Outcome
By the end of this lesson, you will be able to navigate the K8s parent-child hierarchy in ZopNight, find any specific workload via filters, and identify what is schedulable (the namespace) and what is not.
| Prerequisites | M2.6.L1 |
| Time | 9 minutes |
1. Concept
Kubernetes workloads appear underneath the cluster they run in, and you drill down the same way every time: the cluster, then the namespace, then the kind of thing, then the thing itself.
A namespace is Kubernetes’ way of dividing one cluster into separate areas, usually one per team or per environment.
EKS cluster├── Namespace: payments│ ├── Deployment: payment-api (3 replicas)│ ├── Deployment: order-service (2 replicas)│ └── CronJob: nightly-cleanup├── Namespace: staging│ ├── Deployment: staging-api (1 replica)│ └── Deployment: staging-worker (2 replicas)└── Namespace: kube-system └── (system workloads; reserved, never schedulable)Each workload is discovered and shown with its own detail and recommendations, but the schedule attaches to the namespace. Stopping a namespace stops every workload inside it; you cannot attach a schedule to one Deployment on its own.
Reaching a specific workload
NAVIGATION FLOW:
1. Open Resources2. Filter type=EKS or GKE or AKS3. Click into a cluster (child count badge shows its children)4. View shows the cluster's namespaces and workloads5. Filter by namespace, kind (deployment/statefulset/cronjob), or name6. To schedule: pick the NAMESPACE and attach a schedule there7. To inspect: click a workload for its detail and recommendations
THREE CLICKS from estate-wide view to a namespace you can scheduleThe hierarchy is predictable; navigation is fast.
What ZopNight discovers per workload
DEPLOYMENT / STATEFULSET: Name, namespace, kind Current replicas, desired replicas Pod template: Container images Resource requests/limits Labels and annotations Status: Available, Progressing, Updated
CRONJOB: Name, namespace Schedule (cron expression in K8s syntax) Last schedule time Active jobs count Suspended (boolean)
JOB (one-time): Name, namespace Completions / Parallelism Start time, completion timeThe discovery runs every 6 hours per cluster, alongside the cluster discovery.
Why namespace matters
NAMESPACE IS THE NATURAL ATTRIBUTION BOUNDARY in K8s
Production / staging / dev separation typically via namespacesFiltering by namespace = quick access to environment-scoped workloads
COMMON NAMESPACE PATTERNS: prod / staging / dev team-platform / team-services / team-data cluster-autoscaler / kube-system (control plane) monitoring / observability
NAMESPACE is the filter that matters most Namespace narrows to environment It is also the unit you attach a schedule toThe natural-attribution-boundary property is why K8s teams use namespaces extensively.
What ZopNight does NOT discover
DISCOVERED, BUT NOT SCHEDULED: Pods, Services and Ingress ConfigMaps / Secrets NetworkPolicies CRDs, PVCs, HPAs, PDBs and more
WHY THEY ARE NOT SCHEDULED: They are config/runtime infrastructure Not workloads that can be scaled to zero Namespace Stop acts on the workloads that run podsThe split is intentional. ZopNight discovers a wide set of K8s object types for inventory and recommendations, but scheduling only ever acts on a namespace’s workloads.
Schedulable vs not-schedulable
SCHEDULABLE: the namespace (eks-, gke-, aks-namespace)
WHAT NAMESPACE STOP DOES TO EACH KIND INSIDE IT: Deployment (replicas to zero; HPA + PDB deleted, saved) StatefulSet (replicas to zero: careful with PV) CronJob (suspend = true) DaemonSet (evicted via a sentinel nodeSelector) KEDA ScaledObject (deleted first, saved, recreated on Start)
NOT SCHEDULABLE: Any single workload on its own (schedule its namespace instead) Reserved namespaces: default, kube-system, kube-public, kube-node-lease, and any name starting kube-, zopnight-, istio-, helm-, gke-managed-, gmp-, gatekeeper-, aks-Start reverses each step from the saved state: replica counts, HPAs, PDBs and DaemonSet node selectors are put back as they were.
Workload status indicators
DEPLOYMENT STATUS: Available: pods are healthy + meeting desired replicas Progressing: deployment is updating ReplicaFailure: replica set having trouble
HEALTH SIGNALS (from drilling down): Restart count (per pod) Last restart time Crashloop detection OOMKilled events
SCHEDULE STATUS: Attached to schedule: yes/no (and which) Currently in active window: yes/no Last action: scale up / scale down / no actionThe status feeds into recommendations (e.g., “deployment is healthy; safe to scale”).
