Multi-tenancy and isolation in MLOps - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to specify the isolation level for a tenant in a Kubernetes namespace.

MLOps

kubectl create namespace [1]

Drag options to blanks, or click blank then click option'

Atenant-isolation

Bdefault

Cshared

Dglobal

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'default' namespace causes no isolation.

Creating a dedicated namespace like tenant-isolation helps isolate tenant resources in Kubernetes.

2fill in blank

medium

Complete the command to apply a network policy that isolates tenant pods.

MLOps

kubectl apply -f [1]

Drag options to blanks, or click blank then click option'

Ashared-network.yaml

Btenant-isolation-network.yaml

Cglobal-policy.yaml

Ddefault-policy.yaml

Attempts:

3 left

💡 Hint

Common Mistakes

Applying default or global policies does not isolate tenants.

The file tenant-isolation-network.yaml contains the network policy to isolate tenant pods.

3fill in blank

hard

Fix the error in the resource quota definition for tenant isolation.

MLOps

""
apiVersion: v1
kind: ResourceQuota
metadata:
  name: tenant-quota
  namespace: tenant-namespace
spec:
  hard:
    pods: [1]
"""

Drag options to blanks, or click blank then click option'

A10

Bten

C"ten"

D"10"

Attempts:

3 left

💡 Hint

Common Mistakes

Using quoted numbers causes YAML parsing errors.

The value for resource quota must be an integer without quotes, so 10 is correct.

4fill in blank

hard

Fill both blanks to create a pod security policy that restricts privilege escalation.

MLOps

""
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
  name: [1]
spec:
  allowPrivilegeEscalation: [2]
"""

Drag options to blanks, or click blank then click option'

Atenant-psp

Btrue

Cfalse

Ddefault-psp

Attempts:

3 left

💡 Hint

Common Mistakes

Allowing privilege escalation weakens isolation.

Using tenant-psp as the policy name and setting allowPrivilegeEscalation to false restricts privilege escalation for tenant pods.

5fill in blank

hard

Fill all three blanks to define a Kubernetes RoleBinding for tenant access control.

MLOps

""
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: [1]
  namespace: [2]
subjects:
- kind: User
  name: [3]
roleRef:
  kind: Role
  name: tenant-role
  apiGroup: rbac.authorization.k8s.io
"""

Drag options to blanks, or click blank then click option'

Atenant-access

Btenant-namespace

Ctenant-user

Ddefault

Attempts:

3 left

💡 Hint

Common Mistakes

Using default namespace or user breaks isolation.

The RoleBinding named tenant-access in tenant-namespace grants the tenant-user access via the tenant-role.

Practice

1. What is the main purpose of multi-tenancy in MLOps platforms?

easy

A. To speed up model training by using multiple GPUs

B. To store all data in a single shared database without restrictions

C. To allow multiple users to share the same system safely

D. To run only one user's workload at a time

Solution

1. Step 1: Understand multi-tenancy concept

   Multi-tenancy means many users share one system but remain separate and safe.

2. Step 2: Identify the correct purpose

   The goal is to let users share resources without interfering with each other.

3. Final Answer:

   To allow multiple users to share the same system safely -> Option C

4. Quick Check:

   Multi-tenancy = safe shared use [OK]

Hint: Multi-tenancy means safe sharing, not exclusive use [OK]

Common Mistakes:

• Confusing multi-tenancy with faster hardware use
• Thinking all data is mixed without separation
• Believing only one user runs at a time

2. Which configuration snippet correctly isolates tenant data in a Kubernetes namespace?

easy

A. apiVersion: v1
kind: ConfigMap
metadata:
name: tenant-a-config

B. apiVersion: v1
kind: Namespace
metadata:
name: tenant-a

C. apiVersion: v1
kind: Service
metadata:
name: tenant-a-service

D. apiVersion: v1
kind: Pod
metadata:
name: tenant-a-pod

Solution

1. Step 1: Identify resource for tenant isolation

   Kubernetes namespaces isolate resources per tenant.

