[ptrincr]

From a service point of view, you should be able to provide isolation between services using namespaces, istio and Calico. You can read about "Soft multi-tenancy" here:

https://istio.io/blog/2018/soft-multitenancy/

That works well to isolate services/apps/teams from each other, but also allows services to be shared where required.

I think if you wanted true multitenancy it would be simpler to spin up a second cluster, especially if you are in gcp and controlling everything using a infrastructure as code solution such as terraform.