GKE Autopilot support on namespaces

[Ganesan_tng]

We are just evaluating autopilot and we are currently using standard mode.

Does GKR autopilot supports manual namespace creation like standard mode?

Does it create namespace automatically based on deployed resources deployment or service?

Any major differences in using namespace in autopilot vs standard?

[garisingh]

The biggest difference in Autopilot mode is that there are a few "managed namespaces" where you cannot make changes / deploy workloads (e.g. `kube-system` is read-only).   The only other namespace-related difference is that if using Gatekeeper, Autopilot does not (yet) support mutating webhooks due to these managed namespaces.

[shannduin]

Adding on to Gari's comment, 

https://cloud.google.com/kubernetes-engine/docs/concepts/autopilot-security#built-in-security lists some of the webhook restrictions and other security default