►
From YouTube: OMG Namespaces! | Raffaele di Fazio
Description
KCD Italy 2021* - The video of the talks are now available!
This talk is a journey through the wonders and mysteries of Kubernetes namespaces. While being a known feature of Kubernetes, there are a number of not so well known things to know about them that can teach a lot about Kubernetes. During the talk we will not only take a look at the details of Kubernetes namespaces, but also show how they are used in different production scenarios.
🤓 SPEAKER: Raffaele di Fazio, Senior Software Engineer @ GitHub
👉🏼 Here the slide deck: https://www.slideshare.net/KCDItaly/omg-namespaces-raffaele-di-fazio
______________________
* KCD Italy 2021 is the first edition of a community-organized non-profit event that will take place on November 17th and 18th and will gather adopters and technologists from open source and cloud native communities for education, collaboration, and networking.
📯 Follow us to be notified about the upcoming MeetUps: https://community.cncf.io/kubernetes-cloud-native-milano/
A
B
C
Are
yes,
of
course,
go
introduce
yourself,
ok,
grateful
thanks
to
everyone.
My
name
will
go
patchy,
I'm
founder
of
classics.
Classics
is
a
star
tablet,
diana
who
develops
sourced
products
and
solutions
in
the
line
and
tim
bernes,
our
flagship
project
is
called
pepsi.
It
is
an
operator
for
whom
to
afford
to
implement
multi
energy
in
clusters
or
for
next
I
am
a
let's
say,
a
fan
of
cooper
in
the
tests
from
the
first
hour,
I
brought
up
the
first
cluster
in
2016,
and
nothing
has
therefore
for
her
from.
A
C
D
D
As
we
said,
we
have
already
seen
this
and
let's
go
straight
to
the
heart
of
the
presentation,
seen
a
lot
of
material
and
not
a
lot
of
time
and
then
namespace.
As
you
know,
many
of
you
have
practically
everyone
who
will
be
following.
This
presentation
has
seen,
for
example,
a
common
resource
probably
often
represented
in
the
form
of
yambol.
This
is
a
de,
probably
dino,
meneghin
ex.
D
Who
has
this
movie
the
engine
ex
in
the
mid-life
section
and
other
other
information
you
can
create
un
in
space,
the
same
way
representing
it
as
in
the
form
of
camogli.
In
this
case
we
have
in
space
kimotho
bread,
a
paul
pizza,
and
this
can
be
created
in
a
class,
for
example
by
doing
city
gallo
fly
of
this.
Of
this
we
give
in
a
file,
or
you
can
do
directly
closed
by
el
krait
namespace
of
the
espace
pana
paul
pizza.
D
If
you
want
to
take
the
first
resource
at
the
deployment,
you
can
add
a
field
in
the
sit
in
the
metadata
that
madonna
in
space,
and
in
this
case,
I
said,
by
doing
this,
the
probably
dino
menghin
ex
will
be
created
at
inside
the
party,
a
pizza
pole,
and
this
will
allow
you
to
have
others
de
probably
engine
ex
inside
the
other
namespaces,
in
short,
to
use
to
limit
this
resource
in
space.
This
is
the
end
of
the
talk
thanks
for
coming
and
I
said
a
short
time,
no
joke
I'm
just
kidding.
A
D
Hope
to
be
able
to
get
to
all
we'll
see
if
we
have
to
skip
something
during
this
presentation,
then,
let's
start
with
the
documentation.
It's
always
the
best
place
to
start
to
understand
how
something
works
up
to
version
1.21.
The
namespace
definition
was
the
following:
I'll
read
it
to
you
in
English
for
needs
and
support
multiples.
This
cluster
spect
aids
in
physics,
coste
des
virtualclass,
eros
al
colle
in
space.
D
So
I'm
saying
that
in
in
space,
I'm
a
sort
of
victor
class-
and
when
I
read
this
thing,
I
thought
in
what
sense
ie
not
really
I
didn't
understand
what
it
meant
and
the
good
news
is
that
a
few
days
before
I
finished
this
presentation,
this
thing
has
changed.
Luckily,
I
will
check
it
again.
Someone
changed
the
definition
in
the
official
documentation,
go
for
the
itis
with
this
as
well
quest
in
the
documentation.
