### Tenant ResourceQuota Example for Migration

Source: https://projectcapsule.dev/docs/resource-management/resourcepools/_print

This YAML manifest shows an example of a Tenant's ResourceQuota configuration. It serves as a starting point for understanding the structure that needs to be migrated to ResourcePools.

```yaml
apiVersion: capsule.clastix.io/v1beta2
kind: Tenant
metadata:
  labels:
    kubernetes.io/metadata.name: migration
  name: migration
spec:
  owners:
  - clusterRoles:
    - admin
    - capsule-namespace-deleter
    kind: User
    name: bob
  preventDeletion: false
  resourceQuotas:
    items:
    - hard:
        limits.cpu: "2"
        limits.memory: 2Gi
        requests.cpu: "2"
        requests.memory: 2Gi
    - hard:
        pods: "7"
    scope: Tenant
status:
  namespaces:
  - migration-dev
  - migration-prod
  - migration-test
  size: 3
  state: Active
```

--------------------------------

### Example Allowed Service: internal.git.com

Source: https://projectcapsule.dev/docs/tenants/rules/enforcement

An example Service of type ExternalName with an allowed hostname.

```yaml
apiVersion: v1
kind: Service
metadata:
  name: git
spec:
  type: ExternalName
  externalName: internal.git.com
  ports:
    - name: https
      port: 443
      targetPort: 443
```

--------------------------------

### Tenant Table Output

Source: https://projectcapsule.dev/docs/guides/namespace-migration-across-tenants

Example output showing the list of tenants, their state, and namespace count. This is typically seen after running 'kubectl get tenants'.

```text
NAME    STATE    NAMESPACE QUOTA   NAMESPACE COUNT   NODE SELECTOR   AGE
solar   Active                     1                                 46s
wind    Active                     1                                 39s
```

--------------------------------

### Pod Deployment Example

Source: https://projectcapsule.dev/docs/tenants/rules/_print

Example Pod definition with containers and image volumes, used to test registry enforcement rules.

```yaml
apiVersion: v1
kind: Pod
metadata:
  name: image-volume
spec:
  containers:
    - name: shell
      command: ["sleep", "infinity"]
      imagePullPolicy: IfNotPresent
      image: harbor/customer/test-image/debian:latest
      volumeMounts:
        - name: volume
          mountPath: /volume
  volumes:
    - name: volume
      image:
        reference: quay.io/crio/artifact:v2
        pullPolicy: IfNotPresent
```

--------------------------------

### Install Capsule Proxy (Legacy)

Source: https://projectcapsule.dev/docs/proxy/setup/installation

Installs the Capsule Proxy using the legacy Helm chart. Ensure the 'capsule-system' namespace exists or is created.

```bash
helm install capsule-proxy projectcapsule/capsule-proxy -n capsule-system --create-namespace

```

--------------------------------

### Define a Resource Pool with Quotas and Namespace Selectors

Source: https://projectcapsule.dev/docs/resource-management/resourcepools/_print

This snippet shows how to define a ResourcePool named 'example'. It specifies hard quotas for CPU, memory, and storage, and selects namespaces belonging to the 'example' tenant using label selectors.

```yaml
apiVersion: capsule.clastix.io/v1beta2
kind: ResourcePool
metadata:
  name: example
spec:
  quota:
    hard:
      limits.cpu: "2"
      limits.memory: 2Gi
      requests.cpu: "2"
      requests.memory: 2Gi
      requests.storage: "5Gi"
  selectors:
  - matchLabels:
      capsule.clastix.io/tenant: example

```

--------------------------------

### Enable Gangplank Installation

Source: https://projectcapsule.dev/docs/proxy/_print

Enable Gangplank installation by setting the `enabled` flag to `true` in your configuration.

```yaml
gangplank:
  enabled: true
```

--------------------------------

### ResourcePool with Defaults and Hard Quotas

Source: https://projectcapsule.dev/docs/resource-management/resourcepools/_print

An example ResourcePool named 'example' that defines default resource requests for storage ('0Gi') and sets hard quotas for CPU, memory, and storage limits and requests. It selects tenants with the label 'capsule.clastix.io/tenant: example'.

```yaml
apiVersion: capsule.clastix.io/v1beta2
kind: ResourcePool
metadata:
  name: example
spec:
  defaults:
    requests.storage: "0Gi"
  quota:
    hard:
      limits.cpu: "2"
      limits.memory: 2Gi
      requests.cpu: "2"
      requests.memory: 2Gi
      requests.storage: "5Gi"
  selectors:
  - matchLabels:
      capsule.clastix.io/tenant: example

