diff --git a/README.md b/README.md index 24b3f633..9d711a9d 100644 --- a/README.md +++ b/README.md @@ -20,7 +20,13 @@ Kubernetes introduces the _Namespace_ object type to create logical partitions of the cluster as isolated *slices*. However, implementing advanced multi-tenancy scenarios, it becomes soon complicated because of the flat structure of Kubernetes namespaces and the impossibility to share resources among namespaces belonging to the same tenant. To overcome this, cluster admins tend to provision a dedicated cluster for each groups of users, teams, or departments. As an organization grows, the number of clusters to manage and keep aligned becomes an operational nightmare, described as the well know phenomena of the _clusters sprawl_. # Entering Caspule -Capsule takes a different approach. In a single cluster, it aggregates multiple namespaces in a lightweight abstraction called _Tenant_. Within each tenant, users are free to create their namespaces and share all the assigned resources while a Policy Engine keeps different tenants isolated from each other. The _Network and Security Policies_, _Resource Quota_, _Limit Ranges_, _RBAC_, and other policies defined at the tenant level are automatically inherited by all the namespaces in the tenant. And users are free to operate their tenants in authonomy, without the intervention of the cluster administrator. +Capsule takes a different approach. In a single cluster, the Capsule Controller aggregates multiple namespaces in a lightweight abstraction called _Tenant_. Within each tenant, users are free to create their namespaces and share all the assigned resources while the Capsule Policy Engine keeps the different tenants isolated from each other. + +The _Network and Security Policies_, _Resource Quota_, _Limit Ranges_, _RBAC_, and other policies defined at the tenant level are automatically inherited by all the namespaces in the tenant. And users are free to operate their tenants in authonomy, without the intervention of the cluster administrator. Take a look at following diagram: + +

+ +

# Features ## Self-Service diff --git a/assets/capsule-operator.svg b/assets/capsule-operator.svg new file mode 100644 index 00000000..230f1d35 --- /dev/null +++ b/assets/capsule-operator.svg @@ -0,0 +1,3 @@ + + +
Capsule Controller
Capsule Controller
Capsule Policy Engine
Capsule Policy Engine
Tenant A
Tenant...
Tenant B
Tenant...
Capsule Operator
Capsule Operator
namespaces aggregation
namespaces aggregation
namespaces aggregation
namespaces aggregation
tenant isolation
tenant isolation
tenant isolation
tenant isolation
WorkerNodes, ResourceQuotas, IngressClasses, StorageClasses, NetworkPolicies, ImageRegistries, ...
WorkerNodes, ResourceQuotas, IngressClasses,...
Namespace
A-production
Namespace...
Namespace
A-production
Namespace...
namespaces
namespaces
Namespace
B-production
Namespace...
Namespace
B-production
Namespace...
namespaces
namespaces
WorkerNodes, ResourceQuotas, IngressClasses, StorageClasses, NetworkPolicies, ImageRegistries, ...
WorkerNodes, ResourceQuotas, IngressClasses,...
Viewer does not support full SVG 1.1
\ No newline at end of file