Namespaces
Virtual clusters, and cross-namespace DNS names.
In plain terms
A namespace is an apartment inside a building. Your “kitchen” and your neighbor’s “kitchen” don’t clash, and the building sets separate rules and a separate budget for each apartment.
A namespace is a virtual cluster inside the cluster — a scope for names, access, and resource budgets. Objects of the same kind must have unique names within a namespace, not across them, so one team’s “web” Service never collides with another’s.
terminal
$ kubectl create namespace payments$ kubectl -n payments get all# a Service is reachable from another namespace by its full DNS name:# web.payments.svc.cluster.local$ kubectl get nsNAME STATUSdefault Activekube-system Active # control-plane add-ons — never deploy here
RBAC roles, resource quotas, network policies, and Pod Security labels all attach at the namespace, which is why one team or app per namespace is the pattern that scales. A handful are built in — kube-system holds the control-plane add-ons and is off-limits for your workloads.
A namespace is not a security boundary alone
Without NetworkPolicies and RBAC, a pod in one namespace can still reach pods in another. Isolation is opt-in — the Security section makes it real.