```

--------------------------------

### Example Allowed Service: api.example.com

Source: https://projectcapsule.dev/docs/tenants/rules/enforcement

An example Service of type ExternalName with a hostname matching a regular expression.

```yaml
apiVersion: v1
kind: Service
metadata:
  name: api
spec:
  type: ExternalName
  externalName: api.example.com
  ports:
    - name: https
      port: 443
      targetPort: 443
```

--------------------------------

### Tenant Promotion Rules Example

Source: https://projectcapsule.dev/docs/_print

Defines promotion rules for ServiceAccounts within a Tenant. This example shows how to assign ClusterRoles universally or based on labels, and how to scope promotions to specific namespaces.

```yaml
---
aspect: capsule.clastix.io/v1beta2
kind: Tenant
metadata:
  name: solar
spec:
  ...
  rules:
    - permissions:
        promotions:
          # Every promoted ServiceAccount receives this ClusterRole in all Namespaces of Tenant solar.
          - clusterRoles:
              - "configmap-replicator"

          # Every promoted ServiceAccount with the matching labels receives this ClusterRole.
          - clusterRoles:
              - "secret-replicator"
            selector:
              matchLabels:
                super: "account"

    - namespaceSelector:
        matchExpressions:
          - key: env
            operator: In
            values: ["prod"]
      permissions:
        promotions:
          # Promoted ServiceAccounts receive this ClusterRole only in namespaces matching env=prod.
          - clusterRoles:
              - "secret-replicator:prod"

```

--------------------------------

### Install Capsule-Proxy (OCI)

Source: https://projectcapsule.dev/docs/proxy/_print

Installs the capsule-proxy using the OCI-compatible Helm chart. Ensures the target namespace is created if it does not exist.

```bash
helm install capsule-proxy oci://ghcr.io/projectcapsule/charts/capsule-proxy -n capsule-system --create-namespace
```

--------------------------------

### Install Capsule Proxy (OCI)

Source: https://projectcapsule.dev/docs/proxy/setup/installation

Installs the Capsule Proxy using the OCI-compliant Helm chart. Ensure the 'capsule-system' namespace exists or is created.

```bash
helm install capsule-proxy oci://ghcr.io/projectcapsule/charts/capsule-proxy -n capsule-system --create-namespace

```

--------------------------------

### Example Service Enforcement Rule

Source: https://projectcapsule.dev/docs/tenants/rules/enforcement

A comprehensive example demonstrating how to configure service enforcement with various types and constraints.

```yaml
rules:
  - enforce:
      action: allow
      services:
        types:
          - ClusterIP
          - NodePort
          - LoadBalancer
          - ExternalName
        loadBalancers:
          cidrs:
            - 10.0.0.2/32
        externalNames:
          hostnames:
            - exp: ".*\\.example\\.com"
              exact:
                - internal.git.com
        nodePorts:
          ports:
            - from: 30000
              to: 32767

```

--------------------------------

### Pod Deployment Example

Source: https://projectcapsule.dev/docs/tenants/rules/enforcement

Example Pod definition to test registry enforcement rules. This Pod uses an image that should be denied by a specific rule.

```yaml
apiVersion: v1
kind: Pod
metadata:
  name: image-volume
spec:
  containers:
    - name: shell
      command: ["sleep", "infinity"]
      imagePullPolicy: IfNotPresent
      image: harbor/customer/test-image/debian:latest
      volumeMounts:
        - name: volume
          mountPath: /volume
  volumes:
    - name: volume
      image:
        reference: quay.io/crio/artifact:v2
        pullPolicy: IfNotPresent

```

--------------------------------

### Production Pod Deployment Example

Source: https://projectcapsule.dev/docs/tenants/rules/enforcement

Example Pod definition for a production environment, utilizing a specific image allowed by a namespace-scoped rule.

```yaml
apiVersion: v1
kind: Pod
metadata:
  name: prod-image
spec:
  containers:
    - name: shell
      command: ["sleep", "infinity"]
      imagePullPolicy: Always
      image: harbor/customer/prod-image/debian:latest

