<p>I have the following scenario:</p>

<p><a href="https://i.stack.imgur.com/9hPXa.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/9hPXa.png" alt="enter image description here"></a></p>

<p>The <strong>user red</strong> make a http request to one of the three services in the <strong>namespace1</strong>. Somehow in the K8s, it should verify, if the <strong>user red</strong> has a valid certificate for <strong>namespace1</strong> to call services or not. In this case, the <strong>user red</strong> owns the right certificate for the <strong>namespace1</strong>, so it allows to call any services within the <strong>namespace1</strong>. The same rule is also apply for <strong>user blue</strong>.</p>

<p>But when user red try to call services in the <strong>namespace2</strong>, then requests should be rejected, because it does not own the right certificat for <strong>namespace2</strong>. </p>

<p>The question is, it is possible to create namespace certificate in kubernetes. For example, when I have a <strong>certificate A</strong>, then I can only access <strong>namespace1</strong> but not <strong>namespace2</strong>.</p>

softshipper
<p>I think Kubernetes Services don’t offer such features. The authentication should be done in an ingress controller (e.g. nginx-ingress). You just deploy two different ones, one per namespace, with different certificate configuration.</p>
