Kubernetes at Cruise: Two Years of Multitenancy
Talkat KubeCon + CloudNativeCon North America 2019 · on Tuesday, 2019-11-19· at 10:55· Room 6F - San Diego Convention Center, Upper Level·
summary
Cruise runs Kubernetes with over 40 internal tenants, ~100,000 pods and ~4,000 nodes and reports moving from “barely isolated” to tightly isolated while saving millions. Practical details include using GKE, Cloud NAT, Istio for L7 rate limits, Spinnaker + a Spinnaker operator for per-namespace CD, Vault with Daytona sidecar for in-memory secrets, policy enforcement via K-Rail, and deployment add-ons via Isopod and internal Juno. Major pain points: DNS saturation, ephemeral storage/quota, network/QPS and shared CRD/tooling limits.
AI-written summary · about
chapters (10)
- 0:00Intro
- 1:37What is multitenancy
- 5:47Authentication
- 10:07Permission Isolation
- 14:21Resource Isolation
- 16:52Network Isolation
- 18:59Network Policies
- 22:08Shared Observability
- 24:37Was it worth it
- 28:30Questions
related talks
29mNavigating the Multitenancy Maze: Avoiding Kubernetes Antipattern Pitfalls
32mKubernetes Namespaces Unleashed: Unlocking the Full Potential of You...
34mEmbracing Upstream Kubernetes in Web Scale Organization
35mKubernetes, Lessons Learnt
35mKubernetes journey
06mLightning Talk: OpenKruise: Advancing Kubernetes Workload Auto...
51mMulti-tenant Kubernetes
33mKubernetes Multi-tenancy: Principles and Practices for Large Scale Internal Deve...