Managing Namespaces and Multi-Tenancy
1. Creating Namespace in Chart
Warning: Avoid templating
kind: Namespace inside an app chart. Use helm install --create-namespace or manage namespaces in a separate platform chart. Owning namespaces in templates makes uninstall risky.2. Using Release Namespace
| Reference | Resolves to |
|---|---|
{{ .Release.Namespace }} | Namespace passed via -n |
{{ .Values.global.namespace }} | Explicit override |
3. Installing Charts Across Namespaces
Example: Per-namespace releases
helm install api ./chart -n team-a --create-namespace
helm install api ./chart -n team-b --create-namespace
helm list --all-namespaces4. Implementing Namespace Isolation
| Control | Resource |
|---|---|
| RBAC | Namespaced Role + RoleBinding |
| Network | NetworkPolicy deny cross-namespace |
| Quotas | ResourceQuota per namespace |
| Identity | ServiceAccount per workload |
5. Using Namespace-scoped Resources
| Resource | Scope |
|---|---|
| Deployment, Service, ConfigMap, Secret | Namespaced |
| Role, RoleBinding, ServiceAccount | Namespaced |
| PVC, NetworkPolicy, HPA | Namespaced |
6. Managing Cluster-scoped Resources
| Resource | Pattern |
|---|---|
| ClusterRole, ClusterRoleBinding | Gate with if + unique names per release |
| StorageClass, CRD | Manage in platform chart, not app chart |
| PersistentVolume | Avoid; prefer dynamic provisioning |
7. Implementing Resource Quotas
Example: Tenant ResourceQuota
apiVersion: v1
kind: ResourceQuota
metadata:
name: {{ .Release.Name }}-quota
namespace: {{ .Release.Namespace }}
spec:
hard:
requests.cpu: {{ .Values.quota.cpuRequest }}
requests.memory: {{ .Values.quota.memRequest }}
limits.cpu: {{ .Values.quota.cpuLimit }}
limits.memory: {{ .Values.quota.memLimit }}
pods: {{ .Values.quota.maxPods }}8. Using LimitRange for Namespaces
Example: Default container limits
apiVersion: v1
kind: LimitRange
metadata:
name: {{ .Release.Name }}-limits
spec:
limits:
- type: Container
default: { cpu: "500m", memory: "512Mi" }
defaultRequest: { cpu: "100m", memory: "128Mi" }
max: { cpu: "2", memory: "2Gi" }9. Handling Cross-Namespace References
| Reference | Format |
|---|---|
| DNS to Service | svc.<ns>.svc.cluster.local |
| Secret reference | Cannot — copy via ExternalSecrets / Reflector |
| ServiceAccount token | Use TokenRequest API in target namespace |