Capsule

https://projectcapsule.dev/docs/
Admin
Capsule is a Kubernetes multi-tenancy engine that enables policy-based resource sharing and tenant...
Tokens:243,725
Snippets:1,968
Trust Score:7.1
Update:1 week ago
Show doc for...
Tokens:
Raw
### Install Capsule and create tenant

Source: https://projectcapsule.dev/docs/operating/setup/managed-kubernetes

Applies the default Capsule Tenant example from the official repository to create a tenant where alice has ownership.

```bash
kubectl apply -f https://raw.githubusercontent.com/clastix/capsule/master/config/samples/capsule_v1beta1_tenant.yaml

```

--------------------------------

### Install capsule-proxy via Helm (standard and OCI)

Source: https://projectcapsule.dev/docs/proxy/setup/installation

Installs the capsule-proxy chart into the capsule-system namespace, creating the namespace if needed. Two equivalent commands are shown: the standard repository install and the OCI registry install.

```bash
helm install capsule-proxy projectcapsule/capsule-proxy -n capsule-system --create-namespace

```

```bash
helm install capsule-proxy oci://ghcr.io/projectcapsule/charts/capsule-proxy -n capsule-system --create-namespace

```

--------------------------------

### Multiple resources and selectors GlobalProxySettings example

Source: https://projectcapsule.dev/docs/proxy/proxysettings

A rule can select several resources, and a GlobalProxySettings can contain several rules. This legacy-style List declarations enable both LIST and GET because of the compatibility mapping described above.

```yaml
apiVersion: capsule.clastix.io/v1beta1
kind: GlobalProxySettings
metadata:
  name: global-proxy-settings
spec:
  rules:
  - subjects:
    - kind: User
      name: alice
    clusterResources:
    - apiGroups:
      - capsule.clastix.io
      resources:
      - resourcepools
      - globalcustomquotas
      - globalresourcequotas
      - tenantowners
      operations:
      - List
      selector:
        matchLabels:
          projectcapsule.dev/tenant: green
    - apiGroups:
      - kyverno.io
      resources:
      - "*"
      operations:
      - List
      - Get
      selector:
        matchLabels:
          app.kubernetes.io/type: dev
```

--------------------------------

### ProxySetting YAML example

Source: https://projectcapsule.dev/docs/proxy/proxysettings

Example of a ProxySetting resource that grants the user 'alice' the List operation on IngressClasses. It must be created in a namespace belonging to a tenant.

```yaml
apiVersion: capsule.clastix.io/v1beta1
kind: ProxySetting
metadata:
  name: solar-proxy
  namespace: solar-prod
spec:
  subjects:
  - kind: User
    name: alice
    proxySettings:
    - kind: IngressClasses
      operations:
      - List

```

--------------------------------

### generateAgeKey output example

Source: https://projectcapsule.dev/docs/operating/concepts/templating

Example output of the generateAgeKey usage, showing the generated Secret with placeholder identity and recipient values.

```yaml
apiVersion: v1
kind: Secret
metadata:
  name: age-key
type: Opaque
stringData:
  identity: "AGE-SECRET-KEY-1..."
  recipient: "age1..."
```

--------------------------------

### kubectl requests covered by the rule

Source: https://projectcapsule.dev/docs/proxy/proxysettings

Both collection and named-resource reads are covered by the example rule.

```bash
kubectl get persistentvolumes
kubectl get persistentvolume pvc-0574499c-f01b-4a53-85f1-ddb002de9cae

```

--------------------------------

### ResourceQuota output for defaultsZero example

Source: https://projectcapsule.dev/docs/resource-management/resourcepools

Shows the resulting ResourceQuota from the pool with defaultsZero and persistentvolumeclaims default, displaying the requests and limits.

```text
NAME                     AGE   REQUEST                                                                                             LIMIT
capsule-pool-example     10h   count/persistentvolumeclaims: 0/3, requests.cpu: 0/0, requests.memory: 0/0, requests.storage: 0/0   limits.cpu: 0/0, limits.memory: 0/0

