Hardening · Workload isolation

Node Pools

Dedicated node pools keep selected tenants off the same worker nodes. They replace one cluster-wide host trust domain with smaller, more deliberate ones.

A node pool is a group of worker nodes configured and managed together. Giving a tenant or trust class its own pool means its workloads no longer share a kernel with tenant workloads in other pools. A container escape on one of those nodes has a smaller immediate blast radius.

Node pools are especially useful when tenants have different risk profiles, or when a sensitive workload cannot accept the shared kernel boundary described in the Nodes risk. This does have a knock-on reduction in the cost benefits of Kubneretes

References & further reading

← All hardening techniques