Keyboard shortcuts

Press ← or → to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

Warning

This page was translated from the original Japanese version by PLaMo Translate. The Japanese version is authoritative; the English translation may contain inaccuracies.

Logical Cluster Division Using Namespaces

Kubernetes enables the creation of multiple workspaces by defining Namespace resources, allowing independent management of resources within each workspace. This feature proves particularly useful when operating environments with different access permissions or network connectivity requirements, such as development and production environments, or when multiple teams need to share resources.

PFCP provides functionality for creating Namespace resources. However, because PFCP’s Kubernetes clusters are configured as multi-tenant environments, there are the following constraints on Namespace resource creation that differ from standard Kubernetes clusters:

Warning

Namespace Constraints

  • Each organization is automatically provisioned with one Namespace resource as its root namespace.
  • Additional Namespace resources must be created as subordinate subnamespaces1 under this root namespace.
  • The resource name for the root namespace is org-<organization-name>.
  • For subnamespaces, the resource name must start with the prefix org-<organization-name>--.
  • The root namespace is pre-created across all PFCP clusters and cannot be deleted.
  • Subnamespaces must be created individually for each PFCP cluster and can be deleted.
  • Direct creation of Namespace resources using tools like kubectl is not allowed.2
  • You cannot create subnamespaces that themselves contain further subnamespaces (grandchild namespaces).

Below we explain how to manage subnamespaces.

Creating Subnamespaces

Follow these steps to create a subnamespace:

  1. Access the Namespaces page in the portal.
  2. Open the Create Namespace interface.
  3. Enter the Cluster Name, Namespace Name, and an optional description.
  4. If you do not want communication from other Namespaces within your organization to be permitted, check the optional2 box.
  5. Click the Create button to initiate the subnamespace creation process.

Once created, the subnamespace can be used as a standard Namespace resource.

# Example: After creating a subnamespace `org-<organization-name>--foo`
$ kubectl get all -n org-<organization-name>--foo
No resources found in org-<organization-name>--foo namespace.

Organization administrators are automatically granted org-admin role permissions for the subnamespaces they create. Regular users do not receive automatic permissions for subnamespaces; you must create a RoleBinding to assign them permissions. For details on RoleBindings, see Permission Configuration.

Modifying Subnamespaces

  1. Access the Namespaces page in the portal.
  2. Open the modification interface for the subnamespace you wish to change and make your adjustments. Note that you cannot modify the cluster name or namespace name.
  3. Click the Update button to apply the changes to the subnamespace.

Note

The root namespace cannot be modified.

Deleting Subnamespaces

  1. Access the Namespaces page in the portal.
  2. Select the Namespace you want to delete and remove it.

Warning

When deleting a subnamespace, all resources created within that Namespace resource will also be removed.

Note

The root namespace cannot be deleted.

Reference: Managing Subnamespaces via Command Line Tools

The subnamespace functionality is implemented through the SubnamespaceAnchor custom resource of Hierarchical Namespace. By installing the kubectl-hns plugin, you can perform subnamespace operations directly from the terminal.

Creating Subnamespaces

# Create a subnamespace `org-<organization-name>--foo`
$ kubectl hns create org-<organization-name>--foo -n org-<organization-name>
Successfully created "org-<organization-name>--foo" subnamespace anchor in "org-<organization-name>" namespace

Viewing Hierarchical Structure

$ kubectl hns tree org-<organization-name>
org-<organization-name>
└── [s] org-<organization-name>--foo

Deleting Namespaces

$ kubectl delete subnamespaceanchor org-<organization-name>--foo -n org-<organization-name>

  1. To implement subnamespace functionality, we are utilizing Hierarchical Namespace. ↩

  2. By using the SubnamespaceAnchor custom resource provided by Hierarchical Namespace, you can create Namespace resources as subnamespaces. ↩ ↩2