hardScenarioDesignSeniorStaff
Would you use iptables or eBPF for network policy enforcement in a massive multi-tenant Kubernetes cluster, and what are the operational trade-offs?
eBPF-based Kubernetes network policy can enforce hard multi-tenancy with faster identity-aware checks than long iptables chains, but it demands verifier-safe rollouts, fail-closed controls, and strong policy observability.
2 min readUpdated 2026-08-15
Answer
Short answer
For massive multi-tenant Kubernetes clusters, eBPF is usually the better enforcement plane than long iptables chains because it gives identity-aware, low-latency policy checks at kernel hooks. The trade-off is operational: you must validate programs, observe policy decisions, manage verifier limits, and keep fail-closed controls around every rollout.
Was this answer helpful?
Likely follow-ups
- A tenant's workload triggers the eBPF verifier's resource limits under load. What happens to their traffic while the program is being rejected or reloaded?
- How does your policy design change once a single node needs to enforce isolation across hundreds of tenants rather than a handful?
- An engineer pushes an eBPF program update that silently fails open instead of denying traffic. How do you detect that isolation has been breached?
Related questions
- A customer reports seeing another company's records in your admin console. Walk me through the first hour, and then tell me what you change so this class of bug cannot happen again.hardAlso on multi-tenancy and security4 min
- A Kubernetes cluster admin account has been compromised for 45 minutes. Do you clean the cluster or burn it to the ground, and why?hardAlso on security and kubernetes2 min
- Rate-limit an LLM gateway where one request can cost a hundred times another.hardAlso on multi-tenancy5 min
- Pods are being evicted during node pressure even though your CPU dashboards look fine. Where do you look, and what would you change so it stops?hardAlso on kubernetes4 min