Multi-Tenancy

Tenancy Models

Soft tenancy — one shared cluster, namespaces as tenant boundaries. Cheap to run and operate; isolation depends entirely on correctly configured Kubernetes primitives (quotas, RBAC, network policy, admission).

Hard tenancy — a cluster (or vcluster/virtual control plane) per tenant. Strong isolation, independent upgrades and failure domains, at the cost of control planes and overhead per tenant.

Hybrids are common: trusted teams share a cluster; untrusted or regulated tenants get dedicated ones. The same primitives apply inside either boundary — shared clusters just make them non-optional.

Soft-Tenancy Controls

Four mechanisms fence each namespace:

apiVersion: v1
kind: ResourceQuota
metadata: { name: team-a, namespace: team-a }
spec:
  hard:
    requests.cpu: "20"
    requests.memory: 40Gi
    limits.cpu: "40"
    pods: "60"
    persistentvolumeclaims: "20"

• ResourceQuota caps consumption; a matching LimitRange supplies per-container defaults so pods omitting requests are rejected rather than admitted unbounded
• RBAC: Role + RoleBinding granting only in-namespace verbs to tenant identities (prefer groups)
• NetworkPolicy: default-deny plus explicit allows between tenants and shared services
• Pod Security Admission: label the namespace pod-security.kubernetes.io/enforce: baseline (or restricted) to block privileged containers

Hierarchical Namespace Controller can delegate sub-namespace administration for tenant self-service.

Limits and Interview Angles

Namespaces are not a security boundary. Tenants share kernels, kubelets, and often nodes; kernel CVEs and side-channel risk cross namespace lines. High-assurance isolation needs separate clusters (or a hardened nested-control-plane design with node separation).

NetworkPolicy enforcement varies. Without a CNI that implements policies, your "isolation" silently allows everything.

ClusterRoles leak scope. A tenant granted nodes or secrets cluster-wide has effectively escaped the namespace.

Quota gaps. Quotas bound CPU/memory/PVCs but not image pulls, number of Ingresses, or Cost from CRDs — audit what your quota omits.

Interview angle: state exactly what namespace isolation guarantees and what it does not, then defend your tenancy choice against a stated threat model (internal teams vs external customers vs regulated data).