Least-Privilege Metrics: Securing PromQL in Multi-Tenant Clusters - Oshi Gupta & Anushka Saxena

Why watch

This talk demonstrates how to secure PromQL in multi-tenant Kubernetes clusters by treating queries like tool invocations that must pass through a policy layer. The presenters show how to implement label-based tenant isolation, metric name allow/deny lists, and cost-aware rate limiting using Kyverno policies with a query proxy in front of Prometheus - without forking Prometheus itself. Ideal for platform engineers, SREs, and DevOps professionals managing multi-tenant observability infrastructure.