-
Notifications
You must be signed in to change notification settings - Fork 1
OSC Platform Networking and Isolation Model
This page answers common questions about how network traffic reaches your services on Eyevinn Open Source Cloud, and what isolation exists between tenants sharing the platform. It's written for anyone evaluating OSC for their own security or compliance review.
Every deployed service instance and My App gets its own public HTTPS URL with automatically issued and renewed TLS certificates. Access to your instance's management and configuration is protected by your OSC login or a Personal Access Token — requests without valid authentication are rejected at the edge before they reach your workload.
OSC runs on shared Kubernetes clusters: your services run alongside other tenants' services on common infrastructure, not on dedicated hardware or a dedicated cluster per customer.
Within that shared infrastructure:
- Access to your instance is authenticated. External requests are checked against your account or token before they're allowed to reach your workload.
- Network-level isolation between tenant workloads is not currently enforced. OSC does not today apply Kubernetes network policies to segment tenant workloads from one another at the network layer. We're evaluating this as a platform improvement.
- Per-tenant compute resource limits (CPU, memory, disk) are not currently enforced on service instances or My Apps.
If your use case has specific isolation, compliance, or resource-guarantee requirements — for example, handling regulated data, or needing guaranteed CPU/memory — reach out before committing to the platform so we can discuss what's actually needed for your case.
Practical limits to design around when building against a service instance or My App:
| Limit | Value |
|---|---|
| Maximum request body size | 64 MB |
| Request timeout | 60 seconds |
| Per-tenant bandwidth / rate limiting | Not currently enforced by default |
If your application needs to handle larger uploads, longer-running requests, or has bandwidth-intensive requirements (e.g. media streaming, large file transfer), talk to us — these are platform characteristics we can discuss and may be able to accommodate differently for your use case.
This page will be updated as the platform's isolation model evolves. If you have a specific compliance or security question not answered here, ask in the OSC community Slack or open a discussion.