Lesson 04 Namespaces & Labels
Theme:

Lab Guide: Namespaces & Labels

Three hands-on exercises covering namespace isolation, standard labels, and resource quotas in Helm charts

Prerequisites

A running Kubernetes cluster (minikube, kind, or k3d), Helm 3 installed, and kubectl configured. All exercises use a chart scaffolded with helm create.

Exercise 1 — Namespace-Aware Deployment

In this exercise you will create a chart, deploy it into a dedicated namespace, and verify that namespace isolation works correctly.

Step 1 — Scaffold a new chart

helm create lab04-ns
cd lab04-ns

Step 2 — Install into a new namespace

helm install lab04 . -n lab04-staging --create-namespace

✓ Expected Output:

NAME: lab04
NAMESPACE: lab04-staging
STATUS: deployed
REVISION: 1

Step 3 — Verify the namespace was created and resources landed there

kubectl get namespaces | grep lab04
kubectl get all -n lab04-staging

✓ Expected Output:

lab04-staging     Active   <age>

NAME                                  READY   STATUS    RESTARTS   AGE
pod/lab04-lab04-ns-xxxxxxxxxx-xxxxx   1/1     Running   0          30s

NAME                     TYPE        CLUSTER-IP     EXTERNAL-IP   PORT(S)   AGE
service/lab04-lab04-ns   ClusterIP   10.x.x.x      <none>        80/TCP    30s

NAME                             READY   UP-TO-DATE   AVAILABLE   AGE
deployment.apps/lab04-lab04-ns   1/1     1            1           30s

Step 4 — Confirm the resource does not appear in the default namespace

kubectl get deployment lab04-lab04-ns -n default 2>&1

✓ Expected Output:

Error from server (NotFound): deployments.apps "lab04-lab04-ns" not found

✓ Checkpoint: You have deployed a chart into an isolated namespace and confirmed that resources are scoped to that namespace only.

Exercise 2 — Standard Labels & Selectors

You will inspect the default labels that helm create generates, add a custom label, and use label selectors to query resources.

Step 1 — Inspect the labels on the deployed pod

kubectl get pods -n lab04-staging --show-labels

✓ Expected Output (labels column):

app.kubernetes.io/instance=lab04,app.kubernetes.io/managed-by=Helm,
app.kubernetes.io/name=lab04-ns,app.kubernetes.io/version=1.16.0,
helm.sh/chart=lab04-ns-0.1.0,pod-template-hash=xxxxxxxxxx

Step 2 — Add a custom label to _helpers.tpl

Open templates/_helpers.tpl and find the mychart.labels definition (it will be named lab04-ns.labels). Add a custom label:

{{- define "lab04-ns.labels" -}}
helm.sh/chart: {{ include "lab04-ns.chart" . }}
{{ include "lab04-ns.selectorLabels" . }}
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
app.kubernetes.io/managed-by: {{ .Release.Service }}
team: backend
{{- end }}

Step 3 — Upgrade the release and verify

helm upgrade lab04 . -n lab04-staging
kubectl get pods -n lab04-staging -l team=backend

✓ Expected Output:

NAME                              READY   STATUS    RESTARTS   AGE
lab04-lab04-ns-xxxxxxxxxx-xxxxx   1/1     Running   0          10s

Step 4 — Use a label selector to filter across resources

# Find all resources managed by Helm in this namespace
kubectl get all -n lab04-staging -l app.kubernetes.io/managed-by=Helm

✓ Checkpoint: You can add custom labels via _helpers.tpl and query resources using label selectors.

Exercise 3 — Resource Quotas via Helm

You will add a ResourceQuota template to the chart and observe how Kubernetes enforces it.

Step 1 — Create the ResourceQuota template

Create templates/resourcequota.yaml:

{{- if .Values.resourceQuota.enabled }}
apiVersion: v1
kind: ResourceQuota
metadata:
  name: {{ .Release.Name }}-quota
  labels:
    {{- include "lab04-ns.labels" . | nindent 4 }}
spec:
  hard:
    requests.cpu: {{ .Values.resourceQuota.cpu | quote }}
    requests.memory: {{ .Values.resourceQuota.memory | quote }}
    pods: {{ .Values.resourceQuota.pods | quote }}
{{- end }}

Step 2 — Add default values

Add the following to values.yaml:

resourceQuota:
  enabled: false
  cpu: "2"
  memory: "2Gi"
  pods: "10"

Step 3 — Deploy with the quota enabled

helm upgrade lab04 . -n lab04-staging --set resourceQuota.enabled=true

Step 4 — Verify the quota is in place

kubectl get resourcequota -n lab04-staging
kubectl describe resourcequota lab04-quota -n lab04-staging

✓ Expected Output:

Name:            lab04-quota
Namespace:       lab04-staging
Resource         Used    Hard
--------         ----    ----
pods             1       10
requests.cpu     100m    2
requests.memory  128Mi   2Gi

Step 5 — Test the quota limit

Try scaling the deployment beyond the pod quota:

helm upgrade lab04 . -n lab04-staging \
  --set resourceQuota.enabled=true \
  --set resourceQuota.pods="1" \
  --set replicaCount=3
kubectl get events -n lab04-staging --sort-by='.lastTimestamp' | tail -5

✓ Expected Output (events):

... forbidden: exceeded quota: lab04-quota, requested: pods=1, used: pods=1, limited: pods=1

✓ Checkpoint: The ResourceQuota prevented additional pods from being scheduled. Your namespace-level governance is working.

Cleanup

helm uninstall lab04 -n lab04-staging
kubectl delete namespace lab04-staging

Next

In Lesson 05, you will learn how to manage ServiceAccounts and RBAC within Helm charts to control what your workloads are allowed to do.