Resource Isolation

Resource isolation prevents one tenant from consuming excessive cluster resources and starving other tenants. The MATIH Platform enforces resource isolation through Kubernetes ResourceQuotas, LimitRanges, and priority classes, ensuring fair resource distribution across all tenants.

ResourceQuota Enforcement

Each tenant namespace has a ResourceQuota that sets hard limits on the total resources available:

Resource	Description	Enforcement Point
`requests.cpu`	Total CPU requested by all pods	Kubernetes scheduler
`requests.memory`	Total memory requested by all pods	Kubernetes scheduler
`limits.cpu`	Maximum CPU limit across all pods	Kubernetes scheduler
`limits.memory`	Maximum memory limit across all pods	Kubernetes scheduler
`pods`	Maximum number of pods	Kubernetes API server
`services`	Maximum number of services	Kubernetes API server
`persistentvolumeclaims`	Maximum storage claims	Kubernetes API server

When a tenant's namespace reaches its quota, new pod creation is rejected until resources are freed.

Quota Configuration by Tier

Resource	Free	Professional	Enterprise
CPU requests	2 cores	8 cores	Custom
Memory requests	4Gi	16Gi	Custom
CPU limits	4 cores	16 cores	Custom
Memory limits	8Gi	32Gi	Custom
Pods	20	50	Custom
Services	10	20	Custom
PVCs	5	10	Custom

Enterprise tenants can request custom quotas based on their workload requirements and SLA agreements.

LimitRange

LimitRanges provide default resource limits for individual containers and pods:

apiVersion: v1
kind: LimitRange
metadata:
  name: tenant-limits
spec:
  limits:
    - type: Container
      default:
        cpu: 500m
        memory: 512Mi
      defaultRequest:
        cpu: 100m
        memory: 256Mi
      max:
        cpu: "2"
        memory: 4Gi
      min:
        cpu: 50m
        memory: 64Mi

Setting	Purpose
`default`	Applied when a container does not specify limits
`defaultRequest`	Applied when a container does not specify requests
`max`	Maximum allowed per container
`min`	Minimum required per container

Priority Classes

The platform uses Kubernetes PriorityClasses to ensure critical services are scheduled first:

Priority Class	Priority Value	Services
`platform-critical`	1000000	Control Plane services
`tenant-high`	100000	Core Data Plane services (ai, query-engine)
`tenant-normal`	10000	Other Data Plane services
`tenant-low`	1000	Background jobs, batch processing

When the cluster is under resource pressure, lower-priority pods are preempted to make room for higher-priority pods.

Resource Monitoring

Metric	Source	Alert Threshold
CPU utilization per namespace	Prometheus `container_cpu_usage_seconds_total`	80% of quota
Memory utilization per namespace	Prometheus `container_memory_working_set_bytes`	85% of quota
Pod count per namespace	Prometheus `kube_pod_info`	90% of quota
Quota exhaustion events	Kubernetes events	Any rejection

Capacity Planning

Resource quota values are derived from the tenant tier and observed workload patterns:

Workload Factor	Impact on Quota
Number of active users	More users = more concurrent requests = higher CPU
AI query volume	AI inference is CPU/memory intensive
Dashboard count	More dashboards = more concurrent queries
ML training jobs	Training requires burst compute capacity
Data volume	Larger datasets require more memory for query processing

Quota Escalation

When a tenant consistently hits their quota limits:

Step	Action
1	Billing service detects quota pressure via metrics
2	Notification sent to tenant admin
3	Tenant admin requests tier upgrade
4	Platform admin approves and adjusts quota
5	ResourceQuota updated in namespace (no restart required)

Burst Handling

For Enterprise tenants, the platform supports burst capacity:

Feature	Description
Burst CPU	Allow short-term CPU usage above quota (Kubernetes `limits` vs `requests`)
Auto-scaling	Horizontal Pod Autoscaler within quota bounds
Queue-based overflow	AI and ML requests queued when at capacity

Namespace Isolation -- NetworkPolicy and RBAC
Database Isolation -- Schema-level data isolation
Tenant Context Propagation -- Application-level context
Architecture: Multi-Tenancy -- Full multi-tenancy architecture

Namespace Isolation RBAC Model