---
schema_version: "1"
id: 8c5d2ad23ff7956ac9e27fdbe64d7bce2e3ef6edf89d9f87c0fbdb9df784ba5c
title: Configuring Authorized Namespaces in Runtime Fabric
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/runtime-fabric/2.9/authorized-namespaces.md
canonical_url: https://docs.mulesoft.com/runtime-fabric/2.9/authorized-namespaces
source_site: docs.mulesoft.com
content_type: documentation
content_hash: d080e467491686c31b909579a13581c0de24bf993e4e6910441daa0151830696
description: MuleSoft Documentation Site
release: "2.9"
latest: false
---
---
product: Runtime Fabric
version: 2.9
---

# Configuring Authorized Namespaces in Runtime Fabric

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

Authorized namespaces enable you to deploy Runtime Fabric alongside other services in a Kubernetes
cluster. By limiting permissions in your cluster, you can allow Runtime Fabric to access resources
only within namespaces assigned to Runtime Fabric.

With authorized namespaces, you have control of the creation of the following Runtime Fabric
resources:

- Namespaces

- RoleBindings

- ServiceAccounts

## How Authorized Namespaces Work

At install time, you provide a configuration file that consists of your namespaces, ServiceAccounts,
ClusterRoles/Roles, and RoleBindings.

Runtime Fabric installs the Runtime Fabric agent (rtf-agent) in the Runtime Fabric namespace, and it
has access to any additional namespaces that you provide in the authorized namespace list.

### Example

The following is an example of a Runtime Fabric agent ClusterRole that allows the agent to control
all cron jobs across all namespaces in a cluster.

```yaml
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
 name: rtf:agent
rules:
- apiGroups:
 - batch
 resources:
 - cronjobs
 verbs:
 - create
 - delete
 - deletecollection
 - get
 - list
 - patch
 - update
 - watch
```

Runtime Fabric creates the required RoleBinding objects which use the ClusterRole rtf:agent to allow
corresponding ServiceAccount to perform various actions (verbs) on cron jobs in two namespaces.

```yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: rtf:agent-1
  namespace: namespace1
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: rtf:agent
subjects:
  - kind: ServiceAccount
    name: rtf-agent-sa
    namespace: default
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: rtf:agent-2
  namespace: namespace2
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: rtf:agent
subjects:
  - kind: ServiceAccount
    name: rtf-agent-sa
    namespace: default
```

To use clustered apps in authorized namespaces mode, the following RoleBinding must be created:

```yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: rtf-mule-clusterip-service
  namespace: <app_namespace>
subjects:
  - kind: ServiceAccount
    name: mule-clusterip-service
    namespace: <rtf_namespace>
roleRef:
  kind: ClusterRole
  name: rtf:mule-clusterip-service
  apiGroup: rbac.authorization.k8s.io
```

## Configure Authorized Namespaces

You configure authorized namespaces when you install Runtime Fabric. Refer to the appropriate
installation instructions:

- [Installing Runtime Fabric on EKS, AKS, and GKE Using Helm](https://docs.mulesoft.com/runtime-fabric/2.9/install-helm)

- [Install Runtime Fabric on Red Hat OpenShift](https://docs.mulesoft.com/runtime-fabric/2.9/install-openshift)

## Add New Namespaces

If you update the authorized-namespaces ConfigMap with a new namespace, you must restart the Runtime
Fabric agent deployment using the following command:

`kubectl rollout restart deployment/agent`