YTJK Systems

Home / Insights

Designing a multi-tenant Kubernetes platform

Platform architecture · YTJK Systems Ltd

Multi-tenancy is a spectrum of isolation, not a single choice. The right level depends on how much control each tenant needs and how much separation the business requires, and most platforms use more than one level at once.

Isolation levelsChosen per workload; most platforms use more than one.
  1. NamespaceOne per application and environment, e.g. payments-prodSoft isolation, lowest cost
  2. TenantSelf-service namespaces within a team's quotaTeam autonomy on shared clusters
  3. Virtual clusterOwn API server, CRDs, operators and admin rights on shared nodesControl-plane isolation
  4. Dedicated clusterRegulated data, separate versions or distinct scaling such as GPUHard isolation, highest cost

More isolation, more cost and operational effort

Tenant onboarding as codeEvery tenant starts secure and consistent
  1. Tenant definitionDeclared in Git: owners, environments, quotas
  2. Review and policyPull request, automated policy checks
  3. GitOps controllerReconciles the desired state
  4. Guardrails appliedNamespaces, group RBAC, quotas, network and admission policies
  5. Golden pathsService, pipeline and dashboard templates
Shared platform services
  • Ingress and DNS
  • Certificates
  • Secrets
  • Policy engine
  • Observability
  • Cost attribution

Key design decisions

  • Isolation per workload, not per platform: namespaces per application and environment by default; a tenant layer where teams need self-service; virtual clusters when teams need cluster-scoped resources; dedicated clusters only for regulatory separation, different Kubernetes versions or distinct scaling profiles such as GPU workloads.
  • Onboarding as code: one tenant definition creates namespaces, group-based RBAC, quotas and limit ranges, network policies and admission policies, so every tenant starts secure and consistent.
  • Data-plane isolation on shared nodes: default-deny networking, dedicated node pools or taints for sensitive and GPU workloads, and sandboxed runtimes where the risk justifies it.
  • Golden paths: templates for a service, its pipeline and its dashboards, so the secure default is also the easiest option.
  • Cost attribution: tenant, application and cost-centre labels from day one, so spend can be shown back to the business.