How discovery handles label changes
DISCOVERY EVERY 6 HOURS: Discoverer fetches all workloads + their current labels Refreshes labels and replica counts in ZopNight's record
EFFECT IF YOU ADD OR REMOVE A LABEL: Next discovery: the workload's labels are updated Group membership does NOT change Schedule attachment does NOT change
WHAT CONTROLS SCHEDULING: Schedules are attached explicitly to a namespace, or to a group whose members you added by handLabels are inventory data, not scheduling rules. Changing a label never adds a namespace to a group or attaches a schedule.
Multi-cluster workloads
A SERVICE may run in multiple clusters: prod-eks-us-east-1 prod-eks-eu-west-1 prod-eks-ap-south-1
ZopNight discovers each cluster's instance separately Each has its own workload entry Each cluster's namespace can be scheduled separately
GROUP across clusters: Add each cluster's payments-api namespace to one group by hand Attach the schedule to the group Single schedule applies to all members
SEE L6 (cross-cluster) for the pattern in depthMulti-cluster workloads are common; an explicitly built group handles them.
2. Demo
A typical drill-down:
T+0 Inventory page → filter type=EKS → 6 clustersT+5s Click prod-eks-1 (28 workloads)T+10s Filter namespace=staging (8 workloads)T+12s Filter kind=Deployment (6 deployments)T+15s Click "staging-orders-svc" to check it Replicas: 4 (max 6, configured by HPA) Image: registry.io/orders-svc:1.2.3 Container resources: Requests: 500m CPU, 1 GB RAM Limits: 1000m CPU, 2 GB RAM Status: Available, ProgressingT+18s Back to the staging namespace → Attach Schedule → pick "business-hours-staging"T+25s Schedule attached. All 8 staging workloads, staging-orders-svc included, scale to zero off-hours.
OUTCOME: 25 seconds from estate view to namespace scheduling No complex search; predictable hierarchy Engineer-friendly navigationThe hierarchy makes large estates manageable.
3. Hands-on (5 min)
Navigate to a specific K8s workload:
□ STEP 1: Open Resources; filter type=EKS/GKE/AKS Cluster count: _____
□ STEP 2: Pick one cluster; click in Workload count: _____ Namespaces: _____
□ STEP 3: Filter to non-prod namespace Workloads visible: _____
□ STEP 4: Pick one Deployment Replicas: _____ Resource requests: __________ Its namespace: __________
□ STEP 5: Identify schedulable namespaces in cluster Total namespaces: _____ Schedulable (not reserved, not prod): _____ Already scheduled: _____ Could schedule: _____A 10-minute exercise reveals the hierarchy + schedulable surface.
4. Knowledge check
Q1
A DaemonSet runs in a non-prod namespace. What happens to it when that namespace is scheduled?
A. Its pods are evicted with a sentinel nodeSelector; Start restores it
B. Nothing: DaemonSets are always skipped, since they run one pod per node
C. It is deleted outright and must be redeployed by hand after Start
D. It keeps running until a separate cluster-level schedule stops it
Show answer
Correct: A. Namespace Stop sets the DaemonSet’s nodeSelector to a zopnight.io/disabled sentinel no real node carries, so its pods drain. Start puts the original nodeSelector back. You cannot schedule the DaemonSet on its own; it follows its namespace.
Q2
Filtering K8s workloads by namespace is useful because:
A. Performance
B. Namespace is the natural attribution boundary in K8s: production/staging/dev typically separated by namespace
C. Namespaces map one-to-one onto the cloud accounts, so the filter is really an account-level filter
D. AWS requires
Show answer
Correct: B. Filtering by namespace gives quick access to environment-scoped workloads. Namespace = environment boundary in most K8s setups.
Q3
The number of clicks from estate-wide view to a schedulable namespace:
A. 3 (cluster → namespace → attach schedule)
B. More than ten separate clicks in the UI
C. 5
D. 7
Show answer
Correct: A. The hierarchy is predictable and navigation is fast: cluster, then namespace, then Attach Schedule.
5. Apply
K8s workload navigation is in Inventory page → filter type=EKS/GKE/AKS → drill into cluster.
For your team: navigate to a non-prod namespace and attach a schedule; build the muscle memory.
Related lessons
- L1: Why K8s is hard
- L3: Deployment to zero (next)
- L4: Suspend cronjobs
- L5: StatefulSets
- L6: Cross-cluster patterns