The hierarchical namespaces project in Kubernetes allows us to organize namespaces in a tree structure. But, since it is just a layer on top of vanilla Kubernetes, it doesn't offer an API to do anything more complex with that tree structure.
With the desire for Rancher Manager to scale to managing 1000s of clusters (10,000 i hear you say) we could try and have 1 instance of Rancher Manager doing it all. But could we have a Manager of Managers? How could we support multi-tenancy where each Rancher Manager has different versions etc?
Currently, the Elemental Operator authenticates the hosts registering for Elemental provisioning via TPM attestation. In particular, the host will perform both Enrollment and Attestation in the same round on the very first registration. Further connections to update the host state will be possible only if the host will be able to proof its identity via TPM (the Enrollment previously done will be used to perform Attestation against the host).