Namespaces

A namespace is the boundary everything lives inside: devices, members, identities, policies, tags, settings. Two namespaces share nothing.

Name and Tenant ID

Every namespace has both, and they do different jobs.

The name is human-facing and can be changed. It must be a valid hostname — lowercase, no dots — because it appears in an SSHID:

$ ssh [email protected]@cloud.shellhub.io
#          ^^^^^^^^^ the namespace name

The Tenant ID is an immutable UUID generated when the namespace is created. It is what devices, API keys and sessions actually reference.

The Tenant ID setting, with the control that copies it

Renaming a namespace changes every SSHID for it. Anything with a stored SSHID — an SSH config alias, an Ansible inventory, a script — breaks. The tenant ID does not change, so agent configuration is unaffected.

Creating one

The Create a Namespace dialog, asking for a name

Reasons to have more than one: separating customers, separating environments where the separation must be absolute, or separating teams that should not see each other’s devices. Within a single namespace, tags and access policies handle most separation without the overhead of a second workspace.

Switching

Each namespace you open is a tab at the top of the console. To open another, click + next to the tabs and pick it from the list. The namespace you’re in comes first, then the ones already open as tabs, then the rest in alphabetical order.

The new-tab picker open under the + button, listing the namespaces this account belongs to

Membership is per namespace, and so is your role — you can be an administrator in one and an observer in another.

Legacy or new

A namespace is either legacy or new, which decides how connections are authorized and how devices enroll. Namespaces created today are new. Namespaces predating identity-based access are legacy, and can be upgraded once.

A new namespace never becomes legacy. See How Authorization Works and Upgrading a Legacy Namespace.

Deleting

The Delete Namespace dialog, which asks for the namespace name before it will proceed

Deleting takes the devices, identities, policies and history with it. Only the owner can do it — an administrator cannot.

Agents keep running on the devices. They no longer have a namespace to enroll into, so stop them if the machines are staying in service.

Device limits

Self-hosted Community has no limit. The Cloud free plan is limited to 3 devices.

Where to go next

Members — Who is in the namespace.
Settings — Recording, announcements, MFA requirements.