What can be restricted using namespaces?

Namespaces in Kubernetes can be used to restrict:

• Resource Isolation: Each namespace acts as a virtual cluster, isolating resources (pods, services, deployments, etc.) from each other. This prevents accidental name conflicts and simplifies management.
• Access: Authorization policies (Role-Based Access Control - RBAC) can be applied at the namespace level, granting or restricting access to resources within a specific namespace for certain users or groups.
• Resource Quotas: Limits on resource consumption (CPU, memory) can be set for each namespace, preventing one namespace from exhausting resources at the expense of others.
• Network Policies: Rules for network interactions between pods within a namespace and between pods in different namespaces can be defined.

Example of creating a namespace:

apiVersion: v1
kind: Namespace
metadata:
  name: production

Example of setting a Resource Quota:

apiVersion: v1
kind: ResourceQuota
metadata:
  name: prod-quota
  namespace: production
spec:
  hard:
    cpu: "20"
    memory: 100Gi
    pods: "50"

Using namespaces is a fundamental concept for organizing and managing resources in Kubernetes, especially in large and multi-user environments.