```

--------------------------------

### Complete Tenant Service Enforcement Example

Source: https://projectcapsule.dev/docs/tenants/rules/enforcement

This example demonstrates a comprehensive set of service enforcement rules, including type, CIDR, hostname, and NodePort restrictions, along with audit rules and namespace exceptions. Use this as a template for defining granular control over tenant services.

```yaml
---
apiVersion: capsule.clastix.io/v1beta2
kind: Tenant
metadata:
  name: solar
spec:
  ...
  rules:
    - enforce:
        action: allow
        services:
          types:
            - ClusterIP
            - NodePort
            - LoadBalancer
            - ExternalName

    - enforce:
        action: allow
        services:
          loadBalancers:
            cidrs:
              - 10.0.0.2/32
              - 10.0.1.0/24

    - enforce:
        action: allow
        services:
          externalNames:
            hostnames:
              - exact:
                  - internal.git.com
              - exp: ".*\\.example\\.com"

    - enforce:
        action: allow
        services:
          nodePorts:
            ports:
              - from: 30000
                to: 30100
              - from: 30500
                to: 30500

    - enforce:
        action: deny
        services:
          nodePorts:
            ports:
              - from: 30090
                to: 30090

    - enforce:
        action: deny
        services:
          loadBalancers:
            cidrs:
              - 10.0.66.0/24

    - enforce:
        action: audit
        services:
          externalNames:
            hostnames:
              - exp: "audit\\..*"

    - namespaceSelector:
        matchLabels:
          environment: prod
      enforce:
        action: allow
        services:
          loadBalancers:
            cidrs:
              - 10.0.171.0/24

```

--------------------------------

### Complete Service Enforcement Example

Source: https://projectcapsule.dev/docs/tenants/_print

This example demonstrates a comprehensive Tenant configuration combining type enforcement, LoadBalancer CIDR restrictions, ExternalName hostname restrictions, NodePort range restrictions, audit rules, and namespace-specific exceptions. Use this to set up granular control over service deployments.

```yaml
apiVersion: capsule.clastix.io/v1beta2
kind: Tenant
metadata:
  name: solar
spec:
  ...
  rules:
    - enforce:
        action: allow
        services:
          types:
            - ClusterIP
            - NodePort
            - LoadBalancer
            - ExternalName

    - enforce:
        action: allow
        services:
          loadBalancers:
            cidrs:
              - 10.0.0.2/32
              - 10.0.1.0/24

    - enforce:
        action: allow
        services:
          externalNames:
            hostnames:
              - exact:
                  - internal.git.com
              - exp: ".*\\.example\\.com"

    - enforce:
        action: allow
        services:
          nodePorts:
            ports:
              - from: 30000
                to: 30100
              - from: 30500
                to: 30500

    - enforce:
        action: deny
        services:
          nodePorts:
            ports:
              - from: 30090
                to: 30090

    - enforce:
        action: deny
        services:
          loadBalancers:
            cidrs:
              - 10.0.66.0/24

    - enforce:
        action: audit
        services:
          externalNames:
            hostnames:
              - exp: "audit\\..*"

    - namespaceSelector:
        matchLabels:
          environment: prod
      enforce:
        action: allow
        services:
          loadBalancers:
            cidrs:
              - 10.0.171.0/24

```

--------------------------------

### Create Namespace and Deploy Resources for 'gas' Tenant

Source: https://projectcapsule.dev/docs/overview/benchmark

As the 'gas' tenant owner ('joe'), this command sequence creates a namespace 'gas-production', sets it as the current context, and deploys an 'nginx' web server with a service.

```bash
kubectl --kubeconfig joe create ns gas-production
kubectl --kubeconfig joe config set-context --current --namespace gas-production
kubectl --kubeconfig joe run webserver --image nginx:latest
kubectl --kubeconfig joe expose pod webserver --port 80
```

--------------------------------

### Helm Values for Controller Configuration

Source: https://projectcapsule.dev/docs/operating/setup/_print

When installing via Helm, additional options can be defined in the `values.yaml` file. This example shows how to enable leader election.

```yaml
manager:
  extraArgs:
  - "--enable-leader-election=true"
```

--------------------------------

### Create Namespace and Deploy Resources for 'oil' Tenant

Source: https://projectcapsule.dev/docs/overview/benchmark

As the 'oil' tenant owner ('alice'), this command sequence creates a namespace 'oil-production', sets it as the current context, and deploys an 'nginx' web server with a service.

```bash
kubectl --kubeconfig alice create ns oil-production
kubectl --kubeconfig alice config set-context --current --namespace oil-production
kubectl --kubeconfig alice run webserver --image nginx:latest
kubectl --kubeconfig alice expose pod webserver --port 80
```

--------------------------------

### Create Namespace as Tenant User

Source: https://projectcapsule.dev/docs/operating/setup/managed-kubernetes

Switch to the tenant user's context (alice) and create a namespace. This verifies that the tenant configuration is working correctly.

```bash
# Unset AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY if defined
unset AWS_ACCESS_KEY_ID
unset AWS_SECRET_ACCESS_KEY
kubectl create namespace test --kubeconfig="kubeconfig-alice.conf"

