Security / Tenant Isolation

Tenant isolation model

Multi-tenant security model for OpenBao Operator, including namespace introduction, split controller identities, admission guardrails, and network isolation.

Open the isolation modelReview tenant onboarding

Covers

• understand what the multi-tenant operating model actually guarantees
• review the boundary between the provisioner and namespace-restricted controller
• connect tenant isolation to RBAC and network controls
• decide whether the shared-service model fits your production requirements

Decision matrix

Tenant isolation pillars

Tenant isolation pillars.

Pillar	What it protects	Primary mechanism
Namespace introduction	Prevents the controller from discovering or managing arbitrary namespaces.	OpenBaoTenant onboarding, explicit RoleBinding introduction, and no namespace-wide controller discovery.
Identity separation	Keeps provisioning and workload management from sharing a single all-powerful credential.	Split provisioner and controller identities with different RBAC scopes.
Admission guardrails	Blocks unsafe configuration drift and unauthorized mutation of managed resources.	Validating admission policies and managed-resource ownership rules.
Network isolation	Prevents cross-tenant traffic and over-broad egress by default.	Default-deny NetworkPolicy plus explicit allow rules.

Next actions

Read the isolation modelNamespace, RBAC, and secret-boundary behavior.Open RBAC architectureHow the split-controller model enforces the tenant boundary at the identity layer.Open tenancy and governanceUser-guide onboarding workflow and governance path.