How to Implement Hierarchical Namespaces in PMK Workload Cluster

Problem

• How to apply comparable policies to many namespaces, such as granting access to team members.
• How to give some amount of resources to a team (similar to ResourceQuota), and it can distribute those resources between subnamespaces.
• How to provide team/group level access to create namespaces themselves as isolation units for their services.

Environment

• Platform9 Managed Kubernetes - v5.6 or Higher

Procedure

• Hierarchical Namespaces is a simple extension to Kubernetes namespaces that addresses some of the shortcomings of the namespace mentioned above.
• It addresses these problems by allowing one to organise their namespaces into trees, ability to create new namespaces within those trees and allowing to apply policies to those trees (or their subtrees).
• Something like below where each of these being namespaces -

xxxxxxxxxx

acme-org

└── team-a

     └── service-1

• By doing this it is easy to manage groups of namespaces that share a common concept of ownership. They are especially useful in clusters that are shared by multiple teams, but the owners do not need to be people.

Additional Information