Working with Namespaces

1. Creating Namespaces

Example: Create a Namespace using kubectl

kubectl create namespace production

Field	Description	Example
metadata.name	Name of the namespace	`production`
metadata.labels	Labels to apply to the namespace	`{"environment": "production"}`
metadata.annotations	Annotations for the namespace	`{"description": "Production environment"}`

Note: Namespaces are used to organize and isolate resources within a Kubernetes cluster.

Warning: Ensure that the namespace name is unique within the cluster to avoid conflicts.

2. Listing Namespaces

Command	Description	Flags
kubectl get namespaces	List all namespaces in the cluster	`-o wide` for additional details
kubectl get ns	Short alias for listing namespaces	`--show-labels` to display labels
kubectl get namespaces -o json	Output in JSON format	`--output json` or `-o json`
kubectl get namespaces -o yaml	Output in YAML format	`-o yaml`

Example: Listing Namespaces with Labels

kubectl get namespaces --show-labels

Example: Listing Namespaces in JSON Format

kubectl get namespaces -o json

3. Switching Namespaces

Command	Description	Example
kubectl config use-context <context-name>	Switch to a specific context (namespace is part of the context)	`kubectl config use-context prod-cluster`
kubectl config set-context --current --namespace=<namespace>	Change the namespace for the current context	`kubectl config set-context --current --namespace=production`

Example: Switching to a Different Namespace

kubectl config set-context --current --namespace=staging

Note: The namespace change only affects the current context. To permanently change the namespace for a context, you need to update the kubeconfig file directly or use kubectl config set-context with the full context definition.

4. Deleting Namespaces

Command	Description	Notes
kubectl delete namespace <namespace-name>	Deletes a namespace and all its resources	Use with caution as it's irreversible
kubectl delete namespace <namespace-name> --ignore-not-found	Deletes a namespace, ignoring if it doesn't exist	Useful in automation scripts to avoid errors

Example: Delete a namespace

kubectl delete namespace production

Note: Deleting a namespace will remove all resources within it, including pods, services, and config maps.

Warning: This action is irreversible and will permanently delete all resources in the namespace.

5. Using Namespace Flag

Flag	Description	Usage Example
--namespace	Specifies the namespace to use for the command	`kubectl get pods --namespace=default`
-n	Short form of --namespace flag	`kubectl get pods -n production`

Example: Using namespace flag in kubectl commands

kubectl get pods --namespace=staging
kubectl get services -n development

Note: If no namespace is specified, kubectl uses the default namespace.

6. Viewing Resources Across Namespaces

Example: List all pods across all namespaces

kubectl get pods --all-namespaces

Flag	Description	Usage
--all-namespaces	List resources across all namespaces	`kubectl get pods --all-namespaces`
-n <namespace>	Specify a namespace to scope the query	`kubectl get pods -n default`

Note: The --all-namespaces flag is equivalent to using -A.

Example: Get all services across namespaces

kubectl get services --all-namespaces

Example: View all deployments in all namespaces

kubectl get deployments --all-namespaces

7. Setting Resource Quotas

Resource	Limit	Description
limits.cpu	`2`	Maximum CPU cores a namespace can consume
limits.memory	`4Gi`	Maximum memory a namespace can consume
requests.cpu	`1`	Minimum CPU cores guaranteed per namespace
requests.memory	`2Gi`	Minimum memory guaranteed per namespace

Example: ResourceQuota YAML Definition

apiVersion: v1
kind: ResourceQuota
metadata:
  name: example-quota
  namespace: production
spec:
  hard:
    limits.cpu: "2"
    limits.memory: 4Gi
    requests.cpu: "1"
    requests.memory: 2Gi

Note: ResourceQuotas are enforced at the namespace level and apply to all pods within that namespace.

Warning: Setting quotas too low can cause pods to be evicted or fail to start.

8. Configuring Limit Ranges

Property	Value	Description
limitRange.spec.limits	`[{...}]`	Array of limit range items defining resource limits
limitRange.spec.limits.type	`"Container"`	Resource type to apply limits to (only "Container" supported)
limitRange.spec.limits.default	`{}`	Default resource limit for containers if not specified
limitRange.spec.limits.defaultRequest	`{}`	Default resource request for containers if not specified
limitRange.spec.limits.max	`{}`	Maximum resource limit allowed per container
limitRange.spec.limits.min	`{}`	Minimum resource limit allowed per container
limitRange.spec.limits.maxLimitRequestRatio	`{}`	Maximum ratio of limit to request for each resource

Example: LimitRange Configuration

apiVersion: v1
kind: LimitRange
metadata:
  name: container-limits
spec:
  limits:
  - default:
      cpu: "1"
      memory: 512Mi
    defaultRequest:
      cpu: "250m"
      memory: 256Mi
    max:
      cpu: "2"
      memory: 1Gi
    min:
      cpu: "100m"
      memory: 64Mi
    type: Container

Note: LimitRanges are enforced at pod creation time and apply to all containers in a namespace that do not explicitly set resource limits or requests.

Key Points

LimitRange enforces resource limits and requests across all containers in a namespace
Defaults are applied when containers don't specify limits/requests
Enforced at pod creation time, not runtime
Can define min/max limits and default values for CPU and memory

9. Understanding Default Namespaces

Namespace	Description	Default Resources
default	The default namespace for objects that are not explicitly assigned to a different namespace.	Includes all resources created without an explicit namespace, such as pods, services, and config maps.
kube-system	Namespace used for Kubernetes system components and infrastructure resources.	Contains system-level pods like kube-dns, dashboard, and other control plane components.
kube-public	Namespace that is publicly accessible and readable by all users.	Used for storing public or shared resources, such as cluster information or public APIs.

Example: Creating a Pod in the Default Namespace

apiVersion: v1
kind: Pod
metadata:
  name: example-pod
spec:
  containers:
  - name: example-container
    image: nginx

Note: When no namespace is specified in a resource definition, it defaults to the default namespace.

10. Isolating Namespaces with Network Policies

Example: Basic Network Policy to Allow Ingress

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-ingress-to-frontend
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: frontend
  policyTypes:
  - Ingress
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          name: monitoring

Field	Description	Values
apiVersion	API version of the NetworkPolicy resource	`networking.k8s.io/v1`
kind	Resource type	`NetworkPolicy`
metadata.name	Name of the NetworkPolicy	String
metadata.namespace	Namespace where the policy is applied	String
spec.podSelector	Labels to select pods to apply policy to	Label selector object
spec.policyTypes	Types of traffic to control (Ingress, Egress)	Array of `Ingress`, `Egress`
spec.ingress	Rules for incoming traffic	Array of ingress rules
spec.egress	Rules for outgoing traffic	Array of egress rules

Note: NetworkPolicies are enforced by the CNI plugin (e.g., Calico, Cilium) and must be supported in your cluster.

Example: Deny All Egress

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-egress
  namespace: staging
spec:
  podSelector: {}
  policyTypes:
  - Egress
  egress:
  - {}

Example: Allow Egress to Specific Namespace

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-egress-to-db
  namespace: app-namespace
spec:
  podSelector:
    matchLabels:
      app: web
  policyTypes:
  - Egress
  egress:
  - to:
    - namespaceSelector:
        matchLabels:
          name: database