Multi-tenancy

Laminar supports multi-tenant deployments where each tenant runs in complete isolation with dedicated resources.

Architecture

Shared Infrastructure
├── laminar-monitoring    # Grafana, GrepTimeDB, Vector
├── laminar-connectors    # MinIO, Redpanda
├── laminar-product       # Product website
└── ingress-nginx         # Ingress controller

Per-Tenant (tenant-{name} namespace)
├── Console               # Web UI
├── Controller            # Stream processing controller
├── Workers               # Dynamic worker pods
├── PostgreSQL            # Metadata database
└── ConfigMap             # Engine configuration

What Gets Deployed Per Tenant

When you create a new tenant, the laminar-core Helm chart deploys the following resources into a dedicated tenant-{name} namespace:

Console (Web UI)

Configuration:

• Image: 792306802931.dkr.ecr.us-east-1.amazonaws.com/laminar/console
• Port: 3000
• Resources: 128Mi memory, 100m CPU (default)
• Environment: NEXT_PUBLIC_API_URL, GREPTIME_URL, AUTH_SECRET, OAuth credentials

Controller (Stream Processing Engine)

Configuration:

• Image: 792306802931.dkr.ecr.us-east-1.amazonaws.com/laminar/backend
• Ports: gRPC 8001, Admin 8004, HTTP 8000
• Resources: 256Mi memory, 500m CPU (EKS default)
• Init Container: Runs database migrations on startup
• Strategy: Recreate (not rolling update)

Workers (Dynamic)

Workers are created dynamically by the controller, not by Helm directly.

Workers run the same backend image with command: /app/laminar --config /config/config.yaml worker

PostgreSQL

Configuration:

• Username: laminar_{tenant} (underscores, not hyphens)
• Database: laminar_{tenant}
• Storage: 10Gi on gp3 StorageClass (EKS)

Ingress

Paths:

• /console/* → Console service (port 3000)
• /api/* → Controller service (port 8000)

Hosts: Configured per tenant (e.g., e6data.lmnr.cloud)

Storage Paths

Each tenant has isolated storage:

Tenant Isolation

Shared Resources:

• Kubernetes cluster
• Ingress controller (nginx)
• Monitoring stack (GrepTimeDB, Grafana)
• Connector services (MinIO, Redpanda)

Adding a New Tenant

Step 1: Create Values File

cd laminar-infra/k8s/laminar-core
 
# Create tenant directory
mkdir -p tenants/acme
 
# Copy template
cp tenants/e6data/values-eks.yaml tenants/acme/values-eks.yaml

Step 2: Configure Tenant Values

Edit tenants/acme/values-eks.yaml:

nameOverride: acme
fullnameOverride: laminar-acme
 
ingress:
  enabled: true
  hosts:
    - acme.lmnr.cloud
 
engine:
  artifactUrl: "s3://laminar-dev/tenants/acme/artifacts"
  checkpointUrl: "s3://laminar-dev/tenants/acme/checkpoints"
 
postgresql:
  fullnameOverride: laminar-acme-postgresql
  auth:
    username: laminar_acme
    password: <secure-password>
    database: laminar_acme
  primary:
    persistence:
      enabled: true
      storageClass: gp3
      size: 10Gi

Step 3: Create ArgoCD Application

Create argocd/applications/tenants/acme.yaml:

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: tenant-acme
  namespace: argo
  labels:
    tenant: acme
    type: persistent
spec:
  project: laminar
  source:
    repoURL: git@github.com:e6data/laminar-infra.git
    targetRevision: main
    path: k8s/laminar-core
    helm:
      valueFiles:
        - values-eks.yaml
        - tenants/acme/values-eks.yaml
  destination:
    server: https://kubernetes.default.svc
    namespace: tenant-acme
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
      - CreateNamespace=true

Step 4: Commit and Deploy

# Commit both files
git add k8s/laminar-core/tenants/acme/values-eks.yaml
git add argocd/applications/tenants/acme.yaml
git commit -m "Add acme tenant"
git push
 
# ArgoCD will automatically sync, or manually:
task argocd:apply

Step 5: Configure DNS

Add DNS record pointing acme.lmnr.cloud to the ingress load balancer.

Tenant Configuration Reference

Required Values

Optional Values

Console Authentication

console:
  authUrl: "https://acme.lmnr.cloud"
  auth:
    secret: "<base64-nextauth-secret>"
    googleClientId: "<google-oauth-client-id>"
    googleClientSecret: "<google-oauth-client-secret>"

Custom Environment Variables

engine:
  env:
    - name: RUST_LOG
      value: "info"
    - name: CDC_JAR_PATH
      value: "/app/cdc-bridge-1.0.0.jar"
    - name: JVM_HEAP_SIZE
      value: "512m"

Node Affinity (Optional)

engine:
  controller:
    nodeSelector:
      node-type: controller
    tolerations:
      - key: "dedicated"
        operator: "Equal"
        value: "controller"
        effect: "NoSchedule"
  worker:
    nodeSelector:
      node-type: worker

Removing a Tenant

Via ArgoCD

# Delete the application (removes all resources)
argocd app delete tenant-acme --cascade
 
# Or via Taskfile
task argocd:delete APP=tenant-acme

Via Helm

helm uninstall laminar-acme -n tenant-acme
kubectl delete namespace tenant-acme

Cleanup

After removing a tenant:

1. Delete S3 data: aws s3 rm s3://laminar-dev/tenants/acme/ --recursive
2. Remove DNS record
3. Delete ArgoCD application file from git
4. Delete tenant values directory from git

Directory Structure

laminar-infra/
├── k8s/laminar-core/
│   ├── Chart.yaml
│   ├── values.yaml              # Base defaults
│   ├── values-eks.yaml          # EKS defaults
│   └── tenants/
│       ├── e6data/
│       │   ├── values.yaml      # Local dev
│       │   └── values-eks.yaml  # EKS production
│       └── highradius/
│           ├── values.yaml
│           └── values-eks.yaml
└── argocd/applications/tenants/
    ├── e6data.yaml
    └── highradius.yaml

Values Merge Order

Helm merges values in this order (later overrides earlier):

1. k8s/laminar-core/values.yaml (chart defaults)
2. k8s/laminar-core/values-eks.yaml (environment defaults)
3. k8s/laminar-core/tenants/{tenant}/values-eks.yaml (tenant overrides)