1.9 Kubernetes Namespace Definition
Kubernetes Namespace Definition is a logical partition that isolates resources, enabling team-specific management and access control within a cluster.
Kubernetes Namespace Definition is the precise characterization of a namespace as a scoping mechanism within the Kubernetes API, defined as a boundary that partitions the names of namespaced resources into independent groups, without itself providing network isolation, resource isolation, or security isolation unless combined with additional, separately defined mechanisms.
Namespace as a Naming Scope
Defined by Uniqueness Rules
A namespace is most precisely defined by the uniqueness rule it enforces: an object's name must be unique within its namespace, but the same name may be reused freely across different namespaces, since the true identity of a namespaced object is the pair of its namespace and name together.
A Property of Objects, Not a Container
Although often described informally as a container for resources, a namespace is more precisely a labeled scope referenced by other objects' metadata; it does not physically contain them the way a folder contains files, but rather partitions the identifier space they exist within.
What a Namespace Definition Excludes
Not Network Isolation
By definition, a namespace alone does not restrict network traffic between the objects within it and objects in other namespaces; that isolation, if desired, must be established separately through NetworkPolicies, which are a distinct mechanism layered on top of namespace scoping.
Not Resource Isolation
Similarly, a namespace does not by itself limit how much compute capacity its objects can consume relative to other namespaces; that limitation requires a separately defined ResourceQuota object applied to the namespace.
Namespaced vs. Cluster-Scoped as a Defining Property
A Property of the Resource Type, Not the Instance
Whether a given kind of resource is namespaced or cluster-scoped is a property fixed by that resource type's definition in the API, not something an individual instance can opt into or out of; a Pod is always namespaced, and a Node is always cluster-scoped.
Consequences for Addressing
This fixed scoping determines how a resource must be addressed: retrieving a namespaced object requires specifying both its namespace and name, while retrieving a cluster-scoped object requires only its name.
The Default Namespace
A Namespace Like Any Other
The namespace named default is not architecturally special; it is defined by the same rules as any other namespace and exists only as the namespace objects are placed into when no namespace is explicitly specified, rather than by any inherent privilege.