D
Inspired
by
a
talk
that
happened
at
the
most
with
is
in
america
a
few
months
ago,
a
few
weeks
ago,
and
the
dedication
is
now
in
includes
disney
expense
and
try
isolating
mechanism.
Robson
resources,
blah
blah,
unique,
will
drive.
Namespace
namespace
object,
so
this
and
is
saying
exist.
Namespaces
are
for
isolating
resources,
are
unique,
all
'inside
an
in
space
and
that
there
are
objects
that
are
namespaced
and
there
are
other
objects
that
are
not
namespaced
from
above
also
more
information
on
when
to
use
in
space.
D
For
example,
when
we
have
environments
that
are
shared
between
multiple
teams.
Multiple
people
precisely
renew
here,
some
information
about
the
purpose
of
the
in
space
and
given
the
information
about
resources,
resource
quota
that
I
won't
talk
about
inside
this
talk,
but
it
is
a
use,
let's
say
main
of
the
ing.
Often,
therefore,
in
this
r
cup
we
have
seen,
but
what
is
important
to
say
that
the
documentation
and
does
not
prescribe
how
to
use
in
expenses
exist,
they
are
there.
D
We
always
use
them
all,
even
if
we
say
because,
if
not
specifying
them
in
space,
the
resource
is
not
that
it
is
created
in
a
vacuum,
but
it
is
created
default
experts,
but
we
do
not
have
information
on
how
to
use
so.
The
question
is:
are
you
referring
to?
Is
there
really
this
isle,
jean
en
el
toque?
D
First
part
we
have
seen
this
solemn
is
not
in
often,
I
offer
you
an
extremely
weak
contract
on
what
it
means,
then
isolating
these
resources,
and
then
we
wonder
what
what
it
really
means
to
divide
resources
across
users,
which
we
will
see
towards
the
end
of
this
top
chapter.
2,
not
everyone
in
space
is
the
same.
This
guy,
my
favorite
topic.
D
D
D
Let's
see
these
defaults.
Instead,
there
is
a
service,
it
is
only
a
service,
this
service
and
the
service
co
for
the
itis
one
would
expect
from
a
non-expert
to
find
an
empty
space
question.
Instead,
it
is
not.
There
is
a
service
and
therefore
what
I
ask
is:
what
is
the
use
of
it
to
understand
what
my
approach
with
a
test
cluster
is
for,
as
I
said,
not
destroyed
many
clusters
to
take
and
delete
europe
until
it
breaks
the
gate,
gate
the
service,
koper
nitish.
D
As
you
can
see,
it
says
no
resource
found
I
get
like
a
madman
and
in
the
end
she
often
comes
back
and
services,
co,
perney
disturbs
but
I'm.
Not
there,
then
not.
Then
there
is
a
test
of
the
end
points.
If
you
know
how
the
end
to
end
service
works,
ipod
is
slowly
created
when
there
is
a
pod.
So
this
mechanism
is
a
bit
strange
and
we
are
confused.
So
at
this
point,
I
say:
okay
at
this
point,
I
cancel
also
default
expenses.
Is
that
I
can't?
Do
it
tells
me
about
expenses?
D
It
can't
be
canceled
probably
doesn't
have
enough
resources
to
do
it.
I
didn't
go
too
deeply
into
the
matter,
but
the
feeling
is
that
we
need
to
invest
more.
We
need
to
understand
what
this
neither
default
expenses
of
so
special
that
differentiates
it
from
the
others.
No
one
else
in
the
expense
of
things
we
know
what
is
needed:
more
systems
system
components,
but
no
one
in
expense.
The
characteristics
that
pesti
default
at
the
INPS,
which,
by
the
way,
is
what
we
all
use.
D
When
we
start
to
use
cooper
nests,
we
spend
we
combine,
we
apply
it
and
it
ends
up
in
spent
default.
So
we
mix
some
of
our
things,
space
issues
which
has
a
bit
special
and
present.
There
are
parts
within
its
of
gubernatis
that
take
care
of
creating
nin
spaces
if
they
don't
exist
in
particular,
as
you
can
see
here,
there
are
codes
that
of
the
code
that
goes
to
create
that
type
service
for
the
itis.
D
D
The
reason
why
we
have
this
in
the
space
this
service
within
the
inps
the
default
and
that
we
need
it
to
talk
to
the
p
ai
service.
