19. Namespaces, labels, and organizing a cluster

19.1 Namespaces

Namespaces are the unit of RBAC, quota, network policy, and naming. They are not a security boundary by themselves.

kube-system           # cluster components
monitoring            # Prometheus, Grafana, Loki, Tempo, OTel
argocd, argo-rollouts, keda, kyverno, cert-manager, envoy-gateway-system, cnpg-system, velero
orbit-dev / orbit-staging / orbit-prod   # (on one cluster for the lab; separate clusters for real prod)

Best practice: prod gets its own cluster (and usually its own cloud account). Namespaces separate teams and apps within an environment; clusters separate environments and blast radius. "One namespace per env on a shared cluster" is fine for dev/staging, and it is how a bad CRD upgrade in staging takes down prod.

19.2 Labels vs annotations

• Labels: identifying, selectable (-l, Service selectors, policies, cost allocation). Keep them small and stable: app.kubernetes.io/*, team, env, cost-center.
• Annotations: non-identifying metadata for tools: prometheus.io/*, argocd.argoproj.io/sync-wave, change-cause, links to runbooks.