Kiosk is a multi-tenancy extension for Kubernetes designed to enable secure cluster sharing and self-service namespace provisioning. Written in Go, the project addresses a fundamental limitation in Kubernetes by providing lightweight, pluggable multi-tenancy capabilities that can be added to any standard Kubernetes cluster without requiring a specialized distribution. The project is now archived and no longer actively maintained, though it remains available for reference and historical use.
The core architecture of kiosk centers on using Kubernetes namespaces as isolated workspaces where tenant applications run separated from each other. The system introduces several key abstractions to manage multi-tenancy. Accounts represent individual tenants and are configured by cluster administrators. Account Users are assigned to Accounts and perform actions within the cluster while using a specific Account context. Spaces are virtual, non-persistent resources that represent exactly one Kubernetes namespace, with each Space belonging to an Account that owns it. This design allows Account Users to see only the Spaces they have access to, rather than being able to list all namespaces or none at all.
Kiosk provides account-level resource management through AccountQuotas, which define cluster-wide aggregated limits for Accounts. Resources across all Spaces and Namespaces belonging to an Account count toward these limits, enabling fair resource sharing and quality of service guarantees. The system also supports Namespace Templates, which are predefined sets of Kubernetes resources that can be applied during Space creation. Templates can be created with different ClusterRoles than Account Users possess, allowing administrators to set up isolation resources like Network Policies that users themselves cannot create. When Templates are applied to Spaces, TemplateInstances are created to track which Templates have been applied and their parameters.
The implementation adds custom resource definitions for Account, AccountQuota, AccountQuotaSet, Template, and TemplateInstance to the config.kiosk.sh API group. These are managed by a controller and API Server Extension that run inside the cluster. The system is designed to be 100 percent open-source under the Apache 2.0 license, pluggable into existing clusters, fast through automation and self-service, secure with default isolation configurations, and extensible as a building block for higher-level Kubernetes platforms.
According to GitGenius activity tracking, the repository shows relatively low engagement with a median issue and pull request response latency of 2206.1 hours and a mean of 7887.8 hours, indicating slower response times typical of archived or less actively maintained projects. The most active contributors tracked were deniseschannon and heiko-braun, each with one recorded event. The repository shares overlapping contributors with argoproj/argo-workflows, loft-sh/vcluster, and k3s-io/k3s, suggesting connections to the broader Kubernetes ecosystem and related projects in the Loft organization.
