Capsule helps to implement a multi-tenancy and policy-based environment in your Kubernetes cluster. It is not intended to be yet another PaaS, instead, it has been designed as a micro-services based ecosystem with minimalist approach, leveraging only on upstream Kubernetes.
Kubernetes introduces the Namespace object type to create logical partitions of the cluster as isolated slices. However, implementing advanced multi-tenancy scenarios, it becomes soon complicated because of the flat structure of Kubernetes namespaces and the impossibility to share resources among namespaces belonging to the same tenant. To overcome this, cluster admins tend to provision a dedicated cluster for each groups of users, teams, or departments. As an organization grows, the number of clusters to manage and keep aligned becomes an operational nightmare, described as the well know phenomena of the clusters sprawl.
Capsule takes a different approach. In a single cluster, it aggregates multiple namespaces in a lightweight abstraction called Tenant. Within each tenant, users are free to create their namespaces and share all the assigned resources while a Policy Engine keeps different tenants isolated from each other. The Network and Security Policies, Resource Quota, Limit Ranges, RBAC, and other policies defined at the tenant level are automatically inherited by all the namespaces in the tenant. And users are free to operate their tenants in authonomy, without the intervention of the cluster administrator.
Leave to developers the freedom to self-provision their cluster resources according to the assigned boundaries.
Share a single cluster with multiple teams, groups of users, or departments by saving operational and management efforts.
Leverage Kubernetes Admission Controllers to enforce the industry security best practices and meet legal requirements.
Take control of the resources consumed by users while preventing them to overtake.
Provide multi-tenancy with a native Kubernetes experience without introducing additional management layers, plugins, or customised binaries.
Capsule is completely declarative and GitOps ready.
Assign to tenants a dedicated set of compute, storage, and network resources and avoid the noisy neighbors' effect.
Please, refer to the corresponding section in the project documentation for a detailed list of common use cases that Capsule can address.
Have a fun with Capsule: