Don't use namespaces. Wire up multi-tenant at the RBAC level. Need stronger isolation? Run another cluster.