When you deploy an application to Kubernetes in production, you shouldn\u2019t throw everything into the In this post, we\u2019ll walk through a clean, real-world Kubernetes namespace structure, show the YAML for each section, and explain what it does. You can drop all of these files into a directory and apply them in one go with:<\/p>\n Create a folder for your Kubernetes manifests, for example:<\/p>\n Kubernetes will treat all of these files as one desired state when you run A namespace is a logical boundary in the cluster. Think of it as a dedicated \u201cfolder\u201d for your application\u2019s resources.<\/p>\n What this does:<\/strong><\/p>\n A What this does:<\/strong><\/p>\n RBAC (Role-Based Access Control) defines what your application is allowed to do inside the namespace. You don\u2019t want your app to have full cluster access; you give it just enough permissions.<\/p>\n What this does:<\/strong><\/p>\n A ConfigMap holds non-secret configuration such as runtime flags, modes, switches, or log levels.<\/p>\n What this does:<\/strong><\/p>\n Secrets hold confidential settings such as database URLs, API keys, and credentials.<\/p>\n What this does:<\/strong><\/p>\n The Deployment defines how your containers run: image, replicas, health checks, resources, and security context. This is the core of your application\u2019s runtime behavior.<\/p>\n What this does:<\/strong><\/p>\n A Service provides a stable, cluster-internal endpoint to reach your pods.<\/p>\n What this does:<\/strong><\/p>\n Ingress exposes your Service to the outside world using a hostname and optional TLS.<\/p>\n What this does:<\/strong><\/p>\n The HPA automatically adjusts the number of replicas based on metrics like CPU usage.<\/p>\n What this does:<\/strong><\/p>\n A PodDisruptionBudget ensures that voluntary disruptions (node drains, upgrades) don\u2019t take down too many pods at once.<\/p>\n What this does:<\/strong><\/p>\n By default, Kubernetes allows every pod to talk to every other pod. NetworkPolicies let you move to a zero-trust model.<\/p>\n What this does:<\/strong><\/p>\n What this does:<\/strong><\/p>\n Once you have all these files in your Kubernetes reads all files, builds the state internally, and creates or updates resources in the correct order, very similar to how Terraform applies all A production-ready Kubernetes deployment is not just a Deployment and a Service. It is a structured set of manifests that cover identity, security, configuration, scaling, networking, and reliability.<\/p>\n With this structure in place, you have a clean, repeatable Kubernetes deployment that fits naturally into Git, CI\/CD, and GitOps workflows.<\/p>\n","protected":false},"excerpt":{"rendered":" How to Deploy a Kubernetes Application with a Clean Namespace Structure When you deploy an application to Kubernetes in production, you shouldn\u2019t throw everything into the default namespace or a single giant YAML file. A proper setup uses: A dedicated namespace for the app A ServiceAccount and RBAC for security ConfigMap and Secret for configuration Deployment, Service, and Ingress forRead More …<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[148],"tags":[],"class_list":["post-2161","post","type-post","status-publish","format-standard","hentry","category-kubernetes"],"_links":{"self":[{"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/posts\/2161","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/comments?post=2161"}],"version-history":[{"count":2,"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/posts\/2161\/revisions"}],"predecessor-version":[{"id":2163,"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/posts\/2161\/revisions\/2163"}],"wp:attachment":[{"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/media?parent=2161"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/categories?post=2161"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/tags?post=2161"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}default<\/code> namespace or a single giant YAML file. A proper setup uses:<\/p>\n\n
