KCNA — Namespaces & Labels
Namespaces & Labels
Namespaces and labels are how you organize resources in Kubernetes. Namespaces provide logical isolation; labels provide selection and filtering.
Namespaces
What Is a Namespace?
A namespace is a virtual cluster within a Kubernetes cluster. It provides logical separation between different teams, projects, or environments.
┌──────────── Kubernetes Cluster ────────────┐
│ │
│ ┌── Namespace: dev ───┐ │
│ │ Pod: web-app │ │
│ │ Service: web-svc │ │
│ └─────────────────────┘ │
│ │
│ ┌── Namespace: staging ┐ │
│ │ Pod: web-app │ (Same name, OK!) │
│ │ Service: web-svc │ │
│ └──────────────────────┘ │
│ │
│ ┌── Namespace: prod ───┐ │
│ │ Pod: web-app │ (Same name, OK!) │
│ │ Service: web-svc │ │
│ └──────────────────────┘ │
│ │
└─────────────────────────────────────────────┘
Default Namespaces
Every Kubernetes cluster comes with these namespaces:
| Namespace | Purpose |
|---|---|
| default | Where resources land if no namespace is specified |
| kube-system | Kubernetes system components (API server, CoreDNS, kube-proxy, etc.) |
| kube-public | Publicly readable data (usually cluster info) |
| kube-node-lease | Node heartbeat data (tracks node health) |
What Namespaces Provide
| Feature | Details |
|---|---|
| Name scoping | Same resource name can exist in different namespaces |
| Resource quotas | Limit CPU/memory per namespace |
| Access control | RBAC can restrict users to specific namespaces |
| Network policies | Control traffic between namespaces |
What Namespaces Do NOT Provide
| Misconception | Reality |
|---|---|
| “Full isolation” | Namespaces are logical, not physical — pods CAN communicate across namespaces by default |
| “Security boundary” | Without Network Policies, pods in different namespaces can talk to each other |
| “All resources are namespaced” | Some resources are cluster-wide: Nodes, PersistentVolumes, ClusterRoles |
Labels
What Are Labels?
Labels are key-value pairs attached to Kubernetes objects. They are used to organize and select resources.
metadata:
labels:
app: web
environment: production
team: frontend
version: v2
Why Labels Matter
Labels are the primary mechanism for:
| Use Case | How Labels Are Used |
|---|---|
| Service routing | Services use label selectors to find backend pods |
| Deployment management | Deployments use selectors to manage their pods |
| Filtering | kubectl get pods -l app=web |
| Scheduling | Node selectors use labels to place pods on specific nodes |
| Network policies | Target pods by labels |
Label Selectors
| Type | Syntax | Example |
|---|---|---|
| Equality-based | =, ==, != |
app=web, environment!=staging |
| Set-based | in, notin, exists |
environment in (prod, staging) |
Annotations
Annotations are similar to labels but are used for non-identifying metadata — data that tools and libraries use but that doesn’t affect selection.
| Aspect | Labels | Annotations |
|---|---|---|
| Purpose | Identify and select objects | Attach non-identifying metadata |
| Used by selectors | Yes | No |
| Length limit | 63 characters (value) | 256 KB (value) |
| Examples | app: web, tier: frontend |
description: "Updated by CI/CD", git-commit: abc123 |
Labels + Namespaces in Practice
A typical production setup:
| Resource | Namespace | Labels |
|---|---|---|
| Frontend pods | production |
app: frontend, tier: web, version: v3 |
| Backend pods | production |
app: backend, tier: api, version: v2 |
| Database pods | production |
app: database, tier: data, version: v1 |
| Frontend pods | staging |
app: frontend, tier: web, version: v4 |
| Monitoring | monitoring |
app: prometheus, component: server |
Key Takeaways for the Exam
- Namespaces provide logical isolation within a cluster — they are NOT physical isolation
- Default namespaces: default, kube-system, kube-public, kube-node-lease
- Some resources are cluster-scoped (Nodes, PersistentVolumes) and don’t belong to namespaces
- Labels are key-value pairs used to select and organize resources
- Services and Deployments use label selectors to find their pods
- Annotations are for non-identifying metadata — they can’t be used in selectors
- Pods can communicate across namespaces by default (unless Network Policies restrict it)
What’s Next?
Let’s learn how to manage configuration data and secrets.