2. Step 2: Match correct YAML kind

   Namespace kind with tenant name isolates tenant data correctly.

3. Final Answer:

   apiVersion: v1 kind: Namespace metadata: name: tenant-a -> Option B

4. Quick Check:

   Namespace = tenant isolation [OK]

Hint: Namespaces isolate tenants, not pods or services alone [OK]

Common Mistakes:

• Choosing Pod or Service which do not isolate tenants
• Confusing ConfigMap with isolation resource
• Missing correct YAML syntax for namespaces

3. Given this code snippet for tenant isolation in a shared ML platform, what will be the output?

tenants = {"tenant1": {"models": ["modelA"]}, "tenant2": {"models": ["modelB"]}}

for tenant, data in tenants.items():
    print(f"{tenant} has models: {', '.join(data['models'])}")

medium

A. tenant1 has models: modelA
tenant2 has models: modelB

B. tenant1 has models: modelB
tenant2 has models: modelA

C. tenant1 has models:
tenant2 has models:

D. Error: KeyError

Solution

1. Step 1: Understand dictionary structure

   Each tenant key maps to a dict with a 'models' list.

2. Step 2: Loop and print models per tenant

   Loop prints tenant name and joins model names correctly.

3. Final Answer:

   tenant1 has models: modelA tenant2 has models: modelB -> Option A

4. Quick Check:

   Correct tenant-model mapping printed [OK]

Hint: Check keys and values carefully in dict loops [OK]

Common Mistakes:

• Swapping models between tenants
• Printing empty model lists
• Mistyping keys causing KeyError

4. You have this Kubernetes YAML snippet meant to isolate tenant workloads:

apiVersion: v1
kind: Namespace
metadata:
  name: tenant1
---
apiVersion: v1
kind: Pod
metadata:
  name: tenant1-pod
  namespace: tenant2
spec:
  containers:
  - name: app
    image: ml-app:latest

What is the main issue here?

medium

A. Pod is assigned to a different namespace than tenant's namespace

B. Namespace name is invalid

C. Container image name is incorrect

D. Pod spec is missing container ports

Solution

1. Step 1: Check namespace assignment

   Pod metadata namespace is 'tenant2' but tenant namespace defined is 'tenant1'.

2. Step 2: Identify isolation problem

   Pod runs in wrong namespace, breaking tenant isolation.

3. Final Answer:

   Pod is assigned to a different namespace than tenant's namespace -> Option A

4. Quick Check:

   Namespace mismatch breaks isolation [OK]

Hint: Pod namespace must match tenant namespace exactly [OK]

Common Mistakes:

• Ignoring namespace mismatch
• Assuming image name causes error
• Thinking missing ports cause isolation failure

5. In a multi-tenant MLOps platform, you want to ensure that tenant A's models cannot access tenant B's data. Which combination of strategies best achieves this?

hard

A. Run all tenant workloads on the same node without resource limits

B. Store all tenant data in one database and rely on application code to separate access

C. Allow tenants to share the same service account for simplicity

D. Use separate namespaces for each tenant and enforce RBAC policies limiting access

Solution

1. Step 1: Understand isolation requirements

   Tenant data must be separated and access controlled to prevent leaks.

2. Step 2: Identify best isolation methods

   Namespaces isolate resources; RBAC controls who can access what.

3. Step 3: Evaluate options

   Only Use separate namespaces for each tenant and enforce RBAC policies limiting access uses both namespaces and RBAC for strong isolation.

4. Final Answer:

   Use separate namespaces for each tenant and enforce RBAC policies limiting access -> Option D

5. Quick Check:

   Namespaces + RBAC = strong tenant isolation [OK]

Hint: Combine namespaces and RBAC for secure tenant isolation [OK]

Common Mistakes:

• Relying only on application code for data separation
• Sharing service accounts across tenants
• Ignoring resource limits and node sharing risks