```

--------------------------------

### Checking GlobalTenantResource Status

Source: https://projectcapsule.dev/docs/_print

Demonstrates how to check the status of GlobalTenantResource objects using `kubectl get globaltenantresource`. It shows examples of resources that are not ready due to failed applications or missing dependencies.

```bash
kubectl get globaltenantresource

```

```text
NAME                           ITEM COUNT   READY   STATUS                            AGE
custom-cm                      6            False   applying of 6 resources failed    12h
gitops-owners                  6            False   dependency custom-cm-2 not found   8h

```

```bash
kubectl get globaltenantresource gitops-owners

```

```text
NAME                           ITEM COUNT   READY   STATUS                            AGE
gitops-owners                  6            False   dependency custom-cm-2 not found   8h

```

--------------------------------

### Create Namespaces

Source: https://projectcapsule.dev/docs/tenants/quickstart

Create namespaces for tenant production and development environments.

```bash
kubectl create namespace solar-production
kubectl create namespace solar-development
```

--------------------------------

### Create User and Namespace

Source: https://projectcapsule.dev/docs/_print

These commands create a user and then a namespace within the specified tenant. The user 'alice' is granted ownership of the 'oil' tenant.

```bash
./create-user.sh alice oil
```

```bash
kubectl --kubeconfig alice create ns oil-production
```

```bash
kubectl --kubeconfig alice config set-context --current --namespace oil-production
```

--------------------------------

### Tenant Definition Example

Source: https://projectcapsule.dev/docs/_print

This is an example of a Tenant definition in Kubernetes, used to configure multi-tenant environments.

```yaml
---apiVersion: capsule.clastix.io/v1beta2
kind: Tenant
metadata:
  name: solar
spec:
  owners:
  - name: alice
    kind: User
  nodeSelector:
    node-role.kubernetes.io/worker: ''
```

--------------------------------

### Create ClusterRole per Tenant with Go Template

Source: https://projectcapsule.dev/docs/replications/tenant

This example demonstrates creating a ClusterRole for each Tenant using a Go template. It ensures that any referenced context keys are present, otherwise it will stop execution with an error.

```yaml
---
apiVersion: capsule.clastix.io/v1beta2
kind: TenantResource
metadata:
  name: tenant-cluster-rbac
spec:
  resources:
    - generators:
        - missingKey: error
          template: |
            apiVersion: rbac.authorization.k8s.io/v1
            kind: ClusterRole
            metadata:
              name: tenant:{{$.tenant.metadata.name}}:reader
            rules:
            - apiGroups: [""]
              resources: ["secrets"]
              verbs: ["get", "watch", "list"]            

```

--------------------------------

### Example Denied Service: api.bad.com

Source: https://projectcapsule.dev/docs/tenants/rules/enforcement

An example Service of type ExternalName with a hostname that does not match any allowed rules.

```yaml
apiVersion: v1
kind: Service
metadata:
  name: api
spec:
  type: ExternalName
  externalName: api.bad.com
  ports:
    - name: https
      port: 443
      targetPort: 443
```

--------------------------------

### Create Tenant with Resource Quotas

Source: https://projectcapsule.dev/docs/overview/benchmark

Use this snippet to create a new tenant and define its resource quotas for CPU, memory, and storage. This ensures isolation and fairness across tenants.

```yaml
apiVersion: capsule.clastix.io/v1beta2
kind: Tenant
metadata:
  name: oil
spec:
  owners:
  - kind: User
    name: alice
  resourceQuotas:
    items:
    - hard:
        limits.cpu: "8"
        limits.memory: 16Gi
        requests.cpu: "8"
        requests.memory: 16Gi
    - hard:
        requests.storage: 100Gi
```

--------------------------------

### Example Tenant Promotion Status

Source: https://projectcapsule.dev/docs/tenants/rules/permissions

An example of the status output showing a promoted ServiceAccount and its target namespaces.

```json
[
  {
    "clusterRoles": [
      "tenant-replicator"
    ],
    "kind": "ServiceAccount",
    "name": "system:serviceaccount:solar-test:gitops-reconcile",
    "targets": [
      "solar-test",
      "solar-prod"
    ]
  }
]

```

--------------------------------

### Tenant Reconciliation Error Example

Source: https://projectcapsule.dev/docs/tenants/rules/permissions

An example of a Tenant reconciliation error message indicating a missing ClusterRole.

```yaml
conditions:
- lastTransitionTime: "2026-02-16T23:08:59Z"
  message: 'cannot sync rolebindings items: rolebindings.rbac.authorization.k8s.io
    "tenant-replicator" not found'

