Flux2-multi-tenancy is an example repository that demonstrates how to manage multi-tenant Kubernetes clusters with Flux v2 using Git as the source of truth.
The repository addresses the challenge of isolating multiple tenants on a shared Kubernetes cluster while allowing each to deploy applications independently through Git. Flux accomplishes this by leveraging Kubernetes namespaces and RBAC to enforce isolation boundaries. When multi-tenancy lockdown is enabled, Flux prevents cross-namespace access to custom resources, blocks remote Kustomize bases to ensure only approved sources affect cluster state, and impersonates tenant service accounts rather than using the controller's account for reconciliation. The repository demonstrates this through a fleet structure where a platform admin manages cluster-wide resources and policies while tenants deploy only to their assigned namespaces via their own Git repositories.
This repository is designed for platform administrators setting up shared Kubernetes clusters that need to support multiple independent teams or customers. It suits organizations where tenants should have no direct API access and all changes flow through Git. The example shows how to structure both the fleet repository, which contains cluster configuration and admission policies, and individual tenant repositories, which contain application deployments. The reconciliation hierarchy ensures policies are applied before tenant resources, maintaining security guarantees.
The project maintains a structured example with clear separation between platform admin responsibilities and tenant capabilities. The repository includes concrete implementations of Kubernetes ValidatingAdmissionPolicy resources and demonstrates the dependsOn mechanism to enforce policy application order. Documentation covers the distinct roles of platform admins and tenants, showing what each can and cannot do within the multi-tenancy model.
