https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/operating/best-practices/Recent content in Best Practices on CapsuleHugo -- gohugo.ioenhttps://deploy-preview-164--docs-projectcapsule.netlify.app/docs/operating/best-practices/tenants/Mon, 01 Jan 0001 00:00:00 +0000https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/operating/best-practices/tenants/Use this complete Tenant as a starting point for application namespaces. It combines the compatible baseline policies from Workloads and Networking into one ordered spec.rules list. All namespaces in this Tenant receive the same baseline. Included Policies Area Combined configuration Resources Default CPU, memory, and ephemeral-storage requests; remove CPU limits; match memory limits to requests; default ephemeral-storage limits. Capacity Share one illustrative quota across all Tenant namespaces. QoS Deny BestEffort after resource mutation.https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/operating/best-practices/workloads/Mon, 01 Jan 0001 00:00:00 +0000https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/operating/best-practices/workloads/Use namespace rules to establish workload defaults and validate the resulting Pods. Every Capsule policy example below is a complete Tenant manifest with an owner and spec.rules. Replace solar and solar-owner with your Tenant name and owner identity. Each example is an independent configuration; to adopt multiple policies, combine their spec.rules entries into one Tenant manifest. Namespace selectors can give different namespaces different profiles; keep the labels selecting mandatory profiles under platform control.https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/operating/best-practices/networking/Mon, 01 Jan 0001 00:00:00 +0000https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/operating/best-practices/networking/Services For ordinary application namespaces, start with ClusterIP Services and expose applications through a platform-managed Gateway or Ingress. Give namespaces that need other Service types an explicit profile through Service enforcement rules. See the combined Tenant baseline for Service restrictions together with workload and namespace policies. Recommended Baseline Setting Default policy for application namespaces Reason ClusterIP Allow, including headless Services. Supports internal service discovery. NetworkPolicy still needs to control who can connect.https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/operating/best-practices/admission-policies/Mon, 01 Jan 0001 00:00:00 +0000https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/operating/best-practices/admission-policies/As Capsule we try to provide a secure multi-tenant environment out of the box, there are however some additional Admission Policies you should consider to enforce best practices in your cluster. Since Capsule only covers the core multi-tenancy features, such as Namespaces, Resource Quotas, Network Policies, and Container Registries, Classes, you should consider using an additional Admission Controller to enforce best practices on workloads and other resources. Custom Create custom Policies and reuse data provided via Tenant Status to enforce your own rules.