https://deploy-preview-164--docs-projectcapsule.netlify.app/Recent content in Project Capsule on CapsuleHugo -- gohugo.ioenhttps://deploy-preview-164--docs-projectcapsule.netlify.app/docs/proxy/setup/installation/Thu, 05 Jan 2017 00:00:00 +0000https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/proxy/setup/installation/Capsule Proxy is an optional add-on of the main Capsule Operator, so make sure you have a working instance of Capsule before attempting to install it. Use the capsule-proxy only if you want Tenant Owners to list their Cluster-Scope resources. The capsule-proxy can be deployed in standalone mode, e.g. running as a pod bridging any Kubernetes client to the APIs server. Optionally, it can be deployed as a sidecar container in the backend of a dashboard.https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/replications/global/Mon, 01 Jan 0001 00:00:00 +0000https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/replications/global/Overview GlobalTenantResource is a cluster-scoped CRD designed for cluster administrators. It lets you automatically replicate Kubernetes resources - such as Secrets, ConfigMaps, or custom resources - into the Namespaces of selected Tenants. Tenant owners cannot create GlobalTenantResource objects; for tenant-scoped replication, see TenantResource. The diagram below shows that an Administrator can create a GlobalTenantResource. In the GlobalTenantResource spec, an Administrator specifies which resource they would like to replicate, and where this resource should be replicated to.https://deploy-preview-164--docs-projectcapsule.netlify.app/project/contributions/guidelines/Mon, 01 Jan 0001 00:00:00 +0000https://deploy-preview-164--docs-projectcapsule.netlify.app/project/contributions/guidelines/The following guidelines outline the semantics and processes which apply to technical contributions to the project. Supported Versions Versions follow Semantic Versioning terminology and are expressed as x.y.z: where x is the major version y is the minor version and z is the patch version Security fixes, may be backported to the three most recent minor releases, depending on severity and feasibility. Prereleases are marked as -rc.x (release candidate) and may refer to any type of version bump.https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/operating/setup/installation/Mon, 01 Jan 0001 00:00:00 +0000https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/operating/setup/installation/Requirements Helm 3 is required when installing the Capsule Operator chart. Follow Helm’s official documentation for installing Helm on your operating system. A Kubernetes cluster (v1.16+) with the following Admission Controllers enabled: PodNodeSelector LimitRanger ResourceQuota MutatingAdmissionWebhook ValidatingAdmissionWebhook A Kubeconfig file accessing the Kubernetes cluster with cluster admin permissions. Cert-Manager is required by default but can be disabled. It is used to manage the TLS certificates for the Capsule Admission Webhooks. Installation We officially only support the installation of Capsule using the Helm chart.https://deploy-preview-164--docs-projectcapsule.netlify.app/project/resources/Mon, 01 Jan 0001 00:00:00 +0000https://deploy-preview-164--docs-projectcapsule.netlify.app/project/resources/Meet the community 📅 Join an upcoming event or catch up on what recently happened in the Capsule community. Upcoming opportunities to meet the Project Capsule community. The list is sorted automatically from the shared event data. Upcoming events 2 Oct 27 2026 Swiss Dev Confederation 🇨🇭 27 October 2026 Together with a long-term adopter, we will demonstrate how Capsule can enhance the multi-tenancy experience with Red Hat OpenShift. Nov 9–12 2026 KubeCon + CloudNativeCon North America 🇺🇸 9–12 November 2026https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/operating/best-practices/tenants/Mon, 01 Jan 0001 00:00:00 +0000https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/operating/best-practices/tenants/Use this complete Tenant as a starting point for application namespaces. It combines the compatible baseline policies from Workloads and Networking into one ordered spec.rules list. All namespaces in this Tenant receive the same baseline. Included Policies Area Combined configuration Resources Default CPU, memory, and ephemeral-storage requests; remove CPU limits; match memory limits to requests; default ephemeral-storage limits. Capacity Share one illustrative quota across all Tenant namespaces. QoS Deny BestEffort after resource mutation.https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/whats-new/Mon, 01 Jan 0001 00:00:00 +0000https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/whats-new/Events 📅 Upcoming opportunities to meet the Project Capsule community. The list is sorted automatically from the shared event data. Subscribe to event updates Upcoming events 2 Oct 27 2026 Swiss Dev Confederation 🇨🇭 27 October 2026 Together with a long-term adopter, we will demonstrate how Capsule can enhance the multi-tenancy experience with Red Hat OpenShift. Nov 9–12 2026 KubeCon + CloudNativeCon North America 🇺🇸 9–12 November 2026 Visit the Project Capsule kiosk in the Solutions Showcase.https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/rules/enforcement/workloads/Mon, 01 Jan 0001 00:00:00 +0000https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/rules/enforcement/workloads/Workload enforcement is configured under spec.rules[].enforce.workloads. Use targets to select native workload kinds or locations inside their Pod specs. A targets-only rule matches the selected kinds themselves. When workload policies are present, targets scope those policies: resource management, OCI registries, scheduler names, QoS, placement, security profiles, and PodDisruptionBudgets. Rules use the shared namespace selection, audiences, conditions, and actions and order. See Reference for a complete Tenant example. Rule Composition Actions and order Rules are evaluated in declaration order after namespace selection, audience, and condition filtering.https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/rules/mutate/workloads/Mon, 01 Jan 0001 00:00:00 +0000https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/rules/mutate/workloads/Workload mutations set Pod properties under spec.rules[].mutate[].workloads using native Kubernetes Pod syntax. Use placement settings to select schedulers, assign node pools, add tolerations, spread workloads across topology domains, and configure affinity. Use security settings to configure Pod user namespaces, seccomp/AppArmor profiles, and read-only container root filesystems. Use registry settings to configure container image pull policies and Pod image pull secret references. Placement enforcement validates the resulting placement settings using matchers.https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/proxy/proxysettings/Tue, 20 Feb 2024 00:00:00 +0000https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/proxy/proxysettings/The configuration for the Proxy is also declarative via CRDs. This allows both Administrators and Tenant Owners to create flexible rules. GlobalProxySettings GlobalProxySettings grants selected subjects read access to labelled, cluster-scoped resources through Capsule Proxy. A subject does not have to own a Tenant, which makes this resource useful for shared infrastructure and project-wide views of resources such as PersistentVolumes, StorageClasses, ResourcePools, and Capsule global quota resources. The ProxyClusterScoped feature gate must be enabled on Capsule Proxy:https://deploy-preview-164--docs-projectcapsule.netlify.app/project/contributions/adoption/Mon, 01 Jan 0001 00:00:00 +0000https://deploy-preview-164--docs-projectcapsule.netlify.app/project/contributions/adoption/Have your tried Capsule or are you using it in your project or company? Please consider adding your project/company to the list of adopters. This helps the Capsule community understand who is using Capsule and how it is being used. Adding yourself In the adopters.yaml file you can add yourself as an adopter of the project. You just need to add an entry for your company and upon merging it will automatically be added to our website.https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/operating/concepts/architecture/Mon, 01 Jan 0001 00:00:00 +0000https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/operating/concepts/architecture/Key Decisions Introducing a new separation of duties can lead to a significant paradigm shift. This has technical implications and may also impact your organizational structure. Therefore, when designing a multi-tenant platform pattern, carefully consider the following aspects. As Cluster Administrator, ask yourself: 🔑 How much ownership can be delegated to Tenant Owners (Platform Users)? The answer to this question may be influenced by the following aspects: Are the Cluster Administrators willing to grant permissions to Tenant Owners?https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/operating/setup/configuration/Mon, 01 Jan 0001 00:00:00 +0000https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/operating/setup/configuration/The configuration for the capsule controller is done via its dedicated configuration Custom Resource. You can explain the configuration options and how to use them: CapsuleConfiguration The configuration for Capsule is done via its dedicated configuration Custom Resource. You can explain the configuration options and how to use them: kubectl explain capsuleConfiguration.spec administrators These entities are automatically owners for all existing tenants. Meaning they can add namespaces to any tenant. However they must be specific by using the capsule label for interacting with namespaces.https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/proxy/setup/options/Mon, 01 Jan 0001 00:00:00 +0000https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/proxy/setup/options/You can customize the Capsule Proxy with the following configurations. Controller Options You can provide additional options via the helm chart: options: extraArgs: - --disable-caching=true Options are also available as dedicated configuration values: # Controller Options options: # -- Set the listening port of the capsule-proxy listeningPort: 9001 # -- Set leader election to true if you are running n-replicas leaderElection: false # -- Set the log verbosity of the capsule-proxy with a value from 1 to 10 logLevel: 4 # -- Name of the CapsuleConfiguration custom resource used by Capsule, required to identify the user groups capsuleConfigurationName: default # -- Define which groups must be ignored while proxying requests ignoredUserGroups: [] # -- Names of the groups which are not used for impersonation (considered after impersonation-group-regexp) ignoredImpersonationGroups: [] # -- Regular expression to match the groups which are considered for impersonation impersonationGroupRegexp: "" # -- Specify if capsule-proxy will use SSL oidcUsernameClaim: preferred_username # -- Specify if capsule-proxy will use SSL enableSSL: true # -- Set the directory, where SSL certificate and keyfile will be located SSLDirectory: /opt/capsule-proxy # -- Set the name of SSL certificate file SSLCertFileName: tls.https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/quickstart/extended/Mon, 01 Jan 0001 00:00:00 +0000https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/quickstart/extended/Optional This page builds on the basic quickstart. It shows more of what Capsule can do once you have a working Tenant. The examples below extend the solar Tenant from the quickstart. Apply each section on top of the existing Tenant with kubectl apply. Pod Security Standards Read More Kubernetes Pod Security Standards (PSS) control what security contexts are allowed in a namespace. Capsule can enforce a PSS level per environment and even manage a label so users cannot override it.https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/rules/enforcement/metadata/Mon, 01 Jan 0001 00:00:00 +0000https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/rules/enforcement/metadata/Metadata enforcement is configured under spec.rules[].enforce.metadata. Use Metadata Targets to select resource kinds, then configure labels and annotations, including defaults, managed values, required keys, and