Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/arjunprabhulal/devops-skills/multi-tenancynpx skills add arjunprabhulal/devops-skills --skill multi-tenancygit clone --depth 1 https://github.com/arjunprabhulal/devops-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/arjunprabhulal/devops-skills/multi-tenancy)<a href="https://agentmods.dev/skills/arjunprabhulal/devops-skills/multi-tenancy"><img src="https://agentmods.dev/badge/skills/arjunprabhulal/devops-skills/multi-tenancy.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00101 | $0.01452 |
| Opus 5 | $0.00051 | $0.00726 |
| Sonnet 5 | $0.00020 | $0.00290 |
| Haiku 4.5 | $0.00010 | $0.00145 |
Grade A, and why
multi-tenancy scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 121 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Multi-Tenancy
A namespace is an organizational boundary in the Kubernetes API, not a security or resource boundary by itself. Left alone, tenants in different namespaces on the same cluster can still see each other's Services via DNS, exhaust shared node capacity, and — depending on RBAC — read each other's resources entirely. Multi-tenancy is the work of turning that organizational boundary into an actual isolation boundary, one control at a time.
Decide up front how much isolation each tenant actually needs, because that decision changes everything downstream — quotas, network policy, and whether namespaces are even enough. Namespaces are the unit of ownership; isolation has to be built on top of them deliberately.
1. Decide soft or hard multi-tenancy before you provision anything
Soft multi-tenancy assumes tenants are mutually trusted (different teams in the same org) and namespaces plus quotas/RBAC are sufficient. Hard multi-tenancy assumes tenants are mutually untrusted (external customers, regulated separation requirements) and needs isolation namespaces can't provide alone — separate node pools, or separate clusters entirely, because a shared kernel and shared control plane are themselves an attack surface between untrusted tenants.
- Soft tenancy: namespace-per-tenant + ResourceQuota + RBAC + NetworkPolicy is a legitimate, well-trodden pattern.
- Hard tenancy: needs kernel-level isolation (dedicated nodes via taints/tolerations, or gVisor /Kata sandboxing) at minimum, and often separate clusters — the blast radius of a container escape or control-plane compromise has to stop at the tenant boundary.
- This decision drives cost directly — hard tenancy's dedicated infrastructure is real spend;
see
cost-optimizationfor that tradeoff once the isolation requirement is fixed.
Done when: the tenancy model is written down as a decision (soft or hard) with the trust assumption that justifies it, not left implicit.
2. Give every tenant a ResourceQuota before their first workload
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 121 lines · 101 tokens per session scan A 9e2bc934aff7
multi-tenancy is a skill published in the GitHub repository arjunprabhulal/devops-skills (3 stars, last pushed 10d ago), licensed MIT. It adds 101 tokens to every session and 1,452 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
gke-app-onboarding
Manages GKE application onboarding, covering containerization, deployment manifests, and migration. Use when onboarding or deploying an application to GKE for the first time, or containerizing an app for GKE. Don't use for general GKE cluster administration or upgrades (use gke-basics or gke-upgrades instead).
build-mcpb
This skill should be used when the user wants to "package an MCP server", "bundle an MCP", "make an MCPB", "ship a local MCP server", "distribute a local MCP", discusses ".mcpb files", mentions bundling a Node or Python runtime with their MCP server, or needs an MCP server that interacts with the local filesystem…
google-mobile-ads-android-migrate-to-next-gen
Migrates Android applications from the old, legacy Google Mobile Ads (GMA) SDK (com.google.android.gms:play-services-ads) to the new GMA Next-Gen SDK (com.google.android.libraries.ads.mobile.sdk:ads-mobile-sdk). Provides comprehensive mapping tables for imports, classes, and method signatures to help determine…
google-cloud-solution-guided-gke-ai-migration
Guides the migration of existing AI workloads (Cloud Run, Gemini API, Gemini Enterprise Agent Platform) to self-hosted GKE inference using gcloud and kubectl. Use when the user has an existing AI inference workload (on Cloud Run, the Gemini API, Gemini Enterprise Agent Platform, or a custom VM) and wants to move it to…
agent-platform-deploy
Deploy open models or custom weights from Model Garden to Agent Platform endpoints, check the status of an in-progress deployment operation, or clean up resources by undeploying models and deleting endpoints. Use when asked to actively deploy a model, list the Model Garden CATALOG of available models, check if a…
agent-platform-eval-flywheel
Measures and improves the quality of AI models and agents on Google Cloud using the Eval Quality Flywheel methodology. Use when evaluating an agent or model, building an eval dataset, picking or writing evaluation metrics, analyzing failures, comparing results before and after a fix, or when guidance is needed on…