Let's
say
a
backbone
of
the
entire
Bernese
arc
class,
so
the
default
expenses
that
we
don't
use
and
think
about
our
our
up
to
a
certain
point
is
a
and
often
a
bit
special
and
in
fact
that
that
service
is
the
cluster
ep
della
pia
and
the
place
settings
is
used
by
come
on.
D
Since
you
use
the
cluster
and
by
all
the
controllers
and
the
question
that
comes
to
me,
however,,
because
in
the
deformed
space,
which
is
precisely
the
place
where
we
then
go
to
create
all
the
resources
or
when
we
start
with
q
berlin,
when
we
don't
have
a
strategy
on
how
to
use
nei,
it
is
often
seen
that
the
documentation
doesn't
provide
us
with
any
information.
I
didn't
know,
I
searched
everywhere.
In
the
end,
Abbado
said
on
twitter
and
I:
ask
him
moment.
King
and
I.
Ask
him
precisely.
D
Why
are
the
often
default
the
answer
and
not
in
cube
system,
for
example,
the
answers
that
there
is
is
not
for
the
users.
It
is
a
decision
that
we
made
at
the
beginning
and,
as
you
know,
at
the
beginning,
yes,
we
start
some
decisions
that
seem
easy,
but
they
have
structural
consequences
and
it
says
enhancement.
Su
prohibì,
nec
for
need
is
namespace,
so
probably
not
in
the
same
defaults,
okay,
mystery
solved,
and
now
let's
go
but
let's
say
mine
in
this
exploration.
D
D
However,
they
have
a
metadata
field,
which
is
the
same
that
all
the
resources
have
and
therefore
I
asked
myself
but
islands.
But
how
does
this
work?
What
is
one
in
often
resources,
as
we
have
seen
for
deployments
here,
is
the
deployment
and
compromised
first
with
space
from
a
pole,
pizza,
and
there
are
resources
only
not
in
spaced,
like
a
cluster
roll,
for
example,
which
has
neither
space
specified
and
in
spes
we
see
that
you
define
space
is
an
optional
field
that
defines
let
's
say
exactly
where
the
resources
go.
D
I
know
the
cookie
object
n
space.
This
is
not
necessary
for
all
the
resources.
The
value
for
these
will
be
empty,
but
at
this
point,
but
in
space
they
are
namespaces,
I
can
do
nor
spent
in
a
namespace
and
I
took
this
unispace
named
a
pizza
pole
was
enough.
I
used
this
talk
enough
and
I
say:
ok,
I
want
to
create.
It
was
in
the
space
cube
system.
I
would
like
to
take
a
break,
but
unfortunately
we
have
time.
What
do
you
think?
D
What
happens
if
I
do
the
plata
of
this
resource
is
that
he
told
me
if
he
eats
it
calmly.
If
he
takes
it,
he
says
in
space
was
created.
If
we
go
to
see
the
representation
I
call
of
the
resource-
as
you
can
see
in
this
slide,
that
a
system
has
disappeared
everywhere
from
this
from
the
representation
namespace
and
I
went
so
far
as
to
go
and
ask
the
same
object
directly
to
the
sites
using
the
city
hall
sites.
As
you
can
see
here
too,
there
is
nothing
about
more
system
about
the
namespace.
D
We
told
you
how
it
works
it
works
here
is
for
nests
sa
resource
by
resource.
Sorry,
here
is
something
even
more
interesting.
Some
parties,
for
example,
this
file.
As
you
see
they
set
it
in
the
expenses
in
the
hub,
jazz
metal,
7,
ronin
space.
They
set
it
for
a
and
space,
but
they
set
it
as
empty,
and
then
there
are
some
gems
like
this,
which
I
think
is
from
klein
rank
that
is
called
being
woodworm
cluster
scott,
I.e.
this
is
really
class
scott
and
we
ask
ourselves
twice.
D
They
are
quite
sympathetic,
but
in
fact
what
happens
is
that
in
space
are
not
the
in
space,
and
this
is
understandable
why
this
method
exists
is
called
lance
bass,
cope
which
always
comes
back,
perhaps
for
the
in
space,
which
is
practically
defined
in
different
parts,
but
for
all
the
resources
to
it.
I
don't
go
to
the
bottom
of
how
the
whole
flow
of
calls
works.
