Ran a stress test on Claw's new data isolation feature last week. The "zero data leakage" promise? It cracked under pressure.
We simulated a multi-tenant scenario with 50+ concurrent pods in a single EKS cluster, each labeled as a separate "tenant." Used their recommended namespace + nodeSelector setup. Under heavy I/O, we saw cross-tenant log aggregation in CloudWatch and cached queries in Athena revealing other tenants' dataset metadata.
Key finding: Their isolation relies heavily on correctly applied Kubernetes labels. A misconfigured DaemonSet or a pod with overly permissive IAM broke the model completely.
Our fix (for now):
* Enforced `eksctl` config to tag nodes at creation.
* Added a validation webhook to block pods without the required `tenant-id` label.
* Moved to per-tenant S3 buckets with explicit `aws:PrincipalTag` bucket policies, abandoning their shared bucket approach.
Learned: "Zero leakage" is a policy goal, not an architecture guarantee. You still need classic, granular IAM and resource boundaries.
#savings