\nHPA vs PDB (Summary)<\/strong><\/h1>\n
========================<\/h1>\n
\n\n
\n \nFeature<\/th>\n HPA<\/th>\n PDB<\/th>\n<\/tr>\n<\/thead>\n \n Scales pods based on load<\/td>\n \u2714 YES<\/td>\n \u274c NO<\/td>\n<\/tr>\n \n Ensures minimum pods stay up<\/td>\n \u274c NO<\/td>\n \u2714 YES<\/td>\n<\/tr>\n \n Helps with traffic spikes<\/td>\n \u2714 YES<\/td>\n \u274c NO<\/td>\n<\/tr>\n \n Protects during upgrades\/drains<\/td>\n \u274c NO<\/td>\n \u2714 YES<\/td>\n<\/tr>\n \n Operates on load (CPU\/metrics)<\/td>\n \u2714 YES<\/td>\n \u274c NO<\/td>\n<\/tr>\n \n Operates on disruptions<\/td>\n \u274c NO<\/td>\n \u2714 YES<\/td>\n<\/tr>\n \n Controls min\/max replicas<\/td>\n \u2714 YES<\/td>\n \u274c NO<\/td>\n<\/tr>\n \n Controls disruption limits<\/td>\n \u274c NO<\/td>\n \u2714 YES<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n<\/li>\n<\/ul>\n kubectl apply -f k8s\/\n<\/code><\/pre>\n
\n1. Directory Structure<\/h2>\n
k8s\/\n namespace.yaml\n serviceaccount.yaml\n rbac.yaml\n configmap.yaml\n secret.yaml\n deployment.yaml\n service.yaml\n ingress.yaml\n hpa.yaml\n pdb.yaml\n networkpolicy-default-deny.yaml\n networkpolicy-allow-ingress.yaml\n<\/code><\/pre>\nkubectl apply -f k8s\/<\/code>, similar to how Terraform reads multiple .tf<\/code> files in one directory.<\/p>\n
\n2. Namespace \u2013 Isolating the Application<\/h2>\n
apiVersion: v1\nkind: Namespace\nmetadata:\n name: prod-app\n labels:\n name: prod-app\n pod-security.kubernetes.io\/enforce: \"restricted\"\n pod-security.kubernetes.io\/enforce-version: \"latest\"\n<\/code><\/pre>\n\n
prod-app<\/code>.<\/li>\n
\n3. ServiceAccount \u2013 Identity for the Pods<\/h2>\n
ServiceAccount<\/code> represents the identity your pods use inside Kubernetes. Instead of relying on the default ServiceAccount, you create a dedicated one for your app.<\/p>\napiVersion: v1\nkind: ServiceAccount\nmetadata:\n name: app-sa\n namespace: prod-app\n<\/code><\/pre>\n\n
app-sa<\/code> in the prod-app<\/code> namespace.<\/li>\n
\n4. RBAC \u2013 Roles and RoleBindings<\/h2>\n
apiVersion: rbac.authorization.k8s.io\/v1\nkind: Role\nmetadata:\n name: app-read-config\n namespace: prod-app\nrules:\n - apiGroups: [\"\"]\n resources: [\"configmaps\", \"secrets\"]\n verbs: [\"get\", \"list\"]\n\n---\napiVersion: rbac.authorization.k8s.io\/v1\nkind: RoleBinding\nmetadata:\n name: app-read-config-binding\n namespace: prod-app\nsubjects:\n - kind: ServiceAccount\n name: app-sa\n namespace: prod-app\nroleRef:\n kind: Role\n name: app-read-config\n apiGroup: rbac.authorization.k8s.io\n<\/code><\/pre>\n\n
Role<\/code> app-read-config<\/code>:\n\n
get<\/code>, list<\/code>) ConfigMaps and Secrets in this namespace.<\/li>\n<\/ul>\n<\/li>\nRoleBinding<\/code>:\n\n
app-sa<\/code> ServiceAccount.<\/li>\napp-sa<\/code> can now read ConfigMaps and Secrets in prod-app<\/code>.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n
\n5. ConfigMap \u2013 Non-Sensitive Configuration<\/h2>\n
apiVersion: v1\nkind: ConfigMap\nmetadata:\n name: app-config\n namespace: prod-app\ndata:\n APP_ENV: \"production\"\n APP_LOG_LEVEL: \"info\"\n<\/code><\/pre>\n\n
\n6. Secret \u2013 Sensitive Configuration<\/h2>\n
apiVersion: v1\nkind: Secret\nmetadata:\n name: app-secret\n namespace: prod-app\ntype: Opaque\nstringData:\n DATABASE_URL: \"postgres:\/\/user:password@db.prod:5432\/app\"\n API_KEY_EXTERNAL_SERVICE: \"replace-me\"\n<\/code><\/pre>\n\n
\n7. Deployment \u2013 The Application Workload<\/h2>\n