The
inter
nuns,
because
it
is
a
bit
complex.
However,
the
concept
in
in
expenses
is
really
central
in
which
he
defined
for
each
of
the
resources.
D
D
Be
careful,
however,
that
co
for
nests,
lecce
among
etcetera,
are
extremely
tolerant,
as
we
have
seen,
I
gave
him
a
call
to
which,
in
theory
is
invalid,
because
I
told
him
that
there
often
must
have
a
in
the
space
systems
which
in
short,
there
is
no
way
that
I
can
create
a
within
another
namespace.
But
some
tools-
I,
don't
know
I'm
not
present.
I
came
across
the
use
of
a
tool
of
the
project,
both
the
youth.
D
There
are
different
types
of
use.
I
have
listed
a
few
that
I
know
that
are
the
most
common.
The
naive
approach
that
is
all
goes
by
default
in
is
often
the
one
we
started
with
a
bit
all
no
another
that
create
a
namespace
for
each
team
within
organizations.
Putting
teams
center
of
everything,
unispace
tehran
barmen,
for
example,
staging
production
or
a
is
expense
per
action,
and
then,
as
I
said,
I
dont
have
an
opinion
on
how
you
have
to
use
in
space
vi.
D
Leave
it
free
and,
however,
you
are
forced
to
have
this
opinion,
because
otherwise
it
becomes
a
big
mess
to
manage,
and
therefore,
let's
see
the
first
option
that
we
put
everything
at
the
expense
of
default,
which
I
call
closed
tiriolo
a
bit,
because
this
does
not
belong
to
default,
as
we
have
seen
a
little
special.
No,
there
is
the
service.
I
say
for
itis
and
other
things:
I
often
create.
D
Let's
say
for
some
approaches:
it
can
make
sense
because
to
make
commissioning
to
cancel
and
henin
expenses,
you
cannot
cancel
in
the
default
spent
as
I
have
shown,
so
it
is
a
but
something
a
bit.
Special
here
are
some
teachers.
Obviously
it
is
extremely
easy
to
understand.
It
is
the
one
with
which
you
all
start
with
all
the
tutorials.
D
It
is,
however,
on
the
other
hand
that
it
becomes
complex
to
manage
default
expenses
with
a
lot
of
resources,
because
precisely
you
close
rhiag
and
then
hundreds
come
out,
and
it's
not
clear
who
manages
what
so
in
contexts
that
aren't
extremely
small
like
your
cluster,
it
becomes
a
bit
complicated
to
have
fun
and
then
there's
this
fact
that
the
default
expenses
are
a
bit
special,
a
space
x
team.
This
it's
another
option,
I've
seen
it
done
a
lot
because
I
do
n't
know
if
it
makes
sense.
It's
an
option.
D
I
do
n't
know
here
to
tell
you
about
the
meaning.
We
the
pros
that
a
strong
separation
is
created
between
different
teams
and
it's
very
good
for
companies
such
as
the
sector
technology,
that
put
teams
at
the
center
of
everything,
and
it
is
also
true,
however,
that
a
team,,
especially
in
these
times,
in
short,.
The
structures
are
quite
fluid
and
therefore
understand
how
to
manage
in
and
space
over
time
and
therefore,
the
resources
inside
in
space.
D
Let's
say
when
you
make
a
separation
of
this
kind,
it
becomes
complex
and
keep
in
mind
that
if
you
use
the
internal
service
discovery
mechanism
and
the
espace
you
could
have,
neither
spending
inside
the
dns
names
used
so
pay
attention
to
how
you
structure
an
e
space
x,
environment
there.
It's
a
separation
and
logic
between
staging
production,
etc.
D
D
That
I
have
the
pleasure
of
discussing
again,
because
I
think
it
is
a
very
important
thing
to
reiterate
that
there
is
no
default
separation
between
different
things
or
spaces
and,
in
particular,
the
documentation
says
by
default
bozar
non
a
isolate
ex
air
traffic
romanians
source,
the
problem
that
this
information
is
not
in
the
nin
space
page,
but
it
is
in
the
network
policies
page
that
the
solution
to
the
problem,
I.e.
using
network
policy
you
can
restrict.
