Namespaces

A namespace is a virtual cluster within a Kubernetes cluster. Namespaces partition cluster resources between multiple teams, projects, or environments, providing a scope for names, resource quotas, and access control policies.

Default Namespaces

Kubernetes ships with four built-in namespaces:

• default — where resources land if you do not specify a namespace
• kube-system — Kubernetes system components (DNS, kube-proxy, metrics-server)
• kube-public — readable by all users; used for cluster bootstrap information
• kube-node-lease — stores node heartbeat objects used by the node lifecycle controller

Creating and Using Namespaces

apiVersion: v1
kind: Namespace
metadata:
  name: staging
  labels:
    env: staging

# Create a namespace imperatively
kubectl create namespace staging

# List all namespaces
kubectl get namespaces

# Run a command in a specific namespace
kubectl get pods -n staging

# Set a default namespace for your current context
kubectl config set-context --current --namespace=staging

Resource Quotas

A ResourceQuota limits the total amount of compute resources and the number of objects that can be created within a namespace.

apiVersion: v1
kind: ResourceQuota
metadata:
  name: staging-quota
  namespace: staging
spec:
  hard:
    requests.cpu: "4"
    requests.memory: 8Gi
    limits.cpu: "8"
    limits.memory: 16Gi
    pods: "50"
    services: "10"

If a new pod would exceed the namespace quota, Kubernetes rejects it with a 403 Forbidden error, preventing any one team from consuming the entire cluster.

LimitRanges

A LimitRange sets default and maximum resource requests and limits for individual pods and containers within a namespace.

apiVersion: v1
kind: LimitRange
metadata:
  name: default-limits
  namespace: staging
spec:
  limits:
    - type: Container
      default:
        cpu: "200m"
        memory: "256Mi"
      defaultRequest:
        cpu: "100m"
        memory: "128Mi"
      max:
        cpu: "2"
        memory: "2Gi"

Containers that do not specify resource requests or limits inherit the defaults defined by the LimitRange.

Role-Based Access Control and Namespaces

Namespaces integrate tightly with RBAC. A Role grants permissions within a single namespace; a ClusterRole grants permissions cluster-wide. Binding a Role to a user or service account via a RoleBinding scopes that user's access to one namespace, allowing secure multi-tenancy.

# List roles in a namespace
kubectl get roles -n staging

# List role bindings
kubectl get rolebindings -n staging

When to Use Namespaces