Comparison
Noisy neighbourvsTenant isolation
Noisy neighbour
one customer's enormous batch job makes every other customer's requests slow, on shared infrastructure they cannot see.
One tenant's resource consumption degrading others on shared infrastructure. It is the defining operational problem of multi-tenancy, and it appears at every layer: CPU, connection pools, cache space, database locks. Per-tenant quotas, bulkheads and fair queueing are the mitigations; "we will notice" is not.
Full entry →Tenant isolation
you decide whether a namespace is enough or whether each customer needs their own cluster, and the answer is about who you are defending against.
The strength of the boundary between tenants, which ranges from logical separation inside one cluster to separate clusters, accounts or hardware. Containers share a kernel, so a namespace is a fairness and access-control boundary rather than a defence against a determined attacker. Choosing the level is a threat-model decision, and it is the most expensive thing to change later.
Full entry →