D
Let's
say
which
traffic
between
the
various
pods
prevails
in
in
space,
which,
however,
involves
the
fact
of
having
to
use
a
different
sienna
to
the
providers
or
other
features
of
the
various
providers
which
I
won't
discuss
in
general.
It
is
most
likely
a
bad
idea
to
mix
so
mix
and
production
and
not
production
workload.
I
don't
do
it.
Then
there
could
be
cases
where
this
could
make
sense.
There
are
companies
that
deal
with
contexts
in
which
everything
that
is
not
production
is
concerned,
with
the
same
characteristics
of
compliance,
security,
etc.
D
as
production,
and
in
that
case
it
could
make
sense
to
save
resources.
However,
again
it
depends
on
your
case
arpac
elin
space.
Beware
that
they
exist
if
you
give,
for
example,
to
controllers
or
other
things,
the
ability
to
create
or
delete
or,
in
general,
operate
different
spaces.
These
are
extremely
high
privileges
and
it
happens
that
you
give
very
high
privileges
to
custom
controllers,
and
then
things
like
this
happen,
where
the
permission
model
work
of
how
they
are
structured
in
misunderstood
expenses.
D
D
What
kind
of
permissions
you
have,
if
you
can
think
about
it,
let's
say
and
make
one
and
try
to
have
a
defined
strategy
on
how
you
intend
to
use
in
and
space
the
last
year
approach
in
space
x
application,
then
an
application
unispace,
which
has
the
great
advantage
of
having
a
very
well
defined
logical
separation.
You
can
do
tuning
of
what
it
talks
with
what
helps
us
to
keep
the
number
of
resources
per
space
tight.
D
D
Instead,
if
you
have
many
macro
services,
there
are
companies
without
naming
names,
particulars
that
have
hundreds,
even
thousands
of
of
max,
could
end
up
with
thousands
of
namespaces,
which
then
becomes
another
challenge
to
manage.
Ok
last
part:
space
evolution.
What
I
said
is
all
true,
and
this
and
cooper
nyt
up
to
the
latest
version,
so
it
was
true
from
the
beginning.
It
is
true
until
now,
but
there
are
some
new
things.
D
New
things,
for
example,
are
one
of
these
was
rki
from
in
spent,
I.e.
in
hierarchical
spaces,
which
are
a
new
concept
developed
by
the
multi
tenancy
working
group.
I,
say
for
the
itis
and
takes
allows
you
to
create
denis
expenses.
They
are
children
of
another,
neither
often
a
nor
exact
expenses.
This
also
allows
you
to
do
some
very,
very
interesting.
Things
such
as
polis
inheritance,
I.e.
D
thirty
years
old
space
child
ago,
takes
let's
say
the
policy
it
en
éspace
father,
and
this
allows
you
to
restrict
very,
very
well
things
and,
let's
say,
create
a
better
system
in
terms
of
security
and
isolate
less
than
parts
of
the
cluster
in
terms
of
police,
arpac,
etc,
etc.
Have
other
parts
advantages,
but
I
won't
go
to
discuss
them
here.
D
There
is
also
the
concept
of
virtual
cluster
from
this
talk,
what
a
link
point
at
the
bottom,
but
you
can
find
it
on
youtube.
This
was
done
a
few
weeks
ago.
There
is
this
project,
both
ships
cluster,
which
allows
you
to
create
an
entire
cluster
within
the
expenses,
I.e.
going
close
to
the
original
definition
of
mini
expenses
that
we
find
in
the
documentation
up
to
version.
1.21
is,
in
fact
the
pr,
the
pure
quest
to
change
that
documentation
proposed.
D
They
also
helped,
let's
say
the
documentation
to
be
clearer
for
users,,
especially
those
new
to
the
concept
of
namespaces
gubernatis,
ok,
conclusions,
I
think
I'm
in
time
and
be
careful.
You
must
have
a
namespace
massacre.
If
you
don't
have
it,
let's
say
you
are
creating
a
box
with
everything
inside
and
sooner
or
later,
you
will
find
yourself
in
the
situation
of
having
to
move
stuff,
to
restructure
your
company,
to
create
a
mechanism
to
create
higher
security
policies
or
to
have
to
deal
with
cities
and
therefore
with
security
vulnerabilities.
D
D
B
Fantastic
by
the
way,
really
really
cool
by
the
way
we
reached
193
participants,
so
boom
successor
we
are.
