<a href="https://kubernetes.io/docs/tasks/administer-cluster/namespaces-walkthrough/">namespace</a> for each SRE team to isolate their access. For example, you could create a “team1-ns” namespace for team1, and “team2-ns” namespace for team2, such that both teams won’t be able to access each other’s services.</p></li><li><p>If Istio CA is compromised, all its managed keys and certificates in the cluster may be exposed. We <em>strongly</em> recommend running Istio CA on a dedicated namespace (for