Multi-Tenancy
Each tenant gets a Kubernetes namespace, a provisioner ServiceAccount, a pruner ServiceAccount, and cluster-scoped RBAC (ClusterRole + ClusterRoleBinding per SA). All tenant resources are labeled with the tenant identity (katastroma.org/tenant) — this label is the ownership record used for provisioning, pruning, querying, and isolation enforcement.
Gatekeeper enforces label-based namespace ownership so that each tenant’s SAs can only operate in namespaces labeled with its tenant identity. See Tenant Isolation for the full trust chain.