Skip to content

How namespaces are used

CyVerse groups workloads into namespaces along two lines: what has to be isolated for security (user containers), and what has its own lifecycle (add-ons that are installed and upgraded independently of the DE service set).

The DE service namespace is conventionally prod. A site running more than one environment in a cluster names its namespaces after the environments; where a document in this bundle says <NAMESPACE>, that is the choice it refers to.

Namespaces

The DE service namespace

prod in a standard deployment. It holds the DE service set and the supporting services the DE talks to directly:

Workload Document
DE services (Terrain, apps, analyses, metadata, notifications, search, UI) Discovery Environment
de-nginx front end Discovery Environment
Redis and Redis HAProxy Redis HA
Search cluster OpenSearch
Grouper loader and web services Grouper
Unleash Unleash
NATS NATS
User Portal (or its own user-portal namespace) User Portal

Dedicated namespaces

Namespace Contents Why it is separate
vice-apps Interactive analyses, app-exposer, the VICE operator User-supplied containers need their own network policy and service accounts — see VICE
keycloak Keycloak Authentication is upgraded on its own schedule — see Keycloak
openldap OpenLDAP System of record for accounts — see OpenLDAP
irods-csi-driver The iRODS CSI driver Node-level storage plugin with its own upgrade procedure — see iRODS CSI driver
longhorn-system Longhorn Cluster storage — see storage
openebs OpenEBS (legacy) Older cluster storage — see storage
ingress-nginx ingress-nginx VICE ingresses; being retired — see ingress
cert-manager cert-manager and cluster issuers TLS issuance — see cert-manager
argo Argo Workflows Batch analyses — see Argo
harbor Harbor registry Registry lifecycle — see Harbor
mail exim4 smarthost Optional; see mail
jaeger Jaeger collector, query, rollover cron Optional tracing — see Jaeger

Which of these exist depends on what you deployed: Longhorn or OpenEBS, OpenSearch or Elasticsearch, mail and tracing only if installed.

Practical notes

  • Namespaced manifests. Several manifests in cluster resources carry a namespace in a kustomization or in an argument. Deploying into a namespace other than the default means changing them; each document flags where.
  • Cross-namespace addresses. In-cluster names are <service>.<namespace> — ldap://openldap.openldap for the directory, http://vice-operator.vice-apps:10000 for the VICE operator.
  • kubectl scope. Most troubleshooting starts with kubectl get pods -A; per-namespace commands in this bundle use <NAMESPACE> wherever the value is a site choice.

Related