Multi-tenancy and isolation in MLOps - Mini Project: Build & Apply

Multi-tenancy and Isolation in MLOps

📖 Scenario: You are managing machine learning models for different teams in a company. Each team should only access their own models and data. This is called multi-tenancy with isolation.We will create a simple system to store model names by team and then retrieve only the models for a specific team.

🎯 Goal: Build a Python program that stores models for multiple teams in a dictionary, sets a team name as a filter, and then lists only the models belonging to that team.

📋 What You'll Learn

Create a dictionary called team_models with exact keys and values for teams and their models

Create a variable called current_team with the exact team name to filter

Use a list comprehension to create a list called filtered_models containing models only for current_team

Print the filtered_models list exactly as shown

💡 Why This Matters

🌍 Real World

In real MLOps, multiple teams share infrastructure. Multi-tenancy ensures each team accesses only their own models and data, preventing mix-ups and security issues.

💼 Career

Understanding multi-tenancy and isolation is key for roles managing shared ML platforms, ensuring data privacy and smooth collaboration.

1

Create the multi-tenant model storage

Create a dictionary called team_models with these exact entries: 'team_alpha': ['model1', 'model2'], 'team_beta': ['model3'], 'team_gamma': ['model4', 'model5', 'model6'].

MLOps

# Create the team_models dictionary with exact entries
# Your code here

Hint

Use curly braces {} to create a dictionary. Keys are team names as strings. Values are lists of model names.

2

Set the current team for isolation

Create a variable called current_team and set it to the string 'team_gamma' to select that team's models.

MLOps

team_models = {
    'team_alpha': ['model1', 'model2'],
    'team_beta': ['model3'],
    'team_gamma': ['model4', 'model5', 'model6']
}
# Set current_team to 'team_gamma'
# Your code here

Hint

Assign the string 'team_gamma' to the variable current_team.

3

Filter models for the current team

Use a list comprehension to create a list called filtered_models that contains only the models from team_models[current_team].

MLOps

team_models = {
    'team_alpha': ['model1', 'model2'],
    'team_beta': ['model3'],
    'team_gamma': ['model4', 'model5', 'model6']
}

current_team = 'team_gamma'
# Create filtered_models list with models only for current_team
# Your code here

Hint

Use a list comprehension to loop over team_models[current_team] and collect each model.

4

Display the filtered models

Write a print statement to display the filtered_models list exactly as it is.

MLOps

team_models = {
    'team_alpha': ['model1', 'model2'],
    'team_beta': ['model3'],
    'team_gamma': ['model4', 'model5', 'model6']
}

current_team = 'team_gamma'

filtered_models = [model for model in team_models[current_team]]
# Print the filtered_models list
# Your code here

Hint

Use print(filtered_models) to show the list of models for the current team.

Practice

1. What is the main purpose of multi-tenancy in MLOps platforms?

easy

A. To speed up model training by using multiple GPUs

B. To store all data in a single shared database without restrictions

C. To allow multiple users to share the same system safely

D. To run only one user's workload at a time

Solution

1. Step 1: Understand multi-tenancy concept

   Multi-tenancy means many users share one system but remain separate and safe.

2. Step 2: Identify the correct purpose

   The goal is to let users share resources without interfering with each other.

3. Final Answer:

   To allow multiple users to share the same system safely -> Option C

4. Quick Check:

   Multi-tenancy = safe shared use [OK]

Hint: Multi-tenancy means safe sharing, not exclusive use [OK]

Common Mistakes:

• Confusing multi-tenancy with faster hardware use
• Thinking all data is mixed without separation
• Believing only one user runs at a time

2. Which configuration snippet correctly isolates tenant data in a Kubernetes namespace?

easy

A. apiVersion: v1
kind: ConfigMap
metadata:
name: tenant-a-config

B. apiVersion: v1
kind: Namespace
metadata:
name: tenant-a

C. apiVersion: v1
kind: Service
metadata:
name: tenant-a-service

D. apiVersion: v1
kind: Pod
metadata:
name: tenant-a-pod

Solution

1. Step 1: Identify resource for tenant isolation

   Kubernetes namespaces isolate resources per tenant.

