Configure namespace policy and global cluster settings

Set cluster-wide values and namespace policy in a module passed to kix.buildCluster:

how-to/composition/cluster.nix

      clusterDomain = "cluster.example";
      clusterLabels."platform.example.com/environment" = "development";
      k8sVersion = "1.31";

      namespaces.apps = {
        labels."platform.example.com/tier" = "application";
        annotations."platform.example.com/owner" = "platform";
        resourceQuota = {
          "requests.cpu" = "2";
          "requests.memory" = "2Gi";
        };
      };

      instances.apps.storefront = {
        inherit package;
        config.message = "Storefront configuration";
      };

      instances.apps.widget = {
        package = customResourcePackage;
      };

      instances._platform.storage = {
        package = storageProvider;
      };

View source on GitHub ↗

The cluster-wide settings in this example have distinct jobs:

• clusterDomain is used when Kix derives service FQDNs.
• clusterLabels adds the given labels to every managed resource.
• k8sVersion lets package compatibility checks evaluate against the intended Kubernetes version. kix deploy and kix plan then stop if the cluster runs a different version, and tell you the value to set.

The namespaces.apps block configures the generated apps Namespace. Its labels and annotations are added to that Namespace. resourceQuota is the hard map for a generated ResourceQuota named apps-quota.

Add instances beneath the same namespace key. Kix also creates a Namespace for an instance namespace that has no explicit namespaces block, but the explicit block is where its policy belongs.

The instances._platform.storage entry in the snippet is an exception. A namespace key beginning with _ groups cluster-scoped instances without creating a Kubernetes namespace. Kix creates no Namespace, ResourceQuota, or default-deny policy for the group, and cluster scorecard rules skip it. Use this form only when every resource in the instance is cluster-scoped, as the storage provider’s StorageClass is here. Use an ordinary name for anything that needs a real namespace.

Check the cluster

Run the normal pre-deploy checks:

kix-examples/

❱ kix check how-to-composition
 TOOL       RESULT  DETAILS                      
 eval       pass    15 manifests evaluated       
 scorecard  pass    0 errors, 0 warnings, 0 info

To inspect the generated Namespace and ResourceQuota, render the cluster as JSON. The excerpt shows the two relevant resources from the complete build:

kix-examples/ output excerpt

❱ kix build how-to-composition --output json
[
  {
    "kind": "Namespace",
    "name": "apps",
    "labels": {
      "app.kubernetes.io/managed-by": "kix",
      "kubernetes.io/metadata.name": "apps",
      "platform.example.com/tier": "application"
    },
    "annotations": {
      "kix.run/identity-hash": "p1haq8g1419w8ssz3bxialkv2rlrqqsk",
      "kix.run/package": "_cluster",
      "kix.run/package-namespace": "_cluster",
      "platform.example.com/owner": "platform"
    },
    "hard": null
  },
  {
    "kind": "ResourceQuota",
    "name": "apps-quota",
    "labels": {
      "app.kubernetes.io/managed-by": "kix"
    },
    "annotations": {
      "kix.run/depends-on": "p1haq8g1419w8ssz3bxialkv2rlrqqsk",
      "kix.run/identity-hash": "zy99gx69z8g3cyambw8m4axn7vfz89ww",
      "kix.run/package": "_cluster",
      "kix.run/package-namespace": "_cluster"
    },
    "hard": {
      "requests.cpu": "2",
      "requests.memory": "2Gi"
    }
  }
]

Check the generated resources again after changing a quota or a shared label. This catches invalid package configuration and Kubernetes schema problems before deployment.