Namespaces are used to divide Kubernetes cluster resources into virtual and isolated spaces. This topic describes how to create a namespace, enable automatic sidecar proxy injection for a namespace, synchronize automatic sidecar proxy injection labels from/to a Service Mesh (ASM) instance to/from a Kubernetes cluster, and modify clusters to which a global namespace belongs.
Create a namespace
The namespaces that you create in a Service Mesh (ASM) instance, whether in the ASM console or by using the kubectl client, belong only to the ASM instance. They are independent of the Kubernetes clusters on the data plane managed by the ASM instance. Therefore, the namespaces in the ASM instance may be different from those of the Kubernetes clusters on the data plane managed by the ASM instance. When you create or delete namespaces for the Service Mesh instance, the namespaces of the Kubernetes clusters on the data plane managed by the ASM instance are not affected.
Log on to the ASM console. In the left-side navigation pane, choose .
On the Mesh Management page, click the name of the ASM instance. In the left-side navigation pane, choose .
On the Global Namespace page, click Create. In the Create Namespace panel, configure the required parameters and click OK.
Parameter
Description
Name
Specify a name for the namespace. The name must be 1 to 63 characters in length and can contain only digits, letters, and hyphens (-). The name must start and end with a letter or digit.
Labels
Click Add next to Labels. Then, specify the Name and Value parameters to add a label for the namespace.
You can add multiple labels to a namespace. Labels are used to identify namespaces. For example, you can label a namespace as one that is used in the test environment.
After the namespace is created, you can perform the following operations in the Actions column on the Global Namespace page:
Modify a namespace: Click YAML. In the Edit dialog box, modify the configuration and click OK.
Delete a namespace: Click Delete. In the Submit message, click OK.
Enable automatic sidecar proxy injection
After you enable automatic sidecar proxy injection for a namespace, an Envoy proxy is automatically injected as a sidecar into each pod that is created in the namespace. These Envoy proxies comprise the data plane of the ASM instance.
Log on to the ASM console. In the left-side navigation pane, choose .
On the Mesh Management page, click the name of the ASM instance. In the left-side navigation pane, choose .
On the Global Namespace page, find the desired namespace and click Enable Automatic Sidecar Proxy Injection in the Automatic Sidecar Injection column. In the Submit message, click OK.
NoteAfter you enable automatic sidecar proxy injection for a pod, you must restart the pod to make the configuration take effect. For more information, see the "(Optional) Redeploy workloads" section in Configure sidecar proxies.
Synchronize automatic sidecar proxy injection labels from/to an ASM instance to/from a Kubernetes cluster on the data plane
The namespaces that you create in an ASM instance, whether in the ASM console or by using the kubectl client, belong only to the ASM instance. The namespaces are independent of the Kubernetes clusters on the data plane that are managed by the ASM instance. You can synchronize the namespaces and their automatic sidecar proxy injection labels of an ASM instance to Kubernetes clusters on the data plane to which the namespaces belong. The reverse is also true.
Synchronize automatic sidecar proxy injection labels from a Kubernetes cluster on the data plane to an ASM instance
After automatic sidecar proxy injection labels are synchronized from a Kubernetes cluster on the data plane to an ASM instance, the following results occur:
If a namespace exists in the Kubernetes cluster on the data plane but does not exist in the ASM instance, the namespace is automatically created.
If a namespace in the Kubernetes cluster on the data plane has the
istio-injectionlabel or theistio.io/revlabel, the label is automatically synchronized to the namespace with the same name in the ASM instance.
Log on to the ASM console. In the left-side navigation pane, choose .
On the Mesh Management page, click the name of the ASM instance. In the left-side navigation pane, choose .
On the Global Namespace page, click Sync Sidecar Auto-Injection from Kubernetes Cluster. In the Sync Sidecar Auto-Injection from Kubernetes Cluster dialog box, select a Kubernetes cluster that you want to synchronize from and click OK.
On the Global Namespace page, you can find that the global namespaces of the ASM instance are synchronized with the Kubernetes cluster on the data plane.
Synchronize automatic sidecar proxy injection labels from an ASM instance to the Kubernetes clusters on the data plane
When you modify a namespace of an ASM instance, the automatic sidecar proxy injection labels of the namespace of the ASM instance are automatically synchronized to the Kubernetes clusters on the data plane to which the namespace belongs. You must perform this operation only if the namespaces in an ASM instance are different from those of Kubernetes clusters on the data plane because you modify the namespaces of the Kubernetes clusters on the data plane.
After automatic sidecar proxy injection labels are synchronized from an ASM instance to the Kubernetes clusters on the data plane, the following results occur:
If a namespace exists in the ASM instance but does not exist in the Kubernetes clusters on the data plane, the namespace is automatically created.
If a namespace in the ASM instance has the
istio-injectionlabel or theistio.io/revlabel, the label is automatically synchronized to the namespace with the same name in the Kubernetes cluster on the data plane.The labels of the namespaces in the ASM instance are synchronized to all Kubernetes clusters on the data plane.
Log on to the ASM console. In the left-side navigation pane, choose .
On the Mesh Management page, click the name of the ASM instance. In the left-side navigation pane, choose .
On the Global Namespace page, click Sync Automatic Sidecar Injection to Kubernetes Cluster.
You can find that the namespaces in the Kubernetes cluster on the data plane are synchronized with the ASM instance. For more information about how to view the namespaces of a Kubernetes cluster on the data plane, see Manage namespaces and resource quotas.
Modify the clusters to which a global namespace belongs
If multiple Kubernetes clusters on the data plane are added to the ASM instance, you can modify the clusters to which a global namespace belongs. When you synchronize automatic sidecar proxy injection labels from an ASM instance to the Kubernetes clusters on the data plane, the namespaces in the ASM instance and their automatic sidecar proxy injection labels are synchronized to different Kubernetes clusters on the data plane based on the clusters to which the namespaces of the ASM instance belong.
To use this feature, the version of your ASM instance must be 1.17.2.37 or later. For more information about how to update an ASM instance, see Update an ASM instance. The clusters to which a global namespace belongs can be modified by using one of the following methods:
Method 1: The system automatically modifies the clusters when you synchronize automatic sidecar proxy injection labels from a Kubernetes cluster on the data plane to an ASM instance
When you synchronize automatic sidecar proxy injection labels from a Kubernetes cluster on the data plane to an ASM instance, the homing relationship between the cluster and global namespaces is also synchronized.
Method 2: You manually modify clusters to which a global namespace belongs
When you synchronize automatic sidecar proxy injection labels from an ASM instance to the Kubernetes clusters on the data plane, the following results occur for the clusters to which the global namespaces belong:
When you synchronize a global namespace, if a Kubernetes cluster is not the cluster to which the namespace belongs, the namespace and its automatic sidecar proxy injection labels are not synchronized to the data plane.
Add multiple clusters to an ASM instance. For more information, see Add a cluster to an ASM instance or Use a serverless gateway managed by ASM to implement a multi-cluster ingress.
Log on to the ASM console. In the left-side navigation pane, choose .
On the Mesh Management page, click the name of the ASM instance. In the left-side navigation pane, choose .
On the Global Namespace page, find the desired namespace and click Edit in the Homing Cluster column. In the dialog box that appears, select one or more Kubernetes clusters and click OK.