```

--------------------------------

### Replication context template example

Source: https://projectcapsule.dev/docs/operating/concepts/templating

Shows how to use the replication context in a template. The metadata fields are available under $.replications.metadata, and the example uses the quote function and index function for labels. Note that metadata.namespace is absent for cluster-scoped GlobalTenantResource.

```yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: {{ $.replications.metadata.name }}
  labels:
    replication-name: {{ $.replications.metadata.name | quote }}
    team: {{ index $.replications.metadata.labels "company.example/team" | quote }}
data:
  sourceNamespace: {{ $.replications.metadata.namespace | quote }}

```

--------------------------------

### GlobalResourceQuota status example

Source: https://projectcapsule.dev/docs/resource-management/globalresourcequota

Example status output for a GlobalResourceQuota, showing selected namespaces, total hard/used/available limits, per-namespace usage, and readiness conditions. Note that status.total.used is observed native usage; recent admissions may exist only as ledger reservations.

```yaml
status:
  observedGeneration: 1
  namespaceCount: 2
  namespaces:
    - solar-production
    - solar-staging
  total:
    hard:
      requests.cpu: "8"
      requests.memory: 16Gi
    used:
      requests.cpu: "3"
      requests.memory: 6Gi
    available:
      requests.cpu: "5"
      requests.memory: 10Gi
  namespaceUsage:
    solar-production:
      used:
        requests.cpu: "2"
        requests.memory: 4Gi
    solar-staging:
      used:
        requests.cpu: "1"
        requests.memory: 2Gi
  conditions:
    - type: Ready
      status: "True"
      reason: Succeeded
      message: reconciled
```

--------------------------------

### GET-only GlobalProxySettings example

Source: https://projectcapsule.dev/docs/proxy/proxysettings

Use Get without List to allow a subject to retrieve a known object but not enumerate the collection. This adds permission for `kubectl get tenantowner alice` when the object matches the selector, but not for `kubectl get tenantowners`. Native Kubernetes RBAC may still grant additional access independently.

```yaml
apiVersion: capsule.clastix.io/v1beta1
kind: GlobalProxySettings
metadata:
  name: solar-proxy-settings
spec:
  rules:
  - subjects:
    - kind: User
      name: alice
    clusterResources:
    - apiGroups:
      - capsule.clastix.io
      resources:
      - tenantowners
      operations:
      - Get
      selector:
        matchLabels:
          projectcapsule.dev/tenant: solar
```

--------------------------------

### Check tenant status for missing permissions

Source: https://projectcapsule.dev/docs/operating/setup/installation

If permissions are missing, tenants show an error status. Example output of 'kubectl get tnt' showing a forbidden error for rolebindings.

```bash
kubectl get tnt
NAME    STATE    NAMESPACE QUOTA   NAMESPACE COUNT   NODE SELECTOR   READY   STATUS                                                                                                                                                                                                                                                                                                                                          AGE
green   Active                     2                                 False   cannot sync rolebindings items: rolebindings.rbac.authorization.k8s.io "capsule:managed:658936e7f2a30e35" is forbidden: user "system:serviceaccount:capsule-system:capsule" (groups=["system:serviceaccounts" "system:serviceaccounts:capsule-system" "system:authenticated"]) is attempting to grant RBAC permissions not currently held:...   5s

```

--------------------------------

### Deploy and list resources in a Tenant Namespace

Source: https://projectcapsule.dev/docs/tenants/namespaces

Alice can deploy any resource in any Namespace assigned to her Tenant. These commands run an nginx pod and list pods in the solar-development Namespace.

```bash
kubectl -n solar-development run nginx --image=docker.io/nginx
kubectl -n solar-development get pods
```

