About SRGTechnical articleRecruitment Information
About SRGTechnical articleRecruitment Information
HOME/Technical article/HNC has been archived.

HNC has been archived.

Ishikawa Kumo, Service Reliability Group (SRG), Media Management Division@ishikawa_kumo)is.
#SRGThe Service Reliability Group primarily provides comprehensive support for the infrastructure surrounding our media services, focusing on improving existing services, launching new ones, and contributing to open-source software.
Hierarchical Namespaces Controller(HNC)
 

Introduction

Hierarchical Namespaces Controller(以下、HNC)
HNC is a handy controller that enables hierarchical management of namespaces, and we used it at our company for things like tenant isolation. It was a tool that was highly valued in a platform engineering context, so many people will probably be surprised to hear about it.
gcr.io

What is HNC?

HNC is a tool for hierarchically managing namespaces within a Kubernetes cluster. It can propagate various policies, such as RBAC and NetworkPolicy, from parent to child namespaces, and is widely used to efficiently manage large-scale multi-tenant environments and complex microservice configurations.
for example:
  • team-a-stg
  • RBAC and NetworkPolicy settings configured in the parent can be automatically applied to child namespaces.
It can be used like this.
At our company
  • Manages the common components of ArgoCD and cert-manager.
  • Create and separate namespaces for each product.
  • Delegating Namespace management privileges to developers
I used it in situations like these. It was a convenient system that allowed me to easily and securely manage multi-tenant configurations.
Our usage examples

Archive history

A detailed discussion regarding the HNC archive took place in the following GitHub Issue.
Here, we will highlight and introduce the key points of its content.
  • At the SIG Auth meeting held on February 26, 2025, it was officially decided to archive the HNC project.
  • The main reasons are a shortage of maintainers and a lack of implementation examples.
  • Q&A
    • Are there any plans to integrate HNC into the Kubernetes core?
      • I don't have any such plans.
    • Why wasn't it included in the core?
      • Apparently, in order to be included in the core, it needed to be adopted at a level orders of magnitude more widely than it is currently.
    • alternative plan
      • Kubernetes multi-tenancy functionality varies depending on the vendor.
      • Kubernetes Core prioritizes providing extension points over controversial features like multi-tenancy.
No official forks or similar information have been confirmed to date.
However, there is a possibility that it may be relaunched as an unofficial fork by volunteers or as a separate project, so let's continue to keep an eye on it.

Technical impact

As with many open-source projects, "archived" doesn't mean "immediately unusable."
However, there is another problem with HNC this time.
Google Container Registry
Google Container Registry
  • March 18, 2025: New image writing suspended.
  • April 22, 2025: Existing image reading discontinued.← This is important!
  • Artifact Registry
hnc-manager

Alternative plans and future actions

Short-term solution: Transition to ECR

hnc-manager

Medium- to long-term measures: Consider transitioning to alternative technologies.

Accurate
Capsule
Additionally, options such as creating internal tools or using custom scripts are available, but the balance with maintenance costs needs careful consideration.

In conclusion

This article explained the following points:
  • HNC will be officially archived on April 17, 2025.
  • The latest version of HNC relies on GCR, but GCR itself will become unreadable from next Tuesday (April 22, 2025).
  • As a short-term solution, immediate migration to another registry such as ECR is recommended.
  • As a medium- to long-term measure, we recommend adopting alternative technologies such as Accurate or considering a proprietary operating method.
We kindly ask all HNC users to take action and share information.
SRG is looking for new team members. If you are interested, please contact us here.