Multi-tenancy with Namespaces

When Vault is primarily used as a central location to manage secrets, multiple organizations within a company may need to be able to manage their secrets in a self-serving manner. This means that a company needs to implement a Vault as a Service model allowing each organization (tenant) to manage their own secrets and policies. Most importantly, tenants should be restricted to work only within their tenant scope.

To achieve this, HashiCorp Cloud Platform (HCP) Vault utilizes the concept of a namespace. A namespace allows you to create separate groups of secrets, and apply policies to those namespaces to ensure each tenant can only access the secrets they have permission to. When you create a new HCP Vault cluster, a Vault Enterprise cluster with a default namespace of admin is provisioned.

In this tutorial, you will explore the creation of namespaces and learn how to navigate between them.

»Characteristics of Vault namespaces

A Vault namespace enables teams, organizations, or applications a dedicated, isolated environment. Each namespace has its own:

• Policies
• Auth methods
• Secrets engines
• Tokens
• Identity entities and groups

»Create namespaces

You may define nested namespaces within a parent namespace. These child-namespaces enable further isolated environments under the parent namespace.

»Next steps

You created and navigated through Vault Enterprise namespaces. To gain a greater understanding of namespaces complete the Secure Multi-Tenancy with Namespaces tutorial.

Now you understand the fundamentals of Vault Enterprise namespaces. Learn how to store secrets using key/value secrets engine next.