2. Step 2: Match correct YAML kind

   Namespace kind with tenant name isolates tenant data correctly.

3. Final Answer:

   apiVersion: v1 kind: Namespace metadata: name: tenant-a -> Option B

4. Quick Check:

   Namespace = tenant isolation [OK]

Hint: Namespaces isolate tenants, not pods or services alone [OK]

Common Mistakes:

• Choosing Pod or Service which do not isolate tenants
• Confusing ConfigMap with isolation resource
• Missing correct YAML syntax for namespaces

3. Given this code snippet for tenant isolation in a shared ML platform, what will be the output?

tenants = {"tenant1": {"models": ["modelA"]}, "tenant2": {"models": ["modelB"]}}

for tenant, data in tenants.items():
    print(f"{tenant} has models: {', '.join(data['models'])}")

medium

A. tenant1 has models: modelA
tenant2 has models: modelB

B. tenant1 has models: modelB
tenant2 has models: modelA

C. tenant1 has models:
tenant2 has models:

D. Error: KeyError

Solution

1. Step 1: Understand dictionary structure

   Each tenant key maps to a dict with a 'models' list.

2. Step 2: Loop and print models per tenant

   Loop prints tenant name and joins model names correctly.

3. Final Answer:

   tenant1 has models: modelA tenant2 has models: modelB -> Option A

4. Quick Check:

   Correct tenant-model mapping printed [OK]

Hint: Check keys and values carefully in dict loops [OK]

Common Mistakes:

• Swapping models between tenants
• Printing empty model lists
• Mistyping keys causing KeyError

4. You have this Kubernetes YAML snippet meant to isolate tenant workloads:

apiVersion: v1
kind: Namespace
metadata:
  name: tenant1
---
apiVersion: v1
kind: Pod
metadata:
  name: tenant1-pod
  namespace: tenant2
spec:
  containers:
  - name: app
    image: ml-app:latest

What is the main issue here?

medium

A. Pod is assigned to a different namespace than tenant's namespace

B. Namespace name is invalid

C. Container image name is incorrect

D. Pod spec is missing container ports

Solution

1. Step 1: Check namespace assignment

   Pod metadata namespace is 'tenant2' but tenant namespace defined is 'tenant1'.

2. Step 2: Identify isolation problem

   Pod runs in wrong namespace, breaking tenant isolation.

3. Final Answer:

   Pod is assigned to a different namespace than tenant's namespace -> Option A

4. Quick Check:

   Namespace mismatch breaks isolation [OK]

Hint: Pod namespace must match tenant namespace exactly [OK]

Common Mistakes:

• Ignoring namespace mismatch
• Assuming image name causes error
• Thinking missing ports cause isolation failure

5. In a multi-tenant MLOps platform, you want to ensure that tenant A's models cannot access tenant B's data. Which combination of strategies best achieves this?

hard

A. Run all tenant workloads on the same node without resource limits

B. Store all tenant data in one database and rely on application code to separate access

C. Allow tenants to share the same service account for simplicity

D. Use separate namespaces for each tenant and enforce RBAC policies limiting access

Solution

1. Step 1: Understand isolation requirements

   Tenant data must be separated and access controlled to prevent leaks.

2. Step 2: Identify best isolation methods

   Namespaces isolate resources; RBAC controls who can access what.

3. Step 3: Evaluate options

   Only Use separate namespaces for each tenant and enforce RBAC policies limiting access uses both namespaces and RBAC for strong isolation.

4. Final Answer:

   Use separate namespaces for each tenant and enforce RBAC policies limiting access -> Option D

5. Quick Check:

   Namespaces + RBAC = strong tenant isolation [OK]

Hint: Combine namespaces and RBAC for secure tenant isolation [OK]

Common Mistakes:

• Relying only on application code for data separation
• Sharing service accounts across tenants
• Ignoring resource limits and node sharing risks