Title: Discussion 6 — Blast Radius Without Isolation
Course: AIINFRA 101: Applied Infrastructure & Containerization > Section: Week 06 — Introduction to Kubernetes: Architecture & kubectl

💬 Discussion 6 — Blast Radius Without Isolation (20 pts)

Why does Kubernetes isolate control-plane components from user workloads by placing them in the kube-system namespace — and what would actually happen if a buggy AI training pod in the default namespace consumed all available CPU and memory on a shared node? In your initial post (150–250 words), address:

- What kube-system namespace isolation does and does not protect you from, based on this week's lecture
- A concrete scenario of what happens to co-located pods (including possibly control-plane pods, if they share that node) when one workload exhausts node resources
- One practical mitigation you would propose (e.g., resource requests/limits, dedicated node pools) even though we have not formally covered them yet — take your best guess based on what you know about scheduling

Respond to at least two classmates, ideally challenging or building on a mitigation strategy they proposed.