Differene bw Namesapces & Projects

[debianmaster]

@enjk wrote

Projects provide for easier multi tenancy by:

• Having stricter validation than namespaces (i.e. you cannot annotate a project other than a handful of predefined keys meaning you can assert a privileged user or component set that data)
• Projects are actually indirectly created by the server by a request mechanism. Thus you do not need to give users the ability to create projects directly.
• A cluster admin can inject a template for project creation (so you can have a predefined way to set up projects across your cluster).
• The project list is a special endpoint that determines what projects you should be able to see. This is not possible to express via RBAC (i.e. list namespaces means you can see all namespaces).
• Note that all of this was built in the early days of Kubernetes, and thus may be less important now.