Context
The platform lets customers run Kubernetes on the cloud provider of their choice, with self-service onboarding and usage-based billing. Customers pick a provider for cost, compliance, data residency or proximity, so portability across providers is the product, not a feature.
Constraint
Every new tenant got a dedicated VM for its control plane. Provisioning took 8–10 minutes and needed manual coordination. Each tenant also carried its own VM and load balancer, so infrastructure cost grew with every customer.
Decisions
- Moved tenant control planes onto shared hosted control planes (Kamaji) running in a management cluster, instead of one VM per customer.
- Drove provisioning from a Go engine end to end, so onboarding needed no person in the loop.
- Removed the per-tenant VM and load balancer from the architecture rather than trying to make them cheaper.
- Introduced production, staging and demo environments with automated change-detection deploys, so every change was proven before a customer saw it.
- Built end-to-end lifecycle tests that run against live environments, not mocks.
Result
- Provisioning dropped from 8–10 minutes to about 50 seconds, fully self-service.
- Infrastructure spend per customer fell by an order of magnitude.
- Release cycles went from days to minutes, with zero-downtime deploys across all three environments.
- Before launch, the lifecycle tests caught 15 product issues, including a cross-tenant data-isolation vulnerability.
- The same platform now offers AI workloads as self-service add-ons: Kubeflow pipelines, GPU inference serving and serverless functions.