Namespaces and quotas

The Settings → Namespaces tab — creation and deletion restricted to platform administrators.

A namespace is an isolated workspace: its applications, volumes and buckets are separate from those of other namespaces, and it carries its own quotas and permissions.

Creating a namespace

New namespace (from the dashboard header or the Namespaces tab) → name (lowercase letters and digits), description, and quotas:

Quota	What it caps
CPU requests / limits	The sum of pods' CPU reservations and ceilings
Memory requests / limits	Same, for memory
Pods	The number of simultaneous pods
Storage	The sum of persistent volume capacities

The platform's default values are pre-filled and adjustable at creation.

Tracking and adjusting quotas

• The dashboard's quota gauge continuously shows the current namespace's consumption.
• In the Namespaces tab, the Quotas button on each row lets you adjust an existing namespace's ceilings.
• By selecting several namespaces, the edit applies in bulk to the whole selection.

Tip

A deployment refused with exceeded quota names the quota at fault and the requested/used/ceiling values — enough to decide between freeing up resources and raising the quota.

Permissions on a namespace

The Permissions button on a row grants a user a role (viewer, operator, admin) on that namespace — see Access and permissions.

Network isolation

The Network button on a row opens the namespace's network isolation — deny-all by default once enabled: no inbound or outbound traffic is allowed except the rules declared below (plus a handful of technical flows that always stay necessary: DNS, access to the Gateway for HTTPRoutes, etc.).

• Enable / disable isolation: switches the namespace between open (legacy behavior) and isolated. Declared rules stay visible and editable even while disabled, simply with no effect until isolation is turned back on.
• Access rules: allows a namespace (and optionally one specific app of that namespace) to reach this namespace on a given port — useful for example for cross-namespace replication or a legitimate cross-namespace application access.
• Exposed ports: exposes a Service of this namespace on a public TCP port through the shared Gateway, for access from outside the cluster.

Note

Only namespaces created after this feature was introduced can be isolated. An older namespace shows "not isolated": declared rules then have no effect on the cluster.

Warning

Exposing a port (Exposed ports tab) also requires the matching firewall forward on the infrastructure side (OPNsense) — not automated from this interface.

Deleting a namespace

Deletion with confirmation — destroys all of the namespace's content (applications, volumes, buckets). Irreversible.