Twelve teams, forty services. One shared Kubernetes cluster or a cluster per team? Justify.

What the interviewer is testing

Whether you can state precisely what namespace isolation does and does not provide, rather than picking a side.

What namespace isolation actually gives you

Real but partial. It provides resource quotas, network policy separation, RBAC scoping and a naming boundary.

What it does not provide:

• The node kernel is shared — a container escape crosses tenants
• The control plane is shared — one team's runaway controller degrades everyone
• Cluster-scoped resources — CRDs, admission webhooks, node agents — are genuinely global and cannot be namespaced
• Noisy-neighbour effects on network and storage persist despite CPU and memory quotas

The cost of a cluster per team

Twelve clusters means twelve control planes to run and upgrade, twelve sets of platform components, twelve places for configuration to drift, and much worse bin-packing — small teams' clusters run at low utilisation because each needs headroom.

For twelve teams that is a substantial and permanent operational tax.

The answer

Draw the boundary by trust and compliance, not by team. Production separate from non-production. Regulated workloads separate from unregulated. Internet-facing separate from internal, if the threat model warrants it. Within each of those, share.

That typically yields three or four clusters rather than one or twelve, and the boundaries are ones you can explain to an auditor because they correspond to something real.

What a strong answer adds

The controls that make sharing defensible: quotas and limit ranges per namespace, default-deny network policies, pod security standards, separate node pools for differing trust levels, and per-namespace cost attribution.

And the operational point: fewer, larger clusters only work if upgrades are safe and routine. If cluster upgrades are a quarterly ordeal, consolidation concentrates that risk.

Common weak answers

"Shared, namespaces are enough" without naming the limits. "Cluster per team for isolation" without pricing twelve control planes.