The correct option is Kubernetes Namespaces.

Kubernetes Namespaces provide simple logical separation inside a single cluster so teams get their own scope for names and resources. You can create RoleBindings scoped to a namespace to limit who can create or modify objects and you can apply ResourceQuota and LimitRange to control and isolate resource consumption for each team.

Namespaces are a lightweight and secure way to separate workloads because they work with Kubernetes RBAC and admission controls. For network level isolation you can combine Namespaces with NetworkPolicy so network traffic is restricted between namespaces when needed.

Ingress controllers are responsible for routing external HTTP and HTTPS traffic into the cluster. They do not provide user or resource isolation across teams and so they are not the correct feature for separating workloads and access.

Pods are the smallest deployable units that run containers and they are not a mechanism for multi team isolation. Pods live inside namespaces and do not control user permissions or resource scoping across teams.

NetworkPolicy controls network traffic between pods and namespaces and it is useful for isolation. It does not by itself separate user access or resource ownership and you still need Namespaces and RBAC to provide simple and secure team separation.

Full AWS Practitioner Certification Question