· ai-devtools
Readyon details four-layer tenant isolation for multi-tenant Amazon EKS
The foundation of ReadyOn's Harmony platform on Amazon EKS rests upon a four-layer tenant isolation architecture.
This design integrates Kubernetes namespaces, dedicated Karpenter node pools, VPC security groups, and distinct Aurora databases for each tenant.
These controls were rigorously evaluated against a 10-stage multi-tenant threat model, specifically targeting lateral movement and cross-tenant access. ReadyOn asserts that, as of now, adversarial exercises have not revealed any successful cross-tenant pathways.
The first barrier employs a unique Kubernetes namespace for every tenant, enforced with RBAC, resource quotas, admission controls, and default deny network policies. ReadyOn automates the creation of these resources using Argo CD ApplicationSets from Git configurations, ensuring consistent baseline controls across all tenants.
Compute isolation forms the second layer; Karpenter provisions separate node pools for each tenant via a dual taint strategy. Pods must satisfy both a tenant-identifying taint and a workload-type taint to be scheduled, with an admission controller verifying the requested tolerations match the namespace's tenant.
Enforcement extends beneath Kubernetes in the third layer. Per-tenant VPC security groups restrict database connections to the relevant tenant node pool, while Kubernetes network policies maintain default deny behavior between namespaces. Furthermore, the EKS API endpoint is secured via VPN, OpenID Connect, and multi-factor authentication.
The fourth layer achieves data separation by utilizing dedicated Aurora clusters, moving beyond reliance on row-level filtering within a single database. ReadyOn also implements tenant-scoped AWS Secrets Manager paths and uses short-lived credentials managed through IAM Roles for Service Accounts.
AWS documentation notes that while Kubernetes namespaces, RBAC, quotas, and network policies offer logical isolation, they do not prevent workloads from sharing underlying nodes; it suggests using taints and tolerations or affinity rules for stronger separation.
This layered approach has sparked debate regarding verification, as Juan Pablo Gaviria commented on LinkedIn, stating that "traces need to connect workload identity with database and network enforcement to expose gaps between controls. Isolation depth without observability depth is indistinguishable from false confidence."
