Multi-tenancy with Namespaces
When Vault is primarily used as a central location to manage secrets, multiple organizations within a company may need to be able to manage their secrets in a self-serving manner. This means that a company needs to implement a Vault as a Service model allowing each organization (tenant) to manage their own secrets and policies. Most importantly, tenants should be restricted to work only within their tenant scope.
To achieve this, HashiCorp Cloud Platform (HCP) Vault utilizes
the concept of a namespace. A namespace allows you to create
separate groups of secrets, and apply policies to those namespaces
to ensure each tenant can only access the secrets they have
permission to. When you create a new HCP Vault cluster, a Vault
Enterprise cluster with a default namespace of
admin is provisioned.
In this tutorial, you will explore the creation of namespaces and learn how to navigate between them.
This step assumes that you created and connected to the HCP Vault cluster in the Create a Vault Cluster on HashiCorp Cloud Platform (HCP) step.
Characteristics of Vault namespaces
A Vault namespace enables teams, organizations, or applications a dedicated, isolated environment. Each namespace has its own:
- Auth methods
- Secrets engines
- Identity entities and groups
Tokens are locked to a namespace or child-namespaces. Identity groups can pull in entities and groups from other namespaces.
You may define nested namespaces within a parent namespace. These child-namespaces enable further isolated environments under the parent namespace.
In the Vault UI, select Access from the menu.
Select Namespaces and then click the Create namespace action.
educationin the Path field.
educationnamespace is created as a child-namespace of the
adminnamespace. This relationship is represented as the path
Click the admin namespace from the menu.
The namespace selector displays the child-namespaces of the current namespace.
Select the education namespace.
The current namespace changes to the
Navigate to Access > Namespaces and click the Create namespace action.
trainingin the Path field.
trainingnamespace is created as a child-namespace of the
admin/education/namespace. This relationship is represented as the path
Use the namespace selector to navigate to the training namespace and then to the admin namespace.
You created and navigated through Vault Enterprise namespaces. To gain a greater understanding of namespaces complete the Secure Multi-Tenancy with Namespaces tutorial.
Now you understand the fundamentals of Vault Enterprise namespaces. Learn how to store secrets using key/value secrets engine next.