Use namespaces to separate teams, apps and trust levels

Namespaces are where RBAC bindings, ResourceQuotas, LimitRanges, Pod Security labels and default-deny NetworkPolicies attach. Putting everything in default leaves you nowhere to hang those controls.

A simple pattern is one namespace per application and environment, or per team, such as checkout-prod and checkout-staging. The RBAC good practices page notes that boundaries within a namespace are weak, so workloads that need different trust levels should not share one.

For each namespace you create, decide up front:

• who can deploy to it (a RoleBinding)
• how much it can use (a ResourceQuota and a LimitRange with default requests)
• which Pod Security level it enforces (labels)
• which traffic it allows (a default-deny NetworkPolicy plus explicit allows)

To check, run kubectl get all -n default: in a well-organised cluster it holds little more than the kubernetes Service.