Architecting multi-tenant PaaS offerings
summary
Shows how to run a pooled EKS cluster for external customers using namespaces plus enforced RBAC, NetworkPolicy and PodSecurityPolicy to block cross-tenant access, and recommends deleting the default eks privileged PSP. Describes using IAM Roles for Service Accounts (OIDC + STS) to scope S3/Dynamo access per tenant, metering with Prometheus or CloudWatch Container Insights to implement cost-per-tenant billing, and options for stronger isolation like node affinity/taints, Firecracker microVMs, ALB ingress v2 target groups, and vertical pod autoscaler. Never expose the Kubernetes API to tenants.
AI-written summary · about
chapters (11)
- 0:00Welcome and introduction
- 1:04Platform as a Service overview
- 3:56Multi-tenant design fundamentals
- 6:21Kubernetes multi-tenancy challenges
- 13:05Compute isolation techniques
- 22:23Network isolation strategies
- 30:50Resource quotas and isolation
- 37:36Storage isolation approaches
- 46:11Cost per tenant monetization
- 51:52Advanced hardware isolation
- 55:05Database scaling with VPA
related talks
29mManaging a Multi-Tenanted Kubernetes Cluster in Production
37mMulti-Tenancy in Kubernetes: Best Practices Today, and Future Directions
37mTenant Autonomy & Isolation In Multi-Tenant Kubernetes Clusters - A Comprehensive Guide
40mPanel Discussion: Multi-Tenancy in Kubernetes: Current State and Future Roadmap
25mSecuring Kubernetes Multi-Tenancy: Navigating Challenges Through DevSecOps Control and Visibility
46mAdvanced Kubernetes: Lesson Learned From Building..
20mDesigning a Multitenancy Kubernetes Strategy That Fits Your Org
38mMulti-Tenancy WG Deep Dive