Namespaces, RBAC, and Isolation Basics

Apply namespaces and RBAC basics for isolation and safe multi-team operation without overengineering.

On this page

Namespace Basics (Ops View)

Use namespaces for environment/team separation (dev/stage/prod).
Combine with ResourceQuotas and RBAC for safe multi-tenant operation.

Quick Audit

kubectl get ns
kubectl -n <ns> get all
kubectl -n <ns> get role,rolebinding,serviceaccount
kubectl get clusterrole,clusterrolebinding | head -40

Minimum Safe Defaults

Default deny egress/ingress with NetworkPolicy (if CNI supports it).
Limit blast radius with ResourceQuota and LimitRange.
Use least privilege RBAC; avoid cluster-admin for apps.

Example: ResourceQuota + LimitRange

apiVersion: v1
kind: ResourceQuota
metadata:
  name: quota
  namespace: demo
spec:
  hard:
    requests.cpu: "2"
    requests.memory: "4Gi"
    limits.cpu: "4"
    limits.memory: "8Gi"

Failure Modes

Accidental cross-namespace access: overly broad ClusterRoleBindings.
Quota surprises: deployments fail when quota is reached; watch events.

← Scheduling Basics (taints/affinity/topology)