Namespaces and Tenant Authorities

GWEB K3s Cloud is a shared multi-tenant platform.

A tenant is not the same thing as an entire Kubernetes cluster.

Tenant namespaces

GWEB maps approved tenant environments to namespaces that belong to that tenant.

Examples of environment concepts include:

• dev for active development;
• preprod for release validation;
• prod for production runtime.

The actual namespace names are managed by GWEB Cloud and are tenant-specific.

Use tenant-facing gwebc environment/application commands rather than assuming or directly administering Kubernetes namespace names.

Tenant isolation

Tenant authority is bounded by the authenticated tenant context.

A tenant should not expect access to:

• another tenant's namespaces;
• GWEB platform namespaces;
• cluster-wide Kubernetes administration.

Roles and authorities

Tenant identities may receive roles such as:

• tenant administrator;
• developer;
• read-only user.

The role establishes a base capability boundary.

Some authority can be delegated more narrowly by:

• environment;
• application;
• capability.

Delegation narrows authority; it does not expand the tenant's base role.

Environment policy

An operation can also depend on environment policy.

For example, a tenant may have normal mutation enabled in dev, validation rights in preprod, and read-only inspection in prod while production changes use a separate promotion workflow.

Inspect the environment before mutation:

gwebc environment show dev
gwebc environment show preprod
gwebc environment show prod

For GEDU:

gwebc --profile gedu environment show dev

Application ownership

Some application-level operations require the application to be registered or adopted for the tenant/environment.

Inspect visible applications with:

gwebc app list --environment dev
gwebc app show <application> --environment dev

If an application is not visible or an operation is denied, verify the tenant profile, role/capabilities, environment, and application ownership before treating it as a cluster failure.