--------------------------------

### View Controller CLI Options

Source: https://projectcapsule.dev/docs/operating/setup/configuration

Run the controller locally to display all available command-line flags and their defaults. Use --zap-log-level 7 to increase logging verbosity.

```bash
$ go run ./cmd/controller/ --zap-log-level 7 -h
      --cache-sync-timeout duration       The timeout used when waiting for controller cache synchronization. If unset or 0, the controller-runtime default is used.
      --client-connection-burst int32     Burst to use for interacting with kubernetes apiserver. (default 30)
      --client-connection-qps float32     QPS to use for interacting with kubernetes apiserver. (default 20)
      --configuration-name string         The CapsuleConfiguration resource name to use (default "default")
      --enable-http2                      If set, HTTP/2 will be enabled for the metrics and webhook servers
      --enable-leader-election            Enable leader election for controller manager. Enabling this will ensure there is only one active controller manager.
      --enable-pprof                      Enables Pprof endpoint for profiling (not recommend in production)
      --metrics-addr string               The address the metric endpoint binds to. (default ":8080")
      --metrics-cert-key string           The name of the metrics server key file. (default "tls.key")
      --metrics-cert-name string          The name of the metrics server certificate file. (default "tls.crt")
      --metrics-cert-path string          The directory that contains the metrics server certificate.
      --metrics-secure                    If set, the metrics endpoint is served securely via HTTPS. Use --metrics-secure=false to use HTTP instead.
      --version                           Print the Capsule version and exit
      --webhook-cert-key string           The name of the webhook key file. (default "tls.key")
      --webhook-cert-name string          The name of the webhook certificate file. (default "tls.crt")
      --webhook-cert-path string          The directory that contains the webhook certificate. (default "/tmp/k8s-webhook-server/serving-certs")
      --webhook-port int                  The port the webhook server binds to. (default 9443)
      --workers int                       MaxConcurrentReconciles is the maximum number of concurrent Reconciles which can be run. (default 1)
      --zap-devel                         Development Mode defaults(encoder=consoleEncoder,logLevel=Debug,stackTraceLevel=Warn). Production Mode defaults(encoder=jsonEncoder,logLevel=Info,stackTraceLevel=Error)
      --zap-encoder encoder               Zap log encoding (one of 'json' or 'console')
      --zap-log-level level               Zap Level to configure the verbosity of logging. Can be one of 'debug', 'info', 'error', 'panic'or any integer value > 0 which corresponds to custom debug levels of increasing verbosity
      --zap-stacktrace-level level        Zap Level at and above which stacktraces are captured (one of 'info', 'error', 'panic').
      --zap-time-encoding time-encoding   Zap time encoding (one of 'epoch', 'millis', 'nano', 'iso8601', 'rfc3339' or 'rfc3339nano'). Defaults to 'epoch'.

```

--------------------------------

### List all network policies after creation

Source: https://projectcapsule.dev/docs/tenants/enforcement

Shows the network policies in the namespace after the user-created policy is added.

```bash
kubectl -n solar-production get networkpolicies
NAME                          POD-SELECTOR   AGE
capsule-solar-0               <none>         42h
production-network-policy     <none>         3m

```

--------------------------------

### Gateway API: Backend Termination - TLSRoute to forward traffic to capsule-proxy

Source: https://projectcapsule.dev/docs/proxy/setup/installation

Installs a TLSRoute resource that routes encrypted traffic from the Gateway to the capsule-proxy service on port 9001. This is the second step in the backend termination setup, after creating the Gateway with Passthrough TLS.

```yaml
extraManifests:
  - apiVersion: gateway.networking.k8s.io/v1
    kind: TLSRoute
    metadata:
      name: capsule-proxy-tls-route
      namespace: capsule-system
    spec:
      parentRefs:
        - name: service-gateway
          namespace: solar-system
          sectionName: https-capsule-proxy
      hostnames:
        - api.cluster-name.company.com
      rules:
        - backendRefs:
            - name: capsule-proxy
              port: 9001
```

