Beyond Namespaces: Why Kubernetes Needs Real Workload Isolation
thenewstack.io