<p>Is there a way we can have a K8s pod per user/per firm? I realise, per user/per firm  grouping is mixing up the business level semantics with infrastructure but say I had this need for regulatory reasons, etc to keep things separate. Then is there a way to create a pod on the fly when a user logs in for the first time and hold this pod reference and route any further requests to the relevant pod which will host a set of containers each running an instance of one of the modules.</p>

<ol>
<li>Is this even possible? </li>
<li>If possible, what are those identifiers that
can be injected into the pod on the fly that I could use to identify that this is
USER-A-POD vs USER_B_POD or FIRM_A_POD vs FIRM_B_POD ?
Effectively, I need to have a pod template that helps me create identical pods of 1 replica but the only way they differ is they are serving traffic related to one user/one firm only.</li>
</ol>

<p>Generally, if you want to send traffic to a specific pod say from a <a href="https://kubernetes.io/docs/concepts/services-networking/service/" rel="nofollow noreferrer">Kubernetes Service</a> you would use <a href="https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/" rel="nofollow noreferrer">Labels and Selectors</a>. For example, using the selector <code>app: usera-app</code> in the Service:</p>

<pre><code>apiVersion: v1
kind: Service
metadata:
  name: usera-service
spec:
  selector:
    app: usera-app
  ports:
    - protocol: TCP
      port: 80
      targetPort: 80
</code></pre>

<p>Then say if the <a href="https://kubernetes.io/docs/concepts/workloads/controllers/deployment/" rel="nofollow noreferrer">Deployment</a> for your pods, using the label <code>app: usera-app</code>:</p>

<pre><code>apiVersion: apps/v1
kind: Deployment
metadata:
  name: usera-deployment
spec:
  selector:
    matchLabels:
      app: usera-app
  replicas: 2
  template:
    metadata:
      labels:
        app: usera-app
    spec:
      containers:
      - name: myservice
        image: nginx
        ports:
        - containerPort: 80
</code></pre>

<p>More info <a href="https://kubernetes.io/docs/concepts/services-networking/connect-applications-service/" rel="nofollow noreferrer">here</a></p>

<p>How you assign your pods and deployments is up to you and whatever configuration you may use.  If you'd like to force create some of the labels in deployments/pods you can take a look at <a href="https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#mutatingadmissionwebhook" rel="nofollow noreferrer">MutatingAdminssionWebhooks</a>. </p>

<p>If you are looking at projects to facilitate all this you can take a look at:</p>

<ul>
<li><a href="https://github.com/open-policy-agent/gatekeeper" rel="nofollow noreferrer">Gatekeeper</a> which is an implementation of the <a href="https://www.openpolicyagent.org/" rel="nofollow noreferrer">Open Policy Agent</a> for Kubernetes admission. (Still in alpha as of this writing)</li>
</ul>

<p>Other tools that can help you with attestation and admission mechanism (would have to be adapted for labels):</p>

<ul>
<li><a href="https://github.com/grafeas/kritis" rel="nofollow noreferrer">Kritis</a> </li>
<li><a href="https://github.com/IBM/portieris" rel="nofollow noreferrer">Portieris</a></li>
</ul>
