Introduction to namespaces

You can use namespaces to provide multiple tenants with access to the ECS object store and to ensure that the objects and buckets written by users of each tenant are segregated from the other tenants.

ECS supports access by multiple tenants, where each tenant is defined by a namespace and the namespace has a set of configured users who can store and access objects within the namespace. Users from one namespace cannot access the objects that belong to another namespace.

Namespaces are global resources in ECS. A System Administrator or Namespace Administrator can access ECS from any federated VDC and can configure the namespace settings. The object users that you assign to a namespace are global and can access the object store from any federated VDC.

You configure a namespace with settings that define which users can access the namespace and what characteristics the namespace has. Users with the appropriate privileges can create buckets, and can create objects within buckets, in the namespace.

You can use buckets to create subtenants. The bucket owner is the subtenant administrator and can assign users to the subtenant by using access control lists (ACLs). However, subtenants do not provide the same level of segregation as tenants. Any user assigned to the tenant could be assigned privileges on a subtenant, so care must be taken when assigning users.

An object in one namespace can have the same name as an object in another namespace. ECS can identify objects by the namespace qualifier.

You can configure namespaces to monitor and meter their usage, and you can grant management rights to the tenant so that it can perform configuration, monitoring, and metering operations.

In the ECS Portal you can:

The namespace configuration tasks that you can perform in the ECS Portal can also be performed using the ECS Management REST API.