value validation. Migration covers the legacy Namespace, Pod, and Service metadata options. Rules use the shared namespace selection, audiences, conditions, and actions and order. See Reference for a complete Tenant example. Rule Composition Actions and order Metadata rules are evaluated in declaration order after namespace selection, audience, and condition filtering.https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/tenants/namespaces/Mon, 01 Jan 0001 00:00:00 +0000https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/tenants/namespaces/Assignment Alice, once logged with her credentials, can create a new Namespace in her Tenant, as simply issuing: kubectl create ns solar-production Alice started the name of the Namespace prepended by the name of the Tenant: this is not a strict requirement but it is highly suggested because it is likely that many different Tenants would like to call their Namespaces production, test, or demo, etc. The enforcement of this naming convention is optional and can be controlled by the cluster administrator with forceTenantPrefix option.https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/replications/tenant/Mon, 01 Jan 0001 00:00:00 +0000https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/replications/tenant/Overview TenantResource is a namespace-scoped CRD that lets Tenant owners automatically replicate Kubernetes resources across all Namespaces in their Tenant - without manual distribution or custom automation. It is the tenant-level counterpart to GlobalTenantResource, which is reserved for cluster administrators. The diagram below shows that an Administrator or a Tenant Owner can create a TenantResource inside a Tenant. In the TenantResource spec, a user specifies which resource they would like to replicate across the Tenant.https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/operating/best-practices/workloads/Mon, 01 Jan 0001 00:00:00 +0000https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/operating/best-practices/workloads/Use namespace rules to establish workload defaults and validate the resulting Pods. Every Capsule policy example below is a complete Tenant manifest with an owner and spec.rules. Replace solar and solar-owner with your Tenant name and owner identity. Each example is an independent configuration; to adopt multiple policies, combine their spec.rules entries into one Tenant manifest. Namespace selectors can give different namespaces different profiles; keep the labels selecting mandatory profiles under platform control.https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/proxy/reflection/Tue, 20 Feb 2024 00:00:00 +0000https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/proxy/reflection/Namespace RoleBinding reflection allows users and groups to list every Namespace in which they are referenced by a RoleBinding. The user does not need to be a Tenant Owner. Enable the reflector in the Helm values: options: roleBindingReflector: true Alternatively, pass the corresponding command-line argument: --enable-reflector=true Namespaces The functionality of allowing access to other Namespaces is achieved by enabling the RoleBinding Reflector, which allows the Capsule Proxy to list the namespaces where a rolebinding mentions a user.https://deploy-preview-164--docs-projectcapsule.netlify.app/project/contributions/addons/Mon, 01 Jan 0001 00:00:00 +0000https://deploy-preview-164--docs-projectcapsule.netlify.app/project/contributions/addons/Have you written an operator or some other automation which integrates with the capsule core project? Feel free to add your addon to the capsule ecosystem overview Adding an addon In the addons.yaml file you can add an addon to the ecosystem. You just need to add an entry for your addon and upon merging it will automatically be added to our website. To add your organization follow these steps:https://deploy-preview-164--docs-projectcapsule.netlify.app/project/governance/Mon, 01 Jan 0001 00:00:00 +0000https://deploy-preview-164--docs-projectcapsule.netlify.app/project/governance/The Capsule project is dedicated to creating a multi-tenancy and policy-based framework for Kubernetes. This governance explains how the project is run. Values Maintainers Becoming a Maintainer Removing a Maintainer Meetings CNCF Resources Code of Conduct Security Response Team Voting Modifying this Charter Values The Capsule and its leadership embrace the following values: Openness: Communication and decision-making happens in the open and is discoverable for future reference. As much as possible, all discussions and work take place in public Slack channels and open repositories.https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/operating/best-practices/networking/Mon, 01 Jan 0001 00:00:00 +0000https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/operating/best-practices/networking/Services For ordinary application namespaces, start with ClusterIP Services and expose applications through a platform-managed Gateway or Ingress. Give namespaces that need other Service types an explicit profile through Service enforcement rules. See the combined Tenant baseline for Service restrictions together with workload and namespace policies. Recommended Baseline Setting Default policy for application namespaces Reason ClusterIP Allow, including headless Services. Supports internal service discovery. NetworkPolicy still needs to control who can connect.https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/tenants/permissions/Mon, 01 Jan 0001 00:00:00 +0000https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/tenants/permissions/Administrators Administrators are users that have full control over all Tenants and their namespaces. They are typically cluster administrators or operators who need to manage the entire cluster and all its Tenants. However as administrator you are automatically Owner of all Tenants.Tenants This means that administrators can create, delete, and manage namespaces and other resources within any Tenant, given you are using label assignments for tenants. Ownership Capsule introduces the principal, that tenants must have owners (Tenant