No Workloads Should Run In The default Namespace

kubectl get all -n default

# Export existing manifest
kubectl get deployment my-app -n default -o yaml > my-app-deploy.yaml

# Edit the manifest: in metadata, set
#   namespace: my-tenant-namespace
# If no namespace field exists under metadata, add:
#   namespace: my-tenant-namespace
#
# Also review and update any other namespaced references (ConfigMaps, Services, RBAC, etc.)

kubectl create namespace my-tenant-namespace

kubectl apply -f my-app-deploy.yaml

# Deployments
kubectl delete deployment my-app -n default

# StatefulSets
kubectl delete statefulset my-stateful-app -n default

# DaemonSets
kubectl delete daemonset my-daemon -n default

# CronJobs
kubectl delete cronjob my-cronjob -n default

# Jobs (if still present)
kubectl delete job my-job -n default

# Services, ConfigMaps, Secrets, etc., that were only for these workloads
kubectl delete service my-app -n default
kubectl delete configmap my-app-config -n default
kubectl delete secret my-app-secret -n default

kubectl get pods -n default

#!/usr/bin/env bash
set -euo pipefail

# This script:
# - Finds all workload resources (Pods, Deployments, ReplicaSets, StatefulSets,
#   DaemonSets, Jobs, CronJobs) in the "default" namespace.
# - For each, creates a copy in a target namespace and deletes the original.
# - Verifies that the "default" namespace has no Pods remaining.
#
# REQUIREMENTS:
# - Run on any machine with kubectl access and permissions to list/get/create/delete
#   resources cluster-wide.
# - kubectl must be configured to point at the target GKE cluster.
#
# USAGE:
#   ./move-default-workloads.sh <target-namespace>
#
# The target namespace MUST exist beforehand and be prepared with appropriate
# RBAC, ResourceQuotas, and NetworkPolicies.

if [[ $# -ne 1 ]]; then
  echo "Usage: $0 <target-namespace>" >&2
  exit 1
fi

TARGET_NS="$1"

echo "==> Verifying target namespace '${TARGET_NS}' exists"
if ! kubectl get namespace "${TARGET_NS}" >/dev/null 2>&1; then
  echo "ERROR: target namespace '${TARGET_NS}' does not exist." >&2
  echo "Create it first, for example:" >&2
  echo "  kubectl create namespace ${TARGET_NS}" >&2
  exit 1
fi

echo "==> Checking for workloads in the 'default' namespace"
# If there are no pods, we consider the check already compliant and exit early.
POD_COUNT="$(kubectl get pods -n default --no-headers 2>/dev/null | wc -l | tr -d ' ')"
if [[ "${POD_COUNT}" -eq 0 ]]; then
  echo "No pods found in 'default' namespace. Nothing to move."
  echo "Cluster is already compliant with respect to this control."
  exit 0
fi

echo "Workloads found in 'default' namespace. Beginning migration to '${TARGET_NS}'."

# Resource types to migrate.
# These cover the common workload controllers; adjust if you use additional kinds.
RESOURCE_KINDS=(
  "deployment.apps"
  "replicaset.apps"
  "statefulset.apps"
  "daemonset.apps"
  "job.batch"
  "cronjob.batch"
  "pod"          # standalone pods not managed by controllers
)

for KIND in "${RESOURCE_KINDS[@]}"; do
  echo "==> Processing kind: ${KIND}"
  # List resource names; ignore "No resources found" errors.
  MAPFILE -t RESOURCES < <(kubectl get "${KIND}" -n default -o name 2>/dev/null || true)
  if [[ "${#RESOURCES[@]}" -eq 0 ]]; then
    echo "  No ${KIND} resources in 'default' namespace."
    continue
  fi

  for RES in "${RESOURCES[@]}"; do
    NAME="${RES#*/}" # strip the kind prefix, e.g. deployment.apps/my-deploy -> my-deploy

    echo "  -> Migrating ${KIND} '${NAME}' from 'default' to '${TARGET_NS}'"

    # Check if it already exists in the target namespace (idempotency).
    if kubectl get "${KIND}" -n "${TARGET_NS}" "${NAME}" >/dev/null 2>&1; then
      echo "     Target '${KIND}/${NAME}' already exists in '${TARGET_NS}'."
      echo "     Skipping creation; will only ensure original is removed."
    else
      # Export the object from 'default', adjust namespace, and recreate in target namespace.
      # Strip fields that should not be migrated (status, resourceVersion, uid, etc.).
      echo "     Creating '${KIND}/${NAME}' in '${TARGET_NS}'"
      kubectl get "${KIND}" -n default "${NAME}" -o json \
      | jq '
          del(
            .metadata.uid,
            .metadata.resourceVersion,
            .metadata.selfLink,
            .metadata.creationTimestamp,
            .metadata.generation,
            .metadata.annotations."kubectl.kubernetes.io/last-applied-configuration",
            .status
          )
          | .metadata.namespace = "'"${TARGET_NS}"'"
        ' \
      | kubectl apply -f -
    fi

    # Delete original from default namespace (idempotent: delete succeeds even if already gone).
    echo "     Deleting original '${KIND}/${NAME}' from 'default'"
    kubectl delete "${KIND}" -n default "${NAME}" --ignore-not-found=true
  done
done

echo "==> Waiting for any terminating pods in 'default' to fully disappear"
# Wait loop: break when no pods remain.
for i in {1..30}; do
  REMAINING="$(kubectl get pods -n default --no-headers 2>/dev/null | wc -l | tr -d ' ')"
  if [[ "${REMAINING}" -eq 0 ]]; then
    break
  fi
  echo "  ${REMAINING} pod(s) still present in 'default'; rechecking in 10s..."
  sleep 10
done

echo "==> Final verification (matches benchmark audit style)"
{ kubectl get pods -n default -o json
  kubectl get namespace default -o json
} | jq -rs '
  .[0] as $pods | .[1] |
  .metadata as $m
  | (($m.labels // {}) | to_entries | map("\(.key):\(.value)") | join(",")) as $labels
  | (($pods.items // []) | length) as $count
  | "kind=Namespace name=default uid=\($m.uid) apiVersion=v1"
    + (if ($m.creationTimestamp // "") == "" then "" else " created=\($m.creationTimestamp)" end)
    + (if $labels == "" then "" else " labels=\($labels)" end)
    + " podCount=\($count)"
    + " is_compliant=\(if $count == 0 then "true" else "false" end)"'

echo "==> Migration complete."