Platform Center
Home / Project management / Namespaces / Creating a namespace

Creating a namespace

Create a new namespace based on the available quota of the project under the associated cluster.

The new namespace will use the existing resources (memory, CPU, etc.) of the project, and all resources of a namespace can only come from the same cluster.

Creating a namespace

  1. In the Project Management view, click on the Project name for which you want to create a namespace.

  2. In the left navigation bar, click on Namespaces > Namespaces.

  3. Click on create namespace.

  4. Configure the Basic information.

    Parameter Description
    Cluster Select the cluster in which you want to create the namespace, under the associated project.
    Namespaces Name of the namespace, with the project name as the fixed prefix.

  5. (Optional) Configure the Resource Quotas.

    Each container’s computing or storage resource limit (limits) specified under the namespace, or each new Pod or PVC added, will consume the quota set here.

    Note:

    • The resource quota of the namespace comes from the quota allocated to the project by the cluster. For any given resource, the maximum quota that can be set is the unused quota in the project. If the available amount of any resource is 0, you will not be able to create a namespace. Please contact the platform administrator for support.

    • GPU resource quota can only be configured when GPU (vGPU or pGPU) resources are deployed in the cluster. When vGPU resources are used, vMemory quota can also be configured.

      GPU Units: 100 units of virtual cores are equivalent to 1 physical core (1 pGPU = 1 core = 100 vGPU), and pGPU is allocated in whole units. 1 unit of memory is equal to 256 MiB, and 1024 MiB = 1 GiB.

    • If no quota is specified for a certain resource, it defaults to Unlimited. This means that the namespace can use the available resources of the corresponding type allocated to the project in the cluster as needed, without any limit.

    Explanation of Quota Parameters

    Category Quota Type Value and Unit Description
    Storage Resource Quota All Gi The total requested storage capacity of all Persistent Volume Claims (PVCs) in this namespace cannot exceed this value.
    Storage Class In this namespace, the total requested storage capacity of all Persistent Volume Claims (PVCs) associated with the selected storage class cannot exceed this value.

    Note: Please allocate the storage class to the project where the namespace resides in advance.
    Extended Resources Obtained from the configuration dictionary (ConfigMap), please refer to Extended Resources Explanation for details. - If the corresponding configuration dictionary does not exist, this category will not be displayed.
    Other Resources Enter custom quotas, please refer to Other Resources Explanation for specific input rules. - To avoid duplicate resource definitions, the following values are not allowed as quota types:
    • limits.cpu
    • limits.memory
    • requests.cpu
    • requests.memory
    • pods
    • cpu
    • memory

  6. (Optional) If CPU or memory quota is specified, Container LimitRange (LimitRange) must be configured accordingly.

    Use Kubernetes LimitRange as an admission controller to set default request and limit values for all containers that do not specify compute resources, and continuously track container usage to ensure that there are no resources exceeding the maximum value in the namespace.

    Note: The resource request (requests) of a container is the resource limit (limits) divided by the cluster oversubscription ratio. The requests value is used by the scheduler to determine whether to schedule a container. The scheduler checks the available resources on each node (total resources - sum of requests of containers scheduled on the node). If the sum of requests of containers in a newly created pod exceeds the remaining available resources on a node, the pod will not be scheduled on that node.

    Parameter Description
    Default Request, Default Limit Used to specify default values for resources required for container execution in the namespace.
    Max Used to specify the maximum resource values allowed for container execution in the namespace.

  7. (Optional) Container group security policies can restrict the privileges or functionalities that containers in the group can use, as well as dictate how the containers in the group should run. The platform implements more granular container group security policies based on Pod Security Admission (PSA). It defines three security modes and security standards:

    • Security Mode: Security mode in Kubernetes is a mechanism for controlling security policies, defining how Kubernetes handles container groups that violate security policies. For more details, please refer to the official documentation . Security modes can be divided into the following three types:

      • Enforce: When a container group violates a security policy, Kubernetes will reject the creation or modification of the container group and return an error message. This mode is suitable for production environments with high security requirements.

      • Audit Mode: When a container group violates a security policy, Kubernetes will record the event and store the record in an audit log. This mode is usually used to understand security events in the cluster for subsequent investigation and analysis.

      • Warn: When a container group violates a security policy, Kubernetes will allow the creation or modification of the container group and return a warning message. This mode is usually used for testing or transitional periods, allowing administrators to gradually adjust security policies without affecting applications.

