kubectl: Namespaces, Contexts & Configuration

Namespaces

Namespaces partition cluster resources between multiple users or teams. Most resources are namespace-scoped; a few (nodes, PVs, namespaces themselves) are cluster-scoped.

# List namespaces
kubectl get namespaces

# Create namespace
kubectl create namespace staging

# Work in a specific namespace
kubectl get pods -n staging
kubectl apply -f app.yaml -n staging

# Set default namespace for current context
kubectl config set-context --current --namespace=staging

# Delete namespace (deletes all resources inside!)
kubectl delete namespace staging

# Namespace-scoped vs cluster-scoped resources
kubectl api-resources --namespaced=true    # namespace-scoped
kubectl api-resources --namespaced=false   # cluster-scoped

Contexts & kubeconfig

A context is a named triple of (cluster, namespace, user). kubeconfig stores credentials and contexts — typically at ~/.kube/config.

# View current config
kubectl config view
kubectl config view --minify           # only current context
kubectl config view --raw              # decode base64 secrets

# Current context
kubectl config current-context

# List contexts
kubectl config get-contexts

# Switch context
kubectl config use-context prod-cluster

# Rename context
kubectl config rename-context old-name new-name

# Delete context
kubectl config delete-context old-context

# Merge kubeconfigs (combine cluster credentials)
KUBECONFIG=~/.kube/config:~/Downloads/new-cluster.yaml   kubectl config view --flatten > ~/.kube/config

# Use a different kubeconfig file
kubectl --kubeconfig=/path/to/config get pods
export KUBECONFIG=/path/to/config    # or set env var

ConfigMaps & Secrets

# ConfigMap from literal values
kubectl create configmap app-config   --from-literal=DB_HOST=postgres   --from-literal=DB_PORT=5432

# ConfigMap from file
kubectl create configmap nginx-conf --from-file=nginx.conf
kubectl create configmap app-props --from-env-file=.env

# View ConfigMap data
kubectl get configmap app-config -o yaml
kubectl describe configmap app-config

# Secret (values are base64-encoded in YAML, not encrypted)
kubectl create secret generic db-creds   --from-literal=username=admin   --from-literal=password=s3cr3t

# TLS secret
kubectl create secret tls my-tls   --cert=tls.crt --key=tls.key

# Decode secret value
kubectl get secret db-creds -o jsonpath='{.data.password}' | base64 -d

# Update secret (edit base64-encodes values in $EDITOR)
kubectl edit secret db-creds

RBAC

# List roles and bindings
kubectl get roles,rolebindings -n default
kubectl get clusterroles,clusterrolebindings

# Check permissions (as yourself)
kubectl auth can-i create pods
kubectl auth can-i delete deployments -n production

# Check permissions as another user/serviceaccount
kubectl auth can-i get pods --as=jane
kubectl auth can-i list secrets --as=system:serviceaccount:default:my-sa

# Create role + binding
kubectl create role pod-reader   --verb=get,list,watch   --resource=pods

kubectl create rolebinding read-pods   --role=pod-reader   --user=jane   --serviceaccount=default:my-sa