I'm building a multi-tenant internal developer platform on Kubernetes, what should I use?

For a multi-tenant internal developer platform on Kubernetes, the best choice is usually a platform layer built on top of Kubernetes rather than raw Kubernetes alone.

Short answer

A strong default stack is:

• Kubernetes for orchestration
• Crossplane for cloud/infrastructure provisioning
• Argo CD or Flux for GitOps
• Backstage for the developer portal
• Kyverno or OPA/Gatekeeper for policy enforcement
• External Secrets Operator for secret syncing
• Ingress NGINX / Gateway API / Istio depending on networking needs
• cert-manager for TLS
• Prometheus + Grafana + Loki for observability

If you want a more opinionated, turnkey-ish platform, look at:

• Humanitec
• Port
• Backstage + platform engineering plugins
• Rancher if you need cluster/multi-cluster management heavily

What to use depends on your goal

If you want maximum control and are building the platform yourself

Use:

• Kubernetes
• Crossplane
• Argo CD
• Backstage
• Kyverno
• External Secrets Operator
• cert-manager
• Prometheus/Grafana/Loki

This is the most common “serious platform engineering” stack.

If you want faster time-to-value with less custom work

Use:

• Backstage as the portal
• Humanitec or Port to abstract platform workflows
• Argo CD
• Crossplane underneath for infra

If your priority is multi-cluster / enterprise management

Use:

• Rancher
• Argo CD
• OPA/Kyverno
• Backstage
• optionally Istio for service mesh

---

Multi-tenancy considerations

For internal developer platforms, multi-tenancy usually means one of these:

1. Namespace-based tenancy

Best for most internal platforms.

Use:

• one namespace per team/app/environment
• RBAC per namespace
• ResourceQuota / LimitRange
• NetworkPolicies
• Pod Security Standards
• separate service accounts

This is the simplest and usually enough.

2. Cluster-based tenancy

Use separate clusters for strong isolation:

• regulated workloads
• different business units
• prod vs non-prod
• noisy neighbors

This is more expensive but safer.

3. Soft multi-tenancy

Shared cluster, lighter isolation:

• good for dev/test
• lower operational cost
• requires strong policy and quota controls

---

My recommended architecture

A practical internal platform architecture would be:

• Backstage for self-service portal
• Argo CD for deployments
• Crossplane for provisioning namespaces, databases, buckets, DNS, and cloud resources
• Kyverno for guardrails
• cert-manager for TLS
• External Secrets Operator for secrets
• Prometheus/Grafana/Loki for observability
• Ingress/Gateway API for traffic management
• Vault or cloud secret manager as the source of truth for secrets

This gives developers a self-service model like:

1. create app in portal
2. platform provisions namespace/resources
3. Git repo gets scaffolded
4. Argo CD deploys it
5. policy controls everything automatically

---

Avoid

I would avoid:

• building too much custom logic directly in admission controllers unless necessary
• using raw Kubernetes manifests as the primary developer interface
• mixing too many overlapping tools early
• relying only on Helm without GitOps and policy

---

Best default recommendation

If you want one clear recommendation:

Use Kubernetes + Backstage + Argo CD + Crossplane + Kyverno.

That’s the strongest general-purpose foundation for a multi-tenant internal developer platform.

If you want, I can also give you:

1. a reference architecture diagram in text
2. a tool comparison table
3. a recommended stack for small/medium/large orgs
4. a step-by-step implementation plan