    • Security Standard: Pod security standards define three different policies to cover a wide range of security scenarios. For more details, please refer to the official documentation .

      • Privileged: Containers in the container group have privileged access, allowing all operations without any restrictions.

      • Baseline: Restricts the use of host namespaces, network, file system, and processes by containers in the container group. This is a default security standard that is usually suitable for most scenarios.

      • Restricted: Further restricts the use of host resources by containers in the container group, including limiting the use of file systems and networks. This is a highly secure standard that is suitable for scenarios with very high security requirements. These security standards can be verified for container groups through Admission Controllers in Kubernetes to ensure that containers in the container group do not compromise the security of the Kubernetes cluster.

  8. (Optional) In the More Configurations section, add labels and annotations to the current namespace.

    Tip: Labels can be used to define the properties of the namespace, while annotations can be used to supplement additional information to the namespace. Both can be used to filter and select namespaces.

  9. Click Create.

Relevant operations

Delete/remove namespaces

Delete/remove a namespace under the specified project.

Delete Namespace: Delete the namespace and clean up the resources under the namespace to release the quota resources occupied by the namespace.

Remove Namespace: Removing the namespace only removes the namespace from the project and does not affect the resources already under the namespace. For example: applications, persistent volume claims, configurations, computing, namespace members and their roles, etc.
After the namespace is removed, it can be imported and managed under other projects associated with the cluster where the namespace is located. For specific operations, please refer to Import Namespace .

Related Instructions

Other Resources Explanation

The format of custom quota names must adhere to the following specifications:

Extended Resources Explanation

The quota types in extended resources are obtained from the configuration dictionary (ConfigMap). If there is no corresponding configuration dictionary, this category will not be displayed.

ConfigMap Field Explanation

Field Description
data.dataType Specifies the data type of the value.
data.defaultValue Sets the default value. If this field does not exist or is empty, it indicates there is no default value.
data.descriptionEn English tooltip information, which can be viewed by clicking the icon to the right of the value.
data.descriptionZh Chinese tooltip information, which can be viewed by clicking the icon to the right of the value.
data.excludeResources Mutually exclusive resources. This field is used to add resources that cannot be configured simultaneously, separated by commas.
data.group Group
data.groupI18n The bilingual names of the group, which can be viewed and selected in the corresponding dropdown option of the quota type. Suitable for cases where a resource has one or more values.
data.key Specifies the value of the key. A configuration dictionary can only describe one key.
data.labelEn/data.labelZh The English/Chinese name of the resource, which can be viewed and selected in the corresponding dropdown option of the quota type. This field serves the same function as the data.groupI18n field but is only applicable when a resource has a single value and can be compatible with older configuration dictionaries (ConfigMap).
data.limits Whether to configure limits values for the resource. Possible values include: disabled (indicating that configuring limits values for the resource is not allowed), required (indicating that input is mandatory), optional (indicating that input is optional).
data.requests Whether to configure requests values for the resource. Possible values include: disabled (indicating that configuring requests values for the resource is not allowed), required (indicating that input is mandatory), optional (indicating that input is optional), fromLimits (indicating that the same configuration as limits is used).
data.relatedResources Related resources. This is a reserved field and is currently not usable.
data.resourceUnit The unit of the resource, which must be entered in English letters; Chinese input is not supported.
data.runtimeClassName The required runtime class, default is empty, optional value is nvidia.
metadata.labels
  • features.cpaas.io/type: CustomResourceLimitation, this label is mandatory and cannot be changed.
  • features.cpaas.io/group: <groupName>, this label is mandatory and the groupName should be modified to the corresponding group.
  • features.cpaas.io/enabled: “true”, this label is mandatory and indicates whether it is enabled, default is true.
metadata.name Format is cf-crl-<groupName>-<name>, where
  • cf-crl is a fixed field and cannot be changed.
  • groupName is the name of the group to which the resource belongs, such as gpu-manager, galaxy, etc.
  • name is the resource name:
    • The resource name can be a standard resource type name, such as cpu, memory, pods, etc. The standard resource name must comply with Kubernetes qualified name rules and exist within the standard resource types defined by Kubernetes.
    • The resource name can also start with a specific prefix, such as hugepages- or requests.hugepages- for special resource types.
metadata.namespace Must be specified as the kube-public namespace and cannot be changed.

ConfigMap Configuration Example

The document provides YAML configuration examples only for physical GPU, GPU Manager cores and memory, and MPS cores and memory. If you need to use other resources, please refer to the above field descriptions for customization.