[Feature] Tenant namespace management module

[sathindudezoysa]

Summary

This PR introduces the management/tenant-namespace Terraform module, providing a standardized, reusable way to provision and manage Kubernetes namespaces within a Rancher v2 project.

Previously, namespace creation lacked a unified approach for enforcing tenant guardrails. This module solves that by bundling namespace creation with strict governance controls, allowing administrators to seamlessly apply container resource limits and project-level resource quotas across multiple namespaces at once.

Closes #243

Changes

New Features:

• Bulk Provisioning: Implemented a for_each loop to dynamically provision multiple namespaces simultaneously based on a provided list.
• Resource Quotas: Added a dynamic block for resource_quota to enforce limits on Pods, ConfigMaps, Persistent Volume Claims, Services, and Storage.
• Container Limits: Added a dynamic block for container_resource_limit to set default CPU and memory requests/limits for deployments within the namespace.
• Metadata Support: Added variables to easily attach custom labels and annotations for organizational tagging.

Refactors & Improvements:

• Safeguards: Implemented local.namespaces to safely handle null inputs and convert the namespace list toset() for the for_each loop.
• Documentation: Added a comprehensive module description header outlining features, capabilities, and necessary prerequisites (e.g., the rancher2 provider and an existing project_id).

Testing

• Ran terraform fmt and terraform validate to ensure syntax and module structure are correct.
• Executed terraform plan using a test configuration passing multiple namespace names, a custom resource quota, and container limits. Verified the plan output correctly mapped all nested dynamic blocks.
• Applied the module to a non-production Rancher environment and verified via the Rancher UI/kubectl that:
  • All namespaces were created in the correct Project.
  • Quotas and limits were successfully attached.
  • Labels and annotations were correctly applied.

Checklist

• Tests / validation for the changed area pass
• Docs updated if behaviour or interfaces changed
• No secrets, tokens, or kubeconfigs committed
• No internal or other-repository names, private hostnames, or environment names included

Summary by CodeRabbit

• New Features
  • Added tenant namespace management for creating multiple namespaces within a project.
  • Supports shared descriptions, labels, annotations, and optional cluster-readiness waiting.
  • Added optional container resource limits and per-namespace resource quotas.
  • Exposes created namespaces and their IDs for use by other configurations.

[coderabbitai]

📝 Walkthrough

Walkthrough

This change adds a Terraform module that creates Rancher namespaces from normalized inputs. It supports shared metadata, cluster waiting, optional container limits, optional resource quotas, and outputs for namespace resources and IDs.

Changes

Tenant namespace management

Layer / File(s)	Summary
Namespace inputs and provider requirements modules/management/tenant-namespace/variables.tf, modules/management/tenant-namespace/versions.tf	Defines project, namespace, metadata, cluster-wait, container-limit, and resource-quota inputs. Requires Terraform 1.5 or newer and declares Rancher2, Harvester, and Kubernetes providers.
Namespace creation and resource settings modules/management/tenant-namespace/main.tf	Normalizes namespace names and creates one rancher2_namespace resource per name. Applies metadata, cluster-wait settings, optional container limits, and optional resource quotas.
Namespace outputs modules/management/tenant-namespace/outputs.tf	Exports the created namespace resources and a map of namespace names to IDs.

Estimated code review effort: 3 (Moderate) | ~20 minutes

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Linked Issues check	⚠️ Warning	The module uses shared limits and list(string), so it does not implement per-namespace quotas, remainder distribution, aggregate validation, or per-namespace application [#243].	Refactor namespaces to per-namespace objects and implement explicit-quota summing, remainder distribution, aggregate preconditions, and per-key quota application.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Out of Scope Changes check	✅ Passed	No unrelated code changes are evident; all additions support namespace provisioning and namespace governance.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Title check	✅ Passed	The title clearly identifies the primary change: a tenant namespace management Terraform module.
Description check	✅ Passed	The description includes the required summary, changes, testing, and checklist sections with relevant details.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@modules/management/tenant-namespace/main.tf`:
- Around line 30-31: Update the labels configuration in the tenant namespace
resource to merge var.labels first, then set the required
"field.cattle.io/projectId" label from var.project_id so caller-provided labels
cannot override it; leave annotations unchanged.

In `@modules/management/tenant-namespace/variables.tf`:
- Around line 6-15: Replace the names-only namespaces input with per-namespace
quota configuration, and add a project-level quota input. Derive each
namespace’s quota from its explicit values or the remaining project quota when
unspecified, then validate the aggregate explicit and calculated quotas do not
exceed the project quota before creating rancher2_namespace.this resources.
Update the resource_quota usage in main.tf so each namespace receives only its
calculated quota rather than one shared object.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 6bb304bf-b06e-4214-a49f-88e7279364b9

📥 Commits

Reviewing files that changed from the base of the PR and between 25cb78e and e3aa067.

📒 Files selected for processing (4)

• modules/management/tenant-namespace/main.tf
• modules/management/tenant-namespace/outputs.tf
• modules/management/tenant-namespace/variables.tf
• modules/management/tenant-namespace/versions.tf

[sathindudezoysa]

Implementing asymmetric resource and container limits within a single module execution specifically, adding local math to sum explicit limits, subtract them from the project total, and auto-split the remainder. significantly increases the complexity of our Terraform logic. It makes the module harder to read, maintain, and troubleshoot if validation errors occur.

Instead of building this complex logic into a single "one-size-fits-all" module, we should create a custom module dedicated exclusively to creating namespaces under a project.

How the New Design Works

Keep it Simple and Uniform: The custom module will be designed to create multiple namespaces, but it will apply the same resource and container limits to every namespace defined within that specific module block.

Handling Different Quotas:

• If a user needs to create a namespace (or a group of namespaces) with different quota limits, they do not need complex map objects. Instead, they simply create a new section (instantiate the module again) with the specific limits required.

Example Usage

Under this design, users achieve asymmetric quotas by composing multiple simple blocks rather than writing one complex block:

# Section 1: Standard namespaces with uniform limits
module "standard_namespaces" {
  source           = "./modules/rancher-namespace"
  project_id       = var.project_id
  namespaces       = ["backend", "frontend"]
  cpu_limit        = "2"
  memory_limit     = "4Gi"
}

# Section 2: A specialized namespace with custom limits
module "data_namespace" {
  source           = "./modules/rancher-namespace"
  project_id       = var.project_id
  namespaces       = ["database"]
  cpu_limit        = "8"         # Higher custom limit
  memory_limit     = "16Gi"      # Higher custom limit
}

[HiranAdikari]

Just noticed, this is pointing at the wrong branch (main), because all the Terraform code go into the terraform branch. Please look into pushing the changes to it instead.

[sathindudezoysa]

Noted !
Creating a new PR for terraform branch