Default-deny network policies for tenant isolation on GKE

Thu, 05 Nov 2026 09:00:00 -0500

This post is for platform teams running multi-tenant Kubernetes on GCP, where each team or customer gets its own namespace. Network policies are the right tool for isolating services from each other, but they isolate only the pods a policy selects. The real work is setting a default-deny baseline in every tenant namespace and then allowing traffic on purpose. Below I cover what to turn on, the order I’d roll it out in, and where policies stop protecting you.

Credential isolation between clients on a shared GCP foundation

Thu, 26 Feb 2026 09:00:00 -0500

This post is for cloud engineers building a GCP foundation with Terraform that will host workloads for more than one client. Isolation between clients comes from giving each client principals and trust domains that cannot overlap. Naming conventions and the secrecy of identifiers do not provide it. If two clients’ workloads can end up as the same IAM principal, IAM cannot tell them apart, and a role granted to one applies to both. Below is how I would lay out service accounts, keys and pools so they can’t overlap, and when you can relax.

Gke on RLGeeX

Default-deny network policies for tenant isolation on GKE

Credential isolation between clients on a shared GCP foundation