Kubernetes Namespace

Deploys a Kubernetes namespace with optional resource quotas, LimitRanges, network policies, service mesh sidecar injection, and Pod Security Standards enforcement. Configuration is abstracted into T-shirt-sized resource profiles and declarative network isolation rules, so each namespace is created with resource limits and network isolation configured from the start.

What Gets Created

When you deploy a KubernetesNamespace resource, OpenMCF provisions:

• Namespace — a Kubernetes Namespace with merged labels (user-specified plus standard management labels) and annotations (user-specified plus service-mesh annotations when enabled)
• ResourceQuota — enforces CPU, memory, and object-count limits for the namespace, created only when a resourceProfile preset or custom quota is configured
• LimitRange — sets default CPU and memory requests/limits for containers that do not declare their own, created only when custom defaultLimits are provided
• Ingress NetworkPolicy — a default-deny ingress policy that allows traffic only from pods within the namespace and from explicitly listed namespaces, created only when networkConfig.isolateIngress is true
• Egress NetworkPolicy — a default-deny egress policy that allows DNS traffic to kube-system, traffic within the namespace, and traffic to explicitly listed CIDR blocks, created only when networkConfig.restrictEgress is true

Prerequisites

• Kubernetes credentials configured via environment variables or OpenMCF provider config
• A running Kubernetes cluster reachable from the deployment environment
• A CNI plugin that supports NetworkPolicy (e.g., Calico, Cilium) if using ingress isolation or egress restriction
• A service mesh control plane (Istio, Linkerd, or Consul Connect) already installed on the cluster if enabling service mesh injection

Quick Start

Create a file namespace.yaml:

apiVersion: kubernetes.openmcf.org/v1
kind: KubernetesNamespace
metadata:
  name: my-namespace
  labels:
    openmcf.org/provisioner: pulumi
    pulumi.openmcf.org/organization: my-org
    pulumi.openmcf.org/project: my-project
    pulumi.openmcf.org/stack.name: dev.KubernetesNamespace.my-namespace
spec:
  name: my-namespace

Deploy:

openmcf apply -f namespace.yaml

This creates a bare namespace named my-namespace with standard OpenMCF management labels. No quotas, network policies, or service mesh injection are applied.

Configuration Reference

Required Fields

Optional Fields

Built-in resource profile sizes:

Examples

Basic Namespace with a Resource Profile

A development namespace with the small resource profile to set guardrails on resource consumption:

apiVersion: kubernetes.openmcf.org/v1
kind: KubernetesNamespace
metadata:
  name: dev-team-alpha
  labels:
    openmcf.org/provisioner: pulumi
    pulumi.openmcf.org/organization: my-org
    pulumi.openmcf.org/project: my-project
    pulumi.openmcf.org/stack.name: dev.KubernetesNamespace.dev-team-alpha
spec:
  name: dev-team-alpha
  labels:
    team: alpha
    cost-center: engineering
  resourceProfile:
    preset: small

Network-Isolated Namespace with Pod Security

A staging namespace that locks down both ingress and egress, allows traffic from a shared monitoring namespace, permits outbound access to an internal subnet, and enforces the baseline Pod Security Standard:

apiVersion: kubernetes.openmcf.org/v1
kind: KubernetesNamespace
metadata:
  name: staging-backend
  labels:
    openmcf.org/provisioner: pulumi
    pulumi.openmcf.org/organization: my-org
    pulumi.openmcf.org/project: my-project
    pulumi.openmcf.org/stack.name: staging.KubernetesNamespace.staging-backend
spec:
  name: staging-backend
  labels:
    team: backend
    environment: staging
  resourceProfile:
    preset: medium
  networkConfig:
    isolateIngress: true
    restrictEgress: true
    allowedIngressNamespaces:
      - monitoring
      - istio-system
    allowedEgressCidrs:
      - "10.0.0.0/8"
  podSecurityStandard: baseline

Full-Featured Production Namespace with Service Mesh and Custom Quotas

A production namespace with Istio sidecar injection pinned to a specific revision, custom resource quotas and default container limits, full network isolation, and the restricted Pod Security Standard:

apiVersion: kubernetes.openmcf.org/v1
kind: KubernetesNamespace
metadata:
  name: prod-payments
  labels:
    openmcf.org/provisioner: pulumi
    pulumi.openmcf.org/organization: my-org
    pulumi.openmcf.org/project: my-project
    pulumi.openmcf.org/stack.name: prod.KubernetesNamespace.prod-payments
spec:
  name: prod-payments
  labels:
    team: payments
    compliance: pci-dss
  annotations:
    janitor/ttl: "never"
  targetCluster:
    clusterKind: GcpGkeCluster
    clusterName: prod-us-central1
  resourceProfile:
    custom:
      cpu:
        requests: "12"
        limits: "24"
      memory:
        requests: "24Gi"
        limits: "48Gi"
      objectCounts:
        pods: 150
        services: 30
        configmaps: 200
        secrets: 200
        persistentVolumeClaims: 50
        loadBalancers: 5
      defaultLimits:
        defaultCpuRequest: "100m"
        defaultCpuLimit: "2000m"
        defaultMemoryRequest: "128Mi"
        defaultMemoryLimit: "1Gi"
  networkConfig:
    isolateIngress: true
    restrictEgress: true
    allowedIngressNamespaces:
      - istio-system
      - monitoring
      - logging
    allowedEgressCidrs:
      - "10.0.0.0/8"
      - "172.16.0.0/12"
  serviceMeshConfig:
    enabled: true
    meshType: istio
    revisionTag: prod-stable
  podSecurityStandard: restricted

Stack Outputs

After deployment, the following outputs are available in status.outputs:

Related Components

• KubernetesDeployment — deploys containerized workloads into namespaces managed by this component
• KubernetesPostgres — deploys PostgreSQL into a namespace, often co-deployed alongside application namespaces
• KubernetesRedis — deploys Redis into a namespace for caching and pub/sub workloads