Comparison
Multi-tenancyvsTenant isolation
Multi-tenancy
several teams or customers share one cluster, and every performance question becomes 'is it us or is it them'.
Running multiple independent workloads or customers on shared infrastructure. It is what makes a platform economical, and it introduces isolation, fairness, quota and noisy-neighbour problems that dedicated infrastructure simply does not have. The critical distinction is whether the tenants trust one another: sharing between internal teams and sharing between hostile customers require entirely different boundaries.
Full entry →Tenant isolation
you decide whether a namespace is enough or whether each customer needs their own cluster, and the answer is about who you are defending against.
The strength of the boundary between tenants, which ranges from logical separation inside one cluster to separate clusters, accounts or hardware. Containers share a kernel, so a namespace is a fairness and access-control boundary rather than a defence against a determined attacker. Choosing the level is a threat-model decision, and it is the most expensive thing to change later.
Full entry →