Kubernetes Multi-Tenancy & Security Policies at LBNL

To protect sensitive experimental data and maintain compliance across Berkeley Lab projects, Berkelium enforces strict multi-tenant isolation principles.

Key Security Guardrails

• Network Isolation: By default, each scientific namespace is provisioned with default-deny ingress rules. Inter-namespace network traffic must be explicitly allowed via standard NetworkPolicy manifests.
• Pod Security Standards (PSS): Berkelium enforces the baseline and restricted PSS profiles. Containers must not run as root (runAsNonRoot: true), and privileged container escalation is prohibited on public node pools.
• HashiCorp Vault Integration: Avoid committing API keys or DB passwords into container images. Use the vault.hashicorp.com/agent-inject annotations to mount secrets directly into memory.

metadata:
  annotations:
    vault.hashicorp.com/agent-inject: 'true'
    vault.hashicorp.com/role: 'sci-als-role'
    vault.hashicorp.com/agent-inject-secret-config: 'secret/data/als/credentials'