--------------------------------

### Create namespaces with OIDC context

Source: https://projectcapsule.dev/docs/operating/authentication

Example commands for user alice to create namespaces using the OIDC context. This demonstrates that the OIDC authentication is working.

```bash
$ kubectl --context alice-oidc@mycluster create namespace wind-production
$ kubectl --context alice-oidc@mycluster create namespace wind-development
$ kubectl --context alice-oidc@mycluster create namespace water-marketing

```

--------------------------------

### Alice cannot get tenants

Source: https://projectcapsule.dev/docs/tenants/permissions

Checks that Alice cannot get Tenant resources, expecting no.

```bash
kubectl auth can-i get tenants
no

```

--------------------------------

### deterministicUUID usage example

Source: https://projectcapsule.dev/docs/operating/concepts/templating

Example of calling deterministicUUID with multiple input strings to generate a stable UUID.

```gotemplate
{{ deterministicUUID "cluster-a" "app-123" "tenant-x" "some-role" }}
```

--------------------------------

### kubectl create namespaces as OIDC user

Source: https://projectcapsule.dev/docs/operating/setup/authentication

Example commands to create namespaces using the OIDC context. Demonstrates successful authentication.

```bash
$ kubectl --context alice-oidc@mycluster create namespace wind-production
$ kubectl --context alice-oidc@mycluster create namespace wind-development
$ kubectl --context alice-oidc@mycluster create namespace water-marketing
```

--------------------------------

### Set up kubectl OIDC login with kubelogin plugin

Source: https://projectcapsule.dev/docs/operating/authentication

Set up the kubelogin plugin for OIDC authentication. This command obtains an OIDC token and configures kubectl to use it. Requires the kubelogin plugin to be installed.

```bash
kubectl oidc-login setup \
	--oidc-issuer-url=https://${OIDC_ISSUER} \
	--oidc-client-id=kubernetes-auth \
	--oidc-client-secret=${OIDC_CLIENT_SECRET}

```

--------------------------------

### generateAgeKey usage example

Source: https://projectcapsule.dev/docs/operating/concepts/templating

Example of using generateAgeKey to create a Kubernetes Secret with the generated age identity and recipient keys.

```gotemplate
{{ $key := generateAgeKey }}
apiVersion: v1
kind: Secret
metadata:
  name: age-key
type: Opaque
stringData:
  identity: {{ $key.Identity | quote }}
  recipient: {{ $key.Recipient | quote }}
```

--------------------------------

### Create a network policy with kubectl apply

Source: https://projectcapsule.dev/docs/tenants/enforcement

Creates a NetworkPolicy in the 'solar-production' namespace using a here-document. The policy selects all pods and allows ingress and egress.

```bash
kubectl apply -f - << EOF
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  labels:
  name: production-network-policy
  namespace: solar-production
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress
EOF

```

--------------------------------

### Helm chart extraArgs example

Source: https://projectcapsule.dev/docs/proxy/setup/options

Shows how to pass additional controller options via the Helm chart's extraArgs field, using --disable-caching=true as an example.

```yaml
options:
  extraArgs:
    - --disable-caching=true

```

--------------------------------

### kubectl get globaltenantresource - error output

Source: https://projectcapsule.dev/docs/replications/global

Output of 'kubectl get globaltenantresource argo-cd-permission -o yaml' showing the error for each tenant: 'resource v1/ConfigMap argocd/argocd-rbac-cm exists and cannot be adopted'.

```yaml
kubectl get globaltenantresource argo-cd-permission -o yaml

...
  processedItems:
  - kind: ConfigMap
    name: argocd-rbac-cm
    namespace: argocd
    status:
      message: 'apply failed for item 0/generator-0-0: resource evaluation: resource
        v1/ConfigMap argocd/argocd-rbac-cm exists and cannot be adopted'
      status: "False"
      type: Ready
    tenant: green
    version: v1
  - kind: ConfigMap
    name: argocd-rbac-cm
    namespace: argocd
    status:
      message: 'apply failed for item 0/generator-0-0: resource evaluation: resource
        v1/ConfigMap argocd/argocd-rbac-cm exists and cannot be adopted'
      status: "False"
      type: Ready
    tenant: solar
    version: v1
  - kind: ConfigMap
    name: argocd-rbac-cm
    namespace: argocd
    status:
      message: 'apply failed for item 0/generator-0-0: resource evaluation: resource
        v1/ConfigMap argocd/argocd-rbac-cm exists and cannot be adopted'
      status: "False"
      type: Ready
    tenant: wind
    version: v1
```

