Skip to main content
Your progress
0 of 7 complete0%
T2 / M2.6 / L2 OF 6 / Engineer LEVEL / 9 min

Cluster → namespace → workload hierarchy

Outcome

By the end of this lesson, you will be able to navigate the K8s parent-child hierarchy in ZopNight, find any specific workload via filters, and identify what is schedulable (the namespace) and what is not.


PrerequisitesM2.6.L1
Time9 minutes

1. Concept

Kubernetes workloads appear underneath the cluster they run in, and you drill down the same way every time: the cluster, then the namespace, then the kind of thing, then the thing itself.

A namespace is Kubernetes’ way of dividing one cluster into separate areas, usually one per team or per environment.

Terminal window
EKS cluster
├── Namespace: payments
│ ├── Deployment: payment-api (3 replicas)
│ ├── Deployment: order-service (2 replicas)
│ └── CronJob: nightly-cleanup
├── Namespace: staging
│ ├── Deployment: staging-api (1 replica)
│ └── Deployment: staging-worker (2 replicas)
└── Namespace: kube-system
└── (system workloads; reserved, never schedulable)

Each workload is discovered and shown with its own detail and recommendations, but the schedule attaches to the namespace. Stopping a namespace stops every workload inside it; you cannot attach a schedule to one Deployment on its own.

Reaching a specific workload

Terminal window
NAVIGATION FLOW:
1. Open Resources
2. Filter type=EKS or GKE or AKS
3. Click into a cluster (child count badge shows its children)
4. View shows the cluster's namespaces and workloads
5. Filter by namespace, kind (deployment/statefulset/cronjob), or name
6. To schedule: pick the NAMESPACE and attach a schedule there
7. To inspect: click a workload for its detail and recommendations
THREE CLICKS from estate-wide view to a namespace you can schedule

The hierarchy is predictable; navigation is fast.

What ZopNight discovers per workload

Terminal window
DEPLOYMENT / STATEFULSET:
Name, namespace, kind
Current replicas, desired replicas
Pod template:
Container images
Resource requests/limits
Labels and annotations
Status: Available, Progressing, Updated
CRONJOB:
Name, namespace
Schedule (cron expression in K8s syntax)
Last schedule time
Active jobs count
Suspended (boolean)
JOB (one-time):
Name, namespace
Completions / Parallelism
Start time, completion time

The discovery runs every 6 hours per cluster, alongside the cluster discovery.

Why namespace matters

Terminal window
NAMESPACE IS THE NATURAL ATTRIBUTION BOUNDARY in K8s
Production / staging / dev separation typically via namespaces
Filtering by namespace = quick access to environment-scoped workloads
COMMON NAMESPACE PATTERNS:
prod / staging / dev
team-platform / team-services / team-data
cluster-autoscaler / kube-system (control plane)
monitoring / observability
NAMESPACE is the filter that matters most
Namespace narrows to environment
It is also the unit you attach a schedule to

The natural-attribution-boundary property is why K8s teams use namespaces extensively.

What ZopNight does NOT discover

Terminal window
DISCOVERED, BUT NOT SCHEDULED:
Pods, Services and Ingress
ConfigMaps / Secrets
NetworkPolicies
CRDs, PVCs, HPAs, PDBs and more
WHY THEY ARE NOT SCHEDULED:
They are config/runtime infrastructure
Not workloads that can be scaled to zero
Namespace Stop acts on the workloads that run pods

The split is intentional. ZopNight discovers a wide set of K8s object types for inventory and recommendations, but scheduling only ever acts on a namespace’s workloads.

Schedulable vs not-schedulable

Terminal window
SCHEDULABLE: the namespace (eks-, gke-, aks-namespace)
WHAT NAMESPACE STOP DOES TO EACH KIND INSIDE IT:
Deployment (replicas to zero; HPA + PDB deleted, saved)
StatefulSet (replicas to zero: careful with PV)
CronJob (suspend = true)
DaemonSet (evicted via a sentinel nodeSelector)
KEDA ScaledObject (deleted first, saved, recreated on Start)
NOT SCHEDULABLE:
Any single workload on its own (schedule its namespace instead)
Reserved namespaces: default, kube-system, kube-public,
kube-node-lease, and any name starting kube-, zopnight-,
istio-, helm-, gke-managed-, gmp-, gatekeeper-, aks-

Start reverses each step from the saved state: replica counts, HPAs, PDBs and DaemonSet node selectors are put back as they were.

Workload status indicators

Terminal window
DEPLOYMENT STATUS:
Available: pods are healthy + meeting desired replicas
Progressing: deployment is updating
ReplicaFailure: replica set having trouble
HEALTH SIGNALS (from drilling down):
Restart count (per pod)
Last restart time
Crashloop detection
OOMKilled events
SCHEDULE STATUS:
Attached to schedule: yes/no (and which)
Currently in active window: yes/no
Last action: scale up / scale down / no action

The status feeds into recommendations (e.g., “deployment is healthy; safe to scale”).