We
are
very
happy
I.
Ask
you
a
couple
of
questions
already
mentioned.
Congratulations
first
and
space,
you
chose
pine
and
then
there
is
also
a
poll
on
twitter
on
the
digital
casey
for
the
best
pizza
vote,
too.
Pineapple
pizza,
I
work.
B
Then
I
'll
ask
you
a
question
in
the
meantime,
adriano
pezzuto
had
erected
asked
a
question,
but
he
only
dusted
off
what
you
would
have
answered
in
a
few
chats
because
he
was
asking
about
high
hierarchical
namespaces.
So,
let's
skip
and
instead
pietro
più
asks
you
for
a
hybrid
approach.
Peridance
space
like
up
and
as
you
see
it,
raffaele
asks
if
it
could
be
a
blasphemy
I,
don't
know.
I
do.
D
N't
know
well
lazy.
What
is
meant
by
that
in
the
end
in
style
they
force
flat.
So
it's
not
like
you
can
put
at
least
you
don't
use
and
the
project
of
hierarchs
canes
in
spaces.
You
can't
put
an
expense
inside
another
in
expenses,
so
either
go
with
one
or
the
other
of
approach
and
default,
and
for
my
preference
I
would
prefer
to
always
separate
memo
text
staging
setups
from
production
for
reasons
yes,
not
just
for
security
reasons.
Why
one?
Why
the
approach
of
saying?
Ok,
we
apply
all
the
security
compliance
rules
to
test.
D
It
is
possible
at
that
point.
There
is
no
need
to
separate
anything.
There
is
only
one
problem
also.
It
introduces
a
lot
a
lot
of
friction.
Therefore,
many
many
problems
for
the
developer
in
doing
absurd
things
that
is,,
when
I,
have
to
develop
a
controller
or
something,
I
like
to
act
on
the
class,,
delete
things
to
do
csec
inside
the
containers,
install
via
and
all
the
other
things
that
I
normally
wouldn't
want
inside,,
it
will
come
across
in
production,.
So
if
you
want
to
restrict
these
things,,
it
is
very
limited.
The
developers'
possibility
of
experimentation.
D
B
Peter
then
adds
that
perhaps
with
the
high
archicad
namespaces,
you
could
do
something
upside
for
sure
and
then
I'll
ask
you
a
question,
I'll
pass
on
Luigi
Corsello's
question,
asking
for
a
more
real
separation
between
workloads
at
a
higher
level
than
multi
terra.
Yes,
and
it
comes
to
mind
cup
sul
I,.
D
B
D
B
Always
here,
let's
see
if
there
are,
if
there
are
other
questions,
actually
I
inform
you
that
the
survey
is
being
won
by
the
pineapple
pizza,
obviously,
because
because
we
can't
have
beautiful
things,
eh,
no
guys,
794.
What
a
few
more
questions
since
we
are
on
the
final
I.
Think
if
you
want
to
add
something
otherwise,
I
have
a
question
for
you
then
see
a
question
for
you
now
I'll:
ask
you
what
tool
used
to
investigate
the
internals
of
cooper
in
the
tests
and.
D
As
mentioned
kind,
certainly,
but
then
I
never
left
the
browser.
This
was
a
challenge
for
me
and
therefore
precisely
kind
source
kraft
for
the
to
navigate
the
source,
a
bit
to
make
references
in
to
see
what
the
official
documentation
called.
What
and
spaces
for
us
that
we
have
to
do
some
small
experiments,
the
kind
cluster
created
inside
the
con
space.
So,
in
short,
the
slides
also
made
with
a
web
app
in
short,,
covered
a
browser,
I,
never
closed
and
office.
Knight,
perfect.
D
D
Professional
field
and
possibly
and
use
different
clusters
for
the
empowerment
division
in
a
field.
Clearly,
let's
say
personal
development
experimentation.
That
case
is
not
too
important
and
I
always
try
not
to
use
the
default
experts
for
the
reasons
what
I
said.
Typically,
if
I
have
a
class
in
my
cloud,
I
also
try
not
to
spend
too
much
money
on
it.
So
typically,
it
creates
a
namespace.
There
is
just
the
whole
gate
nor
itself,
for
example,
for
external
dns.
The
project
I
am
maintaining.