# Kubesphere Multi Tenant Management

KubeSphere multi-tenant management Skill.

- Repository: https://github.com/kubesphere/kubesphere (17074 stars)
- Category: Engineering
- License: see repository
- Last updated: 2026-07-15
- Runs scripts: yes, review before use

## Install

Claude Code: `npx skills add kubesphere/kubesphere --skill kubesphere-multi-tenant-management -g -a claude-code -y`
Codex: `npx skills add kubesphere/kubesphere --skill kubesphere-multi-tenant-management -g -a codex -y`
Cursor: `npx skills add kubesphere/kubesphere --skill kubesphere-multi-tenant-management -g -a cursor -y`
Gemini CLI: `npx skills add kubesphere/kubesphere --skill kubesphere-multi-tenant-management -g -a gemini-cli -y`

## Description

KubeSphere multi-tenant management Skill. Use when user requests to create users, workspaces, projects, or assign roles/permissions. Supports user lifecycle management, workspace configuration, project creation, role binding. Do not perform any delete operations, do not create custom roles.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# KubeSphere Multi-Tenant Management

## Security Guidelines

1. **Never use kubectl edit/delete** - Do NOT use `kubectl edit`, `kubectl delete`, or similar commands to modify or delete workspaces, projects, users, roles, or role bindings. These operations are sensitive and should be performed via KubeSphere Console with proper approval workflow.

2. **Never perform delete operations via API** - Do NOT delete users, workspaces, projects, roles, or role bindings via API. These operations must be performed manually via KubeSphere Console with proper approval workflow. Only use this skill for creating and querying resources.

3. **Never create custom roles** - Do NOT create custom roles (Role, WorkspaceRole, GlobalRole). Only use built-in roles provided by KubeSphere. If custom permissions are needed, instruct the user to configure them via KubeSphere Console.

4. **Default to least privilege** - When creating users or assigning permissions, always use the minimum required access level:
   - New user creation: default to `platform-regular` (not platform-admin)
   - Inviting user to workspace: default to `<workspace-name>-regular` (not admin)
   - Inviting user to project: default to `viewer` (not admin)
   - Only escalate permissions when explicitly requested


## Core Concepts

### Workspace

The top-level organizational unit in KubeSphere, representing a team, department, or business unit. A workspace can contain multiple projects and serves as the basic boundary for resource grouping and access control. **Workspaces can span multiple clusters**, enabling centralized management of resources distributed across different clusters.

### Project

KubeSphere's enhanced Kubernetes namespace, representing a specific application, environment, or workload within a workspace. Each project maps to a separate namespace.

### User & Role

The rest: https://github.com/kubesphere/kubesphere/blob/HEAD/skills/kubesphere-multi-tenant-management/SKILL.md