Building a Multi-Tenant Observability Platform with SigNoz + OneUptime

Building a Multi-Tenant Observability Platform with SigNoz + OneUptime

This article details the architecture of a multi-tenant monitoring platform built using SigNoz and OneUptime, designed to provide deep observability without compromising tenant isolation or security. The system supports both fully isolated stacks per tenant and logical isolation within a shared stack, enabling scalability and cost efficiency.

Why This Matters

Ideal observability solutions assume unlimited resources and perfect data isolation, which is often unrealistic and expensive. In reality, SaaS providers face the challenge of balancing detailed monitoring capabilities with the operational costs of maintaining separate infrastructure for each customer. Failure to achieve this balance can lead to significant overhead, compliance issues, and compromised security, potentially costing organizations thousands of dollars in fines and lost business.

Key Insights

• Hub-and-Spoke Model: The architecture employs a central monitoring VM acting as a hub, distributing data to tenant-specific spokes (SigNoz/OneUptime stacks).
• Tenant Isolation Modes: Offers both full isolation (dedicated stacks) and logical isolation (shared stack with routing) based on tenant needs.
• OpenTelemetry (OTEL): Leverages OTEL Collectors for consistent data ingestion from application VMs, forwarding logs, traces, and metrics to the central monitoring VM.

Working Example

map $host $signoz_collector_upstream {
signoz.tenant-a.example signoz-otel-collector-tenant-a;
signoz.tenant-b.example signoz-otel-collector-tenant-b;
default signoz-otel-collector-default;
}
server {
listen 4318;
location / {
proxy_pass http://$signoz_collector_upstream;
}
}

processors:
resourcedetection:
detectors: [system]
resource:
attributes:
- key: business_id
value: ${env:BUSINESS_ID}
action: upsert
transform/logs:
log_statements:
- context: log
statements:
- set(severity_text, attributes["severity"]) where attributes["severity"] != nil

Practical Applications

• SaaS Provider: A cloud-based application provider uses this architecture to offer dedicated monitoring dashboards to each customer, ensuring data privacy and compliance with industry regulations.
• Pitfall: Relying solely on shared infrastructure without proper routing and access controls can lead to data breaches and compliance violations, damaging the provider’s reputation and incurring legal penalties.

References:

• https://dev.to/starkprince/building-a-multi-tenant-observability-platform-with-signoz-oneuptime-523g