Kubernetes Cheatsheet

Namespaces

Use this Kubernetes reference while you build software engineering projects, review code for technical interview prep, or polish examples for a software engineer resume.

What Namespaces Do

Namespaces partition cluster resources (Pods, Services, ConfigMaps, etc.) into virtual sub-clusters. Most resources are namespace-scoped; a few are cluster-scoped (Nodes, PVs, StorageClasses, ClusterRoles).

Built-in Namespaces

Namespace	Purpose
`default`	Resources created without a namespace
`kube-system`	Control-plane components (DNS, metrics-server)
`kube-public`	World-readable; mostly the `cluster-info` ConfigMap
`kube-node-lease`	Node heartbeat Lease objects

Create and Manage

# create
kubectl create namespace staging

# or via manifest

apiVersion: v1
kind: Namespace
metadata:
  name: staging
  labels:
    env: staging

# list
kubectl get namespaces
kubectl get ns

# delete (deletes ALL resources inside)
kubectl delete namespace staging

# set default namespace for current context
kubectl config set-context --current --namespace=staging

# check current default namespace
kubectl config view --minify | grep namespace

Working Across Namespaces

# target a specific namespace
kubectl get pods -n staging
kubectl apply -f deploy.yaml -n staging

# all namespaces
kubectl get pods -A
kubectl get pods --all-namespaces

# get any resource across namespaces
kubectl get svc -A
kubectl get ingress -A

Resource in a Manifest

metadata:
  name: api
  namespace: staging    # explicit; overrides context default

ResourceQuota

Limit total resource consumption within a namespace:

apiVersion: v1
kind: ResourceQuota
metadata:
  name: staging-quota
  namespace: staging
spec:
  hard:
    pods: "20"
    requests.cpu: "4"
    requests.memory: 8Gi
    limits.cpu: "8"
    limits.memory: 16Gi
    persistentvolumeclaims: "10"
    services.loadbalancers: "2"

kubectl describe quota -n staging   # show usage vs. limits

LimitRange

Set default requests/limits and enforce per-container/Pod/PVC bounds:

apiVersion: v1
kind: LimitRange
metadata:
  name: default-limits
  namespace: staging
spec:
  limits:
  - type: Container
    default:
      cpu: "500m"
      memory: "256Mi"
    defaultRequest:
      cpu: "100m"
      memory: "128Mi"
    max:
      cpu: "2"
      memory: "1Gi"
    min:
      cpu: "50m"
      memory: "64Mi"
  - type: PersistentVolumeClaim
    max:
      storage: 20Gi

NetworkPolicy (namespace isolation)

Deny all ingress to a namespace, then allow selectively:

# deny-all ingress for the namespace
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-all
  namespace: production
spec:
  podSelector: {}       # all pods
  policyTypes:
  - Ingress
---
# allow ingress only from staging namespace
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-from-staging
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: api
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          env: staging

RBAC Scoped to a Namespace

# Role (namespace-scoped; ClusterRole for cluster-wide)
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: pod-reader
  namespace: staging
rules:
- apiGroups: [""]
  resources: ["pods", "pods/log"]
  verbs: ["get", "list", "watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: read-pods
  namespace: staging
subjects:
- kind: User
  name: jane
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: Role
  name: pod-reader
  apiGroup: rbac.authorization.k8s.io

Cross-Namespace Service Access

Services are namespace-scoped. Reference them by FQDN:

<service>.<namespace>.svc.cluster.local

# from staging, reach production API
curl http://api.production.svc.cluster.local/health

Common Patterns

Pattern	How
Per-environment isolation	`dev`, `staging`, `production` namespaces
Per-team isolation	`team-payments`, `team-platform` + RBAC per namespace
Cost allocation	Label namespaces; filter metrics by label in Prometheus
Soft multi-tenancy	Namespace + NetworkPolicy + ResourceQuota + RBAC