Owners).https://deploy-preview-164--docs-projectcapsule.netlify.app/project/branding/Mon, 01 Jan 0001 00:00:00 +0000https://deploy-preview-164--docs-projectcapsule.netlify.app/project/branding/Find all the available artworks and logos for the project in the CNCF Logo repository: https://github.com/cncf/artwork/tree/main/projects/capsulehttps://deploy-preview-164--docs-projectcapsule.netlify.app/docs/operating/authentication/Mon, 01 Jan 0001 00:00:00 +0000https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/operating/authentication/Capsule does not care about the authentication strategy used in the cluster and all the Kubernetes methods of authentication are supported. The only requirement to use Capsule is to assign tenant users to the group defined by userGroups option in the CapsuleConfiguration, which defaults to projectcapsule.dev. OIDC In the following guide, we’ll use Keycloak an Open Source Identity and Access Management server capable to authenticate users via OIDC and release JWT tokens as proof of authentication.https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/operating/setup/authentication/Mon, 01 Jan 0001 00:00:00 +0000https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/operating/setup/authentication/Capsule does not care about the authentication strategy used in the cluster and all the Kubernetes methods of authentication are supported. The only requirement to use Capsule is to assign tenant users to the group defined by userGroups option in the CapsuleConfiguration, which defaults to projectcapsule.dev. OIDC In the following guide, we’ll use Keycloak an Open Source Identity and Access Management server capable to authenticate users via OIDC and release JWT tokens as proof of authentication.https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/proxy/gangplank/Mon, 01 Jan 0001 00:00:00 +0000https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/proxy/gangplank/Gangplank is a web application that allows users to authenticate with an OIDC provider and configure their kubectl configuration file with the OpenID Connect Tokens. Gangplank is based on Gangway, which is no longer maintained. Prerequisites For Authentication you will need a Confidential OIDC client configured in your OIDC provider, such as Keycloak, Dex, or Google Cloud Identity. By default the Kubernetes API only validates tokens against a Public OIDC client, so you will need to configure your OIDC provider to allow the Gangplank client to issue tokens.https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/operating/operations/monitoring/Mon, 01 Jan 0001 00:00:00 +0000https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/operating/operations/monitoring/The Capsule dashboard allows you to track the health and performance of Capsule manager and tenants, with particular attention to resources saturation, server responses, and latencies. Prometheus and Grafana are requirements for monitoring Capsule. OpenTelemetry Tracing Capsule can export OpenTelemetry traces for admission webhook requests through the OTLP gRPC exporter. Enable tracing with manager.options.tracing.enabled=true and set manager.options.tracing.endpoint to your collector or tracing backend, for example tempo.monitoring-system.svc:4317. The exporter supports insecure transport for local clusters, TLS server name overrides, gzip compression, export timeouts, custom OTLP headers, and basic authentication.https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/rules/enforcement/network/Mon, 01 Jan 0001 00:00:00 +0000https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/rules/enforcement/network/Network enforcement covers three policy groups under spec.rules[].enforce: Policy Configuration path Network Policies network.policies.ingress.cidrs, network.policies.egress.cidrs Services services Ingress ingress Use these policies to control ingress and egress CIDR grants, Service types and addresses, and hostnames on ingress resources. Reference provides a complete Tenant example for each policy group. Rules use the shared namespace selection, audiences, conditions, and actions and order. Rule Composition Actions and order Rules are evaluated in declaration order after namespace selection, audience, and condition filtering.https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/tenants/administration/Mon, 01 Jan 0001 00:00:00 +0000https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/tenants/administration/Cordoning Bill needs to cordon a Tenant and its Namespaces for several reasons: Avoid accidental resource modification(s) including deletion during a Production Freeze Window During the Kubernetes upgrade, to prevent any workload updates During incidents or outages During planned maintenance of a dedicated nodes pool in a BYOD scenario With the default installation of Capsule all CREATE, UPDATE and DELETE operations performed by Capsule Users are dropped. Any Updates to Subresources (i.https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/operating/backup-restore/Mon, 01 Jan 0001 00:00:00 +0000https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/operating/backup-restore/Velero is a backup and restore solution that performs data protection, disaster recovery and migrates Kubernetes cluster from on-premises to the Cloud or between different Clouds. When coming to backup and restore in Kubernetes, we have two main requirements: Configurations backup Data backup The first requirement aims to backup all the resources stored into etcd database, for example: namespaces, pods, services, deployments, etc. The second is about how to backup stateful application data as volumes.https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/operating/operations/backup-restore/Mon, 01 Jan 0001 00:00:00 +0000https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/operating/operations/backup-restore/Velero is a backup and restore solution that performs data protection, disaster recovery and migrates Kubernetes cluster from on-premises to the Cloud or between different Clouds. When coming to backup and restore in Kubernetes, we have two main requirements: Configurations backup Data backup The first requirement aims to backup all the resources stored into etcd