bedrock
tenant layer

Namespaces

NamespaceHoldsPod SecuritySame-namespace traffic
applicationPrometheus, Alertmanager, Grafana, Loki, Tempo, OpenCost, kube-state-metrics, blackbox exporterrestrictedPer component only
node-agentsAlloy, node-exporterprivilegedNone
cluster-1Primary PostgreSQL cluster and its poolerrestrictedAllowed
cluster-2Live replica cluster and its poolerrestrictedAllowed
cluster-3Delayed replica cluster and its poolerrestrictedAllowed
cnpg-systemCloudNativePG operatorset by the upstream bundleAllowed
garageGarage and its init jobrestrictedPer component only
longhorn-systemLonghornprivilegedAllowed
kyvernoKyverno controllersset by the upstream bundleAllowed
prometheus-operatorprometheus-operatorrestrictedAllowed
falcoFalcoprivilegedAllowed
reloaderReloaderrestrictedNone
natsNATS JetStream, when enabledrestrictedAllowed
redisRedis and Sentinel, when enabledrestrictedAllowed
kafkaStrimzi and Kafka, when enabledrestrictedAllowed
kube-systemRKE2 components, Cilium, CoreDNSset by RKE2Allowed

Default service accounts in every namespace have automountServiceAccountToken: false. Tenant applications get their own restricted namespaces and never run in application.

Priority classes

ClassValueAllowed in
bedrock-storage90000000garage
bedrock-data80000000cluster-1, cluster-2, cluster-3, falco
bedrock-workload50000000any
bedrock-default10000000any, the global default
system-cluster-critical, system-node-criticalKubernetes defaultskube-system, kyverno