Create Administrative Boundaries Between Resources Using Namespaces

# 1. List all namespaces and their age
# Run on: any machine with kubectl access
kubectl get namespaces -o wide

# 2. See which namespaces are actually used by workload objects
kubectl get all --all-namespaces

# 3. Show which namespaces have RoleBindings/ClusterRoleBindings
kubectl get rolebindings,clusterrolebindings --all-namespaces

# 4. Inspect a specific high-usage namespace (example: default)
kubectl get all -n default
kubectl get rolebindings -n default
kubectl describe namespace default

# 5. Correlate namespaces to application ownership using labels
kubectl get namespaces --show-labels

#!/usr/bin/env bash
# Report namespace usage and isolation signals across the cluster.
# Run on: any machine with kubectl access and current context set to target cluster.

set -euo pipefail

echo "== Cluster namespaces =="
kubectl get namespaces -o wide

echo
echo "== Namespaces by label (team/app/environment) =="
# Shows whether namespaces are tagged for ownership and purpose
kubectl get ns \
  -o jsonpath='{range .items[*]}{.metadata.name}{"\t"}{.metadata.labels.team:="(no-team)"}{"\t"}{.metadata.labels.app:="(no-app)"}{"\t"}{.metadata.labels.environment:="(no-env)"}{"\n"}' \
  | column -t

echo
echo "== Workloads per namespace (Deployments, StatefulSets, DaemonSets, Jobs, CronJobs, Pods) =="
for ns in $(kubectl get ns -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}'); do
  echo
  echo "--- Namespace: ${ns} ---"
  kubectl get deploy,sts,ds,job,cronjob,pod -n "${ns}" --ignore-not-found
done

echo
echo "== ClusterRoles and ClusterRoleBindings (cluster-wide permissions) =="
kubectl get clusterrole,clusterrolebinding -o wide

echo
echo "== RoleBindings that bind to ClusterRoles (potential cross-namespace power) =="
kubectl get rolebinding --all-namespaces -o json \
  | jq -r '
    .items[]
    | .metadata.namespace as $ns
    | .metadata.name as $rb
    | .subjects[]? as $s
    | .roleRef
    | select(.kind=="ClusterRole")
    | [$ns, $rb, .name]
    | @tsv' 2>/dev/null \
  | awk 'BEGIN {print "NAMESPACE\tROLEBINDING\tCLUSTERROLE"} {print}' \
  | column -t

echo
echo "== ServiceAccounts used by Pods (by namespace) =="
for ns in $(kubectl get ns -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}'); do
  echo
  echo "--- Namespace: ${ns} ---"
  kubectl get pod -n "${ns}" -o jsonpath='{range .items[*]}{.metadata.name}{"\t"}{.spec.serviceAccountName}{"\n"}' 2>/dev/null \
    | awk 'BEGIN {print "POD\tSERVICEACCOUNT"} {print}' \
    | column -t || true
done

echo
echo "== NetworkPolicies per namespace (is there traffic isolation?) =="
for ns in $(kubectl get ns -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}'); do
  echo
  echo "--- Namespace: ${ns} ---"
  kubectl get networkpolicy -n "${ns}" --ignore-not-found
done

echo
echo "== Namespaces without any NetworkPolicy (potentially fully open) =="
all_ns=$(kubectl get ns -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}')
np_ns=$(kubectl get networkpolicy --all-namespaces -o jsonpath='{range .items[*]}{.metadata.namespace}{"\n"}' | sort -u || true)
echo "${all_ns}" | while read -r ns; do
  if ! echo "${np_ns}" | grep -qx "${ns}"; then
    echo "${ns}"
  fi
done