Managing Namespaces and Multi-Tenancy
1. Creating Namespace in Chart
Warning: Avoid templating kind: Namespace inside an app chart. Use helm install --create-namespace or manage namespaces in a separate platform chart. Owning namespaces in templates makes uninstall risky.
2. Using Release Namespace
Reference Resolves to {{ .Release.Namespace }}Namespace passed via -n {{ .Values.global.namespace }}Explicit override
3. Installing Charts Across Namespaces
Example: Per-namespace releases
helm install api ./chart -n team-a --create-namespace helm install api ./chart -n team-b --create-namespace helm list --all-namespaces
4. Implementing Namespace Isolation
Control Resource RBAC Namespaced Role + RoleBinding Network NetworkPolicy deny cross-namespace Quotas ResourceQuota per namespace Identity ServiceAccount per workload
5. Using Namespace-scoped Resources
Resource Scope Deployment, Service, ConfigMap, Secret Namespaced Role, RoleBinding, ServiceAccount Namespaced PVC, NetworkPolicy, HPA Namespaced
6. Managing Cluster-scoped Resources
Resource Pattern ClusterRole, ClusterRoleBinding Gate with if + unique names per release StorageClass, CRD Manage in platform chart, not app chart PersistentVolume Avoid; prefer dynamic provisioning
7. Implementing Resource Quotas
Example: Tenant ResourceQuota
apiVersion : v1 kind : ResourceQuota metadata : name : {{ .Release.Name }} -quota namespace : {{ .Release.Namespace }} spec : hard : requests.cpu : {{ .Values.quota.cpuRequest }} requests.memory : {{ .Values.quota.memRequest }} limits.cpu : {{ .Values.quota.cpuLimit }} limits.memory : {{ .Values.quota.memLimit }} pods : {{ .Values.quota.maxPods }}
8. Using LimitRange for Namespaces
Example: Default container limits
apiVersion : v1 kind : LimitRange metadata : name : {{ .Release.Name }} -limits spec : limits : - type : Container default : { cpu : "500m" , memory : "512Mi" } defaultRequest : { cpu : "100m" , memory : "128Mi" } max : { cpu : "2" , memory : "2Gi" }
9. Handling Cross-Namespace References
Reference Format DNS to Service svc.<ns>.svc.cluster.localSecret reference Cannot — copy via ExternalSecrets / Reflector ServiceAccount token Use TokenRequest API in target namespace
10. Implementing Multi-Tenant Charts