Multi-tenant Kubernetes is a promise and a problem at the same time. You get utilisation and operational efficiency; you take on the job of making sure one compromised workload cannot become everyone's compromised workload. On AWS, that job is mostly about protocol-level trust between services — and most clusters are not set up for it.

The threat model

In a multi-tenant cluster, the network boundary is already breached by design. Tenants share nodes, the control plane, and the network overlay. The question is not "how do we keep attackers out" but "how do we stop one tenant from reaching another".

The risks that matter:

Lateral movement — a compromised pod in tenant A reaching tenant B's services.

Cross-tenant traffic sniffing — plain-text service calls that any workload on the same node can observe.

Control-plane targeting — misconfigured RBAC or network policies that expose the API server or etcd.

The two controls that matter most

1.…