A Namespace is a logical partition within a cluster used to divide resources between multiple users, teams, or environments and to enforce a scope for names and policies. When a resource is created without specifying a namespace, it is placed in the default namespace named default. Most workload and configuration resources are namespaced, including Pods, Services, Deployments, ConfigMaps, Secrets, and Jobs, while Nodes and PersistentVolumes are cluster-scoped. Namespaces can be bounded by ResourceQuota objects, which constrain aggregate resource consumption such as CPU, memory, and object counts, and by LimitRange objects, which enforce minimum, maximum, default requests, and default limits for individual containers or Pods within the namespace.
Configuration data is decoupled from Pod manifests through ConfigMaps and Secrets. A ConfigMap stores non-confidential key-value pairs that can be mounted into Pods as files or exposed as environment variables. A Secret is the equivalent for sensitive material such as passwords, tokens, or keys, base64-encoded and mountable in the same ways, with optional encryption at rest. The key distinction is that Secrets are intended for confidential data and may be encrypted at rest and exposed only on demand, while ConfigMaps hold plain, non-sensitive configuration.
Durable storage is modeled through PersistentVolumes (PVs), PersistentVolumeClaims (PVCs), and StorageClasses. A PersistentVolume is a piece of storage in the cluster provisioned by an administrator or dynamically by a StorageClass, and it represents a cluster-scoped resource. A PersistentVolumeClaim is a user's request for storage, consuming a PV that matches its requested size, access mode, and storage class. PVs support the access modes ReadWriteOnce (RWO), ReadOnlyMany (ROX), ReadWriteMany (RWX), ReadWriteOncePod (RWOP, Kubernetes 1.22+), and the deprecated WriteOnce. A StorageClass describes the classes of storage offered by the cluster, defining the provisioner, parameters, and reclaim policy. The reclaimPolicy field controls what happens to a PV after its PVC is deleted: Retain, Recycle (deprecated), or Delete.
In the Pod context, a Volume is a directory accessible to the containers in a Pod, with a lifetime tied to the Pod unless backed by a PV. Common volume types include emptyDir, which is created when a Pod is scheduled and exists only as long as the Pod runs on the node's local medium; hostPath, which mounts a file or directory from the host filesystem and is suitable only for system-level or single-node development use; configMap, secret, and persistentVolumeClaim; and infrastructure-specific types such as nfs, awsElasticBlockStore, gcePersistentDisk, azureDisk, and csi.