Example: Multi-tenant watch scope

Prerequisites

A running operator, a tenant namespace, and permission to create a KollectScope there.

Apply

kubectl apply -f config/samples/kollect_v1alpha1_kollectscope_team-a.yaml

Apply the target and workload shown below only after their namespaces match the scope policy.

Verify

kubectl get kscope -n team-a
kubectl describe kscope -n team-a

If it didn't work

Check allowed GVKs, namespaces, family sinks, watch labels, and the target's degraded reason.

Cleanup

kubectl delete -f config/samples/kollect_v1alpha1_kollectscope_team-a.yaml

Further reading

Multi-tenancy · Annotations and labels

Platform operator setup

Combine Helm tenantMode: true with watchNamespaces so each team namespace gets an isolated collection boundary. Add KollectScope when you need GVK, namespace, or sink allow-lists.

tenantMode + watchNamespaces + KollectScope (ADR-0203).

Team-owned install: use chart profile values-minimal-rbac.yaml and the full walkthrough in Team-owned operator (minimal RBAC). Apply kubectl apply -k config/samples/team-operator/ after the Helm install.

Scope sample: kollect_v1alpha1_kollectscope_team-a.yaml or config/samples/team-operator/. Opt-in: kollecttarget_opt-in.yaml.

Watch labels

Teams can opt out individual namespaces or resources with kollect.dev/watch and kollect.dev/namespace-watch without changing Helm values (ADR-0205).

Watch labels: kollect.dev/watch, kollect.dev/namespace-watch (ADR-0205).

flowchart LR
  Namespace["Tenant namespace"] -->|watchNamespaces| Operator["Team operator"]
  Scope["KollectScope"] -. GVK · namespace · sink policy .-> Operator
  Operator --> Allowed["Allowed family sink"]
  Denied["Out-of-scope resource"] -. rejected .-> Scope