# Enforcing Node Allocation to Specific Namespaces in Nomad Open Source

**URL:** <https://discuss.hashicorp.com/t/enforcing-node-allocation-to-specific-namespaces-in-nomad-open-source/67897>\
**Category:** Nomad\
**Created:** [June 17, 2024, 2:15pm UTC](https://discuss.hashicorp.com/t/enforcing-node-allocation-to-specific-namespaces-in-nomad-open-source/67897 "2024-06-17T14:15:10Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![namnx228](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/namnx228/32/42034_2.png) [@namnx228](https://discuss.hashicorp.com/u/namnx228)\
**Post date:** [June 17, 2024, 2:15pm UTC](https://discuss.hashicorp.com/t/enforcing-node-allocation-to-specific-namespaces-in-nomad-open-source/67897/1 "2024-06-17T14:15:10Z")

</div>

I’m working with a Nomad open source cluster that has multiple namespaces. I need to restrict certain nodes to specific namespaces. Here’s the scenario:

- Nodes `node1`, `node2`, and `node3` should be exclusively assigned to the `Dev` namespace.
- Jobs created in the `Dev` namespace should only run on `node1`, `node2`, and `node3`.
- With ACLs enabled, users with access to the `Dev` namespace should only see nodes assigned to `Dev`.

I’ve looked into node pools, which seem to help restrict job allocation. However, operators can still choose to allocate jobs to nodes in the default pool by not specifying the `node_pool` field in the job spec.

Is there a way to enforce that workloads in a namespace are strictly allocated to their assigned nodes? Any suggestions or best practices would be greatly appreciated.

---

<div class="post-metadata">

**Author:** ![Kamilcuk](https://avatars.discourse-cdn.com/v4/letter/k/f08c70/32.png) [@Kamilcuk](https://discuss.hashicorp.com/u/Kamilcuk)\
**Post date:** [June 18, 2024, 10:32pm UTC](https://discuss.hashicorp.com/t/enforcing-node-allocation-to-specific-namespaces-in-nomad-open-source/67897/2 "2024-06-18T22:32:22Z")

</div>

Hi, with Nomad enterprise there is [sentinel policies](https://developer.hashicorp.com/nomad/tutorials/governance-and-policy/sentinel), and with them you can assert specific contraints are there when running a job in specific namespace.

Bottom line, you have to run your job with a specific constraint attached to it. You just have to be consistent and make sure all your jobs have specific constraint. You could add tags to each node with the name of the namespace and make sure there is a `constraints { attribute = "${meta.namespace}" value = "the_namespace" }` in the job definitions.

You could also set nodes to be in different datacenters and run jobs with datacenters equal to the namespace, but that doesn’t sound that flexible, but may be a solution.