Demo Namespace

​

Prerequisites

• Vault Enterprise 1.11 installed and unsealed
• root token available

​

Listing and Creating Namespaces via CLI

1. List existing namespaces:
   vault namespace list
   
   If none exist, you’ll see:
   No namespaces found
   
2. Create a top-level namespace named hcvop:
   vault namespace create hcvop
   
   Output:
   Key     Value
   ---     -----
   id      4clCR
   path    hcvop/
   
3. Verify it’s listed:
   vault namespace list
   
   Keys
   ----
   hcvop/
   

​

Creating Child Namespaces

vault namespace create -namespace=hcvop certification

export VAULT_NAMESPACE=hcvop
vault namespace create training

vault namespace list

Keys
----
certification/
training/

unset VAULT_NAMESPACE
vault namespace list

Keys
----
hcvop/

​

Exploring Namespaces in the UI

vault token lookup

1. Open the Vault UI.
2. Log in with your root token.
3. Click the Namespaces dropdown—you’ll see hcvop/ listed:

4. Select hcvop, re-enter your token, then switch between its certification and training child namespaces.

​

Enabling Secrets Engines in a Child Namespace

export VAULT_NAMESPACE=hcvop/certification
vault secrets list

vault secrets enable aws
vault secrets enable -path=certification-kv kv-v2

vault secrets list

​

Writing a Policy in a Namespace

vault policy write certification-policy -<<EOF
path "certification-kv/*" {
  capabilities = ["read","create","update","delete","list"]
}
EOF

​

Enabling Userpass Authentication

1. In the UI, navigate to Auth > Enable new method.
2. Select Username & Password, then click Enable:

3. Create a user Bryan with password HCVOP and attach certification-policy:

​

Logging in as the New User

• Namespace: hcvop/certification
• Method: Username & Password
• Credentials: Bryan / HCVOP

​

Extending the Policy

vault policy write certification-policy -<<EOF
path "certification-kv/*" {
  capabilities = ["read","create","update","delete","list"]
}
path "sys/policies/*" {
  capabilities = ["read","list"]
}
EOF

​

Summary

1. Add -namespace=<ns> to your Vault commands
2. Export VAULT_NAMESPACE=<ns>