Working with Namespaces
1. Creating Namespaces
| Method | Command |
|---|
| Imperative | kubectl create namespace payments |
| Declarative | kubectl apply -f ns.yaml |
| Inline | kubectl create ns dev --dry-run=client -o yaml | kubectl apply -f - |
Example: Namespace YAML with labels
apiVersion: v1
kind: Namespace
metadata:
name: payments
labels:
team: finance
env: prod
pod-security.kubernetes.io/enforce: restricted
2. Listing Namespaces
| Command | Output |
|---|
kubectl get ns | All namespaces + age + status |
kubectl get ns -l env=prod | Filter by label |
kubectl get ns -o jsonpath='{.items[*].metadata.name}' | Names only |
3. Switching Namespaces
| Command | Effect |
|---|
kubectl config set-context --current --namespace=NS | Persist default |
kubens NS | Same via plugin |
kubectl -n NS get pods | One-off override |
4. Deleting Namespaces
| Command | Behavior |
|---|
kubectl delete ns NS | Cascading delete of all resources in NS |
kubectl delete ns NS --grace-period=0 --force | Force delete |
Warning: Namespace deletion is irreversible. Stuck "Terminating" usually indicates a finalizer; patch spec.finalizers to [] to unstick.
5. Using Namespace Flag
| Flag | Effect |
|---|
-n NS / --namespace NS | Target specific namespace |
-A / --all-namespaces | All namespaces |
6. Viewing Resources Across Namespaces
kubectl get pods -A
kubectl get pods -A -o wide --field-selector=status.phase=Running
kubectl get pods -A --sort-by=.metadata.creationTimestamp
| Tip | Command |
|---|
| Resource count per ns | kubectl get pods -A --no-headers | awk '{print $1}' | sort | uniq -c |
7. Setting Resource Quotas
| Quota Type | Examples |
|---|
| Compute | requests.cpu, limits.memory, requests.storage |
| Object count | pods, services, configmaps, secrets, persistentvolumeclaims |
| Storage class | gold.storageclass.../requests.storage |
| Scope | Terminating, BestEffort, NotBestEffort, PriorityClass |
Example: ResourceQuota
apiVersion: v1
kind: ResourceQuota
metadata:
name: team-quota
namespace: payments
spec:
hard:
requests.cpu: "20"
requests.memory: 40Gi
limits.cpu: "40"
limits.memory: 80Gi
pods: "100"
persistentvolumeclaims: "10"
8. Configuring Limit Ranges
| Field | Purpose |
|---|
| default | Default limit applied if pod omits it |
| defaultRequest | Default request applied |
| max / min | Allowed range |
| maxLimitRequestRatio | Cap on limit/request ratio |
| type | Container, Pod, PersistentVolumeClaim |
Example: Container LimitRange
apiVersion: v1
kind: LimitRange
metadata: { name: mem-cpu-limits, namespace: payments }
spec:
limits:
- type: Container
default: { cpu: 500m, memory: 512Mi }
defaultRequest: { cpu: 100m, memory: 128Mi }
max: { cpu: "2", memory: 2Gi }
min: { cpu: 50m, memory: 64Mi }
9. Understanding Default Namespaces
| Namespace | Purpose |
|---|
| default | Catch-all when no namespace specified |
| kube-system | Control plane & add-ons |
| kube-public | Cluster-readable info (rare) |
| kube-node-lease | Node heartbeat leases |
10. Isolating Namespaces with Network Policies
Example: Deny all ingress from other namespaces
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata: { name: deny-from-other-ns, namespace: payments }
spec:
podSelector: {}
policyTypes: [Ingress]
ingress:
- from:
- namespaceSelector:
matchLabels: { kubernetes.io/metadata.name: payments }
| Pattern | Result |
|---|
| Empty podSelector | Applies to all pods in NS |
| namespaceSelector | Match by NS labels |
| CNI requirement | Calico, Cilium, Weave (not all CNIs enforce) |