Four teams want to share one Kubernetes cluster. How do you isolate them, and when would you give them separate clusters instead?
What they are really testing: Whether you know the isolation primitives and their limits. The strongest answers are honest that namespaces are not a hard security boundary.
A real interview question
Four teams want to share one Kubernetes cluster. How do you isolate them, and when would you give them separate clusters instead?
What most people say
drag me
“Give each team a namespace, that is what namespaces are for.”
It is the right start and stops before everything that matters. Without quotas one team can consume the cluster, without network policy every pod can reach every other pod, and the answer implies namespaces provide security isolation they do not provide.
The follow-ups they ask next
What cluster-scoped things break the isolation illusion?
CRDs, admission webhooks, cluster roles, ingress controllers, node pools and the kernel itself. A misbehaving webhook can block API operations for every namespace at once.
One team wants a cluster-wide operator. How do you decide?
Ask whether it can be namespace-scoped. If it must be cluster-wide, it becomes a platform-owned component with a review, since it affects all tenants and their failure domain.
What the interviewer is listening for
- Names quotas and network policy unprompted
- Honest that namespaces are not hard isolation
- Has clear criteria for splitting clusters
What sinks the answer
- Namespaces alone
- Believes namespaces are a security boundary
- Defaults to a cluster per team without cost awareness
If you genuinely do not know
Say this instead of freezing. Reasoning out loud from what you do know beats silence every single time, and a good interviewer is listening for exactly that.
“[Namespace per team with scoped RBAC], plus [resource quotas so one team cannot starve others], [default-deny network policies since networking is flat by default], and [pod security standards]. But [namespaces are not a hard security boundary, since the kernel and cluster-scoped resources are shared], so [split clusters for untrusted tenants, compliance, or blast radius].”
Keep going with kubernetes
Junior
Explain the relationship between a Pod, a Deployment, and a Service in Kubernetes.
Junior
What is the difference between a liveness probe and a readiness probe, and what happens if you configure them wrong?
Mid
How do you decide CPU and memory requests and limits for a service, and what breaks if you get them wrong?
Senior
Design a CI/CD system for 15 microservices owned by 4 teams deploying several times a day.
Senior
Design an observability stack for a system where nobody can currently answer why a request was slow.
Senior
Leadership asks you to prove the platform investment is working. What do you measure?
Knowing the answer is not the same as recalling it under pressure
Sign in to send the questions you fumble to spaced recall, so they come back right before you would forget them, and learn the concepts behind them with hands-on labs.
Start free