Kubernetes Namespaces
Logical cluster partitioning for multi-tenant, env separation, and resource quotas.
ContainersIntermediate
Why
Namespaces partition a cluster for isolation — dev/staging/prod or team boundaries. ResourceQuota limits per-namespace resources, NetworkPolicy isolates traffic.
Docker is used by 59% of professional developers per the Stack Overflow 2024 survey, and Kubernetes runs 60% of containerized workloads in production (CNCF 2024 survey). Container orchestration reduces deployment-related incidents by 35% through declarative rollouts.
When
Use namespaces for multi-env, multi-team clusters. Avoid per-microservice (too granular).
How
1. Create — kubectl create namespace dev
2. Deploy — kubectl apply -f app.yaml -n dev
3. Default — set context namespace
4. Quota — ResourceQuota for CPU/memory limits
5. Network — NetworkPolicy to isolate
6. Limit — LimitRange for default pod limits
7. Delete — kubectl delete namespace dev (careful!)
Example
# Create namespace with quota
apiVersion: v1
kind: Namespace
metadata: { name: dev }
---
apiVersion: v1
kind: ResourceQuota
metadata: { name: quota, namespace: dev }
spec:
hard:
requests.cpu: "4"
requests.memory: 8Gi
limits.cpu: "8"
pods: "20"
# NetworkPolicy — isolate dev from prod
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata: { name: isolate, namespace: dev }
spec:
podSelector: {}
policyTypes: [Ingress]
ingress: [] # deny all ingress
# Use namespace
kubectl apply -f app.yaml -n dev
kubectl get pods -n dev
Common Problems
- ⚠Resources in wrong namespace — default is default, specify -n or set context
- ⚠No isolation — namespaces alone don't isolate network, add NetworkPolicy
- ⚠Configuration drift between environments — use infrastructure-as-code (Terraform/Pulumi) to keep dev/staging/prod identical
Best Practices
- ✓Use ResourceQuota per namespace — prevents one team from hogging cluster
- ✓Use NetworkPolicy for isolation — namespaces alone don't block cross-ns traffic
- ✓Set up health checks and graceful shutdown — handle SIGTERM to drain in-flight requests before exit