The requirements of PCI don't require stored data to be separated, only encrypted. Kube isn't a hypervisor and the only 100% sure way to separate data in a kube environment would be to have seperate orchestrators for each customer data set. Hypervisors can use different OS's and kernels, whereas containers cannot. I would focus on encrypting the data, secure access and logging, and data flow monitoring.