The Cost of Kubernetes Isolation

▶ Watch (0:12)

Teams wanting a private Kubernetes space face two options. A namespace provisions quickly but gives only a partitioned slice of a shared cluster, with projects layered around it to simulate isolation. A full tenant cluster gives real isolation, but even from a managed cloud provider it takes 30 minutes to an hour. That overhead rules it out for teams that need isolation without the infrastructure weight.

KCP Workspaces: Full API in One Second

▶ Watch (1:55)

KCP is an open-source, horizontally scalable control plane for Kubernetes-like APIs. Its unit of isolation is the workspace, which provisions in literally a second. Each workspace is a full Kubernetes API without workload resources: no nodes, no pods, no deployments. Users get cluster-admin access and can do whatever they want. A vanilla Kubernetes cluster carries around 80 built-in resources. KCP strips that down to only what a given use case needs.

One Binary from Laptop to Global Control Plane

▶ Watch (3:15)

KCP compiles to a single Go binary. Run it on a laptop, on a managed service, or on Kubernetes. It uses the standard Kubernetes API surface, so kubectl, Helm, and any client-go tool works without modification. At scale, KCP deploys as a global control plane with multi-region support and caching layers. The deployment model adapts from a developer’s laptop to a production platform team’s stack.

CRD Versioning Without the Flag-Day Cut-Over

▶ Watch (3:49)

KCP solves a problem Kubernetes operator authors eventually hit: upgrading a CRD from V1alpha1 to V1alpha2 with a breaking change. Standard Kubernetes does not let different API versions run separate controllers. KCP does. Route V1alpha1 to one controller and V1alpha2 to a different one. You can also export the CRD under a different name in KCP than in the backing cluster. Controller upgrades become incremental rather than a hard cut-over.

Notable Quotes

and it shouldn’t be heavy. Jan Willies · ▶ 01:01

which can be provisioned in seconds. Jan Willies · ▶ 01:52

KCP is the mechanism to deal with CRDs. Jan Willies · ▶ 03:49

Key Takeaways

  • KCP workspaces provision in seconds; managed Kubernetes clusters take 30-60 minutes.
  • Each workspace gives cluster-admin access to a full Kubernetes API without nodes or running workloads.
  • A single Go binary scales from a developer’s laptop to a multi-region global control plane.
  • KCP routes different CRD versions to separate controllers, enabling incremental upgrades without flag-day cut-overs.

About the Speaker(s)

Jan Willies is a Platform Architect at Accenture and a contributor to the crossplane project. He founded the Berlin CI/CD Meetup and organizes the CI/CD DevRoom at FOSDEM. As a maintainer of crossplane provider-gitlab and provider-argocd, he is well connected in the Kubernetes contributor community.