Two hundred control planes per cluster: ten years of SAP's Gardener

A fleet platform has to give hundreds of teams their own cluster, on whichever infrastructure each product sells on, cheaply enough that asking for one is not a budget conversation. Gardener is the rare case where a large company's answer can be read rather than guessed at, and this guide reconstructs it from thirty-five enhancement proposals, a feature gate table that dates every mechanism adopted and withdrawn, 759 timestamped releases, two complete release archives compared across six years, and the three 2025 advisories that price the architecture's one structural risk. A reader finishes able to choose a shape for a fleet control plane, defend a packing ratio and a per-tenant failure domain in review, and name the two failure classes the model creates.

What you get out of it

• Tenant control planes run as pods in a shared host cluster at a documented default of 200 per host, which converts cost that would scale with cluster count into cost that scales with load; the comparator is a published $0.10 per cluster per hour.
• Packing tenants onto a shared host makes the tenancy boundary a validation function: all three 2025 advisories end with a project administrator obtaining control over the host cluster, and one of them had to be fixed in four provider extensions separately.
• Availability was deliberately a scheduling property rather than a replica count until GEP-20 in August 2022 admitted that single-replica etcd made a zone failure a tenant outage, after which the failure domain became a per-tenant field.
• Any controller that acts on the absence of a heartbeat needs a second opinion about the heartbeat path: the dependency watchdog exists because node replacement destroyed healthy machines during a network fault, and it scales the replacing controller to zero instead.
• A fork of a dependency is a dated loan: sitting on a fork of a relicensed log engine bought security updates only, and the escape was to standardise collection first so the store became replaceable.

Scope

Why this, now. The fleet pattern is spreading from Kubernetes platform teams to anyone running per-tenant control planes, and Gardener's 2025 and 2026 record (three host-takeover advisories, in-place node updates driven by GPU scarcity, a forked log store finally replaced) is the freshest public evidence of what the model costs to operate.

What it does not cover. SAP's wider estate (HANA, ABAP, the Business Technology Platform application layer), the Gardener dashboard and CLI surface, the commercial history, and SAP's own operated scale and spend: this session's network policy reached only raw.githubusercontent.com, the Go module proxy, pkg.go.dev and one vendor price list, and refused every engineering blog, talk, paper archive, status page and GitHub's own issue and pull request API, so there is no blog, talk or paper evidence here and no published incident review.