* external facing API in one namespace (external DMZ) * all other services in one namespace (internal DMZ)