Multitenancy

As explained in Platform Engineering on Kubernetes

Multi-tenancy is an architecture in which multiple tenants share underlying infrastructure while maintaining controlled separation of resources and access.

Multitenancy lets teams or customers share a platform while enforcing explicit tenant boundaries, resource limits, and access guarantees. On Kubernetes, platform teams must decide how much isolation each tenant needs and encode that decision in the platform architecture. section 6.2.1 section 6.2.3

Common Kubernetes tenancy choices trade operational cost against isolation and control:

• Namespaces provide cheap logical boundaries with little overhead, but require RBAC for visibility control and resource quotas to prevent resource exhaustion. section 6.2.3
• Namespace tenants share the Kubernetes API server, limiting cluster-wide installations, API-scale independence, and the ability to run conflicting extension versions. section 6.2.3
• Separate Kubernetes clusters provide stronger isolation, independent API endpoints, and tenant-level control over configuration, scalability, resilience, and installed tools. section 6.2.3
• vcluster creates virtual Kubernetes clusters inside a host cluster, giving tenants isolated API servers and, when required, cluster-wide control without provisioning separate physical clusters. section 6.3.1

Choosing vcluster for tenant environments

Use namespaces when teams only need workload access within assigned boundaries. Use vcluster when each tenant needs Kubernetes API access and freedom to install cluster-wide tools. Create a virtual cluster with the vcluster Helm chart or CLI, then connect the tenant to its isolated API server. section 6.3.1 section 6.2.3

Figure 6.14 vcluster provides isolation at the Kubernetes (K8s) API server

Inspect the architecture showing how vcluster isolates tenants at the Kubernetes API-server layer. section 6.3.1

Figure 6.15 Pros and cons of Kubernetes Namespaces vs. vcluster vs. Kubernetes cluster tenants

Compare the operational advantages and limitations of namespaces, vcluster, and separate Kubernetes clusters. section 6.3.1

How Platform Engineering on Kubernetes covers it

How deep it goes

Compares namespaces, clusters, and vcluster through concrete benefits, limitations, API boundaries, RBAC, and resource quotas.

Examples

Uses namespace boundaries, separate clusters, and virtual clusters created through Helm or the vcluster CLI as implementation examples.

What it assumes

Assumes familiarity with Kubernetes while distinguishing namespaces, RBAC, clusters, API servers, and controllers.

What you can do after

Evaluate tenancy requirements and choose namespaces, vcluster, or separate clusters for a Kubernetes platform.

How it connects

Connects multitenancy with Kubernetes Namespaces, RBAC, resource quotas, Kubernetes clusters, API servers, and vcluster.

liveBookmanning.com

Read Platform Engineering on Kubernetes on liveBook Get the book at manning.com

Also explained in

• 

  liveBookmanning.com
  Designing Deep Learning Systems: A guide for software engineersAn application that serves multiple tenants while keeping their data, configuration, or usage contexts logically separated.
• 

  liveBookmanning.com
  Google Anthos in ActionMultitenancy is an architecture in which multiple teams or tenants share a platform while retaining logical separation of their workloads and resources.

Compare how 3 books explain multitenancy →

Related concepts

• database tableuses · A database table is a relational database structure that organizes records into rows and defined columns.
• openid connectuses · OpenID Connect is an identity layer built on OAuth 2.0 that enables clients to authenticate end users and obtain standardized identity claims.
• namespaceproduced by · A namespace is a naming context or identifier space in which names are defined and resolved, distinguishing them from names in other contexts.

This explainer was generated by Manning's knowledge graph from the text of Platform Engineering on Kubernetes. The section links point to the parts of the book it draws on.