Enterprise Multi-Region EKS Multi-Tenant Platform

Context & Pain Points

Scaling election management workloads across multiple jurisdictions required strict tenant isolation and data sovereignty compliance — without the overhead and cost of spinning up a dedicated cluster per tenant.

What We Had To Solve

• Achieving hard multi-tenant isolation for different jurisdictions within shared EKS clusters without creating per-tenant cluster sprawl.
• Designing cross-region EKS architectures with consistent GitOps workflows and unified policy enforcement.
• Dynamically provisioning and right-sizing node groups per tenant using cost-efficient Spot capacity.
• Managing per-tenant networking, ingress routing, and RBAC controls at scale without manual configuration drift.

How We Built It

• Implemented native Kubernetes Namespace isolation per tenant within shared EKS clusters — eliminating sprawl while enforcing strict security boundaries with Calico and OPA Gatekeeper.
• Provisioned multi-region EKS infrastructure using Terraform and Terragrunt with region-parameterized, DRY module hierarchies.
• Deployed ArgoCD at the management cluster level with ApplicationSets to declaratively sync per-tenant workloads across all regions.
• Configured Karpenter with tenant-aware NodePools and Spot interruption handling to dynamically right-size compute per workload profile.

Outcomes That Mattered