Network sharing: shape traffic and authorize reachability

A per-connection limit is not a tenant limit when the tenant can create more connections. Choose a trusted aggregate identity and map its traffic into the enforcement domain across workers, namespaces, and gateways. Account for ingress and egress separately, including replication, storage calls, and retries that a user-facing response counter misses. A shared service can also send traffic on a tenant’s behalf, so classification must survive that hop. Otherwise one tenant moves its consumption into a common service account and escapes the intended budget.

Shaping delays eligible traffic until its schedule permits transmission; policing typically enforces an envelope through decisions such as dropping or marking excess traffic. Linux HTB uses hierarchical classes with rate, ceiling, and burst semantics. A configured rate is meaningful within that hierarchy and the actual bottleneck path, not a guarantee that a remote receiver or congested network will supply the same useful throughput. Queue limits, offloads, encapsulation, classification, and the physical interface can change what packet-level and application-level measurements observe.

A tenant can have a long-run average below its ceiling and still inject enough work to cause a queue. Size the burst allowance, buffer policy, and deadline response together. A large queue can preserve bytes while making requests uselessly late; a deliberate reject or drop may better preserve a stated service objective, but its cost must appear in reported results. In an inference platform, concurrent completions can synchronize response bursts even if request arrivals looked smooth. Measure the bytes that the downstream path actually carries, including protocol overhead when relevant.

Kubernetes NetworkPolicy describes allowed connectivity at supported network layers when the cluster networking implementation enforces it. It does not itself allocate a bandwidth reservation, encrypt a payload, or validate a customer’s application-level object permission. Policies are additive and plugin behavior matters, including supported protocols and packet processing details. Verify the deployed enforcement path rather than assume that an API object alone isolates traffic. A connection permitted by policy can still carry an unauthorized application operation unless the receiving service checks authority.

Run a fixed victim request mix while varying an authorized aggressor’s connection count, packet sizes, response sizes, and direction. Observe offered bytes, admitted bytes, retransmissions, drops, queue delay, and deadline goodput, then repeat at the actual constrained hop. A test inside a fast virtual interface may miss the shared external bottleneck entirely. Separately test forbidden source/destination combinations and application tenant checks. Passing one performance benchmark gives no evidence that a missing NetworkPolicy or an overly broad service credential is safe.

Reset the queue lab, explicitly set arrival two and service three, predict the initial four-item backlog shrinking, then Play or Step. For a distinct overload run Reset and explicitly set arrival four and service three before predicting again. These are fixed-rate abstract jobs, not packets with lengths or token buckets. Control edits retain elapsed time and recompute the initial-value formula. Use the lab to reason about offered versus served work, then use packet and application evidence to test shaping and authorization on the real path.