Kubernetes for the Enterprise: Multi-Tenancy, Security, and Day 2 Operations

A production-ready guide to running Kubernetes at enterprise scale — from cluster topology to namespace governance and workload security.

Covers cluster topology decisions (single large cluster vs fleet of small clusters), namespace-as-a-service multi-tenancy model, network policy design, Pod Security Standards, secret management (Vault + External Secrets Operator), RBAC design patterns, node pool strategy, cluster autoscaling, and the Day 2 operational model including upgrade cadence, certificate rotation, and incident response playbooks.

EDITION · Q3 2021 · 40 PAGES

DEVOPS

Kubernetes for the Enterprise

CELESDEV Solutions · celesdev.com

Executive Summary

Running Kubernetes well is an operating model problem

Getting workloads onto Kubernetes is the easy part. The hard part is the 18 months after go-live: cluster upgrades, secret sprawl, multi-team namespace governance, and the slow accumulation of security exceptions that turn a well-designed cluster into an audit risk.

This document draws on production Kubernetes operations across twelve enterprise clusters, ranging from 50-node single-region to 1,200-node multi-region fleet deployments on AKS and EKS.

1

Namespace-as-a-service beats shared namespaces

Giving each team a dedicated namespace with resource quotas, network policies, and RBAC provisioned automatically via GitOps prevents the resource contention and blast radius issues that plague shared namespaces.

2

External Secrets Operator eliminates secret sprawl

Injecting secrets at runtime from Vault or cloud key management services, rather than storing them in Kubernetes Secrets, is the only pattern that survives a SOC 2 audit without significant manual remediation.

3

Cluster upgrades require quarterly cadence

Clusters more than two minor versions behind the current release accumulate critical CVEs faster than they can be patched individually. Quarterly upgrade cadence with automated node pool rotation is the minimum viable maintenance model.

4

Pod Security Standards replace PSPs correctly

Migration from PodSecurityPolicy to Pod Security Standards requires per-namespace baseline/restricted mode assignment before PodSecurityPolicy removal to avoid silent workload breakage post-1.25.

Cluster Operating Model

Enterprise Kubernetes Stack

Kubernetes Platform Architecture

Developer Self-Service · Namespace Provisioning

GitOps · ArgoCD · Kustomize · Helm

Security · Network Policy · PSS · RBAC

Secrets · Vault · External Secrets Operator

Observability · Prometheus · Grafana · Loki

Author: CELESDEV Solutions — Cloud & Platform Practice.

Applicable contexts: Enterprises running 10+ services on Kubernetes; organisations migrating from Docker Swarm or VM-based deployments; teams managing AKS, EKS, or GKE in production.

Full document includes RBAC role templates, Vault policy examples, network policy library, and a Kubernetes upgrade runbook with rollback procedure.

CELESDEV Solutions | celesdev.com | business@celesdev.com

2 of 3 - Executive Summary

Kubernetes for the Enterprise

CELESDEV Solutions | celesdev.com

Security Hardening Checklist

Cluster security baseline controls

CONTROL AREA	REQUIREMENT	MANDATORY
Pod Security	Restricted profile on all workload namespaces	YES
Network Policy	Default-deny ingress + egress per namespace	YES
RBAC	Least-privilege roles; no cluster-admin bindings	YES
Secrets	External Secrets Operator + Vault; no inline secrets	YES
Image policy	Admission controller enforces signed images only	YES
Audit logging	API server audit log shipped to SIEM	YES
Runtime security	Falco or equivalent for anomaly detection	REC.

Day 2 Operations Calendar

Cluster maintenance operating cadence

WEEKLY

Review DLQ depth and failed pod restarts. Check node pool utilisation and pending pod alerts. Validate certificate expiry warnings. Scan for new CVEs in deployed container images.

MONTHLY

Rotate service account tokens and review RBAC bindings. Run kube-bench CIS benchmark and remediate findings. Review namespace resource quotas against actual consumption.

QUARTERLY

Execute cluster minor version upgrade using blue-green node pool rotation. Drain and cordon old nodes; validate workload migration. Run game day chaos test. Review and update network policies.

ANNUALLY

Full disaster recovery drill including control plane restore from etcd backup. Review cluster topology for the next 12-month capacity plan. Assess certificate authority rotation schedule.

CELESDEV Solutions | celesdev.com | business@celesdev.com

3 of 3 - Technical Reference