Namespaces

This lesson explains Kubernetes namespaces: what they are, when to use them, and how to manage them with kubectl. Namespaces let you partition cluster resources and apply different policies, quotas, and access controls per logical environment (for example, dev vs prod).

Analogy

Imagine two boys both named Mark. To tell them apart, you use last names: Mark Smith and Mark Williams. They each live in their own household (the Smiths and the Williams). Inside a household, people use only first names (e.g., the Smith father calls his son “Mark”). To refer to the Mark in the other household or from outside, you use the full name. In Kubernetes, each household maps to a namespace. Resources within a namespace can refer to each other by simple names; resources outside the namespace must use the full name (namespace-qualified).

What is a namespace?

Every object you create in this course—Pods, Deployments, Services—lives inside a namespace. If you didn’t specify one, it defaults to the default namespace created automatically when the cluster is provisioned. Kubernetes also creates a few other namespaces by default:

Namespace	Purpose
`default`	Where user workloads are created if no namespace is specified.
`kube-system`	System components (networking, DNS, controllers). Separated to avoid accidental user modification.
`kube-public`	Intended for publicly visible cluster information (rarely used).

For small clusters or experiments you can work in default. In larger or production clusters, namespaces are useful for:

Resource isolation (e.g., dev, staging, prod).
Applying resource quotas.
Assigning different policies and RBAC rules per namespace.

You can assign RBAC, NetworkPolicy, and other policies to a namespace so each namespace enforces its own access and networking rules.

A diagram titled "Namespace – Policies" showing three house-shaped namespaces labeled default, dev, and prod, each containing colorful shape icons. The dev namespace has an attached document icon, implying a policy or configuration applied.

Resource quotas

Namespaces let you limit what workloads inside them can consume. A ResourceQuota applied to a namespace ensures workloads cannot exceed allocated resources (CPU, memory, pod count, etc.), which helps prevent a noisy tenant from starving other namespaces.

An infographic titled "Namespace — Resource Limits" showing stacked colored bands for default, prod, and dev namespaces with icons for containers/pods, storage, CPU and nodes. It visually represents resource allocation limits across Kubernetes namespaces.

DNS and cross-namespace Service access

Within a namespace, resources can address other resources by simple names. For example, a Pod in the default namespace can reach a Service named db-service using only the hostname db-service.

A simple diagram titled "DNS" shows a house-shaped "default" namespace containing three components: a blue circle labeled "web-pod", an orange triangle labeled "db-service", and a purple square labeled "web-deployment".

To reach a Service in a different namespace, use the full DNS name: service.namespace.svc.cluster.local Example connecting from an application:

# Connect to a service in the same namespace (default)
mysql.connect("db-service")

# Connect to a service in the dev namespace
mysql.connect("db-service.dev.svc.cluster.local")

DNS components:

service-name — the Service name
namespace — the namespace where the Service lives
svc — subdomain used for Services
cluster.local — default cluster domain

Kubernetes creates DNS entries for Services automatically when you create the Service.

kubectl and namespaces — common operations

By default, kubectl operates against the current namespace (which defaults to default). Here are common operations and examples.

List Pods in the current namespace

$ kubectl get pods
NAME     READY   STATUS    RESTARTS   AGE
pod-1    1/1     Running   0          3d
pod-2    1/1     Running   0          3d

List Pods in a specific namespace

$ kubectl get pods --namespace=kube-system
# or short form
$ kubectl get pods -n kube-system

List resources across all namespaces

$ kubectl get pods --all-namespaces
# or
$ kubectl get pods -A

Common kubectl namespace commands

Operation	Command
Create namespace	`kubectl create namespace dev`
Create from manifest	`kubectl create -f namespace-dev.yml`
Set current context’s namespace	`kubectl config set-context $(kubectl config current-context) --namespace=dev`
Create resource in named namespace (override)	`kubectl create -f resource.yaml --namespace=dev`
Include namespace in manifest	add `metadata.namespace: dev` to the resource YAML

Tip: Set the namespace on your kubectl context if you work primarily in one namespace. This saves you from repeatedly passing --namespace or -n.

Note about contexts: contexts include cluster and user info. Changing the namespace with kubectl config set-context only affects that context.

Creating resources in a specific namespace

When a manifest omits metadata.namespace, the resource is created in the current namespace. You can override this on the command line or include the namespace in the manifest. Create using the default namespace (current context):

$ kubectl create -f pod-definition.yml
pod/myapp-pod created

Create in the dev namespace:

$ kubectl create -f pod-definition.yml --namespace=dev
pod/myapp-pod created

Include the namespace in the manifest to make it explicit:

apiVersion: v1
kind: Pod
metadata:
  name: myapp-pod
  namespace: dev
  labels:
    app: myapp
    type: front-end
spec:
  containers:
    - name: nginx-container
      image: nginx

Creating a namespace

Namespace manifest:

apiVersion: v1
kind: Namespace
metadata:
  name: dev

Create from manifest:

$ kubectl create -f namespace-dev.yml
namespace/dev created

Or create directly:

$ kubectl create namespace dev

ResourceQuota example

To limit resources inside a namespace, apply a ResourceQuota object that sets hard limits for that namespace:

apiVersion: v1
kind: ResourceQuota
metadata:
  name: compute-quota
  namespace: dev

spec:
  hard:
    pods: "10"
    requests.cpu: "4"
    requests.memory: "5Gi"
    limits.cpu: "10"
    limits.memory: "10Gi"

Apply it:

$ kubectl create -f compute-quota.yaml
resourcequota/compute-quota created

Namespaces are NOT a strong security boundary by themselves. To enforce isolation, combine namespaces with RBAC, NetworkPolicies, and Admission Controllers. Resource quotas only limit consumption within a namespace — they do not prevent misconfigured workloads from impacting cluster stability.

Introduction

Core Concepts

Scheduling

Logging & Monitoring

Application Lifecycle Management

Cluster Maintenance

Security

Storage

Networking

Design and Install a Kubernetes Cluster

Install "Kubernetes the kubeadm way"

Troubleshooting

Helm Basics (2025 Updates)

Kustomize Basics (2025 Updates)

Other Topics

Mock Exams

Analogy

What is a namespace?

Resource quotas

DNS and cross-namespace Service access

kubectl and namespaces — common operations

List Pods in the current namespace

List Pods in a specific namespace

List resources across all namespaces

Common kubectl namespace commands

Creating resources in a specific namespace

Creating a namespace

ResourceQuota example

Further reading and references

Watch Video

Practice Lab

​Analogy

​What is a namespace?

​Resource quotas

​DNS and cross-namespace Service access

​kubectl and namespaces — common operations

​List Pods in the current namespace

​List Pods in a specific namespace

​List resources across all namespaces

​Common kubectl namespace commands

​Creating resources in a specific namespace

​Creating a namespace

​ResourceQuota example

​Further reading and references

Watch Video

Practice Lab

Analogy

What is a namespace?

Resource quotas

DNS and cross-namespace Service access

kubectl and namespaces — common operations

List Pods in the current namespace

List Pods in a specific namespace

List resources across all namespaces

Common kubectl namespace commands

Creating resources in a specific namespace

Creating a namespace

ResourceQuota example

Further reading and references