Sub-namespace operations

Sub-namespaces is a feature of Accurate to allow tenant users to create Namespaces and delete the created Namespaces.

Sub-namespaces can be created under either a root Namespace or a sub-namespace.

In the following examples, <name> represents a Namespace name to be changed. Likewise, <parent> represents a root or another sub-namespace.

Setting a Namespace as a root Namespace

Suppose that Accurate is configured to propagate team label.

Using kubectl accurate:

$ kubectl accurate ns set-type <name> root
$ kubectl label ns <name> team=foo

Applying YAML manifests:

apiVersion: v1
kind: Namespace
metadata:
  name: <name>
  labels:
    accurate.cybozu.com/type: root
    team: foo

Accurate only propagates labels/annotations that have been configured in that respect via the labelKeys and annotationKeys parameters in config.yaml. This prevents the propagation of labels/annotations that were not meant to do so.

Preparing resources for tenant users

In almost all cases, a root Namespace should have RoleBinding for a group of tenant users. The RoleBinding should be annotated with accurate.cybozu.com/propagate=update.

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  namespace: <name>
  name: admin
  annotations:
    accurate.cybozu.com/propagate: update
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: admin
subjects:
- kind: Group
  name: foo
  apiGroup: rbac.authorization.k8s.io

You may want to prepare more objects such as ResourceQuotas.

Reverting a root Namespace to a normal one

Using kubectl accurate:

$ kubectl accurate ns set-type <name> none

Applying YAML manifests:

Remove accurate.cybozu.com/type label.

Creating a sub-namespace

Using kubectl accurate:

$ kubectl accurate sub create <name> <parent>

Applying YAML manifests:

apiVersion: accurate.cybozu.com/v2
kind: SubNamespace
metadata:
  namespace: <parent>
  name: <name>

Creating a sub-namespace with additional labels/annotations

Using kubectl accurate:

$ kubectl accurate sub create <name> <parent> --labels=foo=bar --annotations=baz=zot

Applying YAML manifests:

apiVersion: accurate.cybozu.com/v2
kind: SubNamespace
metadata:
  namespace: <parent>
  name: <name>
spec:
  labels:
    foo: bar
  annotations:
    baz: zot

You can edit these spec.labels/spec.annotations with kubectl edit:

$ kubectl edit SubNamespace -n=<parent> <name>

The spec.labels/spec.annotations that can be propagated to sub-namespaces can be set with the subNamespaceLabelKeys/subNamespaceAnnotationKeys parameters in config.yaml.

Deleting a created sub-namespace

Using kubectl accurate:

$ kubectl accurate sub delete <name>

Applying YAML manifests:

Delete the created SubNamespace object.

Changing the parent of a sub-namespace

Only cluster admins can do this.

Using kubectl accurate:

$ kubectl accurate sub move <name> <new-parent>

Applying YAML manifests:

apiVersion: v1
kind: Namespace
metadata:
  name: <name>
  labels:
    accurate.cybozu.com/parent: <new-parent>

Converting a normal Namespace to a sub-namespace

Only cluster admins can do this.

Using kubectl accurate:

$ kubectl accurate sub graft <name> <parent>

Applying YAML manifests:

apiVersion: v1
kind: Namespace
metadata:
  name: <name>
  labels:
    accurate.cybozu.com/parent: <parent>

Converting a sub-namespace to a root Namespace

Only cluster admins can do this.

Using kubectl accurate:

$ kubectl accurate sub cut <name>

Applying YAML manifests:

apiVersion: v1
kind: Namespace
metadata:
  name: <name>
  labels:
    accurate.cybozu.com/type: root
    # and remove accurate.cybozu.com/parent label