KEP-5708: Add namespace role label support for sig-network#5948
KEP-5708: Add namespace role label support for sig-network#5948maifeeulasad wants to merge 1 commit intokubernetes:masterfrom
Conversation
maifeeulasad
commented
Mar 6, 2026
maifeeulasad
commented
- One-line PR description: Add namespace role label support for sig-network
- Issue link: Standard label to identify "system" vs "user" namespaces #5708
- Other comments: Open for upcoming reviews.
k8s-ci-robot
added
the
cncf-cla: yes
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: maifeeulasad The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
Welcome @maifeeulasad! |
k8s-ci-robot
added
kind/kep
|
Hi @maifeeulasad. Thanks for your PR. I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with Regular contributors should join the org to skip this step. Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
k8s-ci-robot
added
the
sig/network
k8s-ci-robot
added
the
size/L
|
|
||
| ## Proposal | ||
|
|
||
| Add the label `kubernetes.io/namespace-role=system` to system namespaces when they are created by the system namespaces controller. |
There was a problem hiding this comment.
How about later reconciliation if those labels are found missing?
| - 2026-03-07: Initial KEP created | ||
|
|
||
| ## Alternatives | ||
|
|
There was a problem hiding this comment.
We could reconcile rather than only labelling on create.
|
|
||
| | Risk | Mitigation | | ||
| |------|------------| | ||
| | Existing namespaces won't have the label | Document that label only applies to newly created system namespaces; provide migration guidance | |
There was a problem hiding this comment.
Why not reconcile? Only labelling new namespaces makes the label something that you can't rely on finding.
|
|
||
| - Define additional role values beyond `system` (future KEP) | ||
| - Automatically label user-created namespaces | ||
| - Change existing namespace admission or validation |
There was a problem hiding this comment.
Why? It could be really useful (eg: warning people if they set that label on a non-system namespace).
| ### Goals | ||
|
|
||
| - Define a standard label key `kubernetes.io/namespace-role` for namespace classification | ||
| - Automatically label system namespaces (`kube-system`, `kube-public`, `default`) with `kubernetes.io/namespace-role=system` |
There was a problem hiding this comment.
default is not a system namespace. However, it does count as a special case.
|
|
||
| ## Summary | ||
|
|
||
| Introduce a standard label `kubernetes.io/namespace-role` to distinguish "system" namespaces (e.g., `kube-system`, `kube-public`, `default`) from "user" namespaces. This enables distribution-independent policy targeting, particularly for ClusterNetworkPolicy. |
There was a problem hiding this comment.
This is not the accepted definition of system namespaces.
|
/ok-to-test |
k8s-ci-robot
added
ok-to-test
3 participants
