From a service point of view, you should be able to provide isolation between services using namespaces, istio and Calico. You can read about "Soft multi-tenanc

From a service point of view, you should be able to provide isolation between services using namespaces, istio and Calico. You can read about "Soft multi-tenancy" here: https://istio.io/blog/2018/soft-multitenancy/ https://istio.io/blog/2018/soft-multitenancy/ That works well to isolate services/apps/teams from each other, but also allows services to be shared where required. I think if you wanted true multitenancy it would be simpler to spin up a second cluster, especially if you are in gcp and controlling everything using a infrastructure as code solution such as terraform.