Designing and Securing a Multi-Tenant Runtime Environment at the New York Times
summary
Builds multi-tenant Kubernetes clusters on EKS to host thousands of pods and scale to 100+ nodes, chooses Cilium on EKS for performance and L3–L7 policies, automates provisioning with Terraform (removing AWS CNI and kube-proxy) and uses IP prefix mode to avoid ENI exhaustion, adds Hubble for flow-level observability, hits a day‑2 incident where Envoy pods suffer intermittent DNS/IP failures caused by an IP-release race in the Cilium ENI allocator, dives into Cilium code, disables the feature temporarily and lands a contributed fix upstream, and validates that eBPF-powered dataplane improves throughput and visibility.
AI-written summary · about
chapters (6)
- 0:00Start
- 6:27Design Considerations
- 8:19Performance
- 10:05Observability
- 12:01Install Script
- 14:38Tenant Onboarding & Isolation
related talks
39mDesigning & Securing Multi-Tenant Runtime Environment at the New York Times
28mWhat We Learned Designing & Securing a Multi-Tenant Developer Platform at The New York Times
05mLightning Talk: What Makes a Good Multi-tenant Kubernetes Solution?
24mScaling Argo Security and Multi-Tenancy in AWS EKS at the New York Times
01h 00mArchitecting multi-tenant PaaS offerings
21mDedicated Infrastructure in a Multitenant World
28mA Decade of Cilium Around the World
32mKubernetes Namespaces Unleashed: Unlocking the Full Potential of You...