INFRA Signal 113
Multi-tenant proxy pattern gives Kubernetes tenants self-service access to their own GPU metrics
↗
Adobe engineers describe a pattern using a tenant-aware proxy and a MetricAccess custom resource to give Kubernetes teams self-service visibility into their GPU metrics without exposing other tenants' data or overloading the central Prometheus.
In multi-tenant Kubernetes, GPU utilization data often sits locked in a central Prometheus that can't be safely shared, leaving expensive idle resources invisible to the teams that own them. This pattern solves both the security and noisy-neighbor problems without adding a new metrics stack, using only CNCF-native components.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
A central Prometheus can't be safely opened to all tenants because PromQL queries aren't namespace-aware and heavy queries from one team degrade the store for everyone.
The solution places a multi-tenant proxy in front of the central Prometheus that authenticates callers, restricts queries to the tenant's namespace, and optionally remote-writes curated metrics to tenant-owned Prometheus instances.
Self-service is enabled through a MetricAccess custom resource where teams declare which metrics they want, separating platform mechanism from tenant policy.
THE CLUSTER