Multi-tenancy on K8s - Namespace as a Service - Rafay Product Documentation
Overview
This system template enables the provisioning of a Kubernetes namespace on a shared, multi-tenant cluster, offering a streamlined approach to namespace-level isolation for development and data science workloads.
The template provisions a namespace with default resource quotas for CPU and memory to ensure efficient resource usage. It also creates a new RBAC group with Namespace Admin privileges and assigns the requesting user to this group, enabling secure and scoped access to the namespace.
As part of the output, users receive a kubeconfig file with the necessary privileges, allowing secure access to the namespace for application deployment and resource management.
For detailed steps to get started, refer to the Namespace as a Service System Template Get Started Guide.
Initial Setup
The platform team is responsible for performing the initial configuration and setup of the Namespace as a Service template. The sequence diagram below outlines the high-level steps. In this process, the platform team selects the system template, configures it with predefined settings, and shares it with the appropriate project to make it available for end users.
| End User Project | System Catalog | Platform Admin |
|---|---|---|
| Selects Namespace Template from System Catalog | Shares Template with Predefined Controls | Template Available in End User's Project |
End User Flow
The end user launches a shared template, provides the required input values, and provisions a new Kubernetes namespace.
| Host Kubernetes Cluster | Rafay Project | End User |
|---|---|---|
| Launches Shared Template for Namespace | Provides Required Input Values (Environment Name, Resource Quotas) | Clicks "Deploy" |
| Creates a Namespace in the Designated Cluster | Namespace Created Successfully | Provides Kubeconfig File as Output |
The templates are designed to support both:
- Day 1 operations: Initial provisioning of the namespace
- Day 2 operations: Ongoing access and management of resources within the namespace
Resources
A dedicated Kubernetes namespace created within the designated cluster, configured with default resource quotas and RBAC policies to ensure secure and scoped access for application development and management.
Pre-Requisites
- Host Cluster: Ensure that a Kubernetes cluster is available and configured within the Rafay project for namespace provisioning.
- Rafay Configuration: At template launch, supply the following configuration values:
- Environment Name (used to name the namespace)
- Resource Quota overrides (optional)
- Agent Configuration: A configured and healthy agent must be available in the project where the template will be used. Follow these instructions to deploy a new agent. Existing agents within the project can be reused if available.
Configuration
At template launch, provide the required configuration values as exposed by the Platform Admin. This may include:
- Namespace Configuration:
- Environment Name: Specify a name for the namespace
- Host Cluster Name: Select the Kubernetes cluster where the namespace will be created
- Resource Quotas: Optionally override the default CPU and memory quotas
After entering the required information, click Deploy to initiate the namespace provisioning.
Input Variables for Namespace as a Service System Template
Cluster and Namespace Configuration
| Name | Default Value | Value Type | Description |
|---|---|---|---|
cluster_name |
resource.res-gen-kubeconfig-user.cluster_name, resource.res-gen-naas.cluster_name |
string | Name of the target cluster |
Project |
resource.res-gen-naas.project |
string | Associated project name |
Namespace |
resource.res-gen-naas.namespace |
string | Kubernetes namespace to be created or used |
Namespace Labels |
resource.res-gen-naas.namespace_labels |
map | Labels to assign to the namespace |
Namespace Annotations |
resource.res-gen-naas.namespace_annotations |
map | Annotations to assign to the namespace |
Allowed Namespaces for Network Policy |
resource.res-gen-naas.allowed_namespaces_for_network_policy |
list | List of namespaces allowed in network policies |
Enable Network Policy |
resource.res-gen-naas.network_policy |
bool | Whether to enable network policy |
Namespace Quota Size |
resource.res-gen-naas.namespace_quota_size |
string | Preset size of namespace resource quota |
Namespace Quotas |
resource.res-gen-naas.namespace_quotas |
map | Custom resource quotas for the namespace |
Authentication and Access
| Name | Default Value | Value Type | Description |
|---|---|---|---|
Host server |
resource.res-gen-naas.hserver |
string | Host server endpoint |
Client Certificate Data |
resource.res-gen-naas.clientcertificatedata |
string | Base64-encoded client certificate data |
Client Key Data |
resource.res-gen-naas.clientkeydata |
string | Base64-encoded client private key data |
Certificate Authority Data |
resource.res-gen-naas.certificateauthoritydata |
string | Base64-encoded CA certificate data |
Kubeconfig |
resource.res-gen-naas.kubeconfig |
string | Full kubeconfig content |
Launch Time
The estimated time to launch a namespace as a service using this template is approximately 3 minutes.