How discovery handles label changes

Terminal window
DISCOVERY EVERY 6 HOURS:
Discoverer fetches all workloads + their current labels
Refreshes labels and replica counts in ZopNight's record
EFFECT IF YOU ADD OR REMOVE A LABEL:
Next discovery: the workload's labels are updated
Group membership does NOT change
Schedule attachment does NOT change
WHAT CONTROLS SCHEDULING:
Schedules are attached explicitly to a namespace,
or to a group whose members you added by hand

Labels are inventory data, not scheduling rules. Changing a label never adds a namespace to a group or attaches a schedule.

Multi-cluster workloads

Terminal window
A SERVICE may run in multiple clusters:
prod-eks-us-east-1
prod-eks-eu-west-1
prod-eks-ap-south-1
ZopNight discovers each cluster's instance separately
Each has its own workload entry
Each cluster's namespace can be scheduled separately
GROUP across clusters:
Add each cluster's payments-api namespace to one group by hand
Attach the schedule to the group
Single schedule applies to all members
SEE L6 (cross-cluster) for the pattern in depth

Multi-cluster workloads are common; an explicitly built group handles them.


2. Demo

A typical drill-down:

Terminal window
T+0 Inventory page → filter type=EKS → 6 clusters
T+5s Click prod-eks-1 (28 workloads)
T+10s Filter namespace=staging (8 workloads)
T+12s Filter kind=Deployment (6 deployments)
T+15s Click "staging-orders-svc" to check it
Replicas: 4 (max 6, configured by HPA)
Image: registry.io/orders-svc:1.2.3
Container resources:
Requests: 500m CPU, 1 GB RAM
Limits: 1000m CPU, 2 GB RAM
Status: Available, Progressing
T+18s Back to the staging namespace → Attach Schedule
→ pick "business-hours-staging"
T+25s Schedule attached. All 8 staging workloads,
staging-orders-svc included, scale to zero off-hours.
OUTCOME:
25 seconds from estate view to namespace scheduling
No complex search; predictable hierarchy
Engineer-friendly navigation

The hierarchy makes large estates manageable.


3. Hands-on (5 min)

Navigate to a specific K8s workload:

Terminal window
□ STEP 1: Open Resources; filter type=EKS/GKE/AKS
Cluster count: _____
□ STEP 2: Pick one cluster; click in
Workload count: _____
Namespaces: _____
□ STEP 3: Filter to non-prod namespace
Workloads visible: _____
□ STEP 4: Pick one Deployment
Replicas: _____
Resource requests: __________
Its namespace: __________
□ STEP 5: Identify schedulable namespaces in cluster
Total namespaces: _____
Schedulable (not reserved, not prod): _____
Already scheduled: _____
Could schedule: _____

A 10-minute exercise reveals the hierarchy + schedulable surface.


4. Knowledge check

Q1

A DaemonSet runs in a non-prod namespace. What happens to it when that namespace is scheduled?

A. Its pods are evicted with a sentinel nodeSelector; Start restores it
B. Nothing: DaemonSets are always skipped, since they run one pod per node
C. It is deleted outright and must be redeployed by hand after Start
D. It keeps running until a separate cluster-level schedule stops it

Show answer

Correct: A. Namespace Stop sets the DaemonSet’s nodeSelector to a zopnight.io/disabled sentinel no real node carries, so its pods drain. Start puts the original nodeSelector back. You cannot schedule the DaemonSet on its own; it follows its namespace.

Q2

Filtering K8s workloads by namespace is useful because:

A. Performance
B. Namespace is the natural attribution boundary in K8s: production/staging/dev typically separated by namespace
C. Namespaces map one-to-one onto the cloud accounts, so the filter is really an account-level filter
D. AWS requires

Show answer

Correct: B. Filtering by namespace gives quick access to environment-scoped workloads. Namespace = environment boundary in most K8s setups.

Q3

The number of clicks from estate-wide view to a schedulable namespace:

A. 3 (cluster → namespace → attach schedule)
B. More than ten separate clicks in the UI
C. 5
D. 7

Show answer

Correct: A. The hierarchy is predictable and navigation is fast: cluster, then namespace, then Attach Schedule.


5. Apply

K8s workload navigation is in Inventory page → filter type=EKS/GKE/AKS → drill into cluster.

For your team: navigate to a non-prod namespace and attach a schedule; build the muscle memory.


Glossary terms touched

Namespace boundary


Start with the bill.

Foundations takes about five hours. The first lesson is nine minutes.

Free curriculum. No paywall. 290 lessons across 7 courses, plus an optional 24-lesson beginner course. Browse every course without an account; a free account opens the lessons, saves your progress and opens the exams for three publicly verifiable credentials. Read it on the train, take the exam on a Saturday, list the credential on your résumé Monday.

5h median time to finish Foundations
free account, every course, no paywall
3 certifications, each with a public verifier
Multi-cloud automation· Production-ready in 30 min· SOC 2 · ISO 27001· 20–60% off the bill, first month· 4 platforms · 1 console· Multi-cloud automation· Production-ready in 30 min· SOC 2 · ISO 27001· 20–60% off the bill, first month· 4 platforms · 1 console·