database, for example: namespaces, pods, services, deployments, etc. The second is about how to backup stateful application data as volumes.https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/rules/enforcement/storage/Mon, 01 Jan 0001 00:00:00 +0000https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/rules/enforcement/storage/Storage enforcement is configured under spec.rules[].enforce.storage. Persistent Volumes covers default Tenant isolation and additional volume access for PVs without a Tenant label. Rules use the shared namespace selection, audiences, conditions, and actions and order. See Reference for a complete Tenant example. Rule Composition Actions and order Storage rules use the existing ordered action evaluation, but affect only additional access to PVs without a Tenant label: Action Effect on additional access allow Grants access when the selector, audience, namespace selection, and all conditions match.https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/tenants/metadata/Mon, 01 Jan 0001 00:00:00 +0000https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/tenants/metadata/Managed By default all namespaced resources within a Namespace which are part of a Tenant labeled at admission with the following labels: capsule.clastix.io/managed-by: <tenant-name> (Legacy label) projectcapsule.dev/tenant: <tenant-name> The labels are used by Capsule to identify resources belonging to a specific tenant. This is currently important for the Capsule Proxy to filter resources accordingly. Namespaces ManagedMetadataOnly Disallows any further metadata to be added to the Namespaces created by the tenant owners.https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/operating/concepts/parameter-schema/Mon, 01 Jan 0001 00:00:00 +0000https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/operating/concepts/parameter-schema/Capsule parameter schemas define the contract between a template and the values submitted by a consuming API object. Resource Permits currently use spec.paramSchema to validate ResourcePermit.spec.params before context loading and rendering. spec.paramSchema on the referenced template is the complete contract for ResourcePermit.spec.params. It accepts JSON Schema 2020-12 keywords, Kubernetes-compatible x-kubernetes-validations CEL rules, and Capsule’s x-capsule-form presentation extension. Capsule validates parameters during ResourcePermit admission, before loading context or rendering resources. Invalid parameters are rejected and no ResourcePermit is created.https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/tenants/rules/Mon, 01 Jan 0001 00:00:00 +0000https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/tenants/rules/Rules documentation The Rules documentation is the main reference for the rules API. Find all mutation and enforcement properties there, together with conditions, audiences, and rule evaluation order. This page covers Tenant-specific configuration through Tenant.spec.rules: namespace selection, templating, and quota generation. Enforcement rules allow Bill, the cluster administrator, to set policies and restrictions on a per-Tenant basis. These rules are enforced by Capsule admission webhooks when Alice, the TenantOwner, creates or modifies resources in her Namespaces.https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/operating/concepts/managed-resources/Mon, 01 Jan 0001 00:00:00 +0000https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/operating/concepts/managed-resources/Capsule uses a shared resource manager to apply Kubernetes objects, track their ownership, and prune them when they leave scope. TenantResource, GlobalTenantResource, ResourcePermitTemplate, and GlobalResourcePermitTemplate share spec.resources[].policy. Each block controls its generated resources, allowing namespaces within a tenant to receive different configuration and lifecycle behavior. Apply and ownership model Capsule uses Kubernetes server-side apply (SSA) with a stable field manager for each managing parent. A ResourcePermit manager is derived from the request UID:https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/operating/best-practices/admission-policies/Mon, 01 Jan 0001 00:00:00 +0000https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/operating/best-practices/admission-policies/As Capsule we try to provide a secure multi-tenant environment out of the box, there are however some additional Admission Policies you should consider to enforce best practices in your cluster. Since Capsule only covers the core multi-tenancy features, such as Namespaces, Resource Quotas, Network Policies, and Container Registries, Classes, you should consider using an additional Admission Controller to enforce best practices on workloads and other resources. Custom Create custom Policies and reuse data provided via Tenant Status to enforce your own rules.https://deploy-preview-164--docs-projectcapsule.netlify.app/project/commitment/Mon, 01 Jan 0001 00:00:00 +0000https://deploy-preview-164--docs-projectcapsule.netlify.app/project/commitment/Our commitment is to deliver a robust, stable Tenancy specification that serves as a foundational platform for a wide range of automation use cases in multi-tenant environments. Rather than focusing on niche scenarios, our project addresses the fundamental aspects that are universally required, including: Streamlined Permissions Management: Efficiently governing access control across diverse namespaces (tenants). Comprehensive Resource Oversight: Facilitating seamless resource management across multiple tenants. Exceptional User Experience: Prioritizing intuitive design and ease of use.https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/operating/concepts/known-metadata/Mon, 01 Jan 0001 00:00:00 +0000https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/operating/concepts/known-metadata/Labels Labels commonly used in Capsule items are listed below. These labels are applied to the corresponding resources by the Capsule controller and can be used for filtering and selection purposes. capsule.clastix.io/tenant Description Target Objects Audience Established the connection between Object and Tenant. It’s