● Covered by 2 sources · 2 reportsMedium impact2 neutral
ReadyOn Details Four-Layer Tenant Isolation Architecture for Multi-Tenant Amazon EKS
Key points
- ReadyOn uses four layers for tenant isolation on Amazon EKS.
- Layers include Kubernetes namespaces, Karpenter node pools, VPC security groups, and Aurora databases.
- Architecture prevents cross-tenant access across multiple infrastructure layers.
- Designed to secure payroll and analytics data for enterprise customers.
- AWS published an architecture for multi-tenant Kubernetes security gaps.
- The solution uses namespace-scoped mTLS gateways, managed TURN relay, and JWT identity chains.
- The architecture secures cross-namespace traffic and provides scalable authentication.
- The solution addresses protocols like ADB and WebRTC lacking encryption and enterprise authentication.
Multi-Layered Isolation for Harmony Platform
ReadyOn has implemented a four-layer tenant isolation architecture for its Harmony workforce intelligence platform, which operates on Amazon Elastic Kubernetes Service (EKS). This architecture is designed to prevent unauthorized access between different tenants sharing the same infrastructure.
Addressing Multi-Tenant Security Challenges
The Harmony platform handles sensitive enterprise data, including payroll, organizational hierarchies, and operational analytics. ReadyOn maps its security controls against a 10-stage multi-tenant threat model, specifically focusing on preventing lateral movement from a compromised tenant workload. The company reports that internal adversarial exercises have not yet found a successful cross-tenant path.
Architectural Components
The first layer of isolation uses dedicated Kubernetes namespaces for each tenant, enforced with RBAC, resource quotas, admission controls, and default deny network policies. Argo CD ApplicationSets generate these resources from Git configurations, ensuring consistent controls and automatic reconciliation of changes.
The second layer provides compute isolation through Karpenter, which provisions dedicated node pools for each tenant. This is achieved using a dual taint strategy, requiring pods to tolerate both a tenant-identifying taint and a workload-type taint. An admission controller verifies that requested tolerations match the tenant's namespace.
The third layer enforces security below Kubernetes. Per-tenant VPC security groups restrict database connections to their corresponding tenant node pools. Kubernetes network policies further enforce default deny behavior between namespaces.
Industry Perspective
Mohammad Akbarpour, a Professor at Stanford Graduate School of Business, noted the broader challenge of advancing AI capabilities while securing data boundaries. William Antonio G, Principal AWS Engineer at Sparq, highlighted how multi-tenancy fundamentally alters the security threat model compared to single-tenant clusters.
Updates
- AWS published an architecture for multi-tenant Kubernetes security gaps.
- The solution uses namespace-scoped mTLS gateways, managed TURN relay, and JWT identity chains.
- The architecture secures cross-namespace traffic and provides scalable authentication.
- The solution addresses protocols like ADB and WebRTC lacking encryption and enterprise authentication.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Primary sources
GitHub cert-manager/aws-privateca-issuerHow outlets covered it
AWS published an architecture to address security gaps in multi-tenant Kubernetes clusters, specifically for protocols like ADB and WebRTC that lack encryption and enterprise authentication. The solution uses namespace-scoped mutual TLS (mTLS) gateways, managed TURN relay via Amazon Kinesis Video Streams, and JWT identity chains integrated with an enterprise identity provider. This architecture aims to secure cross-namespace traffic and provide scalable authentication for protocols that do not natively support it.
ReadyOn implemented a four-layer tenant isolation architecture for its Harmony platform on Amazon EKS, combining Kubernetes namespaces, dedicated Karpenter node pools, Amazon VPC security groups, and per-tenant Amazon Aurora databases. This design aims to prevent cross-tenant access at the Kubernetes, compute, network, and data layers, addressing security challenges in multi-tenant environments.