--- title: How We Designed SaaS With Kubernetes | daily.dev description: Teleport describes the architecture decisions behind Teleport Cloud, its SaaS version of the on-prem access platform, built on Kubernetes and AWS. Each... canonical: https://daily.dev/posts/how-we-designed-saas-with-kubernetes-o8yyypera twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: How We Designed SaaS With Kubernetes | daily.dev og:description: Teleport describes the architecture decisions behind Teleport Cloud, its SaaS version of the on-prem access platform, built on Kubernetes and AWS. Each... og:url: https://daily.dev/posts/how-we-designed-saas-with-kubernetes-o8yyypera og:image: https://api.daily.dev/og/posts/o8YyyPERa.png og:image:alt: How We Designed SaaS With Kubernetes og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # How We Designed SaaS With Kubernetes **[Teleport](https://daily.dev/sources/teleport)** · 9 min read · 0 upvotes · 0 comments ## Summary Teleport describes the architecture decisions behind Teleport Cloud, its SaaS version of the on-prem access platform, built on Kubernetes and AWS. Each customer gets an isolated Kubernetes namespace acting as a tenant, managed by a custom billing-service and a kubebuilder-based tenant-operator that provisions infrastructure automatically for self-service. The team explains a naive resource-allocation policy using a 1:4 dedicated-to-pooled CPU ratio while they gather real usage data via Prometheus, and details security measures including per-pod IAM roles via kiam and external secret management with kubernetes-external-secrets to avoid storing credentials in plaintext. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How can I isolate multiple customers' resources in a single Kubernetes cluster for a multi-tenant SaaS product? Assign each customer their own Kubernetes namespace, treating it as a dedicated virtual cluster within the shared physical cluster. Teleport Cloud isolates pods, deployments, load balancers, S3 buckets, and databases per namespace, and pairs this with a custom tenant-operator built with kubebuilder that provisions infrastructure automatically whenever a new Tenant custom resource is created. _daily.dev surfaces architecture patterns like namespace-based multi-tenancy for engineers designing SaaS on Kubernetes._ ### How do you assign different IAM permissions to different services running in the same Kubernetes cluster? Use kiam to associate specific IAM roles with individual pods via metadata annotations, so an agent intercepts AWS API requests and rejects any that don't match the pod's assigned role. This lets separate components, such as a billing-service and a tenant-operator, hold distinct AWS permissions instead of sharing one broad IAM policy across the cluster. _Engineers hardening cloud IAM boundaries can track patterns like this via daily.dev._ ### What CPU allocation strategy can I use for a new multi-tenant Kubernetes service before I have real usage data? A workable starting point is a naive default policy based on the idle cost of a service instance rather than live metrics. Teleport Cloud found each idle Teleport instance cost roughly 50 millicores, fitting about 20 tenants per core, and reserved 75% of CPU for bursts using a 1:4 dedicated-to-pooled resource ratio, manually adding cores once idle consumption hit 25%. _daily.dev helps engineers compare resource-provisioning approaches before committing to autoscaling._ ## Similar posts on daily.dev - [Harnessing the potential of 5G with Kubernetes: a cloud-native telco transformation perspective](https://daily.dev/posts/harnessing-the-potential-of-5g-with-kubernetes-a-cloud-native-telco-transformation-perspective-z4qas3tmj) · Ubuntu · 0 upvotes · 0 comments --- Tags: [#aws](https://daily.dev/tags/aws), [#kubernetes](https://daily.dev/tags/kubernetes), [#multi-tenancy](https://daily.dev/tags/multi-tenancy) [View this post on daily.dev](https://daily.dev/posts/how-we-designed-saas-with-kubernetes-o8yyypera) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"How We Designed SaaS With Kubernetes","url":"https://daily.dev/posts/how-we-designed-saas-with-kubernetes-o8yyypera","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/how-we-designed-saas-with-kubernetes-o8yyypera"},"datePublished":"2026-08-23T12:19:34.504Z","dateModified":"2026-08-23T12:38:09.901Z","description":"Teleport describes the architecture decisions behind Teleport Cloud, its SaaS version of the on-prem access platform, built on Kubernetes and AWS. Each...","image":"https://media.daily.dev/image/upload/s--2-1xRawN--/f_auto/v1722860399/public/Placeholder%2011","thumbnailUrl":"https://media.daily.dev/image/upload/s--2-1xRawN--/f_auto/v1722860399/public/Placeholder%2011","isAccessibleForFree":true,"articleSection":"Teleport","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Teleport","logo":"https://media.daily.dev/image/upload/s--Dw-Bbw6O--/c_limit,w_256/f_auto,q_auto/v1787487494/logos/teleport?_a=BAMAMicg0","url":"https://daily.dev/sources/teleport"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/how-we-designed-saas-with-kubernetes-o8yyypera","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"aws,kubernetes,multi-tenancy","timeRequired":"PT9M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Teleport","item":"https://daily.dev/sources/teleport"},{"@type":"ListItem","position":3,"name":"How We Designed SaaS With Kubernetes"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/how-we-designed-saas-with-kubernetes-o8yyypera#faq","mainEntity":[{"@type":"Question","name":"How can I isolate multiple customers' resources in a single Kubernetes cluster for a multi-tenant SaaS product?","acceptedAnswer":{"@type":"Answer","text":"Assign each customer their own Kubernetes namespace, treating it as a dedicated virtual cluster within the shared physical cluster. Teleport Cloud isolates pods, deployments, load balancers, S3 buckets, and databases per namespace, and pairs this with a custom tenant-operator built with kubebuilder that provisions infrastructure automatically whenever a new Tenant custom resource is created. daily.dev surfaces architecture patterns like namespace-based multi-tenancy for engineers designing SaaS on Kubernetes."}},{"@type":"Question","name":"How do you assign different IAM permissions to different services running in the same Kubernetes cluster?","acceptedAnswer":{"@type":"Answer","text":"Use kiam to associate specific IAM roles with individual pods via metadata annotations, so an agent intercepts AWS API requests and rejects any that don't match the pod's assigned role. This lets separate components, such as a billing-service and a tenant-operator, hold distinct AWS permissions instead of sharing one broad IAM policy across the cluster. Engineers hardening cloud IAM boundaries can track patterns like this via daily.dev."}},{"@type":"Question","name":"What CPU allocation strategy can I use for a new multi-tenant Kubernetes service before I have real usage data?","acceptedAnswer":{"@type":"Answer","text":"A workable starting point is a naive default policy based on the idle cost of a service instance rather than live metrics. Teleport Cloud found each idle Teleport instance cost roughly 50 millicores, fitting about 20 tenants per core, and reserved 75% of CPU for bursts using a 1:4 dedicated-to-pooled resource ratio, manually adding cores once idle consumption hit 25%. daily.dev helps engineers compare resource-provisioning approaches before committing to autoscaling."}}]} ```