Nest

First-Class Multi-Tenancy

Every DataResource is scoped to a tenant, enforced at the API layer via JWT claims, with automatic per-tenant network isolation.

  • `nest-api` validates the JWT `tenant` claim before any scope check and rejects requests without a valid tenant claim or where the claim does not match the requested `tenant_id`.
  • On the first DataResource provisioned into a tenant namespace, the controller creates a `nest-default-deny` NetworkPolicy scoping that namespace to same-namespace ingress/egress, DNS to `kube-system`, and the gateway services on their provisioning ports. Creation is idempotent and best-effort.
  • Shared resources add data-layer isolation on top: index-prefix isolation for a shared `SearchPool`, and per-tenant database accounts (with optional row-level security) for shared databases.
  • Quota enforcement runs alongside isolation: the free tier caps a tenant at 5 DataResources, and the API returns a clear upgrade error once the limit is reached.

← Back to all features

Full technical documentation →