From one cluster per customer to one platform

The situation

TODO(anshuman): rewrite from your actual engagement, keeping this structure.

One dedicated Kubernetes cluster per customer. It had been the right decision at ten customers — simple isolation story, easy to reason about, easy to sell. At [[N]] customers it had become the main constraint on the business: onboarding took [[days]], infrastructure cost scaled linearly with revenue rather than sub-linearly, and a two-person platform team was hand-maintaining [[N]] near-identical clusters that had quietly drifted apart.

The constraint

• Enterprise customers had contractual isolation language that a naive "everyone shares a namespace" model would violate
• [[Any regulatory constraint — GDPR, data residency, sector-specific]]
• Migration had to be per-customer and reversible; a big-bang cutover was unacceptable to the account teams
• The platform team had no capacity to operate something more complex than what they had

That last constraint mattered most and is the one usually ignored. A tenancy model the team cannot run is worse than the problem it solves.

What I did

Designed a shared multi-tenant platform with isolation that was enforced rather than assumed:

• Namespace per tenant with hierarchical RBAC, so tenant-scoped access could be delegated without granting cluster-wide rights
• Network policy isolation as the default posture — deny cross-tenant traffic, allow by exception
• Resource quotas and priority classes per tenant, so one customer's batch job cannot degrade another's interactive traffic
• Admission policy enforcing the boundaries at the API server, so isolation is a property of the cluster rather than a convention in a runbook
• Per-tenant cost showback via OpenCost, which gave the commercial team unit economics per customer for the first time
• A documented escape hatch — a dedicated-cluster tier for the small number of customers with genuine hard-isolation requirements, priced accordingly

That last point was the one that made the design acceptable to sales. Pretending one model fits every customer is how these projects stall.

The outcome

• Cluster count reduced from [[N]] to [[N]]
• Customer onboarding moved from [[days]] to [[minutes]], fully automated
• Per-customer infrastructure overhead down [[N%]]
• Platform team reclaimed [[N]] hours a week previously spent on cluster maintenance
• Unit economics per customer visible to the commercial team

What I'd do differently

[[TODO(anshuman)]]