The platform for your SaaS solution

Multi-tenant isolation | CI/CD-ready | Harbor registry included | generous fair-use egress allowance

Scale SaaS without losing control

As a SaaS provider, you face a unique set of challenges:

Challenge 1: Multi-tenancy Every customer expects isolation — for data as well as performance. Noisy neighbors must never degrade the experience of an individual customer. At the same time, the infrastructure has to be used efficiently.

Challenge 2: Scalability Your platform has to grow with your customer base. New customers should be onboarded in minutes, not days. And during load peaks, the platform must scale automatically.

Challenge 3: CI/CD and deployment velocity Feature releases need to reach production quickly and safely. Deploy several times a day, without downtime, with rollback capability. For that, you need a robust pipeline and a reliable container registry.

Challenge 4: Cost control while growing With hyperscalers, costs explode as you grow: more customers = more egress traffic = a higher bill. Variable costs turn per-customer margin calculations into a nightmare.

focusnet: the Kubernetes platform for SaaS providers

Namespace-based tenant separation

Use Kubernetes namespaces to cleanly isolate your customers. Each tenant gets their own namespace with defined resource quotas, Cilium network policies, and RBAC roles. With dedicated clusters, you additionally get a dedicated VLAN with a dedicated public IP and full Gateway API control.

Architecture pattern:

Cluster (focusnet Dedicated L or XL)
|
|-- Namespace: tenant-alpha (4 vCPU, 8 GB, network policy)
|-- Namespace: tenant-beta (2 vCPU, 4 GB, network policy)
|-- Namespace: tenant-gamma (8 vCPU, 16 GB, network policy)
|-- Namespace: shared-services (monitoring, logging)
|-- Namespace: ci-cd (pipeline, Harbor)

Harbor registry for CI/CD

The integrated Harbor container registry offers:

• Private repositories for your application images
• Vulnerability scanning on every push
• Image signing for supply chain security
• Replication for multi-cluster deployments
• Garbage collection for storage optimization
• Robot accounts for automated pipeline access

Cilium eBPF networking

Cilium is the Kubernetes network for our Managed Kubernetes products and delivers high-performance eBPF-based networking with granular policy rules between namespaces:

• Kubernetes network policies: standards-compliant rules between namespaces and workloads (source/dest, port, protocol, pod selector)
• eBPF datapath: kernel-native networking without classic iptables complexity
• Gateway API: a modern ingress and routing model without nginx workarounds
• Hubble observability optional: flow logs, service maps, and network metrics in real time
• Dedicated tier: dedicated VLAN, dedicated public IP, and full Gateway API control

Note: application-layer policies such as HTTP/gRPC filtering or DNS-aware policies can be added via Cilium, Gateway API, or a service mesh, depending on the setup.

Predictable costs for your margin calculation

Fixed monthly prices instead of variable costs. PVC storage included according to tier. Egress traffic: fair-use allowance, no hard limits — 500 GB per vCPU on Dedicated, 250 GB per vCPU on Flex/Business. Internal traffic always unlimited. You know exactly what a tenant costs — and can price your SaaS accordingly.

Cost example for 20 tenants (cluster L: 20+ vCPU, 80 GB RAM, 1 TB PVC, 10 TB egress/month):

*Fair use: 500 GB per vCPU per month (with Dedicated L and 5 worker nodes at 4 vCPU each = 20 vCPU = 10 TB included), no hard limits, internal traffic unlimited.

With a 24-month commitment (−25%): focusnet at around €824/month, or €41 per tenant. At AWS, Savings Plans / Reserved Instances would cut EC2 costs by about 40%, but egress, storage, load balancers, and monitoring would remain just as expensive.

Scale with T-shirt sizing — or granularly per resource

You have the choice: either start with a cluster M and upgrade to L or XL as your customer base grows — the next T-shirt size is always clearly defined. Or configure granularly with pay-per-resource pricing (vCPU, RAM, storage individually) and fine-tune every resource to your needs. Both models are cancelable monthly or bookable with commitment discounts.

Proven multi-tenancy architectures on focusnet

Pattern 1: Namespace per tenant (recommended)

Each customer gets their own namespace with resource quotas and network policies. Shared services (database, message queue) run in a separate namespace.

Advantages: cost-efficient, simple to manage, good isolation Suited for: SaaS with many customers, similar workload profiles

Pattern 2: Cluster per tier

Different clusters for different customer segments: free tier on namespaces, premium on dedicated clusters.

Advantages: maximum isolation for premium customers, cost-efficient for the free tier Suited for: SaaS with a freemium model

Pattern 3: Dedicated cluster for enterprise customers

Major accounts get their own dedicated cluster for maximum isolation and performance. focusnet continues to manage the control plane (updates, patches); the customer gets dedicated CP and worker nodes on a dedicated VLAN.

