Namespace Overview and Setup

Namespace Creation

To begin, click on the vSphere Menu and select Workload Management.

Make sure that the Namespaces tab is selected and then click on New Namespace.

Select the vCenter Cluster where Workload Management is enabled and where you want to create the new Namespace. Provide the Namespace a DNS-compliant Name and optionally give it a brief Description to help identify its usage then click on the Create button to finish.

The newly created Namespace Summary tab shown below provides important monitoring and management functions for vSphere administrators to report, allocate and access the Namespace:

The six main tabs are summarized here with more detail on components 2-4 covered in the remainder of this guide. vSphere Pods and Tanzu Kubenetes Clusters (items 5 and 6) will have their own dedicated KB article.

1. Status: Provides kubernetes service status information, the cluster and vCenter instances the Namespace belongs to and useful URL links to CLI tools.
2. Permissions: Who can view and who can edit the Namespace through the cluster API endpoint provided via the Workload Management Supervisor Cluster.
3. Storage: Which StorageClass or StorageClasses defined via vSphere SPBM are assigned to the Namespace.
4. Capacity and Usage Limits: How much CPU, memory and storage on a per datastore basis can be used by the Namespace.
5. vSphere Pods: vSphere Pods are supported by NSX-T backed Workload Management instances only with VMware Cloud Foundation. This summary screen shows how many are running and in what state they are in.
6. Tanzu Kubernetes Clusters: This shows the number of Tanzu Kubernetes Cluster (TKC) instances running underneath this Namespace and also provides the ability to change the Content Library associated with them and view more detail about the TKC components.

Namespace Permissions

Adding one or more developers or groups of developers to the Namespace gives the ability to access the it with the kubectl command via the Workspace control plane node IP or FQDN. Depending on the role assigned, developers can build, monitor and/or delete container deployments.

To add a user to the Namespace, start by clicking on the Add Permissions button on the Permissions window.

Next, choose your Identity Source from the pull down menu. The Identity source can be the local vSphere SSO (vsphere.local user as our example shows) or something like Active Directory if that has been integrated with your vCenter instance.

Once the proper Identity Source has been selected, search for the user or group that you want to add for access and select it.

Finally, give them the desired Role. As you might expect, Can view gives read-only permissions to the Namespace while Can edit gives administrative rights to the Namespace.

Click on OK when you have made the desired selections.

The Control Plane IP address can be found in the Workload Management menu under the Clusters tab.

Use this IP address (alternatively the IP address can be assigned an FQDN on your DNS server as well) to connect to the Namespace we added the user to in this section.

An example of how to authenticate to the Tanzu cluster is shown in this code snippet:

# kubectl vsphere login --server <Control Plane Node> --vsphere-username <user@domain> --insecure-skip-tls-verify

The users provides their password to authenticate to the cluster.

Logged in successfully.

You have access to the following contexts:

   <Control Plane Node>

   tkc-test

In this example we see we have access to the tkc-test context as expected.

To select our new context to use, enter the following command:

# kubectl config use-context tkc-test

Switched to context "tkc-test".

#

Next, let's see what storageclass is available to use:

# kubectl describe namespace tkc-test

Name:         tkc-test

Labels:       vSphereClusterID=domain-c8

Annotations:  ls_id-0: 4a03e9a0-beea-4198-bbf1-ce0516653567

              ncp/extpoolid: domain-c8:aeb518f4-209a-4d70-87ae-4e267b5c9338-ippool-10-21-132-129-10-21-132-190

              ncp/router_id: t1_06f663d9-4330-4651-b8cc-62613a48ffc7_rtr

              ncp/snat_ip: 10.21.132.130

              ncp/subnet-0: 10.244.0.16/28

              vmware-system-resource-pool: resgroup-3009

              vmware-system-vm-folder: group-v3010

Status:       Active

No resource quota.

No LimitRange resource.

