Multi-tenancy limits and pitfalls — what namespaces cannot do

Namespaces have limits. This lesson walks what namespaces cannot do, the failure modes, the verification, and the operational discipline of recognising when namespaces are not enough.

What namespaces cannot do

flowchart LR
    A[Namespace cannot] --> B[Isolate network without NetworkPolicy]
    A --> C[Isolate resources without ResourceQuota]
    A --> D[Isolate kernel]
    A --> E[Isolate workload identity without ServiceAccount per tenant]
    A --> F[Reduce blast radius for control-plane failure]
    A --> G[Protect from misconfigured policies]

The limits:

• No network isolation without NetworkPolicy. Two Pods in different namespaces can talk by default.
• No resource isolation without ResourceQuota. A namespace’s Pods can starve the node.
• No kernel isolation. cgroups are not per-namespace; pods share the kernel.
• No workload identity isolation without ServiceAccount per tenant. The default ServiceAccount is shared.
• No blast radius reduction for control-plane failure. A control-plane failure takes down every namespace.
• No protection from misconfigured policies. A missing NetworkPolicy breaks isolation for all tenants.

The failure modes

flowchart LR
    A[Failure modes] --> B[Escaped Pod]
    B --> C[Privileged container breaks out of namespace]
    A --> D[Noisy neighbour]
    D --> E[One tenant's Pods starve others]
    A --> F[Etcd blast radius]
    F --> G[kubectl delete ns cascades]
    A --> H[Missing policies]
    H --> I[Isolation broken silently]

The failure modes:

• Escaped Pod. A privileged container breaks out of the namespace and accesses the node or other namespaces. PSS prevents this; missing PSS allows it.
• Noisy neighbour. One tenant’s Pods consume CPU, memory, or storage; other tenants’ Pods are evicted. ResourceQuota prevents this; missing ResourceQuota allows it.
• Etcd blast radius. A bad write or kubectl delete ns cascades; the namespace’s objects are gone. LimitRange and admission policies help; full protection requires cluster separation.
• Missing policies. NetworkPolicy, ResourceQuota, or PSS missing for a tenant; isolation is silently broken. Verification tests catch this.

Verification

flowchart TD
    A[Verification] --> B["Test 1: cross-namespace network blocked"]
    B --> C["Test 2: cross-namespace RBAC denied"]
    C --> D["Test 3: ResourceQuota enforced"]
    D --> E["Test 4: PSS blocks privileged"]
    E --> F["Test 5: ServiceAccount isolation"]
    F --> G{All pass?}
    G -->|Yes| H[Multi-tenancy verified]
    G -->|No| I[Fix policies and re-test]

The verification tests:

1. Cross-namespace network blocked. A Pod in tenant A cannot reach a Pod in tenant B.
2. Cross-namespace RBAC denied. A user in tenant A cannot list objects in tenant B.
3. ResourceQuota enforced. A namespace exceeding its quota is rejected.
4. PSS blocks privileged. A privileged Pod is rejected.
5. ServiceAccount isolation. A Pod in tenant A cannot mount a Secret from tenant B.

When namespaces are not enough

flowchart TD
    A[Use case] --> B{Need: separate control plane?}
    B -->|Yes| C[vCluster or separate cluster]
    B -->|No| D[Namespaces with policies sufficient]
    A --> E{Untrusted tenants?}
    E -->|Yes| C
    E -->|No| D
    A --> F{Compliance: PCI / HIPAA dedicated?}
    F -->|Yes| C
    F -->|No| D

When namespaces are not enough:

• Untrusted tenants. Soft multi-tenancy assumes tenants are trusted not to misconfigure their workloads. Untrusted tenants need vCluster or separate clusters.
• Compliance requires dedicated infrastructure. PCI DSS, HIPAA, FedRAMP may require physical isolation (separate clusters, separate accounts).
• Blast radius reduction. A regional outage or control-plane failure takes down every namespace. Multi-cluster reduces blast radius.

The discipline is to recognise when namespaces are sufficient and when they are not.

Quiz

The operational discipline

Multi-tenancy limits in production rest on five non-negotiable elements:

• Apply every layer. A namespace without NetworkPolicy, ResourceQuota, PSS, ServiceAccount isolation is not multi-tenant.
• Verify with tests. Automated isolation tests catch missing policies.
• Recognise the limits. Namespaces are anchors, not boundaries.
• Escalate to vCluster or separate clusters. When untrusted tenants or compliance require it.
• Audit periodically. Policies drift; the quarterly review catches the drift.

The discipline is to recognise when namespaces are enough and when they are not. A namespace is a tool; the right tool depends on the driver.