--------------------------------

### List Pods in solar-development

Source: https://projectcapsule.dev/docs/tenants/quotas

Shows the pods running in the solar-development namespace after the quota enforcement.

```bash
kubectl -n solar-development get pods
NAME                     READY   STATUS    RESTARTS   AGE
nginx-55649fd747-6fzcx   1/1     Running   0          12s
nginx-55649fd747-7q6x6   1/1     Running   0          12s
nginx-55649fd747-86wr5   1/1     Running   0          12s
nginx-55649fd747-h6kbs   1/1     Running   0          12s
nginx-55649fd747-mlhlq   1/1     Running   0          12s
nginx-55649fd747-t48s5   1/1     Running   0          7s

```

--------------------------------

### Leader election error log example

Source: https://projectcapsule.dev/docs/operating/setup/installation

Example error log showing leader election failure due to timeout. This indicates the need to tune leader election settings.

```log
E0707 08:38:18.319041       1 leaderelection.go:452] "Error retrieving lease lock"
  err="Get \"https://10.96.0.1:443/apis/coordination.k8s.io/v1/namespaces/capsule-
  system/leases/42c733ea.clastix.capsule.io?timeout=5s\": net/http: request canceled
  (Client.Timeout exceeded while awaiting headers)" lock="capsule-
  system/42c733ea.clastix.capsule.io"
  I0707 08:38:18.442700       1 leaderelection.go:299] "Failed to renew lease"

```

--------------------------------

### Create Namespace with Promoted ServiceAccount

Source: https://projectcapsule.dev/docs/tenants/permissions

Creates a namespace using the promoted ServiceAccount, demonstrating that it can now create namespaces in the Tenant.

```bash
kubectl create ns green-valkey--as system:serviceaccount:green-test:gitops-reconcile
```

--------------------------------

### CustomQuota definition for monitoring example

Source: https://projectcapsule.dev/docs/resource-management/customquotas

Example CustomQuota definition used as the basis for the Prometheus metrics shown on this page. It counts Pods in the wind-test namespace with a limit of 3 and emitMetricPerClaimUsage set to false.

```yaml
apiVersion: capsule.clastix.io/v1beta2
kind: CustomQuota
metadata:
  name: pod-count-limit
  namespace: wind-test
spec:
  limit: 3
  options:
    emitMetricPerClaimUsage: false
  sources:
  - apiVersion: "v1"
    kind: Pod
    op: count
status:
  claims:
  - group: ""
    kind: Pod
    name: nginx-deployment-77bc6bd484-4qm4h
    namespace: wind-test
    uid: c6df70ce-f483-4b02-af65-c8c150d22ed2
    usage: "1"
    version: v1
  - group: ""
    kind: Pod
    name: nginx-deployment-77bc6bd484-f8qcv
    namespace: wind-test
    uid: eeae006b-5ce8-442b-b6c3-f208387545a7
    usage: "1"
    version: v1
  - group: ""
    kind: Pod
    name: nginx-deployment-77bc6bd484-bsnfz
    namespace: wind-test
    uid: 9e1135a7-b286-4768-becd-147b37c999f8
    usage: "1"
    version: v1
  conditions:
  - lastTransitionTime: "2026-04-23T09:21:29Z"
    message: reconciled
    reason: Succeeded
    status: "True"
    type: Ready
  targets:
  - group: ""
    kind: Pod
    op: count
    scope: namespace
    version: v1
  usage:
    available: "0"
    used: "3"

