All Products
Search

This Product

    Container Service for Kubernetes:Manage namespaces and quotas

    Document Center

    Container Service for Kubernetes:Manage namespaces and quotas

    Last Updated:Aug 03, 2026

    Namespaces partition a shared Container Service for Kubernetes (ACK) cluster into isolated workspaces, enabling resource quotas, permission management, and cost tracking per team or environment.

    Namespaces

    In an ACK cluster, namespaces divide cluster resources into isolated groups. When multiple teams share a cluster, create namespaces to classify resources by team or environment, then use resource quotas to limit what each namespace can consume.

    By default, running pods can consume unlimited CPU and memory resources on nodes. Pods in a single namespace can exhaust the entire cluster's resources. Configure resource quotas per namespace — including CPU, memory, and pod count — to prevent this.

    Example allocations: In a cluster with 32 GiB RAM and 16 CPU cores, allocate 20 GiB and 10 cores to team A, 10 GiB and 4 cores to team B, and keep 2 GiB and 2 cores in reserve. Alternatively, give the testing namespace 1 core and 1 GiB RAM, and let production use whatever remains.

    Create a namespace

    Use the ACK console

    1. Log on to the ACK console. In the left navigation pane, click Clusters.

    2. On the Clusters page, click the name of your cluster. In the left navigation pane, click Namespaces and Quotas.

    3. Click Create. In the dialog box that appears, configure the name and label of the namespace and click OK.

    Use kubectl

    1. Create a namespace.

      kubectl create namespace test

    2. Verify that the namespace is created.

      kubectl get namespaces

      Expected output:

      NAME              STATUS   AGE
default           Active   46h
kube-node-lease   Active   46h
kube-public       Active   46h
kube-system       Active   46h
test              Active   9s

      The namespace test is now active in the list.

    Configure resource quotas and limits

    Note

    After you configure CPU and memory quotas (ResourceQuota) for a namespace, pods created in the namespace must specify CPU and memory limits, unless default resource limits (LimitRange) are configured for the namespace.

    Use the ACK console

    1. On the Namespace page, click Resource Quotas and Limits in the Actions column of the target namespace.

    2. In the Resource Quotas and Limits dialog box, configure resource quotas and default resource limits. For details, see Resource Quotas and Configure Default Memory Requests and Limits for a Namespace.

    Best practices for modifying quotas

    Important

    Modify quotas during off-peak hours. Check the resource usage of existing workloads before making changes.

    • Reserve enough resources for Horizontal Pod Autoscaler (HPA) autoscaling.

    • Monitor the cluster for at least 30 minutes after adjusting quotas to confirm that HPA runs as expected.

    Delete a namespace

    Warning

    Built-in namespaces (default, kube-system, kube-public, kube-node-lease) cannot be deleted. Clear all resources in the namespace before deleting it. If the namespace stays in the Terminating status for a long time, see What do I do if the namespace is stuck in Terminating status?.

    Use the ACK console

    1. On the Namespace page, find the target namespace and click image > Delete in the Actions column. To disable deletion protection first, click image > Disable Deletion Protection in the Actions column.

    2. In the Confirm dialog box, confirm the associated resources in the namespace and click Confirm.

    Use kubectl

    kubectl delete namespace test

    FAQ

    What do I do if the namespace is stuck in Terminating status?

    When a namespace that still contains resources is deleted, the deletion stays in Terminating status for a long time. The fix is to clear the finalizers array in the namespace spec — Kubernetes then automatically removes the namespace. Note that this may leave orphaned resources in the cluster, so clean up workloads in the namespace before proceeding.

    Use the following steps to force-delete a namespace. This example uses the istio-system namespace:

    1. Open a terminal and start a reverse proxy for the cluster.

      kubectl proxy

      Expected output:

      Starting to serve on 127.0.0.1:8001

    2. Open a second terminal. Export a token and verify connectivity to the API server.

      export TOKEN=$(kubectl describe secret $(kubectl get secrets | grep default | cut -f1 -d ' ') | grep -E '^token' | cut -f2 -d':' | tr -d '\t')
curl http://localhost:8001/api/v1/namespaces --header "Authorization: Bearer $TOKEN" --insecure

    3. Export the namespace configuration to a JSON file.

      kubectl get namespace istio-system -o json > istio-system.json

    4. Open istio-system.json and clear the finalizers array in the spec section.

      "spec": {
    "finalizers": []
}

    5. Apply the updated configuration to remove the finalizers.

      curl -X PUT --data-binary @istio-system.json http://localhost:8001/api/v1/namespaces/istio-system/finalize -H "Content-Type: application/json" --header "Authorization: Bearer $TOKEN" --insecure

    Related documents