Skip to content

Namespaces support

OpenFaaS has support for multiple-namespaces.

Multiple namespaces can be used for the following use-cases:

  • multi-tenancy (must be combined with other OpenFaaS Pro security features)
  • multiple stages or environments within a single cluster with all of dev/staging/prod (to save money)
  • logical segregation of groups of functions within a single company or team (ingestion, inference, cron)

Additional configuration required

You must configure OpenFaaS to have sufficient permissions to administrate multiple namespaces, this feature will not work in a default installation.


  • Kubernetes
  • OpenFaaS Pro on Kubernetes (or faasd, see final section)

Configure OpenFaaS with additional permissions

Additional RBAC permissions are required to work with namespaces, using a ClusterRole is currently supported for multiple namespaces.

arkade install openfaas --clusterrole

Or via helm, set this override:

--set clusterRole=true

If you cannot use a ClusterRole for any reason, then feel free to ask us about OpenFaaS Pro which includes a separate configuration suitable for enterprise companies called a "Split Installation".

Create one or more additional namespaces

Each additional function namespace must be annotated, kube-system is black-listed and not available at this time.

kubectl create namespace staging-fn

kubectl annotate namespace/staging-fn openfaas="1"

kubectl create namespace dev

kubectl annotate namespace/dev openfaas="1"

Now you can use faas-cli or the API to list namespaces:

# faas-cli namespaces

 - dev
 - staging-fn
 - openfaas-fn

Deploy some functions:

# faas-cli store deploy nodeinfo --namespace dev
# faas-cli store deploy nodeinfo --namespace staging-fn
# faas-cli store deploy figlet

The URL will be as follows: http://gateway:port/function/NAME.NAMESPACE

Use a YAML file:


  name: openfaas

    namespace: dev
    skip_build: true
    image: functions/alpine:latest
    fprocess: "sha512sum"

Deploy the stack.yml and invoke the function:

faas-cli deploy

head -c 16 /dev/urandom | faas-cli invoke --namespace dev stronghash

Override the namespace configured in the stack.yml when deploying the function and test:

faas-cli deploy --namespace staging-fn

head -c 16 /dev/urandom | faas-cli invoke --namespace staging-fn stronghash

Controlling network access

You should consider whether network policies or service mesh policies are required to restrict traffic between namespaces.


Using an OpenFaaS Pro, you can enable a Profile to isolate potentially hostile functions using gVisor or Kata containers.

Namespaces in faasd

For instructions on how to manage multiple namespaces with faasd, see Serverless For Everyone Else.