Multi-tenancy and isolation in MLOps - Time & Space Complexity

Time Complexity: Multi-tenancy and isolation

O(n * m)

Understanding Time Complexity

When managing multiple users or teams on the same system, it's important to understand how the system's work grows as more tenants are added.

We want to know how the system handles tasks for many tenants without slowing down too much.

Scenario Under Consideration

Analyze the time complexity of the following code snippet.

for tenant in tenants:
    isolate_environment(tenant)
    for job in tenant.jobs:
        run_job(job)
        log_results(job)

This code runs jobs for each tenant separately, isolating their environments and logging results.

Identify Repeating Operations

Identify the loops, recursion, array traversals that repeat.

• Primary operation: Running jobs inside each tenant's isolated environment.
• How many times: For each tenant, all their jobs are processed one by one.

How Execution Grows With Input

As the number of tenants and their jobs increase, the total work grows by adding all jobs from all tenants.

Input Size (tenants * jobs)	Approx. Operations
10 tenants with 5 jobs each	50 operations
100 tenants with 5 jobs each	500 operations
100 tenants with 50 jobs each	5,000 operations

Pattern observation: The total work grows proportionally with the total number of jobs across all tenants.

Final Time Complexity

Time Complexity: O(n * m)

This means the time grows in proportion to the number of tenants (n) times the number of jobs per tenant (m).

Common Mistake

[X] Wrong: "Adding more tenants won't affect the time much because jobs run independently."

[OK] Correct: Even if jobs run separately, the system still processes all jobs for all tenants, so total time grows with total jobs.

Interview Connect

Understanding how work scales with tenants and jobs helps you design systems that stay efficient as more users join.

Self-Check

"What if jobs for all tenants could run in parallel? How would that change the time complexity?"

Practice

1. What is the main purpose of multi-tenancy in MLOps platforms?

easy

A. To speed up model training by using multiple GPUs

B. To store all data in a single shared database without restrictions

C. To allow multiple users to share the same system safely

D. To run only one user's workload at a time

Solution

1. Step 1: Understand multi-tenancy concept

   Multi-tenancy means many users share one system but remain separate and safe.

2. Step 2: Identify the correct purpose

   The goal is to let users share resources without interfering with each other.

3. Final Answer:

   To allow multiple users to share the same system safely -> Option C

4. Quick Check:

   Multi-tenancy = safe shared use [OK]

Hint: Multi-tenancy means safe sharing, not exclusive use [OK]

Common Mistakes:

• Confusing multi-tenancy with faster hardware use
• Thinking all data is mixed without separation
• Believing only one user runs at a time

2. Which configuration snippet correctly isolates tenant data in a Kubernetes namespace?

easy

A. apiVersion: v1
kind: ConfigMap
metadata:
name: tenant-a-config

B. apiVersion: v1
kind: Namespace
metadata:
name: tenant-a

C. apiVersion: v1
kind: Service
metadata:
name: tenant-a-service

D. apiVersion: v1
kind: Pod
metadata:
name: tenant-a-pod

Solution

1. Step 1: Identify resource for tenant isolation

   Kubernetes namespaces isolate resources per tenant.

2. Step 2: Match correct YAML kind

   Namespace kind with tenant name isolates tenant data correctly.

3. Final Answer:

   apiVersion: v1 kind: Namespace metadata: name: tenant-a -> Option B

4. Quick Check:

   Namespace = tenant isolation [OK]

Hint: Namespaces isolate tenants, not pods or services alone [OK]

Common Mistakes:

• Choosing Pod or Service which do not isolate tenants
• Confusing ConfigMap with isolation resource
• Missing correct YAML syntax for namespaces

3. Given this code snippet for tenant isolation in a shared ML platform, what will be the output?

tenants = {"tenant1": {"models": ["modelA"]}, "tenant2": {"models": ["modelB"]}}

for tenant, data in tenants.items():
    print(f"{tenant} has models: {', '.join(data['models'])}")

medium

A. tenant1 has models: modelA
tenant2 has models: modelB

B. tenant1 has models: modelB
tenant2 has models: modelA

C. tenant1 has models:
tenant2 has models:

D. Error: KeyError

Solution

1. Step 1: Understand dictionary structure

   Each tenant key maps to a dict with a 'models' list.

2. Step 2: Loop and print models per tenant

   Loop prints tenant name and joins model names correctly.

3. Final Answer:

   tenant1 has models: modelA tenant2 has models: modelB -> Option A

4. Quick Check:

   Correct tenant-model mapping printed [OK]

Hint: Check keys and values carefully in dict loops [OK]

Common Mistakes:

• Swapping models between tenants
• Printing empty model lists
• Mistyping keys causing KeyError

4. You have this Kubernetes YAML snippet meant to isolate tenant workloads:

apiVersion: v1
kind: Namespace
metadata:
  name: tenant1
---
apiVersion: v1
kind: Pod
metadata:
  name: tenant1-pod
  namespace: tenant2
spec:
  containers:
  - name: app
    image: ml-app:latest

What is the main issue here?

medium

A. Pod is assigned to a different namespace than tenant's namespace

B. Namespace name is invalid

C. Container image name is incorrect

D. Pod spec is missing container ports

Solution

1. Step 1: Check namespace assignment

   Pod metadata namespace is 'tenant2' but tenant namespace defined is 'tenant1'.

2. Step 2: Identify isolation problem

   Pod runs in wrong namespace, breaking tenant isolation.

3. Final Answer:

   Pod is assigned to a different namespace than tenant's namespace -> Option A

4. Quick Check:

   Namespace mismatch breaks isolation [OK]

Hint: Pod namespace must match tenant namespace exactly [OK]

Common Mistakes:

• Ignoring namespace mismatch
• Assuming image name causes error
• Thinking missing ports cause isolation failure

5. In a multi-tenant MLOps platform, you want to ensure that tenant A's models cannot access tenant B's data. Which combination of strategies best achieves this?

hard

A. Run all tenant workloads on the same node without resource limits

B. Store all tenant data in one database and rely on application code to separate access

C. Allow tenants to share the same service account for simplicity

D. Use separate namespaces for each tenant and enforce RBAC policies limiting access

Solution

1. Step 1: Understand isolation requirements

   Tenant data must be separated and access controlled to prevent leaks.

2. Step 2: Identify best isolation methods

   Namespaces isolate resources; RBAC controls who can access what.

3. Step 3: Evaluate options

   Only Use separate namespaces for each tenant and enforce RBAC policies limiting access uses both namespaces and RBAC for strong isolation.

4. Final Answer:

   Use separate namespaces for each tenant and enforce RBAC policies limiting access -> Option D

5. Quick Check:

   Namespaces + RBAC = strong tenant isolation [OK]

Hint: Combine namespaces and RBAC for secure tenant isolation [OK]

Common Mistakes:

• Relying only on application code for data separation
• Sharing service accounts across tenants
• Ignoring resource limits and node sharing risks