eg-multi-tenant

Multi-tenant isolation in Envoy Gateway is configured by provisioning per-tenant namespaces with scoped Gateway and HTTPRoute policies. This prevents cross-tenant access by attaching tenant-specific SecurityPolicy and BackendTrafficPolicy for isolated auth and rate limits across a shared control plane.

The best way to enforce per-tenant rate limits is by attaching tenant-specific SecurityPolicy and BackendTrafficPolicy to each tenant's routes. This isolates authentication and traffic controls per tenant while maintaining a shared Gateway controller in Kubernetes.

Yes, you can use cross-namespace references with a shared Envoy GatewayClass. The multi-tenant setup explicitly satisfies deployment workflow requirements for cross-namespace references, enabling per-tenant routing across isolated namespaces with a common controller.

Onboarding new SaaS tenants involves creating tenant namespaces and defining per-tenant HTTPRoutes and SecurityPolicies. You deploy a shared GatewayClass to enable isolated gateway runtimes, allowing each tenant specific routing, security, and RBAC controls.

Yes, multi-tenant Envoy Gateway supports observability telemetry for individual tenants. The deployment workflow includes configuring per-tenant routes, security policies, rate limits, and observability telemetry across namespaces to monitor isolated tenant traffic.

You should not use a shared control plane for multi-tenant gateway routing when strict runtime isolation is required beyond namespace-level controls. This approach relies on policy enforcement within a shared controller, which may not satisfy tenants requiring completely separate gateway infrastructure.