In-namespace sub-tenancy with looser isolation

Even if the same OpenShift cluster is shared, there is still the overhead and expense of running multiple installations of Cloud Pak for Data services for each tenant. While namespace-based separation provides much more assurance in terms of meeting security, compliance, and performance SLA guarantees, it comes with additional expense. For example, we would need to install separate copies of the Kubernetes deployments in each tenant namespace, and that implies more oversight and maintenance personnel (even if the Operator pattern makes it easier to upgrade, scale, and so on). Separate copies also take up additional compute and storage resources, thus increasing the cost of procurement in the first place, as well as ongoing operational expenses.

In some cases, in the interests of reducing expenditure, some enterprises may choose to share more resources between tenants, even if it means losing flexibility or reduced isolation. In this...