Hardening · Workload isolation
Node Pools
Dedicated node pools keep selected tenants off the same worker nodes. They replace one cluster-wide host trust domain with smaller, more deliberate ones.
A node pool is a group of worker nodes configured and managed together. Giving a tenant or trust class its own pool means its workloads no longer share a kernel with tenant workloads in other pools. A container escape on one of those nodes has a smaller immediate blast radius.
Node pools are especially useful when tenants have different risk profiles, or when a sensitive workload cannot accept the shared kernel boundary described in the Nodes risk. This does have a knock-on reduction in the cost benefits of Kubneretes