Skip to main content

Multi-Tenancy: Sharing the Cluster

Key Takeaways for AI & Readers
  • Shared Clusters: Multi-tenancy enables cost-effective sharing of a single Kubernetes cluster among multiple teams or applications.
  • Three Pillars of Isolation: Namespaces provide logical separation, ResourceQuotas enforce resource limits, and NetworkPolicies control inter-namespace communication.
  • Soft vs. Hard Multi-tenancy: Soft multi-tenancy relies on trust within an organization, while hard multi-tenancy requires stronger isolation (e.g., separate control planes) for adversarial environments like SaaS platforms.

One giant cluster is cheaper than 100 small ones. Multi-tenancy is the practice of hosting multiple teams, users, or applications on a single shared cluster securely.

1. Soft Isolation​

Visualize how teams are partitioned.

Namespace: team-a
Soft Isolation
Quota: 4 vCPU / 8Gi
Namespace: team-b
Network Policy Active
Quota: 2 vCPU / 4Gi
Multi-tenancy in Kubernetes is achieved via Logical Isolation. By combining Namespaces, ResourceQuotas, and NetworkPolicies, you can securely host multiple teams on one physical cluster.

2. The Three Pillars of Isolation​

  1. Namespaces: The logical border. Teams can't see objects in other namespaces by default.
  2. ResourceQuotas: The economic border. Prevents "Team A" from taking all the CPU and starving "Team B".
  3. NetworkPolicies: The network border. Blocks pods in Namespace A from talking to pods in Namespace B unless explicitly allowed.

3. Hard vs. Soft Multi-Tenancy​

  • Soft (Trusting): Used inside a company. We trust our developers, but want to prevent accidents.
  • Hard (Adversarial): Used by SaaS providers (e.g. Google Cloud). Requires separate Control Planes or VMs for each user to prevent kernel-level attacks.