TenantForge: Multi-Tenant Platform Engineering

Overview

TenantForge is a personal platform-engineering build that demonstrates how to stand up a secure, observable, cost-governed multi-tenant service the way a platform team would, with each layer mapped explicitly to Microsoft's Well-Architected Framework pillars. It has two layers: the Platform, a self-service golden-path system for provisioning multi-tenant services on Azure, and the Reference Workload, a deliberately simple service that exists only to prove the platform works end-to-end. The primary Azure landing zone is fully modeled in Terraform; the AWS reference implementation of the same modules is the piece currently applied and verified against real infrastructure, alongside the containerized reference workload, CI/CD supply-chain pipeline, ArgoCD GitOps rollout, observability stack, tenant admission policy, and Backstage onboarding template.

Key Features

• Terraform IaC for an Azure landing zone plus a portable AWS reference implementation proving the modules aren't cloud-locked
• CI/CD supply-chain pipeline with SAST scanning, SBOM generation, and artifact signing
• ArgoCD GitOps app-of-apps deployment onto AKS
• Zero-trust identity via Microsoft Entra Workload Identity Federation
• OpenTelemetry, Prometheus, and Grafana observability with SLO alerting, dashboards, and runbooks
• Tenant isolation via Kubernetes NetworkPolicy plus an OPA/Gatekeeper admission policy
• Backstage-based Internal Developer Platform with a self-service onboarding template
• FinOps cost dashboards, budget alerts, and an orphan-resource cleanup bot

Challenges

• Keeping the same Terraform modules portable across Azure and AWS without cloud-specific drift
• Enforcing tenant isolation and least-privilege identity without slowing down the self-service golden path
• Sequencing a large platform build so each layer (IaC, GitOps, observability, policy, FinOps) is independently verifiable before wiring the rest together

Tech Stack

Source

System Architecture