Docker : Kubernetes Namespaces (default, kube-public, kube-system) and switching namespaces (kubens)

bogotobogo.com site search:

Initial Namespaces

A Kubernetes namespace is a virtual cluster inside a Kubernetes cluster. Using the namespace, we can organize Kubernetes resources in namespaces and we can have multiple namespaces in a cluster.

$ kubectl get namespace
NAME              STATUS   AGE
default           Active   62m
kube-node-lease   Active   62m
kube-public       Active   62m
kube-system       Active   62m

Those four are the initial Kubernetes namespaces out of box.

The kube-public is not used much and the only interesting object in kube-public is a ConfigMap named cluster-info which is publicly accessible data via kubectl cluster-info:

$ kubectl cluster-info
Kubernetes master is running at https://127.0.0.1:32768
KubeDNS is running at https://127.0.0.1:32768/api/v1/namespaces/kube-system/services/kube-dns:dns/proxy

It is usually a good idea to leave the kube-system alone not touched (we do not want to create/modify in the kube-system), especially, in managed systems such as Google Kubernetes Engine and EKS. The components of the kube-system are system processes as well as master and kubectl processes.

The kube-node-lease is used for node heart beat and it's a recently added component. Each node has associated object in namespace and kube-node-lease contains info about the availability of a node.

So, this leave us one namespace which is default where our services and apps are created.

Creating a Namespace

Let's create a namespace called "test":

$ kubectl create ns my-namespace
namespace/my-namespace created

$ kubectl get ns
NAME              STATUS   AGE
default           Active   73m
kube-node-lease   Active   73m
kube-public       Active   73m
kube-system       Active   73m
my-namespace      Active   39s

$ kubectl delete ns my-namespace
namespace "my-namespace" deleted

We can also create a namespace using yaml (ns.yaml) like any other Kubernetes resources:

apiVersion : v1
kind: Namespace
metadata:
  name: my-namespace
  labels:
    name: my-namespace

Apply the yaml file (ns.yaml):

$ kubectl apply -f ns.yaml
namespace/my-namespace created

NAME              STATUS   AGE
default           Active   79m
kube-node-lease   Active   79m
kube-public       Active   79m
kube-system       Active   79m
my-namespace      Active   57s

Creating resources in a specific Namespace

Let's look into one of the simplest pod definition yaml (mypod.yaml):

apiVersion: v1
kind: Pod
metadata:
  name: mypod
  labels:
    app: mypod
spec:
  containers:
    - name: mypod
      image: nginx

Note that there is no "namespace" related line in the yaml. It'll be deployed into the defalut namespace. Actually, that's the namespace currently active.

There are two ways of specifying the namespace. The first one is to use the "namespace" flag:

$ kubectl apply -f mypod.yaml --namespace=my-namespace
pod/mypod created

However, we see no pod with:

$ kubectl get pods 
No resources found.

That's because the command checks for "default" namespace. If we check against all namespaces, we can see the pod has been create under "test" namespace:

$ kubectl get pods --all-namespaces  
NAMESPACE      NAME                               READY   STATUS    RESTARTS   AGE
kube-system    coredns-66bff467f8-cpqbk           1/1     Running   1          95m
kube-system    etcd-minikube                      1/1     Running   0          44m
kube-system    kube-apiserver-minikube            1/1     Running   0          44m
kube-system    kube-controller-manager-minikube   1/1     Running   1          95m
kube-system    kube-proxy-4xws7                   1/1     Running   1          95m
kube-system    kube-scheduler-minikube            1/1     Running   1          95m
kube-system    storage-provisioner                1/1     Running   3          95m
my-namespace   mypod                              1/1     Running   0          57s

Or:

$ kubectl get pods --namespace=my-namespace
NAME    READY   STATUS    RESTARTS   AGE
mypod   1/1     Running   0          3m24s

$ kubectl get pods -n my-namespace
NAME    READY   STATUS    RESTARTS   AGE
mypod   1/1     Running   0          12m

Switching Namespaces - kubens

Switching namespaces requires a couple of commands as shown in Share a Cluster with Namespaces.

We can use kubens command. But we need to install kubectx. For MacOS:

$ brew install kubectx

To see current namespace:

$ kubens
default
kube-node-lease
kube-public
kube-system
my-namespace

Current namespace is highlighted! We can switch it to "my-namespace":

$ kubens my-namespace
Context "minikube" modified.
Active namespace is "my-namespace".

$ kubens
default
kube-node-lease
kube-public
kube-system
my-namespace

Now that we're in "my-namespace" namespace, we can just issue kubectl get pods without "my-namespace" namespace flag:

$ kubectl get pods
NAME    READY   STATUS    RESTARTS   AGE
mypod   1/1     Running   0          9m35s

We can switch back to the default namespace using kubectl config set-context command as well:

$ kubectl config set-context --current --namespace=default
Context "minikube" modified.