apiVersion: apps\/v1\nkind: Deployment\nmetadata:\n name: app-deployment\n namespace: prod-app\n labels:\n app: my-app\nspec:\n replicas: 3\n revisionHistoryLimit: 5\n strategy:\n type: RollingUpdate\n rollingUpdate:\n maxUnavailable: 0\n maxSurge: 1\n selector:\n matchLabels:\n app: my-app\n template:\n metadata:\n labels:\n app: my-app\n spec:\n serviceAccountName: app-sa\n automountServiceAccountToken: false\n securityContext:\n runAsNonRoot: true\n runAsUser: 1000\n runAsGroup: 1000\n fsGroup: 1000\n containers:\n - name: app\n image: your-registry\/your-image:TAG\n imagePullPolicy: IfNotPresent\n ports:\n - containerPort: 8080\n name: http\n envFrom:\n - configMapRef:\n name: app-config\n - secretRef:\n name: app-secret\n resources:\n requests:\n cpu: \"200m\"\n memory: \"256Mi\"\n limits:\n cpu: \"500m\"\n memory: \"512Mi\"\n readinessProbe:\n httpGet:\n path: \/healthz\n port: http\n initialDelaySeconds: 5\n periodSeconds: 10\n livenessProbe:\n httpGet:\n path: \/livez\n port: http\n initialDelaySeconds: 15\n periodSeconds: 20\n securityContext:\n readOnlyRootFilesystem: true\n allowPrivilegeEscalation: false\n capabilities:\n drop:\n - ALL\n terminationGracePeriodSeconds: 30\n<\/code><\/pre>\n\n
maxUnavailable: 0<\/code>, maxSurge: 1<\/code>).<\/li>\napp-sa<\/code> ServiceAccount, inheriting its RBAC permissions.<\/li>\nConfigMap<\/code> and Secret<\/code>.<\/li>\nreadinessProbe<\/code>, livenessProbe<\/code>) so Kubernetes knows when to route traffic and when to restart pods.<\/li>\n
\n8. Service \u2013 Internal Load Balancer<\/h2>\n
apiVersion: v1\nkind: Service\nmetadata:\n name: app-service\n namespace: prod-app\n labels:\n app: my-app\nspec:\n type: ClusterIP\n selector:\n app: my-app\n ports:\n - name: http\n port: 80\n targetPort: http\n<\/code><\/pre>\n\n
http<\/code>).<\/li>\napp-service.prod-app.svc.cluster.local<\/code>.<\/li>\napp: my-app<\/code>.<\/li>\n<\/ul>\n
\n9. Ingress \u2013 External HTTP\/HTTPS Access<\/h2>\n
apiVersion: networking.k8s.io\/v1\nkind: Ingress\nmetadata:\n name: app-ingress\n namespace: prod-app\n annotations:\n kubernetes.io\/ingress.class: \"nginx\"\n nginx.ingress.kubernetes.io\/ssl-redirect: \"true\"\nspec:\n tls:\n - hosts:\n - app.your-domain.com\n secretName: app-tls-secret\n rules:\n - host: app.your-domain.com\n http:\n paths:\n - path: \/\n pathType: Prefix\n backend:\n service:\n name: app-service\n port:\n number: 80\n<\/code><\/pre>\n\n
https:\/\/app.your-domain.com<\/code> to app-service<\/code> on port 80.<\/li>\napp-tls-secret<\/code> for TLS termination (usually created by cert-manager).<\/li>\n
\n10. Horizontal Pod Autoscaler (HPA) \u2013 Scaling on Load<\/h2>\n
apiVersion: autoscaling\/v2\nkind: HorizontalPodAutoscaler\nmetadata:\n name: app-hpa\n namespace: prod-app\nspec:\n scaleTargetRef:\n apiVersion: apps\/v1\n kind: Deployment\n name: app-deployment\n minReplicas: 3\n maxReplicas: 10\n metrics:\n - type: Resource\n resource:\n name: cpu\n target:\n type: Utilization\n averageUtilization: 60\n<\/code><\/pre>\n\n
app-deployment<\/code> Deployment.<\/li>\n
\n11. PodDisruptionBudget (PDB) \u2013 Protecting Availability<\/h2>\n
apiVersion: policy\/v1\nkind: PodDisruptionBudget\nmetadata:\n name: app-pdb\n namespace: prod-app\nspec:\n minAvailable: 2\n selector:\n matchLabels:\n app: my-app\n<\/code><\/pre>\n\n
\n12. Network Policies \u2013 Zero-Trust Networking<\/h2>\n
Default Deny Policy<\/h3>\n
apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n name: default-deny-all\n namespace: prod-app\nspec:\n podSelector: {}\n policyTypes:\n - Ingress\n - Egress\n<\/code><\/pre>\n\n
Allow Traffic from Ingress Controller to the App<\/h3>\n
apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n name: allow-from-ingress\n namespace: prod-app\nspec:\n podSelector:\n matchLabels:\n app: my-app\n policyTypes:\n - Ingress\n - Egress\n ingress:\n - from:\n - namespaceSelector:\n matchLabels:\n app.kubernetes.io\/name: ingress-nginx\n ports:\n - protocol: TCP\n port: 80\n egress:\n - to:\n - namespaceSelector: {}\n ports:\n - protocol: TCP\n port: 5432\n - protocol: TCP\n port: 443\n<\/code><\/pre>\n\n
ingress-nginx<\/code>) to send HTTP traffic to the app.<\/li>\n
\nApplying Everything<\/h2>\n
k8s\/<\/code> directory, you deploy the entire application stack with:<\/p>\nkubectl apply -f k8s\/\n<\/code><\/pre>\n.tf<\/code> files in a directory.<\/p>\n
\nConclusion<\/h2>\n
\n