Build a Multi-Tenant Kubernetes Platform

What you will build

A shared cluster where one team's mistake or compromise cannot hurt another.

Starting point: you only need a Vultr account. This challenge is self-contained, so you can do it without having done any other.

The requirements

• At least three tenants, each created from a template in Git, not by hand
• RBAC so each team can manage only its own namespace
• ResourceQuotas and LimitRanges so no tenant can starve the others
• Default-deny NetworkPolicies with only the flows each tenant needs
• Policy enforcement such as Kyverno or Gatekeeper: no privileged pods, no latest tags, required resource limits and labels
• Per-tenant visibility of resource usage

Act as the attacker

1. From tenant A, try to read tenant B's secrets and list its pods
2. Try to reach tenant B's services over the network
3. Deploy a privileged pod, a pod without limits and an image tagged latest
4. Try to consume the whole cluster's CPU
5. Document every attempt, whether it was blocked, and the control that stopped it

kubectl auth can-i get secrets -n tenant-b --as=system:serviceaccount:tenant-a:default

How you will be judged

• Onboarding a fourth tenant takes one commit
• Every attack attempt documented with its result
• Gaps you found are fixed, or honestly listed as residual risk

Run attacks only against your own cluster. Destroy the cluster and any load balancers or volumes it created when you are done so you are not billed for them.