Advantages: complete isolation, dedicated SLAs, compliance-ready Suited for: SaaS with enterprise customers in regulated industries

Pattern 4: Dedicated host cluster with SUSE vClusters per tenant

For SaaS providers who want to offer their tenants maximum isolation on a platform they control, we combine pattern 3 with a vCluster layer: you book your own dedicated host cluster, in which we spin up a separate SUSE vCluster per tenant. Each tenant thereby gets their own complete Kubernetes cluster (own control plane, own API, own RBAC) — at significantly higher efficiency than a dedicated cluster per tenant.

Advantages: cluster-level isolation per tenant (no shared kube-api, no shared etcd), yet shared hardware efficiency and unified platform operations Suited for: SaaS with premium tenants or regulated tenants who require "their own cluster" without paying the cost of 1 cluster = 1 tenant

Seamless CI/CD pipeline with focusnet

focusnet integrates seamlessly into your existing CI/CD pipeline:

Typical workflow:

1. Developer pushes code to Git (GitHub, GitLab, Bitbucket)
2. CI pipeline builds the container image
3. Image is pushed to the Harbor registry (vulnerability scan runs automatically)
4. CD pipeline deploys via Helm/Kustomize to the target namespace
5. Rolling update without downtime
6. Monitoring tracks the rollout

Supported tools:

• CI: GitHub Actions, GitLab CI, Jenkins, CircleCI, Drone
• CD: ArgoCD, Flux, Helm, Kustomize
• Registry: Harbor (included), integration with external registries
• Monitoring: basic monitoring (Prometheus) included, SUSE Observability as an add-on for logs + traces

Harbor robot accounts: create automated accounts for your pipeline with granular permissions per repository.

S3-compatible object storage for your SaaS data

Many SaaS applications need object storage for uploads, backups, logs, or artifacts. focusnet offers S3-compatible storage with flat-rate tiers: €15/TB (up to 50 TB), €12/TB (50–500 TB), €7/TB (from 500 TB).

Typical use cases:

• Customer uploads (documents, images, videos)
• Application backups
• Log archiving
• Data lake for analytics
• Artifact storage for CI/CD

Advantages:

• S3-compatible API — all S3 SDKs and tools just work
• No egress traffic within the focusnet network
• Data stored in Germany
• Flat-rate tiers from €15/TB (up to 50 TB) down to €7/TB (from 500 TB)

Enterprise security for your SaaS platform

What our customers say

"We run several dozen tenants on two focusnet clusters. Namespace isolation with Cilium network policies gives our customers the assurance they need — and our costs are predictable month over month."

"Harbor has noticeably simplified our CI/CD pipeline. Vulnerability scanning on every push and robot accounts for automation are included in the tier price, which saves us separate tooling contracts."

FAQ

1. How many tenants can I run on a single cluster?

That depends on the resource requirements of your tenants. A cluster XL (54 vCPU, 232 GB RAM, 2 TB PVC) can easily host 50–100+ lightweight tenants. For resource-intensive workloads, we recommend 10–30 tenants per cluster.

2. Is namespace isolation sufficient for regulated customers?

For most SaaS applications, Kubernetes namespaces with Cilium network policies provide sufficient isolation. For customers with strict regulatory requirements (e.g., the financial sector), we recommend a dedicated cluster. With both shared and dedicated clusters, focusnet manages the control plane (updates, patches); the Dedicated tier additionally provides dedicated hardware (own CP and worker nodes, dedicated VLAN).

3. Can I migrate individual tenants to dedicated clusters?

Yes. When a tenant grows or needs stricter isolation, you can migrate them to their own dedicated cluster at any time. Your manifests and images are portable.

4. How does auto-scaling work?

Within a cluster, you can use the Horizontal Pod Autoscaler (HPA) to scale pods automatically. To scale the cluster itself (more nodes), contact our team for an upgrade to the next T-shirt size.

5. Do you offer multi-cluster management?

Yes. Via the SUSE Rancher UI, you can manage multiple clusters centrally. This is particularly relevant for SaaS providers running different clusters for different customer segments.

Your SaaS platform deserves sovereign Kubernetes

Namespace isolation, Harbor registry, Cilium eBPF networking, predictable costs — everything you need for your SaaS infrastructure. Try it free for 14 days.

Contract terms: Cancellation with 30 days notice to the end of the month, no minimum term. Offer exclusively for businesses within the meaning of Section 14 of the German Civil Code (B2B). SLA: 99.9% availability for Kubernetes (Dedicated and shared).