Namespaces under the tube access cluster

Scene Introduction

A certain enterprise customer has purchased and is using a Kubernetes cluster (such as an OpenShift cluster or Amazon EKS cluster) that requires dedicated personnel to operate and maintain. They hope to connect these clusters to the platform, unify the management of all clusters and hosts within the enterprise through the platform, and enable the enterprise to run clusters across regions and platforms quickly, effectively, and at low cost.

After the cluster is connected to the platform with account permissions, it is necessary to ensure that the standard Kubernetes resources (such as ConfigMap, secret, service, ingress, etc.) already on the cluster can be used normally on the platform and can be visually operated and maintained.

Implementation scheme

Tip: The following only describes how to manage and access existing Kubernetes resources under the connected cluster. For more information on the functions after successful connection and resource management, please refer to the user manual.

After the cluster is successfully connected, the existing namespaces and standard Kubernetes resources under the cluster are imported into specific projects on the platform for enterprise users to access or use as part of the development/testing/production process, as shown in the figure below.

1. Prepare the project and associate it with the connected cluster to import the existing namespaces under the cluster.

   Note:

   • As a smaller and isolated resource space, Kubernetes Namespace can achieve the continuity of the permission system after being managed under a specific project on the platform, allowing users with relevant permissions to access or use resources in the namespace through the platform.

   • The namespaces under the connected cluster can only be imported into projects that have been associated with the cluster (the cluster allocates resources to the project).

2. Import the namespace under the access cluster to the platform project, so that the namespace and standard Kubernetes resources under the namespace can be visualized and managed on the platform and allocated to tenants for use.

3. Manage the access permissions of the namespace by assigning project/namespace roles to users.

   The platform supports role-based user permission management function. By assigning different project and namespace roles to users, personnel access isolation between projects and namespaces can be achieved. This further enhances access control over resources and ensures the security of platform resources.

Step 1 - Prepare the project

The project is a project environment that can achieve resource and personnel isolation based on the resource quota of one or more clusters on the platform to meet the multi-tenant usage scenarios of enterprises. It can represent different subsidiaries, departments, or project teams in the enterprise.

By associating the access cluster with the project, the resources of the access cluster can be allocated to one or more projects. Before associating the access cluster with the project, please confirm whether to associate it with an existing project on the platform according to the actual situation.

Tip: The following will take creating a new project based on the access cluster as an example. If you want to allocate resources under the access cluster to an existing project, please refer to the method of adding the cluster to the existing project in Add Project Associated Cluster .

Procedure

1. In the Project Management view, click Create Project.

2. On the Basic information page, enter the following required parameters, and select optional parameters as needed.

   1. Enter the name of the project in the Name input box.

   2. Click the drop-down box under Cluster and select Import Cluster.

3. Click the Next button and set the resource quotas for the cluster allocated to the current project based on the actual situation.

   • If the quota for a certain resource is not entered, it defaults to Unlimited. That is, the project can use the corresponding type of resource available in the cluster as needed, without a maximum limit.

   • The set project quota value should be within the quota range displayed on the page. Under the input box for each resource quota, the allocated quota and total amount of that resource will be displayed for reference.

4. After setting is complete, click Create Project.

Step 2 - Import the namespace under the project

After importing the existing namespace under the access cluster to the platform project, you can manage the standard Kubernetes resources under the namespace and the namespace itself in the access cluster through the platform.

Procedure

1. In the left navigation bar, click Namespaces > Namespaces.

2. Click the Import Namespace button to the right of the button.

3. Refer to the required parameter instructions and configure the namespace Basic information.

   • Cluster: Click the drop-down selection box and select Import Cluster.

   • Namespaces: Click the drop-down selection box and select a namespace.

4. Update the Resource Quota of the namespace.

   Note:

• After setting the resource quota, the original resource quota information of the namespace to be imported will be overwritten. In addition, setting the resource quota for the namespace beyond the available resource quota of the project will result in the failure of importing the namespace.

• The resource quota of the namespace is part of the cluster project quota. For a certain resource, the highest quota that can be set is the unused resource quota in the project. If the available amount of any resource is 0, the namespace cannot be imported. Please contact the platform administrator.

6. See the following parameter description to configure Container Resource Limits (LimitRange).

   By setting container limits, you can control the CPU/Memory size of the containers created in the current namespace. The CPU and memory size of a single container must be between the default value and the maximum value.

   Note: After setting the container limit, when creating custom applications or computing components in the namespace, the Resource limit of the container defaults to the Default Value of the namespace. The reset value cannot be less than the Default Value of the namespace and cannot be greater than the Maximum Value of the namespace.

7. (Optional) In the More Configurations section, you can configure labels and annotations for the namespace.

8. Click Import.

Step 3 - Manage access to namespaces

By importing users into the project associated with the access cluster or the namespace under the access cluster and setting roles for them, you can control users’ access to the namespace and resources under the namespace, thereby achieving personnel access isolation between projects and namespaces.

The following is an example of importing users for namespaces. You can also grant corresponding access permissions by adding project/namespace roles to individual users. Similarly, removing members can revoke users’ access permissions.

Procedure

1. On the Namespace Member tab, click Import Member.

2. Click the selection box in front of the username to select one or more users.

3. Click the drop-down box to the right of the Bind item at the bottom of the dialog box, and select the name of the role to be assigned.

4. Click Import.

Validation of results

If the following operations can be performed smoothly, it indicates that the namespace management under the access cluster is successful.

Procedure

1. Log in to the platform with an account that has access permissions to the configured namespace.

2. In the container platform, select the Project and Import Cluster prepared in the above steps, and click the imported Namespaces.

3. You can view and manage resources in the namespace.