> ## Documentation Index
> Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Demo Namespace
> This lesson covers working with Vault namespaces using CLI and UI in Vault Enterprise 1.11.
In this lesson, you’ll work with Vault namespaces using both the CLI and UI. We assume Vault Enterprise 1.11 is running locally, unsealed, and you’re authenticated as `root`.
***
## Prerequisites
* Vault Enterprise 1.11 installed and unsealed
* `root` token available
***
## Listing and Creating Namespaces via CLI
1. List existing namespaces:
```bash theme={null}
vault namespace list
```
If none exist, you’ll see:
```text theme={null}
No namespaces found
```
2. Create a top-level namespace named `hcvop`:
```bash theme={null}
vault namespace create hcvop
```
Output:
```text theme={null}
Key Value
--- -----
id 4clCR
path hcvop/
```
3. Verify it’s listed:
```bash theme={null}
vault namespace list
```
```text theme={null}
Keys
----
hcvop/
```
### Creating Child Namespaces
Method 1: use the `-namespace` flag.
```bash theme={null}
vault namespace create -namespace=hcvop certification
```
Method 2: set `VAULT_NAMESPACE`:
```bash theme={null}
export VAULT_NAMESPACE=hcvop
vault namespace create training
```
List the children under `hcvop`:
```bash theme={null}
vault namespace list
```
```text theme={null}
Keys
----
certification/
training/
```
Return to root:
```bash theme={null}
unset VAULT_NAMESPACE
vault namespace list
```
```text theme={null}
Keys
----
hcvop/
```
***
## Exploring Namespaces in the UI
Fetch your root token if needed:
```bash theme={null}
vault token lookup
```
1. Open the Vault UI.
2. Log in with your root token.
3. Click the **Namespaces** dropdown—you’ll see `hcvop/` listed:
4. Select `hcvop`, re-enter your token, then switch between its `certification` and `training` child namespaces.
***
## Enabling Secrets Engines in a Child Namespace
Target `hcvop/certification` in your shell:
```bash theme={null}
export VAULT_NAMESPACE=hcvop/certification
vault secrets list
```
Enable AWS and KV v2:
```bash theme={null}
vault secrets enable aws
vault secrets enable -path=certification-kv kv-v2
```
Confirm:
```bash theme={null}
vault secrets list
```
| Path | Type | Description |
| ----------------- | ------------- | -------------------------------- |
| aws/ | aws | AWS credential management |
| certification-kv/ | kv | Key/Value secrets engine v2 |
| cubbyhole/ | ns\_cubbyhole | Per-token private secret storage |
| identity/ | ns\_identity | Identity store |
| sys/ | ns\_system | System control & debugging |
In the UI under **Secrets**, you’ll see your enabled engines:
***
## Writing a Policy in a Namespace
Still in `hcvop/certification`, write `certification-policy`:
```bash theme={null}
vault policy write certification-policy -< Policies**, you’ll see your new policy:
***
## Enabling Userpass Authentication
Authentication methods are namespace-specific. Confirm your context is `hcvop/certification`.
1. In the UI, navigate to **Auth > Enable new method**.
2. Select **Username & Password**, then click **Enable**:
3. Create a user `Bryan` with password `HCVOP` and attach `certification-policy`:
***
## Logging in as the New User
Log out of the root session. On the UI login page:
* Namespace: `hcvop/certification`
* Method: **Username & Password**
* Credentials: `Bryan` / `HCVOP`
You’ll see only the `certification-kv/` engine. Other paths (e.g., `aws/`) will return an authorization error:
***
## Extending the Policy
To allow users to list policies:
```bash theme={null}
vault policy write certification-policy -< Policies** to confirm.
***
## Summary
You can target a namespace in two ways:
1. Add `-namespace=` to your Vault commands
2. Export `VAULT_NAMESPACE=`
Namespaces let you organize and isolate Vault resources for different teams, applications, or environments.\
Learn more: [Vault Namespaces](https://www.vaultproject.io/docs/enterprise/namespaces)