value indicates the owning Tenant * Namespaces having a relationship to Tenants Controller projectcapsule.dev/tenant Description Target Objects Audience Established the connection between Object and Tenant. It’s value indicates the owning Tenant.https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/permits/templates/Mon, 01 Jan 0001 00:00:00 +0000https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/permits/templates/A template describes what Capsule renders for a ResourcePermit, who executes it, and how long the resulting resources may remain active. Choose the template scope Use ResourcePermitTemplate when the workflow and its execution identity belong to one namespace. Use GlobalResourcePermitTemplate when platform administrators provide the same workflow to several namespaces. Behavior ResourcePermitTemplate GlobalResourcePermitTemplate Scope Namespaced Cluster Request location Same namespace Any allowed namespace ServiceAccount reference Name only, in the template namespace Name and namespace Namespace selectors/status Not applicable Supported Ready condition and observed generation Supported Supported A minimal local template renders its namespaced targets into the ResourcePermit namespace when metadata.https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/operating/concepts/templating/Mon, 01 Jan 0001 00:00:00 +0000https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/operating/concepts/templating/Fast Templates For simple template cases we provide a fast templating engine. With this engine, you can use Go templates syntax to reference Tenant and Namespace fields. There are no operators or anything else supported. Available fields are: {{tenant.name}}: The Name of the Tenant {{namespace}}: The Name of the namespace within the tenant (current context) Sprout Templating Our template library is mainly based on the upstream implementation from Sprout. You can find the all available functions here:https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/operating/setup/openshift/Mon, 01 Jan 0001 00:00:00 +0000https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/operating/setup/openshift/Introduction Capsule is a Kubernetes multi-tenancy operator that enables secure namespace-as-a-service in Kubernetes clusters. When combined with OpenShift’s robust security model, it provides an excellent platform for multi-tenant environments. This guide demonstrates how to deploy Capsule and Capsule Proxy on OpenShift using the nonroot-v2 and restricted-v2 SecurityContextConstraint (SCC), ensuring tenant owners operate within OpenShift’s security boundaries. Why Capsule on OpenShift While OpenShift can already be configured for multi-tenancy (for example with Kyverno), Capsule takes it a step further and makes it easier to manage.https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/operating/setup/rancher/Mon, 01 Jan 0001 00:00:00 +0000https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/operating/setup/rancher/The integration between Rancher and Capsule, aims to provide a multi-tenant Kubernetes service to users, enabling: a self-service approach access to cluster-wide resources to end-users. Tenant users will have the ability to access Kubernetes resources through: Rancher UI Rancher Shell Kubernetes CLI On the other side, administrators need to manage the Kubernetes clusters through Rancher. Rancher provides a feature called Projects to segregate resources inside a common domain. At the same time Projects doesn’t provide way to segregate Kubernetes cluster-scope resources.https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/permits/requests/Mon, 01 Jan 0001 00:00:00 +0000https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/permits/requests/A ResourcePermit is namespaced. Its namespace is the authorization boundary for creating the request and the default destination for namespaced resources rendered by its template. A request may also create cluster-scoped resources. Lifecycle The normal lifecycle is deliberately small: Phase Meaning Created Accepted by admission; Capsule is resolving and rendering the request Requested Ready for manual review Pending Reserved for a system-held request Denied A reviewer denied the request Approved Approved and waiting for activation Active The rendered resources are being managed Failed A resource preflight or activation failed and may be retried Retrying A caller requested another preflight or activation attempt Expired Access ended; cleanup and retention apply Creationhttps://deploy-preview-164--docs-projectcapsule.netlify.app/docs/operating/setup/managed-kubernetes/Mon, 01 Jan 0001 00:00:00 +0000https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/operating/setup/managed-kubernetes/Capsule Operator can be easily installed on a Managed Kubernetes Service. Since you do not have access to the Kubernetes APIs Server, you should check with the provider of the service: the default cluster-admin ClusterRole is accessible the following Admission Webhooks are enabled on the APIs Server: PodNodeSelector LimitRanger ResourceQuota MutatingAdmissionWebhook ValidatingAdmissionWebhook AWS EKS This is an example of how to install AWS EKS cluster and one user manged by Capsule.https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/proxy/reference/Mon, 01 Jan 0001 00:00:00 +0000https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/proxy/reference/Packages: capsule.clastix.io/v1beta1 capsule.clastix.io/v1beta1 Resource Types: GlobalProxySettings ProxySetting GlobalProxySettings GlobalProxySettings is the Schema for the globalproxysettings API. Name Type Description Required apiVersion string capsule.clastix.io/v1beta1 true kind string GlobalProxySettings true metadata object Refer to the Kubernetes API documentation for the fields of the metadata field. true spec object GlobalProxySettingsSpec defines the desired state of GlobalProxySettings. false status object GlobalProxySettingsStatus defines the observed state of GlobalProxySettings. false GlobalProxySettings.spec GlobalProxySettingsSpec defines the desired state of GlobalProxySettings.https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/reference/Mon, 01 Jan 0001 