Multi-tenancy and isolation in MLOps - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding Multi-tenancy Isolation Levels

Which isolation level best ensures that tenants cannot access each other's data in a multi-tenant MLOps platform?

A Shared database with tenant-specific schemas

B Shared file storage with access control lists

C Shared database and shared schema with tenant ID filtering

D Dedicated database per tenant

💡 Hint

Think about physical separation to prevent accidental or malicious data access.

Dedicated databases per tenant provide the strongest isolation by physically separating data, preventing cross-tenant access.

💻 Command Output

intermediate

Kubernetes Namespace Isolation Output

Given the command kubectl get pods -n tenant-a, what is the expected output if the namespace tenant-a exists but has no pods?

MLOps

kubectl get pods -n tenant-a

A Error from server (NotFound): namespaces "tenant-a" not found

B No resources found in tenant-a namespace.

C

NAME   READY   STATUS   RESTARTS   AGE

D pod1 1/1 Running 0 5m

💡 Hint

Consider what Kubernetes shows when a namespace exists but has no pods.

Kubernetes returns 'No resources found' when the namespace exists but contains no pods.

❓ Configuration

advanced

Configuring Resource Quotas for Tenant Isolation

Which YAML snippet correctly sets a CPU limit of 2 cores and memory limit of 4Gi for a tenant namespace tenant-b in Kubernetes?

A

apiVersion: v1
kind: ResourceQuota
metadata:
  name: tenant-b-quota
  namespace: tenant-b
spec:
  hard:
    limits.cpu: "2"
    limits.memory: 4Gi

B

apiVersion: v1
kind: ResourceQuota
metadata:
  name: tenant-b-quota
  namespace: tenant-b
spec:
  hard:
    cpu: 2
    memory: 4Gi

C

apiVersion: v1
kind: ResourceQuota
metadata:
  name: tenant-b-quota
  namespace: tenant-b
spec:
  hard:
    cpu: "2"
    memory: 4Gi

D

apiVersion: v1
kind: ResourceQuota
metadata:
  name: tenant-b-quota
  namespace: tenant-b
spec:
  hard:
    requests.cpu: "2"
    requests.memory: 4Gi

💡 Hint

ResourceQuota keys for limits must be prefixed with limits.

ResourceQuota requires keys like limits.cpu and limits.memory to set limits on CPU and memory usage.

❓ Troubleshoot

advanced

Troubleshooting Cross-Tenant Data Access

An MLOps platform uses shared storage with access control lists (ACLs) for tenant data isolation. Tenant C reports they can see files belonging to Tenant D. What is the most likely cause?

A ACLs are misconfigured allowing Tenant C read access to Tenant D files

B Tenant C's namespace is incorrectly labeled

C Resource quotas are too high for Tenant D

D Kubernetes pod security policies are too restrictive

💡 Hint

Focus on permissions controlling file access.

If ACLs are misconfigured, tenants can access each other's files despite namespace or quota settings.

🔀 Workflow

expert

Multi-tenant Deployment Workflow

Arrange the steps in the correct order to deploy isolated ML models for multiple tenants using Kubernetes namespaces and resource quotas.

A 1,3,2,4

B 2,1,3,4

C 1,2,3,4

D 1,2,4,3

💡 Hint

Think about setting up the environment before deploying workloads and securing communication last.

Namespaces must be created first, then resource quotas applied, followed by deploying pods, and finally network policies to isolate traffic.