$ kubens
default
kube-node-lease
kube-public
kube-system
my-namespace

When to use namespaces

Here are the use cases when to use namespaces:

Structure our Kubernetes components.
Avoid conflicts among teams.
Share services across different environments.
Limits access and resources at namespace level.

Characteristics_namespaces

Here are some chaacteristics of namespaces:

We cannot access most of the resources in other namespaces. For example, if we have a ConfigMap for DB in one namespace, we cannot use it in another namespace to cofigure a DB. So, in such a case, each namespace should have its own ConfigMap. The same applies to Secrets as well.
Unlike the ConfigMap/Secrets, a service can be shared among different namespaces. In that way, each namespace can share services such as Elastic Stack, Nginx etc.

There are Kubernetes components that cannot be created within a namespace. In other words, they are global and we cannot isolate them in namespaces. The example of them are nodes and persistent volume and we can check it using kubectl api-resources command:

$ kubectl api-resources --namespaced=false
NAME                              SHORTNAMES   APIGROUP                       NAMESPACED   KIND
componentstatuses                 cs                                          false        ComponentStatus
namespaces                        ns                                          false        Namespace
nodes                             no                                          false        Node
persistentvolumes                 pv                                          false        PersistentVolume
mutatingwebhookconfigurations                  admissionregistration.k8s.io   false        MutatingWebhookConfiguration
validatingwebhookconfigurations                admissionregistration.k8s.io   false        ValidatingWebhookConfiguration
customresourcedefinitions         crd,crds     apiextensions.k8s.io           false        CustomResourceDefinition
apiservices                                    apiregistration.k8s.io         false        APIService
tokenreviews                                   authentication.k8s.io          false        TokenReview
selfsubjectaccessreviews                       authorization.k8s.io           false        SelfSubjectAccessReview
selfsubjectrulesreviews                        authorization.k8s.io           false        SelfSubjectRulesReview
subjectaccessreviews                           authorization.k8s.io           false        SubjectAccessReview
certificatesigningrequests        csr          certificates.k8s.io            false        CertificateSigningRequest
ingressclasses                                 networking.k8s.io              false        IngressClass
runtimeclasses                                 node.k8s.io                    false        RuntimeClass
podsecuritypolicies               psp          policy                         false        PodSecurityPolicy
clusterrolebindings                            rbac.authorization.k8s.io      false        ClusterRoleBinding
clusterroles                                   rbac.authorization.k8s.io      false        ClusterRole
priorityclasses                   pc           scheduling.k8s.io              false        PriorityClass
csidrivers                                     storage.k8s.io                 false        CSIDriver
csinodes                                       storage.k8s.io                 false        CSINode
storageclasses                    sc           storage.k8s.io                 false        StorageClass
volumeattachments                              storage.k8s.io                 false        VolumeAttachment

$ kubectl api-resources --namespaced=true
NAME                        SHORTNAMES   APIGROUP                    NAMESPACED   KIND
bindings                                                             true         Binding
configmaps                  cm                                       true         ConfigMap
endpoints                   ep                                       true         Endpoints
events                      ev                                       true         Event
limitranges                 limits                                   true         LimitRange
persistentvolumeclaims      pvc                                      true         PersistentVolumeClaim
pods                        po                                       true         Pod
podtemplates                                                         true         PodTemplate
replicationcontrollers      rc                                       true         ReplicationController
resourcequotas              quota                                    true         ResourceQuota
secrets                                                              true         Secret
serviceaccounts             sa                                       true         ServiceAccount
services                    svc                                      true         Service
controllerrevisions                      apps                        true         ControllerRevision
daemonsets                  ds           apps                        true         DaemonSet
deployments                 deploy       apps                        true         Deployment
replicasets                 rs           apps                        true         ReplicaSet
statefulsets                sts          apps                        true         StatefulSet
localsubjectaccessreviews                authorization.k8s.io        true         LocalSubjectAccessReview
horizontalpodautoscalers    hpa          autoscaling                 true         HorizontalPodAutoscaler
cronjobs                    cj           batch                       true         CronJob
jobs                                     batch                       true         Job
leases                                   coordination.k8s.io         true         Lease
endpointslices                           discovery.k8s.io            true         EndpointSlice
events                      ev           events.k8s.io               true         Event
ingresses                   ing          extensions                  true         Ingress
ingresses                   ing          networking.k8s.io           true         Ingress
networkpolicies             netpol       networking.k8s.io           true         NetworkPolicy
poddisruptionbudgets        pdb          policy                      true         PodDisruptionBudget
rolebindings                             rbac.authorization.k8s.io   true         RoleBinding
roles                                    rbac.authorization.k8s.io   true         Role