Chapter 26 — Cloud and container security: architecture alternatives
Lesson map
Lesson 26 published. Map, example, EX076.
flowchart TD
N0["Learning outcomes"]
N1["26.1 The options"]
N2["26.2 Criteria"]
N3["26.3 Evaluation"]
N4["26.4 Hybrid with nodes"]
N5["26.5 Decision"]
N6["26.6 Revisit triggers"]
N7["Scoring the options"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX076"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["26.1 The options"]
N2["26.2 Criteria"]
N3["26.3 Evaluation"]
N4["26.4 Hybrid with nodes"]
N5["26.5 Decision"]
N6["26.6 Revisit triggers"]
N7["Scoring the options"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX076"]
[Learning outcomes]
|
v
[26.1 The options]
|
v
[26.2 Criteria]
|
v
[26.3 Evaluation]
|
v
[26.4 Hybrid with nodes]
|
v
[26.5 Decision]
|
v
[26.6 Revisit triggers]
|
v
[Scoring the options]
|
v
[Worked example] --> [Exercise EX076]
Learning outcomes
You will (1) compare isolation and tenancy architectures for meterhub; (2) evaluate cost, risk and operations; (3) choose with explicit criteria; (4) record the decision.
26.1 The options
Option 1: one shared cluster with namespaces per service and strict policies. Option 2: one cluster per environment and sensitivity tier. Option 3: one cluster per service. Each gives a different balance of isolation, cost and operational effort.
The three options sit on a spectrum. At one end, everything shares a control plane and nodes, so isolation rests on namespaces, policies and admission rules. At the other, each service has its own cluster and a compromise stays inside it, but every cluster must be upgraded, monitored and secured separately. The middle option groups services by how much harm a compromise would do, which is how many organisations of Solent's size settle the question.
26.2 Criteria
Blast radius if a workload is compromised; cost of control planes and nodes; operational effort for upgrades; consistency of policy; regulator expectations for separation of payment data.
Blast radius asks what an attacker could reach after compromising one workload. Cost includes control-plane fees and the extra nodes that partly empty clusters waste. Operational effort counts the hours four engineers would spend on upgrades each quarter. Policy consistency matters because many clusters drift apart. Regulator expectations are a hard constraint: if separation of payment data is required, an option that cannot show it is ruled out regardless of its other scores.
26.3 Evaluation
Option 1 is cheapest but relies on Kubernetes isolation between namespaces; NIST SP 800-190 suggests grouping containers by sensitivity. Option 3 isolates best but multiplies upgrade work by the number of services. Option 2 balances them: a high-sensitivity cluster for readings and payments, a standard cluster for other services.
Elena puts rough numbers on each option: Option 3 would mean around a dozen clusters to upgrade, each upgrade taking a day, which the team cannot sustain alongside other work. Option 1 would need only one, but a flaw in namespace isolation would expose everything. Option 2 needs two clusters, keeps readings and payments apart from general services, and fits the team's capacity. The scores and the reasons behind them go into the comparison table.
26.4 Hybrid with nodes
Within a cluster, dedicated node pools for sensitive or privileged workloads add separation at the host level.
Namespaces separate workloads logically, but pods from different namespaces can still share a node and its kernel. Dedicated node pools, enforced with taints and tolerations, keep sensitive or privileged pods on their own machines. A kernel-level escape from a general workload then lands on a node with nothing sensitive on it. The node agent, which needs elevated privileges, runs in a pool kept apart from the ingest and database workloads.
26.5 Decision
Option 2 with dedicated node pools, recorded in an architecture decision record with criteria scores.
The record states the context (one shared cluster with no policies after the key leak), the options, the scores against each criterion, the choice and its consequences, including the extra cost of a second cluster and the work of keeping two sets of policies in step. It names who decided and when. Recording scores means a future reviewer can see how close the alternatives were, not just which one won.
26.6 Revisit triggers
The decision is revisited if the number of services doubles, the regulator changes rules or a namespace isolation weakness is published.
Decisions made for one set of conditions can become wrong as conditions change. Doubling the number of services would raise the cost of managing policies in shared clusters. A regulatory change could demand stricter separation. A published flaw in namespace isolation would weaken the main assumption behind Option 2. Naming triggers in advance means the team reconsiders at the right moment rather than when a problem has already happened.
Scoring the options
Each criterion is scored 1 to 5 by three engineers independently, then discussed. Disagreements on operational effort lead to a quick estimate of upgrade hours per cluster, which settles the scores. The scored table goes into the decision record.
Exit path
The decision notes how to merge clusters later if needs change.
Worked example
The finance team questions the extra cluster's cost. Elena shows that it is about 8% of platform spending and that it lets audits of the payment service cover one small cluster instead of the whole estate, saving auditor time each year.
Synthetic case. Options and costs are synthetic.
Errors and limits
Strong isolation can create false confidence if identities span clusters; check identity boundaries too.
Exercises
- EX076 — Three options. Name the three options. Rubric: 3 = shared, per tier, per service; 2 = two; 1 = one; 0 = none.
- EX077 — Chosen option. Which option was chosen? Rubric: 3 = per tier with dedicated node pools; 2 = partial; 1 = vague; 0 = none.
- EX078 — Cost argument. How was the extra cost justified? Rubric: 3 = ~8%, simpler audits; 2 = partial; 1 = vague; 0 = none.
Synthesis
Choose isolation with explicit criteria and revisit triggers.
Continue studying — chapter 26 of 50
← Chapter 25 (draft) · Course chapter index · Chapter 27 (draft) →