Kubernetes Namespace 101

29 November 2018

Namespaces are Kubernetes objects which partition a single Kubernetes cluster into multiple virtual clusters.

Namespaces are Kubernetes objects which partition a single Kubernetes cluster into multiple virtual clusters. Each Kubernetes namespace provides the scope for Kubernetes Names it contains; which means that using the combination of an object name and a Namespace, each object gets a unique identity across the cluster.

By default, a Kubernetes cluster is created with the following three namespaces:

  • default: By default, all the resource created in the Kubernetes cluster are created in the default namespace. By default the default namespace can allow applications to run with unbounded CPU and memory requests/limits (Until someone set resource quota for the default namespace).
  • Kube-public: Namespace for resources that are publicly readable by all users. This namespace is generally reserved for cluster usage.
  • Kube-system: It is the Namespace for objects created by Kubernetes systems/control plane.

Prerequisites

  • Basic experience with Linux/Unix system.
  • Familiarity with Kubernetes.
  • Kubernetes cluster to perform the demo.

Create a Namespace.

  • List the namespaces present in the Kubernetes cluster.
Copy Code
Loading...

We can create a Namespace in two ways either by using kubectl create namespace command or by using a configuration file.

  • Create a new namespace my-namespace with command.
Copy Code
Loading...
  • List the namespaces.
Copy Code
Loading...

We can also create a namespace using the configuration file.

  • Let's create a namespace from the configuration file.
Copy Code
Loading...
  • Deploy the above file.
Copy Code
Loading...
  • List the namespaces.
Copy Code
Loading...

Use-cases of Namespaces

Partition Cluster resources.

Kubernetes Namespaces can be used to divide a cluster into logical partitions allowing a single large Kubernetes cluster to be used by multiple users and teams, or a single user with multiple applications. Each user, the team, or application running in a Namespace, is isolated from every other user, team, or application in other Namespaces and they operate as if they are the sole user of the cluster (note that Namespaces do not provide network segmentation).

Deploy the application in a specific namespace.

Now we will see how to create a Kubernetes object inside a specific namespace.

  • List the namespaces.
Copy Code
Loading...
  • Let's create a pod from the following configuration.
Copy Code
Loading...

In the above configuration, we have specified the namespace with field namespace: my-namespace. So this pod will be created inside the my-namespace namespace.

  • Deploy a pod with the above configuration.
Copy Code
Loading...
  • List the pods present in my-namespace namespace.
Copy Code
Loading...

Bind user to a specific namespace.

By setting the context, we can bind a user to a specific namespace, so this namespace will be the default namespace for that user. You can do it either by modifying the kubeconfig file or using following command

  • Create a Namespace for different teams like dev, qa and production
Copy Code
Loading...
  • Set the context for different user groups.
Copy Code
Loading...

Here we have bound Dev team to dev namespace, QA team to qa namespace and Production team to production namespace.
This specific namespace will act as the default namespace for the particular team assigned to it. For detailed information of Kubernetes context and kubeconfig follow the documentation given at kubernetes.io.

Ability to specify resource consumption policies.

With Resource Quotas applied on namespaces, we can limit the cluster resource usage of a particular set of users. A resource quota is responsible for limiting resource consumption per namespace. It also can limit the number of objects that can be created in a namespace by type, as well as the total amount of computing resources that may be consumed by resources in that namespace.

Now we will see how we can configure the resource quota for specific Namespace.

  • Create a new demo namespace.
Copy Code
Loading...
  • Create a resource quota object for demo namespace.
Copy Code
Loading...

Here, we are specifying that in the demo namespace; we can not request more than 0.5 CPU and 512Mi RAM overall. So if we already have a pod running with 256 Mi request; we would not be able to schedule a new pod, if that requires more than the remaining 256 Mi memory. Similarly, we are setting the hard limit of 1 CPU and 1GB RAM for the namespace.

Deploy this resource qouta object.

Copy Code
Loading...
  • Get detailed information about the above-created resource quota.
Copy Code
Loading...

Here we can see the information about the hard limits as well as used resources for a given namespace.

  • Deploy Demo1 application within this namespace. Whose resource request can be fulfilled by the resource quota set for this namespace.
Copy Code
Loading...
  • Deploy this demo1 application.
Copy Code
Loading...

This application resource request was within the resource quota's specification. So this pod got deployed.

  • Now let's create another pod in demo namespace. Whose resource request is exceeding the resource quota set for the namespace. And let's see what happens.
Copy Code
Loading...
  • Let's try to deploy this demo2 application.
Copy Code
Loading...

This error occurred because this pod is requesting greater resources than specified in the resource quota.

  • Let's delete the demo namespace. It will delete the namespace along with all the objects running inside it.
Copy Code
Loading...
  • Delete earlier created namespace.
Copy Code
Loading...

Policies to run resources.

With the Role-based access control (RBAC), we can control the access permissions within a particular Namespace. Cluster Admin can control the access permission granted to the user or groups of users in specific namespaces, this can be achieved with the help of Role Binding.

A unique scope for Kubernetes Names.

Kubernetes namespace provides the scope for Kubernetes Names. Within the Namespace, an Object can be referred  by a short name like my-app and the Namespace adds further scope to identify the object, e.g. my-app.my-namespace. Within the Namespace, the name of the object must be unique and the combination of Name and Namespace (e.g. my-app.my-namespace ) must have to be unique at the cluster level.

Summary

Namespaces are essential objects for dividing and managing Kubernetes clusters. Namespaces allow us to logically segregate and assign resources to individual users, teams or applications. Namespaces provide the basic building blocks for resource usage allowance, access control and isolation for applications, users, or groups of users. By using Namespaces, you can increase resource efficiencies as a single cluster can now be used for a diverse set of workloads.

References