```

--------------------------------

### Install Capsule Helm chart (standard and OCI)

Source: https://projectcapsule.dev/docs/operating/setup/installation

Installs the Capsule operator chart version 0.14.6 in the capsule-system namespace. The OCI variant uses the ghcr.io registry. Both commands create the namespace if it does not exist.

```bash
helm install capsule projectcapsule/capsule --version 0.14.6 -n capsule-system --create-namespace
```

```bash
helm install capsule oci://ghcr.io/projectcapsule/charts/capsule --version 0.14.6 -n capsule-system --create-namespace
```

--------------------------------

### Create Namespaces with kubectl

Source: https://projectcapsule.dev/docs/tenants/namespaces

Commands for Alice to create additional namespaces within the tenant quota.

```bash
kubectl create ns solar-development
kubectl create ns solar-test
```

--------------------------------

### Pod Security Standards YAML example

Source: https://projectcapsule.dev/docs/operating/best-practices/workloads

Example of a Kubernetes namespace manifest that applies Pod Security Standards labels. Use this when configuring tenant namespaces to enforce the desired Pod Security level.

```yaml
apiVersion: v1
kind: Namespace
metadata:
  name: my-namespace
  labels:
    pod-security.kubernetes.io/enforce: restricted
    pod-security.kubernetes.io/audit: restricted
    pod-security.kubernetes.io/warn: restricted

```

--------------------------------

### List Pods in solar-production

Source: https://projectcapsule.dev/docs/tenants/quotas

Shows the pods running in the solar-production namespace after the quota enforcement.

```bash
kubectl -n solar-production get pods
NAME                     READY   STATUS    RESTARTS   AGE
nginx-55649fd747-52fsq   1/1     Running   0          22m
nginx-55649fd747-9q8n5   1/1     Running   0          22m
nginx-55649fd747-r8vzr   1/1     Running   0          22m
nginx-55649fd747-tkv7m   1/1     Running   0          22m

```

--------------------------------

### kubectl get cm -n argocd argocd-rbac-cm -o yaml

Source: https://projectcapsule.dev/docs/replications/global

Output of 'kubectl get cm -n argocd argocd-rbac-cm -o yaml' showing the ConfigMap after adoption, with per-tenant CSV data and labels.

```yaml
kubectl get cm -n argocd  argocd-rbac-cm -o yaml
apiVersion: v1
data:
  policy.csv: |
    p, my-org:team-alpha, applications, sync, my-project/*, allow
    g, my-org:team-beta, role:admin
    g, user@example.org, role:admin
    g, admin, role:admin
    g, role:admin, role:readonly
  policy.default: role:readonly
  scopes: '[groups, email]'

  green.csv: |2

    p, oidc:org:devops, applications, sync, green/*, allow
    p, bob, applications, sync, green/*, allow
  solar.csv: |2

    p, oidc:org:platform, applications, sync, solar/*, allow
    p, alice, applications, sync, solar/*, allow
  wind.csv: |2

    p, oidc:org:devops, applications, sync, wind/*, allow
    p, joe, applications, sync, wind/*, allow
kind: ConfigMap
```

--------------------------------

### Tenant with proxySettings for Nodes

Source: https://projectcapsule.dev/docs/operating/setup/rancher

Example Tenant manifest that enables the user 'alice' to list Nodes via proxySettings. The '[...]' indicates omitted fields.

```yaml
apiVersion: capsule.clastix.io/v1beta2
kind: Tenant
metadata:
  name: wind
spec:
  owners:
  - kind: User
    name: alice
    proxySettings:
    - kind: Nodes
      operations:
      - List
[...]
```

--------------------------------

### List RoleBindings in tenant namespace

Source: https://projectcapsule.dev/docs/tenants/permissions

Command to list RoleBindings in the 'solar-production' namespace, showing the generated bindings for the tenant.

```bash
$ kubectl -n solar-production get rolebindings
NAME                                              ROLE                                            AGE
capsule-solar-0-admin                               ClusterRole/admin                               90s
capsule-solar-1-capsule-namespace-deleter           ClusterRole/capsule-namespace-deleter           90s
capsule-solar-2-view                                ClusterRole/view                                90s
capsule-solar-3-tenant-resources                    ClusterRole/prometheus-servicemonitors-viewer   25s
```

