Another team must deploy an integration to your GKE cluster but must not modify your existing application. What should you do to restrict changes while allowing their deployments?

Creating a new namespace isolates the other team's deployments from your existing application, preventing accidental or intentional modifications. Granting an Admin role via Kubernetes RBAC specifically to this new namespace provides them the necessary permissions to manage their deployments within that namespace without affecting other parts of the cluster. The other options are incorrect because: Granting the Viewer IAM role would not allow them to deploy anything. Creating a new GKE cluster is an unnecessary overhead for a simple integration and doesn't leverage the existing cluster's resources efficiently. Granting the Editor IAM role on the cluster project would give them broad permissions across the entire project, including the ability to modify your existing application or even delete the cluster, which violates the requirement to restrict changes to your application.