eg-multi-tenant

Provision per-tenant Envoy Gateway isolation and policies in Kubernetes.

3|Updated Mar 8, 2026

Search Tags:#security #routing #kubernetes #multitenant #gateway #envoy

Ready to run

npx skills add https://github.com/missBerg/envoy-skills --skill eg-multi-tenant

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: eg-multi-tenant
Source: https://github.com/missBerg/envoy-skills/tree/main/gateway/adopters/skills/eg-multi-tenant
Command: npx skills add https://github.com/missBerg/envoy-skills --skill eg-multi-tenant

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Orchestrates a scalable, secure multi-tenant Envoy Gateway setup in Kubernetes, enabling tenant isolation and policy enforcement across routes and namespaces.

Core Features & Use Cases

Tenant isolation: Each tenant gets its own namespace-scoped Gateway and HTTPRoute policies to prevent cross-tenant access.
Centralized control with per-tenant security: Attach tenant-specific SecurityPolicy and BackendTrafficPolicy to isolate auth and rate limits per tenant.
Use Case: A SaaS provider onboarding new tenants with isolated gateway runtimes while sharing a common Gateway controller.

Quick Start

Create tenant namespaces, define per-tenant HTTPRoutes and SecurityPolicies, and deploy the shared GatewayClass to enable per-tenant routing and policies.

Frequently Asked Questions about eg-multi-tenant

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I configure multi-tenant isolation in Envoy Gateway on Kubernetes?▼

Multi-tenant isolation in Envoy Gateway is configured by provisioning per-tenant namespaces with scoped Gateway and HTTPRoute policies. This prevents cross-tenant access by attaching tenant-specific SecurityPolicy and BackendTrafficPolicy for isolated auth and rate limits across a shared control plane.

What is the best way to enforce per-tenant rate limits and security policies in a shared Envoy Gateway?▼

The best way to enforce per-tenant rate limits is by attaching tenant-specific SecurityPolicy and BackendTrafficPolicy to each tenant's routes. This isolates authentication and traffic controls per tenant while maintaining a shared Gateway controller in Kubernetes.

Can I use cross-namespace references for HTTPRoutes with a shared Envoy GatewayClass?▼

Yes, you can use cross-namespace references with a shared Envoy GatewayClass. The multi-tenant setup explicitly satisfies deployment workflow requirements for cross-namespace references, enabling per-tenant routing across isolated namespaces with a common controller.

How do I onboard new SaaS tenants with isolated gateway runtimes using Kubernetes?▼

Onboarding new SaaS tenants involves creating tenant namespaces and defining per-tenant HTTPRoutes and SecurityPolicies. You deploy a shared GatewayClass to enable isolated gateway runtimes, allowing each tenant specific routing, security, and RBAC controls.

Does multi-tenant Envoy Gateway support observability telemetry for individual tenants?▼

Yes, multi-tenant Envoy Gateway supports observability telemetry for individual tenants. The deployment workflow includes configuring per-tenant routes, security policies, rate limits, and observability telemetry across namespaces to monitor isolated tenant traffic.

When should I not use a shared control plane for multi-tenant gateway routing?▼

You should not use a shared control plane for multi-tenant gateway routing when strict runtime isolation is required beyond namespace-level controls. This approach relies on policy enforcement within a shared controller, which may not satisfy tenants requiring completely separate gateway infrastructure.