Full lesson
Explore the full explanation, examples, and visuals at your own pace.
Namespaces group namespaced objects inside one cluster.
A Kubernetes namespace scopes many objects within one cluster; it doesn't create a separate cluster.
One cluster, three team spaces
One cluster contains three team spaces: dev, staging, and prod. Dev API, Stage API, and Prod API belong to their respective namespaces, where each team can group its Pods and other namespaced objects without needing a separate cluster.
The same Service name can exist twice
A Service name only needs to be unique within its namespace. The dev namespace can have an api Service, and prod can have another; they’re distinct objects, identified by namespace and name. Staging remains a separate workspace.
The nodes and capacity are still shared
Namespaces organize objects inside the cluster; they don't create separate machines or capacity. Here, Dev Pod and Prod Pod can both run on the same Node, so their workloads may compete for shared resources. Network and access isolation still need separate controls.
If dev and prod use different namespaces, can their Pods run on the same node?
Let's think this through. If dev and prod use different namespaces, can their Pods run on the same node? A: Yes, namespaces do not reserve separate nodes. B: No, each namespace gets its own nodes. C: Only if the Pods have different names. Choose an answer, or just think it through. I'll explain in a moment.
- Yes, namespaces do not reserve separate nodes
- No, each namespace gets its own nodes
- Only if the Pods have different names
If dev and prod use different namespaces, can their Pods run on the same node?
The answer is A: Yes, namespaces do not reserve separate nodes. Namespaces organize objects, but nodes belong to the cluster. Pods from different namespaces can be scheduled onto the same node unless additional scheduling controls prevent it.
- Yes, namespaces do not reserve separate nodes
- No, each namespace gets its own nodes
- Only if the Pods have different names
Isolation requires separate controls
A namespace gives these controls a scope, but doesn't turn them on. RBAC limits who can act, NetworkPolicy limits permitted traffic, and ResourceQuota caps resource use.
- RBAC: restrict who can act
- NetworkPolicy: restrict permitted traffic
- ResourceQuota: cap namespace resource use
Some resources remain cluster-scoped
Nodes belong to the cluster, and StorageClasses and CustomResourceDefinitions are cluster-scoped too. CustomResourceDefinitions define types across the cluster, not separately within each namespace.
- Nodes belong to the cluster
- StorageClasses are not namespaced
- CustomResourceDefinitions define cluster-wide types
Organized together does not mean isolated
A namespace scopes names and many Kubernetes objects within a cluster. It’s an organizational boundary, not automatically a network, access, compute, or cluster-wide resource boundary. Shared nodes need separate controls.