<p>I work in a multi-tenant node app, I know to create a new namespace in Kubernetes is possible to run a kubectl command as follow:
<code>kubectl create namespace &lt;namespace name&gt;</code></p>

<p>How can I create a new namespace from node Microservices when a new customer make a sign up for a new account?</p>

<p>Is there some kubectl API to make a request from an external app?</p>

<p>Is necessary for the user to log out from app, destroy the pods created in kubernetes?</p>

<p>It could be as simple as calling from a shell in your app:</p>

<pre><code>kubectl create namespace &lt;your-namespace-name&gt;
</code></pre>

<p>Essentially, kubectl talks to the kube-apiserver.</p>

<p>You can also directly call the kube-apiserver. This is an example to list the pods:</p>

<pre><code>$ curl -k -H 'Authorization: Bearer &lt;token&gt;' \
              https://$KUBERNETES_SERVICE_HOST:6443/api/&lt;api-version&gt;/namespaces/default/pods
</code></pre>

<p>More specifically to create a namespace:</p>

<pre><code>$ curl -k -H -X POST -H 'Content-Type: application/json' \
                     -H 'Authorization: Bearer &lt;token&gt;' \
                     https://$KUBERNETES_SERVICE_HOST:6443/api/v1/namespaces/ -d '
{
    "apiVersion": "v1",
    "kind": "Namespace",
    "metadata": {
        "name": "mynewnamespace"
    }
}'
</code></pre>

<p>In case you are wondering about the <code>&lt;token&gt;</code>, it's a Kubernetes <a href="https://kubernetes.io/docs/concepts/configuration/secret/" rel="noreferrer">Secret</a> typically belonging to a ServiceAccount and bound to a <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/#role-and-clusterrole" rel="noreferrer"><code>ClusterRole</code></a> that allows you to create namespaces.</p>

<p>You can create a Service Account like this:</p>

<pre><code>$ kubectl create serviceaccount namespace-creator
</code></pre>

<p>Then you'll see the token like this (a token is automatically generated):</p>

<pre><code>$ kubectl describe sa namespace-creator
Name:                namespace-creator
Namespace:           default
Labels:              &lt;none&gt;
Annotations:         &lt;none&gt;
Image pull secrets:  &lt;none&gt;
Mountable secrets:   namespace-creator-token-xxxxx
Tokens:              namespace-creator-token-xxxxx
Events:              &lt;none&gt;
</code></pre>

<p>Then you would get the secret:</p>

<pre><code>$ kubectl describe secret namespace-creator-token-xxxxx
Name:         namespace-creator-token-xxxx
Namespace:    default
Labels:       &lt;none&gt;
Annotations:  kubernetes.io/service-account.name: namespace-creator
              kubernetes.io/service-account.uid: &lt;redacted&gt;

Type:  kubernetes.io/service-account-token

Data
====
ca.crt:     1025 bytes
namespace:  7 bytes
token:      &lt;REDACTED&gt; &lt;== This is the token you need for Authorization: Bearer
</code></pre>

<p>Your <code>ClusterRole</code> should look something like this:</p>

<pre><code>kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: namespace-creator
rules:
- apiGroups: ["*"]
  resources: ["namespaces"]
  verbs: ["create"]
</code></pre>

<p>Then you would bind it like this:</p>

<pre><code>$ kubectl create clusterrolebinding namespace-creator-binding --clusterrole=namespace-creator --serviceaccount=namespace-creator
</code></pre>

<p>When it comes to writing code you can use any HTTP client library in any language to call the same endpoints.</p>

<p>There are also libraries like the <a href="https://github.com/kubernetes/client-go" rel="noreferrer">client-go</a> library that takes care of the plumbing of connecting to a kube-apiserver.</p>
