Multi-tenancy and isolation in MLOps - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to specify the isolation level for a tenant in a Kubernetes namespace.

MLOps

kubectl create namespace [1]

Drag options to blanks, or click blank then click option'

Atenant-isolation

Bdefault

Cshared

Dglobal

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'default' namespace causes no isolation.

Creating a dedicated namespace like tenant-isolation helps isolate tenant resources in Kubernetes.

2fill in blank

medium

Complete the command to apply a network policy that isolates tenant pods.

MLOps

kubectl apply -f [1]

Drag options to blanks, or click blank then click option'

Ashared-network.yaml

Btenant-isolation-network.yaml

Cglobal-policy.yaml

Ddefault-policy.yaml

Attempts:

3 left

💡 Hint

Common Mistakes

Applying default or global policies does not isolate tenants.

The file tenant-isolation-network.yaml contains the network policy to isolate tenant pods.

3fill in blank

hard

Fix the error in the resource quota definition for tenant isolation.

MLOps

""
apiVersion: v1
kind: ResourceQuota
metadata:
  name: tenant-quota
  namespace: tenant-namespace
spec:
  hard:
    pods: [1]
"""

Drag options to blanks, or click blank then click option'

A10

Bten

C"ten"

D"10"

Attempts:

3 left

💡 Hint

Common Mistakes

Using quoted numbers causes YAML parsing errors.

The value for resource quota must be an integer without quotes, so 10 is correct.

4fill in blank

hard

Fill both blanks to create a pod security policy that restricts privilege escalation.

MLOps

""
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
  name: [1]
spec:
  allowPrivilegeEscalation: [2]
"""

Drag options to blanks, or click blank then click option'

Atenant-psp

Btrue

Cfalse

Ddefault-psp

Attempts:

3 left

💡 Hint

Common Mistakes

Allowing privilege escalation weakens isolation.

Using tenant-psp as the policy name and setting allowPrivilegeEscalation to false restricts privilege escalation for tenant pods.

5fill in blank

hard

Fill all three blanks to define a Kubernetes RoleBinding for tenant access control.

MLOps

""
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: [1]
  namespace: [2]
subjects:
- kind: User
  name: [3]
roleRef:
  kind: Role
  name: tenant-role
  apiGroup: rbac.authorization.k8s.io
"""

Drag options to blanks, or click blank then click option'

Atenant-access

Btenant-namespace

Ctenant-user

Ddefault

Attempts:

3 left

💡 Hint

Common Mistakes

Using default namespace or user breaks isolation.

The RoleBinding named tenant-access in tenant-namespace grants the tenant-user access via the tenant-role.