00:00:00 +0000https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/reference/Packages: capsule.clastix.io/v1beta2 capsule.clastix.io/v1beta1 capsule.clastix.io/v1beta2 Resource Types: CapsuleConfiguration CustomQuota GlobalCustomQuota GlobalResourceQuota GlobalTenantResource QuantityLedger ResourcePoolClaim ResourcePool RuleStatus TenantOwner TenantResource Tenant CapsuleConfiguration CapsuleConfiguration is the Schema for the Capsule configuration API. Name Type Description Required apiVersion string capsule.clastix.io/v1beta2 true kind string CapsuleConfiguration true metadata object Refer to the Kubernetes API documentation for the fields of the metadata field. true spec object CapsuleConfigurationSpec defines the Capsule configuration. true status object CapsuleConfigurationStatus defines the Capsule configuration status.https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/tenants/enforcement/Mon, 01 Jan 0001 00:00:00 +0000https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/tenants/enforcement/Deprecated This page covers legacy enforcement configuration. Use Rules for all current policy and restriction management. Scheduling LimitRanges This feature will be deprecated in a future release of Capsule. Instead use TenantReplications Bill, the cluster admin, can also set Limit Ranges for each Namespace in Alice’s Tenant by defining limits for pods and containers in the Tenant spec: apiVersion: capsule.clastix.io/v1beta2 kind: Tenant metadata: name: solar spec: ... limitRanges: items: - limits: - type: Pod min: cpu: "50m" memory: "5Mi" max: cpu: "1" memory: "1Gi" - limits: - type: Container defaultRequest: cpu: "100m" memory: "10Mi" default: cpu: "200m" memory: "100Mi" min: cpu: "50m" memory: "5Mi" max: cpu: "1" memory: "1Gi" - limits: - type: PersistentVolumeClaim min: storage: "1Gi" max: storage: "10Gi" Limits will be inherited by all the Namespaces created by Alice.https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/tenants/quotas/Mon, 01 Jan 0001 00:00:00 +0000https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/tenants/quotas/With help of Capsule, Bill, the cluster admin, can set and enforce resources quota and limits for Alice’s Tenant. Resource Quota Deprecated This feature will be deprecated in a future release of Capsule. Instead use Rules Quota. Migration Guide Here With help of Capsule, Bill, the cluster admin, can set and enforce resources quota and limits for Alice’s Tenant. Set resources quota for each Namespace in the Alice’s Tenant by defining them in the Tenant spec:https://deploy-preview-164--docs-projectcapsule.netlify.app/ecosystem/integrations/argocd/Mon, 01 Jan 0001 00:00:00 +0000https://deploy-preview-164--docs-projectcapsule.netlify.app/ecosystem/integrations/argocd/Integration Resource Actions You may provide Custom Resource Actions for Capsule specific resources and interactions. Namespace Resource Actions With the following configuration, ArgoCD will show Cordon and Resume actions for the Namespace resource. The Cordon action will set the projectcapsule.dev/cordoned label to true, while the Resume action will set it to false. This is only for Namespaces part of a Capsule Tenant. resource.customizations.actions.Namespace: | mergeBuiltinActions: true discovery.lua: | actions = { cordon = { iconClass = "fa fa-solid fa-pause", disabled = true, }, uncordon = { iconClass = "fa fa-solid fa-play", disabled = true, }, } local function has_managed_ownerref() if obj.https://deploy-preview-164--docs-projectcapsule.netlify.app/ecosystem/integrations/crossplane/Mon, 01 Jan 0001 00:00:00 +0000https://deploy-preview-164--docs-projectcapsule.netlify.app/ecosystem/integrations/crossplane/https://deploy-preview-164--docs-projectcapsule.netlify.app/ecosystem/integrations/dashboard/Mon, 01 Jan 0001 00:00:00 +0000https://deploy-preview-164--docs-projectcapsule.netlify.app/ecosystem/integrations/dashboard/This guide works with the kubernetes dashboard v2.0.0 (Chart 6.0.8). It has not yet been tested successfully with with v3.x version of the dashboard. We recommend to use Headlamp as a more modern alternative to the Kubernetes Dashboard. This guide describes how to integrate the Kubernetes Dashboard and Capsule Proxy with OIDC authorization. OIDC Authentication Your cluster must also be configured to use OIDC Authentication for seamless Kubernetes RBAC integration.https://deploy-preview-164--docs-projectcapsule.netlify.app/ecosystem/integrations/envoy-gateway/Mon, 01 Jan 0001 00:00:00 +0000https://deploy-preview-164--docs-projectcapsule.netlify.app/ecosystem/integrations/envoy-gateway/With Envoy Gateway, tenants can publish their applications through the Gateway API while the platform manages the Gateway infrastructure. This guide covers protecting platform Gateways, generating a managed Gateway per Tenant, and delegating listeners with Capsule hostname rules. Before starting, review the upstream documentation: Gateway API roles and personas Envoy Gateway deployment modes and multi-tenancy Gateway API ListenerSets The examples assume Envoy Gateway is installed and a tenants GatewayClass is available.https://deploy-preview-164--docs-projectcapsule.netlify.app/ecosystem/integrations/eso/Mon, 01 Jan 0001 00:00:00 +0000https://deploy-preview-164--docs-projectcapsule.netlify.app/ecosystem/integrations/eso/With External Secrets Operator it’s possible to delegate Secrets Management to an external system while keeping the actual management of the secrets within Kubernetes. This guide provides a simple automation example with External Secrets Operator. Before starting, you might want to explore the existing documentation regarding multi-tenancy: https://external-secrets.io/latest/guides/multi-tenancy/ Secure ClusterSecretStores If you have any ClusterSecretStores, which are not intended to be used by Tenants, you must make sure Tenants can not reference the ClusterSecretStore.https://deploy-preview-164--docs-projectcapsule.netlify.app/ecosystem/integrations/headlamp/Mon, 01 Jan 0001 00:00:00 +0000https://deploy-preview-164--docs-projectcapsule.netlify.app/ecosystem/integrations/headlamp/Headlamp is an easy-to-use and extensible Kubernetes web UI. Headlamp was created to blend