What is a Namespace?
- Docker & Kubernetes course
- Intermediate
- Lesson 55/82
- 4 min
Learn to group resources with Namespaces.
What is a namespace?
A namespace divides a cluster into logical sections. Object names only need to be unique within their own namespace: both the dev and prod namespaces can have a deployment named web. Namespaces are used to separate teams, environments or applications, and to apply permissions (RBAC) and resource quotas.
dev/ web, db, cache
prod/ web, db, cache
kube-system/ coredns, kube-proxy, ...There is no network isolation
Namespaces don't isolate the network by default: a pod in dev can reach a service in prod by the name web.prod. For isolation, NetworkPolicy objects are written (with a network plugin that supports them):
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: yalnizca-ayni-ns
namespace: prod
spec:
podSelector: {}
ingress:
- from:
- podSelector: {}Practice Explore the scope
Write two commands: list the namespaced resource types with --namespaced=true; then list the cluster-scoped types with --namespaced=false.
Starter code
# buraya yazSample solution
kubectl api-resources --namespaced=true
kubectl api-resources --namespaced=falseExpected output
NAME SHORTNAMES APIVERSION NAMESPACED KIND configmaps cm v1 true ConfigMap pods po v1 true Pod NAME SHORTNAMES APIVERSION NAMESPACED KIND namespaces ns v1 false Namespace nodes no v1 false Node
Questions and answers
Review the lesson questions together with their answers. To test yourself, solve the lesson interactively.
1 What does a namespace not separate?
- Deployment names
- Permissions
- Resource quotas
- Nodes; nodes belong to the whole cluster Correct answer
Explanation: Objects such as Node, PersistentVolume and Namespace are cluster-scoped.
2 Check scope: list the resources not bound to a namespace.
kubectl api-resources --namespaced=____kubectl api-resources --namespaced=falseExplanation: --namespaced=false lists cluster-scoped types.
3 Match.
| Term | Meaning |
|---|---|
Namespace |
Logical section |
Node |
Cluster-scoped |
web.prod |
Service in another namespace |
NetworkPolicy |
Network isolation |