This output is expected as we have not yet assigned any SPBM policies to our Namespace, thus no storageclass is available for use. Tanzu will translate assigned SPBM policies to the Namespace into usable storageclasses for users with permissions. We will return to the vSphere UI to assign SPBM policies in the next section of this guide to resolve this.

Namespace Storage

In this section we will show the relationship between an SPBM policy and a storageclass for VMware Tanzu. The prerequisite for this section is that one or more SPBM policies for VMFS and/or vVols has been previously created. These KB articles will walk through the procedure and differences between SPBM for vVols and VMFS on the FlashArray:

Tanzu User Guide: Storage Policy Based Management (SPBM) with vVols

Tanzu User Guide: Storage Policy Based Management (SPBM) with VMFS

A storageclass determines what underlying storage and what storage features are available to be consumed by a given Namespace. VMFS, vVols and NFS protocols can all be used with VMware Tanzu. Storageclasses are an important component of Tanzu as they are what allows for dynamic storage provisioning for persistent volumes.

To assign one or more SPBM policies to the Namespace, start by clicking on the Add Storage button on the Namespace Summary tab.

All SPBM policies associated with the vCenter instance that can be used with your Namespace will be displayed. To add them simply select the checkbox or checkboxes for one or more policies that you wish to use with the Namespace. You optionally can click on the > button to expand each policy and see what datastore(s) are mapped to it in order to confirm that's the policy you wish to use. In our example we will select a VMFS SPBM policy and a vVols SPBM policy and then click on the OK button to assign them.

Successful policy assignment is confirmed in the Storage Window. Note that by default no limits/quotas are assigned to them. We will cover assigning limits in the next section.

With SPBM policies now added to the Namespace, we can re-run the kubectl describe namespace command and we see that storageclass resources are now available to the sample context as resources.

$ kubectl describe namespace tkc-test

Name:         tkc-test

Labels:       vSphereClusterID=domain-c8

Annotations:  ls_id-0: 4a03e9a0-beea-4198-bbf1-ce0516653567

              ncp/extpoolid: domain-c8:aeb518f4-209a-4d70-87ae-4e267b5c9338-ippool-10-21-132-129-10-21-132-190

              ncp/router_id: t1_06f663d9-4330-4651-b8cc-62613a48ffc7_rtr

              ncp/snat_ip: 10.21.132.130

              ncp/subnet-0: 10.244.0.16/28

              vmware-system-resource-pool: resgroup-3009

              vmware-system-vm-folder: group-v3010

Status:       Active

Resource Quotas

 Name:                                                       tkc-test-storagequota

 Resource                                                    Used  Hard

 --------                                                    ---   ---

 wld1-vmfs-k8.storageclass.storage.k8s.io/requests.storage   0     9223372036854775807

 wld1-vvols-k8.storageclass.storage.k8s.io/requests.storage  0     9223372036854775807

Depending on the vCenter permissions assigned to the user accessing the context, the kubectl get storageclass command will also provide available storageclasses, their reclaimpolicy and a few other important characteristics for the context as shown in the below example. If the user does not have sufficient permissions the command will throw an error saying the user lacks sufficient permissions to access the API. More information on vCenter storage permissions with Tanzu can be found here.

# kubectl get storageclass

NAME                       PROVISIONER              RECLAIMPOLICY   VOLUMEBINDINGMODE   ALLOWVOLUMEEXPANSION   AGE

wld1-vmfs-k8               csi.vsphere.vmware.com   Delete          Immediate           true                   23h

wld1-vvols-k8              csi.vsphere.vmware.com   Delete          Immediate           true                   23h

Namespace Resource and Object Limits

The Capacity and Usage panel within the vSphere Namespace allow the vSphere administrator to set how much CPU, memory and/or Storage will be available to the it and associated user contexts. This is an extremely useful feature as it prevents individual Kubernetes applications from negatively impacting other running workloads on the same vSphere cluster. This also provides insights for the vSphere administrator to differentiate between those Namespaces and clusters which have more resource demands and those that are being underutilized.

To set limitations against the Namespace, click on the Edit Limits button.

That will spawn the below window: