Namespace Specification

Nomad Namespaces may be specified as HCL files and submitted by the nomad namespace apply CLI command.

Unlike Job specifications, Namespace specifications do not support HCL2 features like functions.

In federated clusters, all updates to namespaces are forwarded to the authoritative_region and replicated to non-authoritative regions. This requires that ACLs have been bootstrapped in the authoritative region.

Example namespace specification:

name        = "prod-eng"
description = "Namespace for production workloads."

# Quotas are a Nomad Enterprise feature.
quota = "eng"

meta {
  owner = "eng"
}

capabilities {
  enabled_task_drivers   = ["java", "docker"]
  disabled_task_drivers  = ["raw_exec"]
  enabled_network_modes  = ["bridge", "cni/custom"]
  disabled_network_modes = ["host"]
}

# Node Pool configuration is a Nomad Enterprise feature.
node_pool_config {
  default = "prod"
  allowed = ["all", "default"]
}

# Vault configuration is a Nomad Enterprise feature.
vault {
  default = "default"
  allowed = ["default", "infra"]
}

# Consul configuration is a Nomad Enterprise feature.
consul {
  default = "default"
  allowed = ["all", "default"]
}

Namespace Specification Parameters

• name (string: <required>) - Specifies the namespace to create or update.

• description (string: "") - Specifies an optional human-readable description of the namespace.

• quota (string: "") EnterpriseEnterprise - Specifies a quota to attach to the namespace.

• meta (object: null) - Optional object with string keys and values of metadata to attach to the namespace. Namespace metadata is not used by Nomad and is intended for use by operators and third party tools.

• capabilities (Capabilities: <optional>) - Specifies capabilities allowed in the namespace. These values are checked at job submission.

• node_pool_config (NodePoolConfiguration: <optional>) EnterpriseEnterprise - Specifies node pool configurations. These values are checked at job submission.

• vault (Vault: <optional>) EnterpriseEnterprise - Specifies which Vault clusters are allowed to be used from this namespace. These values are checked at job submission.

• consul (Consul: <optional>) EnterpriseEnterprise - Specifies which Consul clusters are allowed to be used from this namespace. These values are checked at job submission.

capabilities Parameters

• enabled_task_drivers (array<string>: []) - List of task drivers allowed in the namespace. If empty all task drivers are allowed.

• disabled_task_drivers (array<string>: []) - List of task drivers disabled in the namespace.

• enabled_network_modes (array<string>: []) - List of network modes allowed in the namespace. If empty all network modes are allowed.

• disabled_network_modes (array<string>: []) - List of network modes disabled in the namespace.

node_pool_config Parameters EnterpriseEnterprise

• default (string: "default") - Specifies the node pool to use for jobs in this namespace that don't define a node pool in their specification.

• allowed (array<string>: nil) - Specifies the node pools that are allowed to be used by jobs in this namespace. By default, all node pools are allowed. If an empty list is provided only the namespace's default node pool is allowed. This field supports wildcard globbing through the use of * for multi-character matching. This field cannot be used with denied.

• denied (array<string>: nil) - Specifies the node pools that are not allowed to be used by jobs in this namespace. This field supports wildcard globbing through the use of * for multi-character matching. If specified, any node pool is allowed to be used, except for those that match any of these patterns. This field cannot be used with allowed.

vault Parameters EnterpriseEnterprise

• default (string: "default") - Specifies the Vault cluster to use for jobs in this namespace that don't define a Vault cluster in their specification.

• allowed (array<string>: nil) - Specifies the Vault clusters that are allowed to be used by jobs in this namespace. By default, all Vault clusters are allowed. If an empty list is provided only the namespace's default Vault cluster is allowed. This field supports wildcard globbing through the use of * for multi-character matching. This field cannot be used with denied.

• denied (array<string>: nil) - Specifies the Vault clusters that are not allowed to be used by jobs in this namespace. This field supports wildcard globbing through the use of * for multi-character matching. If specified, any Vault cluster is allowed to be used, except for those that match any of these patterns. This field cannot be used with allowed.

consul Parameters EnterpriseEnterprise

• default (string: "default") - Specifies the Consul cluster to use for jobs in this namespace that don't define a Consul cluster in their specification.

• allowed (array<string>: nil) - Specifies the Consul clusters that are allowed to be used by jobs in this namespace. By default, all Consul clusters are allowed. If an empty list is provided only the namespace's default Consul cluster is allowed. This field supports wildcard globbing through the use of * for multi-character matching. This field cannot be used with denied.

• denied (array<string>: nil) - Specifies the Consul clusters that are not allowed to be used by jobs in this namespace. This field supports wildcard globbing through the use of * for multi-character matching. If specified, any Consul cluster is allowed to be used, except for those that match any of these patterns. This field cannot be used with allowed.