--------------------------------

### ObjectBucketClaim resource example

Source: https://projectcapsule.dev/docs/operating/best-practices/admission-policies

Example of a namespaced ObjectBucketClaim resource used to demonstrate validation of the storageClassName field. The resource includes labels, finalizers, and storage configuration. Use this as the input for a custom admission policy that restricts allowed StorageClasses.

```yaml
apiVersion: objectbucket.io/v1alpha1
kind: ObjectBucketClaim
metadata:
  name: admission-class
  namespace: solar-production
  finalizers:
    - objectbucket.io/finalizer
  labels:
    bucket-provisioner: openshift-storage.ceph.rook.io-bucket
spec:
  additionalConfig:
    maxSize: 2G
  bucketName: test-some-uid
  generateBucketName: test
  objectBucketName: obc-test-test
  storageClassName: ocs-storagecluster-ceph-rgw

```

--------------------------------

### Apply default GlobalCustomQuotas for CPU, memory, pod count, and storage

Source: https://projectcapsule.dev/docs/resource-management/customquotas

Defines six GlobalCustomQuota resources for the 'solar' tenant: CPU requests/limits, memory requests/limits, pod count, and storage. Adjust .spec.limit and .spec.namespaceSelectors matchLabels to match your tenant labeling before applying. The CPU and memory examples cover both containers and initContainers, and exclude terminal Pods (Succeeded/Failed/Unknown) via fieldSelectors, matching the default behavior of native Kubernetes ResourceQuota.

```yaml
---
apiVersion: capsule.clastix.io/v1beta2
kind: GlobalCustomQuota
metadata:
  name: solar-cpu-requests
spec:
  namespaceSelectors:
    - matchLabels:
        capsule.clastix.io/tenant: solar
  sources:
    - apiVersion: v1
      kind: Pod
      op: add
      path: .spec.containers[*].resources.requests.cpu
      selectors:
        - fieldSelectors:
            - '.status.phase!=Succeeded'
            - '.status.phase!=Failed'
            - '.status.phase!=Unknown'
    - apiVersion: v1
      kind: Pod
      op: add
      path: .spec.initContainers[*].resources.requests.cpu
      selectors:
        - fieldSelectors:
            - '.spec.initContainers'
            - '.status.phase!=Succeeded'
            - '.status.phase!=Failed'
            - '.status.phase!=Unknown'
  limit: "2"
---
apiVersion: capsule.clastix.io/v1beta2
kind: GlobalCustomQuota
metadata:
  name: solar-cpu-limits
spec:
  namespaceSelectors:
    - matchLabels:
        capsule.clastix.io/tenant: solar
  sources:
    - apiVersion: v1
      kind: Pod
      op: add
      path: .spec.containers[*].resources.limits.cpu
      selectors:
        - fieldSelectors:
            - '.status.phase!=Succeeded'
            - '.status.phase!=Failed'
            - '.status.phase!=Unknown'
    - apiVersion: v1
      kind: Pod
      op: add
      path: .spec.initContainers[*].resources.limits.cpu
      selectors:
        - fieldSelectors:
            - '.spec.initContainers'
            - '.status.phase!=Succeeded'
            - '.status.phase!=Failed'
            - '.status.phase!=Unknown'
  limit: "4"
---
apiVersion: capsule.clastix.io/v1beta2
kind: GlobalCustomQuota
metadata:
  name: solar-memory-requests
spec:
  namespaceSelectors:
    - matchLabels:
        capsule.clastix.io/tenant: solar
  sources:
    - apiVersion: v1
      kind: Pod
      op: add
      path: .spec.containers[*].resources.requests.memory
      selectors:
        - fieldSelectors:
            - '.status.phase!=Succeeded'
            - '.status.phase!=Failed'
            - '.status.phase!=Unknown'
    - apiVersion: v1
      kind: Pod
      op: add
      path: .spec.initContainers[*].resources.requests.memory
      selectors:
        - fieldSelectors:
            - '.spec.initContainers'
            - '.status.phase!=Succeeded'
            - '.status.phase!=Failed'
            - '.status.phase!=Unknown'
  limit: "32Gi"
---
apiVersion: capsule.clastix.io/v1beta2
kind: GlobalCustomQuota
metadata:
  name: solar-memory-limits
spec:
  namespaceSelectors:
    - matchLabels:
        capsule.clastix.io/tenant: solar
  sources:
    - apiVersion: v1
      kind: Pod
      op: add
      path: .spec.containers[*].resources.limits.memory
      selectors:
        - fieldSelectors:
            - '.status.phase!=Succeeded'
            - '.status.phase!=Failed'
            - '.status.phase!=Unknown'
    - apiVersion: v1
      kind: Pod
      op: add
      path: .spec.initContainers[*].resources.limits.memory
      selectors:
        - fieldSelectors:
            - '.spec.initContainers'
            - '.status.phase!=Succeeded'
            - '.status.phase!=Failed'
            - '.status.phase!=Unknown'
  limit: "32Gi"
---
apiVersion: capsule.clastix.io/v1beta2
kind: GlobalCustomQuota
metadata:
  name: solar-pod-count
spec:
  namespaceSelectors:
    - matchLabels:
        capsule.clastix.io/tenant: solar
  sources:
    - apiVersion: v1
      kind: Pod
      op: count
  limit: 300
---
apiVersion: capsule.clastix.io/v1beta2
kind: GlobalCustomQuota
metadata:
  name: solar-storage
spec:
  namespaceSelectors:
    - matchLabels:
        capsule.clastix.io/tenant: solar
  sources:
    - apiVersion: v1
      kind: PersistentVolumeClaim
      op: add
      path: .spec.resources.requests.storage
  limit: "50Gi"

