"Multi-tenancy" page may confuse some readers about whether CRDs are cluster scoped

[r21gh]

This is a Bug Report

Problem:
The statement regarding Kubernetes namespace isolation mentions that it "doesn't apply to Kubernetes resources that can't be namespaced, such as Custom Resource Definitions, Storage Classes, and Webhooks." This requires clarification as it inaccurately represents how Custom Resource Definitions (CRDs) function.

Proposed Solution:
Update the statement to clarify the behavior of CRDs, emphasizing that while CRDs are cluster-scoped, the resources they define can be namespaced.

"However, it can be difficult to configure, and it doesn't apply to resources that are cluster-scoped and not namespaced, such as Custom Resource Definitions (CRDs) themselves (though the custom resources they define can be namespaced), Storage Classes, and Webhooks."

I would be happy to contribute to this statement in the documentation.

Page to Update:
https://kubernetes.io/docs/concepts/security/multi-tenancy/#implementations

[aryasoni98]

/assign

[sftim]

The CustomResourceDefinition API is cluster scoped. However, to avoid people getting confused when they read this page, we could use APIService instead of CustomResourceDefinition.

We should also use actual API kinds.

For example:

doesn't apply to Kubernetes resources that can't be namespaced, such as APIServices, StorageClasses, or ClusterTrustBundles.

[sftim]

/remove-kind bug

The docs are correct, but people may still misunderstand them
/language en
/priority backlog

[sftim]

/retitle "Multi-tenancy" page may confuse some readers about whether CRDs are cluster scoped

[salaxander]

/triage accepted