Skip to main content

Kubernetes Namespace-Level vs. Global Cluster-Level Objects

This is a complete breakdown of Kubernetes objects categorized by their scope: Namespace-level (bound to a specific namespace) vs. Cluster-level (global objects shared across the entire cluster).

The Golden Rule​

If you ever need to check this on your own cluster, run these commands:

  • List all Namespace-level objects: kubectl api-resources --namespaced=true

  • List all Global-level objects: kubectl api-resources --namespaced=false

Cluster-Level Objects (Global)​

These objects exist everywhere. They are not contained inside any namespace and often represent physical infrastructure or cluster-wide policies.

CategoryObject NameDescriptionArchitectureNodesThe physical or virtual machines that run your workloads.NamespacesThe "folders" themselves are global objects (you cannot put a namespace inside a namespace).StoragePersistentVolumes (PV)**The actual storage resource (disk/SSD). Note that the claim (PVC) is namespaced, but the volume (PV) is global.StorageClassesDefines the "profiles" of storage available (e.g., standard, ssd, gold).CSIDrivers / CSINodesDrivers and node mappings for Container Storage Interfaces.**Access & AuthClusterRolesPermissions defined globally (e.g., "read-only access to all pods in all namespaces").ClusterRoleBindingsGrants a ClusterRole to a user or group across the entire cluster.Policy & Config****PriorityClassesDefines scheduling importance (e.g., system-critical vs. low-priority).RuntimeClassesDefines different container runtimes (e.g., gVisor, Kata Containers).IngressClassesDefines different Ingress controllers available to the cluster.**Extensions****CustomResourceDefinitions (CRDs)**The definition of a new custom object (e.g., PrometheusRule). Once defined, the instances of that object can be namespaced.Mutating/Validating WebhookConfigurationsRules for intercepting API requests cluster-wide.

Namespace-Level Objects (Local)​

These objects must live inside a specific namespace (e.g., default, kube-system). If you delete the namespace, these objects are deleted with it.

CategoryObject NameDescriptionWorkloadsPodsThe smallest deployable unit.DeploymentsManages stateless apps.StatefulSetsManages stateful apps (databases).DaemonSetsRuns one pod per node.Jobs / CronJobsBatch tasks and scheduled tasks.ReplicaSets / ReplicationControllersEnsures a specified number of pod replicas are running.Networking****ServicesStable IP/DNS for a set of Pods.IngressesHTTP/HTTPS routing rules.NetworkPoliciesFirewalls rules for Pod communication.Endpoints / EndpointSlicesThe list of IP addresses a Service targets.Config & Storage****ConfigMapsNon-sensitive configuration data.SecretsSensitive data (passwords, keys).**PersistentVolumeClaims (PVC)**A request for storage. (Links a Namespaced Pod to a Global PV).ServiceAccountsIdentity for processes running in a Pod.Access & Policy****RolesPermissions limited to a single namespace.RoleBindingsGrants a Role to a user within that specific namespace.ResourceQuotasLimits total resource usage (CPU/RAM) in a namespace.LimitRangesLimits resource usage per Pod/Container in a namespace.PodDisruptionBudgetsLimits how many pods can be down simultaneously during maintenance.Other****EventsLogs of state changes (e.g., "Pod scheduled", "Pull failed").LeasesUsed by controllers for leader election.

Common Confusion Points​

  • PV vs. PVC:

  • PV (Global): Represents the physical hard drive. It belongs to the cluster.

  • PVC (Namespaced): Represents a user's ticket to use that hard drive. It belongs to a specific app in a namespace.

  • Role vs. ClusterRole:

  • Role (Namespaced): "Can read pods in this namespace."

  • ClusterRole (Global): "Can read pods in all namespaces."