Kubernetes tenant isolation, from shared namespaces to a cluster per tenant
“Multi-tenant Kubernetes” covers a wide range of isolation, and the differences matter to a regulator far more than the label does. A shared cluster and a cluster-per-tenant are both “multi-tenant,” but they expose very different blast radiuses. Here is the spectrum, and how to match a tier to the risk.
The isolation spectrum
At the soft end, tenants share a cluster and its control plane, separated by namespaces, policies, and quotas. In the middle, each tenant gets its own Kubernetes API server as a virtual cluster, while still sharing the underlying nodes. At the hard end, each tenant gets a whole cluster of its own, with its own API server, its own datastore, and dedicated worker nodes that share no kernel with any other tenant.
Soft isolation, and its honest limits
Shared-node isolation is genuinely useful for sandboxes, proofs of concept, and cost-sensitive or non-regulated workloads. What it should not do is be presented to a regulator as hard isolation. Tenants that share a kernel share a class of risk, and an honest platform says so rather than letting the word “isolated” do the work.
Hard isolation for regulated workloads
When the workload is a bank, a financial institution, or a government system, the defensible answer is a dedicated cluster per tenant: no shared API server, no shared datastore, no shared kernel. The blast radius of a compromise stops at the tenant boundary because there is a real boundary there.
Match the tier to the risk
The mistake is treating isolation as one setting. Different workloads justify different tiers, and the right platform lets you choose per tenant rather than forcing one model on everything.
How Moncho does it
Moncho offers the range explicitly, and its softest tier is already a virtual cluster rather than bare namespace separation. Two soft tiers, one for development and test and one for business workloads, each give a tenant its own Kubernetes API server as a virtual cluster while sharing the underlying nodes; a dedicated tier gives a whole cluster per tenant, with its own API server, its own datastore, and dedicated worker nodes that share no kernel with any other tenant, for banks, financial institutions, and government. Soft isolation is offered as soft isolation, not dressed up as hard.
Md. Tawfiqul Bari
Md. Tawfiqul Bari is the founder and CEO of Vigilus Labs Incorporated, with a career spanning cybersecurity, cloud infrastructure, and enterprise security.
LinkedIn profileIf this maps to a system you run, the fastest next step is a 30-minute technical call: bring your engines, versions, and audit configuration, and we will run against a scenario you recognise. There is more on Moncho: managed Kubernetes if you would rather read first.