Isolation enforcement in computing node clusters

Abstract

Techniques are disclosed for enforcing isolation in a cluster of computing nodes configured for executing containerized applications. The system receives a request from a requesting entity for access to a target namespace. The request is accompanied by a token. Based on the token, the system identifies a namespace that corresponds to an isolation namespace. To determine if the request is attempting to breach isolation, the system compares the target namespace to the corresponding namespace. If the target namespace is not the corresponding namespace, the system concludes that the request is attempting to breach isolation, and, therefore, denies the request. If the request is not attempting to breach isolation, the system determines if the request is allowed by any permissions that have been granted to the requesting entity. If the request is not allowed by a permission granted to the request entity, the system denies the request.