Comparison
Shuffle shardingvsTenant isolation
Shuffle sharding
each customer is assigned a random pair of workers rather than one, so two customers rarely share both and one bad tenant cannot take out everyone.
Assigning each tenant a random subset of workers, so that any two tenants overlap only partially. With modest numbers it makes the probability of two given tenants sharing an entire subset very small, which means a tenant that poisons its workers damages only a tiny fraction of the others. It is one of the highest-leverage ideas in multi-tenant reliability and it costs essentially nothing but assignment logic.
Full entry →Tenant isolation
you decide whether a namespace is enough or whether each customer needs their own cluster, and the answer is about who you are defending against.
The strength of the boundary between tenants, which ranges from logical separation inside one cluster to separate clusters, accounts or hardware. Containers share a kernel, so a namespace is a fairness and access-control boundary rather than a defence against a determined attacker. Choosing the level is a threat-model decision, and it is the most expensive thing to change later.
Full entry →