Kubernetes Cheatsheet

Namespaces

Use this Kubernetes reference while you build software engineering projects, review code, or refresh the syntax you reach for most.

What Namespaces Do

Namespaces partition cluster resources (Pods, Services, ConfigMaps, etc.) into virtual sub-clusters. Most resources are namespace-scoped; a few are cluster-scoped (Nodes, PVs, StorageClasses, ClusterRoles).

Built-in Namespaces

Namespace	Purpose
`default`	Resources created without a namespace
`kube-system`	Control-plane components (DNS, metrics-server)
`kube-public`	World-readable; mostly the `cluster-info` ConfigMap
`kube-node-lease`	Node heartbeat Lease objects

Create and Manage

# create
kubectl create namespace staging

# or via manifest

apiVersion: v1
kind: Namespace
metadata:
  name: staging
  labels:
    env: staging

# list
kubectl get namespaces
kubectl get ns

# delete (deletes ALL resources inside)
kubectl delete namespace staging

# set default namespace for current context
kubectl config set-context --current --namespace=staging

# check current default namespace
kubectl config view --minify | grep namespace

Working Across Namespaces

# target a specific namespace
kubectl get pods -n staging
kubectl apply -f deploy.yaml -n staging

# all namespaces
kubectl get pods -A
kubectl get pods --all-namespaces

# get any resource across namespaces
kubectl get svc -A
kubectl get ingress -A

Resource in a Manifest

metadata:
  name: api
  namespace: staging    # explicit; overrides context default

ResourceQuota

Limit total resource consumption within a namespace:

apiVersion: v1
kind: ResourceQuota
metadata:
  name: staging-quota
  namespace: staging
spec:
  hard:
    pods: "20"
    requests.cpu: "4"
    requests.memory: 8Gi
    limits.cpu: "8"
    limits.memory: 16Gi
    persistentvolumeclaims: "10"
    services.loadbalancers: "2"

kubectl describe quota -n staging   # show usage vs. limits

LimitRange

Set default requests/limits and enforce per-container/Pod/PVC bounds:

apiVersion: v1
kind: LimitRange
metadata:
  name: default-limits
  namespace: staging
spec:
  limits:
  - type: Container
    default:
      cpu: "500m"
      memory: "256Mi"
    defaultRequest:
      cpu: "100m"
      memory: "128Mi"
    max:
      cpu: "2"
      memory: "1Gi"
    min:
      cpu: "50m"
      memory: "64Mi"
  - type: PersistentVolumeClaim
    max:
      storage: 20Gi

NetworkPolicy (namespace isolation)

Deny all ingress to a namespace, then allow selectively:

# deny-all ingress for the namespace
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-all
  namespace: production
spec:
  podSelector: {}       # all pods
  policyTypes:
  - Ingress
---
# allow ingress only from staging namespace
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-from-staging
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: api
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          env: staging

RBAC Scoped to a Namespace

# Role (namespace-scoped; ClusterRole for cluster-wide)
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: pod-reader
  namespace: staging
rules:
- apiGroups: [""]
  resources: ["pods", "pods/log"]
  verbs: ["get", "list", "watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: read-pods
  namespace: staging
subjects:
- kind: User
  name: jane
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: Role
  name: pod-reader
  apiGroup: rbac.authorization.k8s.io

Cross-Namespace Service Access

Services are namespace-scoped. Reference them by FQDN:

<service>.<namespace>.svc.cluster.local

# from staging, reach production API
curl http://api.production.svc.cluster.local/health

Common Patterns

Pattern	How
Per-environment isolation	`dev`, `staging`, `production` namespaces
Per-team isolation	`team-payments`, `team-platform` + RBAC per namespace
Cost allocation	Label namespaces; filter metrics by label in Prometheus
Soft multi-tenancy	Namespace + NetworkPolicy + ResourceQuota + RBAC