A reference architecture for a multi-tenant internal developer platform on Kubernetes, balancing tenant isolation against the operational overhead of running separate clusters per team.
Namespace-based tenancy with guardrails
Rather than a cluster-per-team model (expensive to operate at scale) or a fully shared cluster with no isolation (risky), this pattern uses namespace-per-team tenancy enforced with resource quotas, network policies, and OPA/Gatekeeper admission policies.
Golden path tooling
A self-service internal developer platform (built on tools like Backstage) exposes pre-approved templates for common workload patterns, so teams get sensible defaults for autoscaling, observability, and security without needing deep Kubernetes expertise.
Cost allocation across tenants
Kubecost or an equivalent cost-allocation tool attributes shared cluster costs back to individual namespaces/teams, which is essential for a credible internal chargeback model and for justifying the platform’s own headcount.
Leave a Reply