We're using Pinot in Kubernetes, and we would like to start using multiple tenants in order to support physical data segregation. We need to not only physically separate the data, but also encrypt each tenant's data at-rest using a different encryption key for their bound volume. The feature that would enable all of this is the ability to set specific servers to be assigned to specific tenants. I have not seen that this is possible in any configuration. Does anyone know of a way to do it?

technically you can create multiple pinot server statefulsets, one for each tenant. And internally you can use different storageClasses each with own encrypted disks.

How can I assign different tenants to each of the stateful sets? Using the Pinot Tenants API, it only lets you configure a number of servers/brokers, not exactly which ones

e.g. you can create a statefulset like

pinot-server-tenantA

, then all the pods name will be ``pinot-server-tenantA-0` , ... Then you can configure each server instance tag to

tenantA_OFFLINE

and

tenantA_REALTIME

Oh I didn't realize you could manually tag the instances with a tenant. I thought I tried that a while back and it wasn't working properly. I'm going to try it out. Thanks for the tips!

you could also do it from the ui 🙂