```

--------------------------------

### OIDC introspection response example

Source: https://projectcapsule.dev/docs/operating/authentication

Example JSON response from the Keycloak introspection endpoint. It includes token metadata such as exp, iat, aud, preferred_username, groups, and active. The groups field shows the user's group membership.

```json
{
  "exp": 1601323086,
  "iat": 1601322186,
  "aud": "kubernetes",
  "typ": "ID",
  "azp": "kubernetes",
  "preferred_username": "alice",
  "email_verified": false,
  "acr": "1",
  "groups": [
    "capsule.clastix.io"
  ],
  "client_id": "kubernetes",
  "username": "alice",
  "active": true
}
```

--------------------------------

### Create a Tenant with Capsule (capsule.clastix.io/v1beta2)

Source: https://projectcapsule.dev/docs/quickstart

Defines the initial Tenant 'solar' with owner alice, a namespace quota of 2, a forced prefix 'solar-', and admission rules that require an 'environment' label with 'dev' as default. Enforces QoS: prod namespaces only allow Guaranteed pods; others allow any QoS class.

```yaml
apiVersion: capsule.clastix.io/v1beta2
kind: Tenant
metadata:
  name: solar
spec:
  owners:
  - name: alice
    kind: User
  namespaceOptions:
    quota: 2
  forceTenantPrefix: true
  rules:
    - enforce:
        action: allow
        metadata:
          - apiGroups:
              - "v1"
            kinds:
              - "Namespace"
            labels:
              environment:
                required: true
                default: "dev"
                values:
                  - exact:
                      - dev
                      - test
                      - prod
    - namespaceSelector:
        matchLabels:
          environment: prod
      enforce:
        action: allow
        workloads:
          qosClasses:
            - Guaranteed
    - namespaceSelector:
        matchExpressions:
        - key: environment
          operator: NotIn
          values:
          - prod
      enforce:
        action: allow
        workloads:
          qosClasses:
            - BestEffort
            - Burstable
            - Guaranteed
```
Tokens:
Raw