How many Kubernetes clusters should an organisation run, and what decides the boundaries?

What is being tested

Whether you treat this as a blast-radius and operational-burden decision rather than a capacity one.

The trade

Fewer, larger clusters: better bin-packing, less operational overhead, simpler service discovery — and a larger blast radius, because a control-plane problem, a bad upgrade or a misconfigured admission policy affects everything.

More, smaller clusters: isolation, independent upgrade schedules, smaller blast radius — and duplicated overhead, harder cross-cluster networking, and more to operate.

The boundaries that make sense

• Environment. Production separate from non-production, always. Sharing is how a test job takes down production.
• Region. Clusters do not usefully span regions; latency and partition behaviour make it a bad idea.
• Compliance boundary. A separate cluster makes the boundary demonstrable to an auditor rather than argued.
• Blast radius for tier-one workloads, which may justify their own cluster so nothing else can affect them.
• Team or tenant, only where isolation genuinely demands it — namespace isolation with network policies and quotas is usually sufficient and far cheaper.

The point about namespaces

Namespaces are a naming boundary, not a security boundary. Isolating within a cluster requires network policies (default deny, explicit allow), resource quotas and limit ranges, admission policy, least-privilege service accounts, and node pools where workload separation matters.

Whether that suffices depends on the threat model: for teams within one organisation, usually yes; for genuinely untrusted workloads, no.

The operational decisions that dominate

Upgrade strategy. Version support windows are short, so a fleet needs an automated, tested upgrade path — or clusters drift and fall out of support, which is the most common failure at scale.

Address planning. Every pod consumes an IP address. A subnet sized for VM-era density exhausts at container density, presenting as pods stuck pending rather than as an address problem.

The answer for most organisations

Small numbers. Production and non-production per region, plus a separate cluster where a compliance or blast-radius requirement genuinely demands one. A cluster per team is a fleet most organisations cannot operate.