Platform & DevOps·Running it: capacity, failure and recovery
you decide whether a namespace is enough or whether each customer needs their own cluster, and the answer is about who you are defending against.
Tenant isolation
Also calledisolation boundary, hard multi-tenancy
The strength of the boundary between tenants, which ranges from logical separation inside one cluster to separate clusters, accounts or hardware. Containers share a kernel, so a namespace is a fairness and access-control boundary rather than a defence against a determined attacker. Choosing the level is a threat-model decision, and it is the most expensive thing to change later.