A city AKS cluster hosts both parks and transit generative workloads. How should the platform team isolate departments and control resource use?
Select an answer to reveal the explanation.
Short Explanation
Namespaces are like separate floors in city hall for parks vs transit AI—each floor gets its own quota so one department's spike doesn't hog the whole building. Dumping everything in default with no limits is a traffic jam waiting to happen.
Full Explanation
On a shared city AKS cluster, separate namespaces for parks and transit generative workloads provide logical isolation for RBAC, NetworkPolicies, and resource accounting, while ResourceQuota objects cap CPU and memory (and related objects) per department. That combination prevents one team's RAG or inference spike from starving the other and is the standard multi-tenant pattern for municipal platform teams that share nodes but not trust boundaries. Namespaces also make chargeback, owners, and policy attachment clearer than a single mixed default space.
Running every municipal AI pod in the default namespace with no ResourceQuota fails by concept because there is no departmental isolation and no hard cap—noisy neighbors and accidental cluster-wide contention are expected. Deleting namespaces weekly so each department starts blank fails because it destroys state, services, secrets, and continuity rather than controlling resources; isolation is not achieved by periodic wipeouts. Giving every pod unrestricted cluster-admin rights fails because it removes authorization boundaries and invites privilege abuse, which is the opposite of quota-and-namespace governance.
Exam caveat: Namespaces isolate Kubernetes API objects and are not a hard security boundary by themselves—pair them with RBAC, NetworkPolicy, and quotas. ResourceQuota limits aggregate namespace usage; LimitRange constrains per-pod defaults. Soft multi-tenancy on shared nodes still shares the kernel and node agents, which matters for high-sensitivity civic workloads.
Operational check: Create parks and transit namespaces, apply ResourceQuota matching each department's budget, bind teams to RoleBindings scoped to their namespace only, deploy sample AI workloads, and verify one namespace cannot schedule beyond its quota while the other remains healthy. Confirm default namespace is not used for production civic AI.