Creating and Securing Kubernetes

Namespace
Kubernetes Namespaces

Introduction:
Kubernetes has emerged as the go-to platform for orchestrating containers enabling
organizations to deploy and oversee applications. As organizations expand their Kubernetes
infrastructure it becomes increasingly important to establish management of namespaces to
ensure orderliness, security and efficient resource utilization. In this blog post we will delve
into the recommended strategies for establishing and safeguarding Kubernetes
namespaces.
Creating a Namespace:
To manage Kubernetes namespaces the initial step involves creating them. This can be
easily done by using the "kubectl create namespace" command. However it is crucial to go
beyond creating a namespace. It is important to associate metadata with the namespace,
such, as contact details for the team accountable for the deployed components. Annotations,
which act as a form of metadata are significant, in offering information and context for the
namespace.
A recommended approach is to either generate a YAML file using templating tools like Jinja
or create and annotate the namespace using a script. For instance, consider the following
script:
ns='my-namespace'

team='some team'

kubectl create namespace ${ns}

kubectl annotate namespace ${ns} team=${team}

By annotating the namespace, you enhance its documentation and make it easier for teams
to understand its purpose and ownership.
Securing the Namespace:
Once a namespace is created, securing it becomes a top priority. Kubernetes provides
Role-Based Access Control (RBAC) to manage user access within a namespace. To grant
access to a specific user, a RoleBinding object is created within the namespace. The
following YAML example illustrates how to bind the "edit" role to a user named "myuser" in
the context of the "my-namespace":
apiVersion: rbac.authorization.k8s.io/v1

kind: RoleBinding

metadata:

name: example

namespace: my-namespace

roleRef:

apiGroup: rbac.authorization.k8s.io

kind: ClusterRole

name: edit

subjects:

- apiGroup: rbac.authorization.k8s.io

kind: User

name: myuser
Applying this role binding can be done with the kubectl create -f role-binding.yaml command.
It's important to update the namespace in the binding if it needs to be reused for different
namespaces.

To ensure tight control over access, it's recommended to avoid granting unnecessary roles.
By restricting users to specific role bindings and making sure they don't have additional
bindings, you can enforce strict access control. Additionally, granting read access to the
entire cluster, except for secret resources, allows developers to monitor activities without
compromising sensitive information.
Resource Quotas for Efficient Resource Management:
Resource quotas are essential for preventing resource hogging and ensuring efficient
resource utilization within a namespace. By setting limits on the total number of resources a
namespace can consume, you prevent one team or application from monopolizing the entire
cluster.
Consider the following example of a ResourceQuota that limits a namespace
("my-namespace") to 10 cores and 100 GB of memory for both requests and limits in the
pods:
apiVersion: v1

kind: ResourceQuota

metadata:

name: limit-compute

namespace: my-namespace

spec:

hard:

requests.cpu: "10"

requests.memory: 100Gi

limits.cpu: 10

limits.memory: 100Gi
This quota ensures that the resources allocated to the namespace align with the intended
capacity, preventing potential resource contention.
Conclusion:
Effective management of Kubernetes architechture is a critical aspect of maintaining a
secure and efficient container orchestration environment. By following best practices such as
annotating namespaces with relevant metadata, implementing RBAC for access control, and
using resource quotas to manage resource consumption, organizations can ensure a
well-organized and secure Kubernetes infrastructure.
As Kubernetes continues to evolve, staying informed about the latest best practices and
incorporating them into your namespace management strategy is essential for optimizing
your containerized applications' performance and security.

Do you like to read more educational content? Read our blogs at Cloudastra Technologies or
contact us for business enquiry at Cloudastra Contact Us.
As your trusted technology consultant, we are here to assist you.
Visit :https://www.cloudastra.co/blogs