The Default Namespace Should Not Be Used

kubectl get all -n default
kubectl get configmap,secret,sa,role,rolebinding,networkpolicy -n default

cat << 'EOF' > namespaces.yaml
apiVersion: v1
kind: Namespace
metadata:
  name: team-a
---
apiVersion: v1
kind: Namespace
metadata:
  name: platform
EOF

kubectl apply -f namespaces.yaml

kubectl get deploy my-app -n default -o yaml > my-app-deploy.yaml
kubectl get svc my-app -n default -o yaml > my-app-svc.yaml

kubectl apply -f my-app-deploy.yaml
kubectl apply -f my-app-svc.yaml

# Delete non-kubernetes services in default
kubectl get svc -n default --no-headers | awk '$1 != "kubernetes" {print $1}' | \
  xargs -r kubectl delete svc -n default

# Delete deployments, replicasets, pods, jobs, cronjobs, daemonsets, statefulsets
kubectl delete deploy,rs,pod,job,cronjob,ds,sts --all -n default

# Optionally clean up non-system configmaps/secrets/serviceaccounts, after review:
kubectl delete configmap --all -n default
kubectl delete secret --all -n default
kubectl delete sa --all -n default
kubectl delete role,rolebinding,networkpolicy --all -n default

output=$(kubectl get all -n default --no-headers 2>/dev/null | grep -v '^service\s\+kubernetes\s' || true)
if [ -z "$output" ]; then echo "DEFAULT_NAMESPACE_UNUSED"; else echo "DEFAULT_NAMESPACE_IN_USE"; fi

#!/usr/bin/env bash
set -euo pipefail

# This script requires:
# - kubectl configured and authorized
# - jq and kubectl-neat (optional but recommended for cleaner manifests)

# CONFIGURATION: map old namespace "default" -> new target namespaces by label selector
# Each entry: "label_selector:new_namespace"
# Example: move all pods with app=web to namespace web, etc.
# Adjust to your environment and policies.
MAPPINGS=(
  "app=web:web"
  "app=api:api"
)

# Helper: ensure a namespace exists
ensure_namespace() {
  local ns="$1"
  if ! kubectl get namespace "${ns}" >/dev/null 2>&1; then
    kubectl create namespace "${ns}"
  fi
}

# Helper: move namespaced resources from default to a given namespace based on label selector
migrate_resources() {
  local selector="$1"
  local target_ns="$2"

  ensure_namespace "${target_ns}"

  # List all resource types that are namespaced
  local types
  types=$(kubectl api-resources --namespaced=true --verbs=list -o name)

  for t in $types; do
    # Skip resources that shouldn't be moved generically
    case "$t" in
      events.k8s.io/*|events|leases.coordination.k8s.io|leases.coordination.k8s.io/*) continue ;;
    esac

    # Get resources in default matching selector
    local names
    names=$(kubectl get "$t" -n default -l "${selector}" -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}' 2>/dev/null || true)
    [ -z "$names" ] && continue

    for name in $names; do
      # Export resource manifest
      if command -v kubectl-neat >/dev/null 2>&1; then
        manifest=$(kubectl get "$t" "$name" -n default -o yaml | kubectl-neat)
      else
        manifest=$(kubectl get "$t" "$name" -n default -o yaml)
      fi

      # Patch namespace and remove fields that prevent re-create
      cleaned=$(printf '%s\n' "$manifest" \
        | sed -E '/^(status:|metadata:)/,/^[^ ]/!b' \
        | sed -E '/^  (creationTimestamp|resourceVersion|uid|selfLink|generation|managedFields|ownerReferences):/d' \
        | sed -E 's/namespace: default/namespace: '"${target_ns}"'/' )

      # Apply in target namespace and delete original
      printf '%s\n' "$cleaned" | kubectl apply -f -
      kubectl delete "$t" "$name" -n default --ignore-not-found
    done
  done
}

# MAIN

# 1. Migrate resources from default namespace according to mappings
for entry in "${MAPPINGS[@]}"; do
  IFS=":" read -r selector ns <<<"$entry"
  migrate_resources "$selector" "$ns"
done

# 2. Final verification: ensure default namespace has no workload resources
output=$(kubectl get all -n default --no-headers 2>/dev/null | grep -v '^service\s\+kubernetes\s' || true)

if [ -z "$output" ]; then
  echo "DEFAULT_NAMESPACE_UNUSED"
else
  echo "DEFAULT_NAMESPACE_IN_USE"
  echo "The following resources remain in the default namespace:"
  echo "$output"
  echo "Review and decide manually where each should be moved, then re-run this script after updating MAPPINGS."
fi