Kubernetes multi-tenancy isolation tested across namespaces gVisor

This practical guide explores multi-tenancy in Kubernetes, testing four layers of isolation—namespaces, dedicated nodes, sandboxed kernels via gVisor, and virtual control planes—against various escape attempts. The author demonstrates that informal agreements and basic configurations fail under scrutiny, and argues that robust isolation requires explicit policies enforced by admission controllers and network plugins. Open article →