SPIKE: Hierarchical namespaces

[ozamosi]

Does hierarchial namespaces solve gitops phase 2 problems?

[chanwit]

Outcomes:

HNS controller offers excellent flexibility in creating namespaces in a restricted cluster.

For example, Team Denim members can only work in the team-denim namespace. With the HNS controller installed, team members can freely create their sub-namespaces inside team-denim namespaces.

HNS controller's sub-namespaces are the real namespaces. They can contain normal K8s workloads. Their set of permissions is inherited from the parent namespace.

Limitations:

• It's not a native K8s capability. The platform operator is required to install the HNS controller beforehand.
• Although sub-namespaces are the real namespaces, we need to manage them via the Custom Resource provided by the controller. We cannot use Namespace APIs to manage them directly.