Restricting Storage Classes per Tenant

Restricting PersistentVolumeClaims to approved StorageClasses

Use the storageClasses.allowed field in the Tenant Custom Resource to limit which StorageClasses a tenant may request when creating PersistentVolumeClaims (PVCs).

Tenant

apiVersion: tenantoperator.stakater.com/v1beta3
kind: Tenant
metadata:
  name: tenant-sample
spec:
  # other fields
  storageClasses:
    allowed:
      - staging-fast
      - shared

Notes

• If the PVC specifies a storageClass explicitly, that value is checked against the allow-list.
• If the PVC references a volumeName, the operator inspects the corresponding PersistentVolume to determine its class.
• If the PVC omits both storageClass and volumeName, evaluation is deferred until a default StorageClass is set in the cluster.
• An empty string ("") is treated as a literal StorageClass name; include "" in the allow-list if you want to permit PVCs that omit a storage class.

Example

Allowed PVC (requests staging-fast, which is in the allow-list):

Allowed PVC

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: pvc-allowed
spec:
  storageClassName: staging-fast
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 1Gi

Denied PVC (requests untrusted-storage, not in the allow-list):

Denied PVC

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: pvc-denied
spec:
  storageClassName: untrusted-storage
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 1Gi

Behavior

• A PVC that requests an allowed StorageClass will be accepted and provisioned as normal.
• A PVC that requests a StorageClass not present in storageClasses.allowed will be rejected by the operator or admission policy.

Demo