the traditional feature set of other web UIs/dashboards (i.e., to list and view resources) with added functionality. Prerequisites You will need a running Capsule Proxy instance. For Authentication you will need a Confidential OIDC client configured in your OIDC provider, such as Keycloak, Dex, or Google Cloud Identity. By default the Kubernetes API only validates tokens against a Public OIDC client, so you will need to configure your OIDC provider to allow the Headlamp client to issue tokens.https://deploy-preview-164--docs-projectcapsule.netlify.app/ecosystem/integrations/kyverno/Mon, 01 Jan 0001 00:00:00 +0000https://deploy-preview-164--docs-projectcapsule.netlify.app/ecosystem/integrations/kyverno/Kyverno is a policy engine designed for Kubernetes. It provides the ability to validate, mutate, and generate Kubernetes resources using admission control. Kyverno policies are managed as Kubernetes resources and can be applied to a cluster using kubectl. Capsule integrates with Kyverno to provide a set of policies that can be used to improve the security and governance of the Kubernetes cluster. Permissions Some policies are attempting to query Capsule specific information, such as the tenant name based on the namespace.https://deploy-preview-164--docs-projectcapsule.netlify.app/ecosystem/integrations/lens/Mon, 01 Jan 0001 00:00:00 +0000https://deploy-preview-164--docs-projectcapsule.netlify.app/ecosystem/integrations/lens/With Capsule extension for Lens, a cluster administrator can easily manage from a single pane of glass all resources of a Kubernetes cluster, including all the Tenants created through the Capsule Operator. Features Capsule extension for Lens provides these capabilities: List all tenants See tenant details and change through the embedded Lens editor Check Resources Quota and Budget at both the tenant and namespace level Please, see the README for details about the installation of the Capsule Lens Extension.https://deploy-preview-164--docs-projectcapsule.netlify.app/ecosystem/integrations/monitoring/Mon, 01 Jan 0001 00:00:00 +0000https://deploy-preview-164--docs-projectcapsule.netlify.app/ecosystem/integrations/monitoring/While we can not provide a full list of all the monitoring solutions available, we can provide some guidance on how to integrate Capsule with some of the most popular ones. Also this is dependent on how you have set up your monitoring solution. We will just explore the options available to you. Logging Loki Promtail config: clients: - url: "https://loki.company.com/loki/api/v1/push" # Maximum wait period before sending batch batchwait: 1s # Maximum batch size to accrue before sending, unit is byte batchsize: 102400 # Maximum time to wait for server to respond to a request timeout: 10s backoff_config: # Initial backoff time between retries min_period: 100ms # Maximum backoff time between retries max_period: 5s # Maximum number of retries when sending batches, 0 means infinite retries max_retries: 20 tenant_id: "tenant" external_labels: cluster: "${cluster_name}" serverPort: 3101 positions: filename: /run/promtail/positions.https://deploy-preview-164--docs-projectcapsule.netlify.app/ecosystem/integrations/opencost/Mon, 01 Jan 0001 00:00:00 +0000https://deploy-preview-164--docs-projectcapsule.netlify.app/ecosystem/integrations/opencost/This guide explains how to integrate OpenCost with Capsule to provide cost visibility and chargeback/showback per tenant. You can group workloads into tenants by annotating namespaces (for example, opencost.projectcapsule.dev/tenant: {{ tenant.name }}). OpenCost can use this annotation to aggregate costs, enabling accurate cost allocation across clusters, nodes, namespaces, controller kinds, controllers, services, pods, and containers for each tenant. Prerequisites Capsule v0.10.8 or later Prometheus Operator Prometheus OpenCost Installation Capsule Create a tenant with spec.https://deploy-preview-164--docs-projectcapsule.netlify.app/ecosystem/integrations/openshift/Mon, 01 Jan 0001 00:00:00 +0000https://deploy-preview-164--docs-projectcapsule.netlify.app/ecosystem/integrations/openshift/https://deploy-preview-164--docs-projectcapsule.netlify.app/ecosystem/integrations/rancher/Mon, 01 Jan 0001 00:00:00 +0000https://deploy-preview-164--docs-projectcapsule.netlify.app/ecosystem/integrations/rancher/https://deploy-preview-164--docs-projectcapsule.netlify.app/search/Mon, 01 Jan 0001 00:00:00 +0000https://deploy-preview-164--docs-projectcapsule.netlify.app/search/https://deploy-preview-164--docs-projectcapsule.netlify.app/ecosystem/integrations/tekton/Mon, 01 Jan 0001 00:00:00 +0000https://deploy-preview-164--docs-projectcapsule.netlify.app/ecosystem/integrations/tekton/With Capsule extension for Lens, a cluster administrator can easily manage from a single pane of glass all resources of a Kubernetes cluster, including all the Tenants created through the Capsule Operator. Prerequisites Tekton must be already installed on your cluster, if that’s not the case consult the documentation here: Tekton Cluster Scoped Permissions Tekton Dashboard Now for the enduser experience we are going to deploy the tekton dashboard. When using oauth2-proxy we can deploy one single dashboard, which can be used for all tenants.https://deploy-preview-164--docs-projectcapsule.netlify.app/ecosystem/integrations/teleport/Mon, 01 Jan 0001 00:00:00 +0000https://deploy-preview-164--docs-projectcapsule.netlify.app/ecosystem/integrations/teleport/Teleport is an open-source tool that provides zero trust access to servers and cloud applications using SSH, Kubernetes, Database, Remote Desktop Protocol and HTTPS. It can eliminate the need for VPNs by providing a single gateway to access computing infrastructure via SSH, Kubernetes clusters, and cloud applications via a built-in proxy.1 If you want to pass requests from teleport users through the capsule-proxy for users to be able to do things like listing namespaces scoped to their own tenants, this integration is for you.https://deploy-preview-164--docs-projectcapsule.netlify.app/ecosystem/integrations/velero/Mon, 01 Jan 0001 00:00:00 +0000https://deploy-preview-164--docs-projectcapsule.netlify.app/ecosystem/integrations/velero/