces. The piece of the puzzle we're missing is resource control on the namespace level.
We already discussed that every container should have resource limits and requests defined. That information helps Kubernetes schedule...
