---
schema_version: "1"
id: fe8044d059d91e13a77b38bebae1323982352c5a2667a332bb15d8f218cd08a6
title: Configuring Authorized Namespaces in Runtime Fabric
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/runtime-fabric/2.8/authorized-namespaces.md
canonical_url: https://docs.mulesoft.com/runtime-fabric/2.8/authorized-namespaces
source_site: docs.mulesoft.com
content_type: documentation
content_hash: 05b7e788d3e484f076c3366d206a68706830f73ff91a3ab170b5b2cff2e6eb4a
description: MuleSoft Documentation Site
release: "2.8"
latest: false
---
---
product: Runtime Fabric
version: 2.8
---

# Configuring Authorized Namespaces in Runtime Fabric

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

Authorized namespaces enable you to deploy Runtime Fabric alongside other services in a Kubernetes
cluster. By limiting permissions in your cluster, you can allow Runtime Fabric to access resources
only within namespaces assigned to Runtime Fabric.

With authorized namespaces, you have control of the creation of the following Runtime Fabric
resources:

- Namespaces

- RoleBindings

- ServiceAccounts

## How Authorized Namespaces Work

At install time, you provide a configuration file that consists of your namespaces, ServiceAccounts,
ClusterRoles/Roles, and RoleBindings.

Runtime Fabric installs the Runtime Fabric agent (rtf-agent) in the Runtime Fabric namespace, and it
has access to any additional namespaces that you provide in the authorized namespace list.

### Example

The following is an example of a Runtime Fabric agent ClusterRole that allows the agent to control
all cron jobs across all namespaces in a cluster.

```yaml
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
 name: rtf:agent
rules:
- apiGroups:
 - batch
 resources:
 - cronjobs
 verbs:
 - create
 - delete
 - deletecollection
 - get
 - list
 - patch
 - update
 - watch
```

Runtime Fabric creates the required RoleBinding objects which use the ClusterRole rtf:agent to allow
corresponding ServiceAccount to perform various actions (verbs) on cron jobs in two namespaces.

```yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: rtf:agent-1
  namespace: namespace1
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: rtf:agent
subjects:
  - kind: ServiceAccount
    name: rtf-agent-sa
    namespace: default
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: rtf:agent-2
  namespace: namespace2
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: rtf:agent
subjects:
  - kind: ServiceAccount
    name: rtf-agent-sa
    namespace: default
```

To use clustered apps in authorized namespaces mode, the following RoleBinding must be created:

```yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: rtf-mule-clusterip-service
  namespace: <app_namespace>
subjects:
  - kind: ServiceAccount
    name: mule-clusterip-service
    namespace: <rtf_namespace>
roleRef:
  kind: ClusterRole
  name: rtf:mule-clusterip-service-<rtf-namespace>
  apiGroup: rbac.authorization.k8s.io
```

## Configure Authorized Namespaces

You configure authorized namespaces when you install Runtime Fabric. Refer to the appropriate
installation instructions:

- [Installing Runtime Fabric on EKS, AKS, and GKE Using Helm](https://docs.mulesoft.com/runtime-fabric/2.8/install-helm)

- [Install Runtime Fabric on Red Hat OpenShift](https://docs.mulesoft.com/runtime-fabric/2.8/install-openshift)

## Add New Namespaces

If you update the authorized-namespaces ConfigMap with a new namespace, you must restart the Runtime
Fabric agent deployment using the following command:

`kubectl rollout restart deployment/agent`