Kubernetes RBAC and Network Policy Enforcement in Multi-Tenant Enterprise Environments

Abstract

Multi-tenant Kubernetes clusters present a unique set of security challenges that single-tenant deployments simply do not face. When multiple development teams, business units, or even external customers share the same underlying cluster infrastructure, the blast radius of any misconfiguration or privilege escalation grows dramatically. A compromised pod in one tenant's namespace can, without proper controls, enumerate services in every other namespace, access secrets belonging to other teams, and even escape to the host node if pod security settings are not enforced. These are not theoretical risks they are the exact attack patterns documented in the MITRE ATT&CK Container Matrix and exploited in real-world Kubernetes breaches. This paper examines the design and enforcement of Role-Based Access Control (RBAC) policies and Kubernetes Network Policies in multi-tenant environments, drawing on operational experience managing enterprise telecommunications infrastructure with over 200 namespaces across development, staging, and production tiers. We propose a layered access-control framework that combines namespace-scoped RBAC bindings, default-deny network policy segmentation, Pod Security Standards enforcement, and Kyverno admission controller automation to achieve tenant isolation without sacrificing developer productivity. The framework is validated against six common attack scenarios from the MITRE ATT&CK Container Matrix, including lateral pod-to-pod movement, privilege escalation through service account token abuse, privileged container escape, cross-namespace kubectl access, egress to external command-and-control servers, and unauthorized image deployment from untrusted registries. Results indicate that the proposed layered approach blocks 100 percent of tested cross-tenant access attempts while adding only 12 milliseconds of admission webhook latency per request. The paper also discusses the operational trade-offs between namespace-level soft multi-tenancy and hard multi-tenancy approaches using virtual cluster solutions.