```

--------------------------------

### RBAC Forbidden Error Example

Source: https://projectcapsule.dev/docs/operating/setup/_print

Example of a status message indicating RBAC permission issues for a tenant.

```text
NAME    STATE    NAMESPACE QUOTA   NAMESPACE COUNT   NODE SELECTOR   READY   STATUS                                                                                                                                                                                                                                                                                                                                          AGE
green   Active                     2                                 False   cannot sync rolebindings items: rolebindings.rbac.authorization.k8s.io "capsule:managed:658936e7f2a30e35" is forbidden: user "system:serviceaccount:capsule-system:capsule" (groups=["system:serviceaccounts" "system:serviceaccounts:capsule-system" "system:authenticated"]) is attempting to grant RBAC permissions not currently held:...   5s

```

--------------------------------

### Create Tenant with Network Policy

Source: https://projectcapsule.dev/docs/_print

As a cluster admin, create a tenant with specific network policy configurations.

```bash
kubectl create -f - <<EOF
apiVersion: capsule.clastix.io/v1beta2
kind: Tenant
metadata:
  name: oil
spec:
  owners:
  - kind: User
    name: alice
  networkPolicies:
    items:
    - ingress:
      - from:
        - namespaceSelector:
            matchLabels:
              capsule.clastix.io/tenant: oil
      podSelector: {}
      policyTypes:
      - Egress
      - Ingress
EOF

./create-user.sh alice oil
```

--------------------------------

### Create ClusterRoles for Tenant Priorities

Source: https://projectcapsule.dev/docs/replications/_print

Example showing how to generate multiple ClusterRoles based on tenant priority classes using a Go template with a range loop.

```yaml
---
apiVersion: capsule.clastix.io/v1beta2
kind: GlobalTenantResource
metadata:
  name: tenant-priority-rbac
spec:
  scope: Tenant
  resources:
    - generators:
        - missingKey: error
          template: |
            {{- range $.tenant.status.classes.priority }}
            ---
            apiVersion: rbac.authorization.k8s.io/v1
            kind: ClusterRole
            metadata:
              name: tenant:{{$.tenant.metadata.name}}:priority:{{.}}
            rules:
              - apiGroups: ["scheduling.k8s.io"]
                resources: ["priorityclasses"]
                resourceNames: ["{{.}}"]
                verbs: ["get"]
            {{- end }}

```

--------------------------------

### Cordoning Admission Error Example

Source: https://projectcapsule.dev/docs/tenants/administration

Example of an error message received when attempting a forbidden operation on a cordoned tenant.

```bash
kubectl delete pod --all -n solar-test --as alice --as-group projectcapsule.dev

Error from server (Forbidden): admission webhook "cordoning.misc.projectcapsule.dev" denied the request: The current namespace 'solar-test' is cordoned. The attempted operation DELETE for /v1/Pod/nginx-deployment-56f567c7cb-pj86t is not permitted during cordoning status.

```

--------------------------------

### Create SopsProvider for each Tenant

Source: https://projectcapsule.dev/docs/replications/global

This snippet demonstrates creating a SopsProvider for each Tenant using 'rawItems'. It configures keys and sops settings, dynamically selecting namespaces based on the tenant name.

```yaml
---
apiVersion: capsule.clastix.io/v1beta2
kind: GlobalTenantResource
metadata:
  name: tenant-sops-providers
spec:
  resyncPeriod: 600s
  scope: Tenant
  resources:
    - rawItems:
        - apiVersion: addons.projectcapsule.dev/v1alpha1
          kind: SopsProvider
          metadata:
            name: "{{tenant.name}}-secrets"
          spec:
            keys:
            - namespaceSelector:
                matchLabels:
                  capsule.clastix.io/tenant: "{{tenant.name}}"
            sops:
            - namespaceSelector:
                matchLabels:
                  capsule.clastix.io/tenant: "{{tenant.name}}"

```

--------------------------------

### Install FluxCD Addon

Source: https://projectcapsule.dev/docs/guides/use-fluxcd

Install the FluxCD addon for Capsule using Helm. Ensure the correct namespace is used.

```bash
helm install -n capsule-system capsule-addon-fluxcd \
  oci://ghcr.io/projectcapsule/charts/capsule-addon-fluxcd
```

--------------------------------

### Create a Tenant with Network Policies

Source: https://projectcapsule.dev/docs/overview/benchmark

Use this command to create a new tenant with specific network policy configurations. This sets up ingress and egress rules for the tenant's namespaces.

```yaml
apiVersion: capsule.clastix.io/v1beta2
kind: Tenant
metadata:
  name: oil
spec:
  owners:
  - kind: User
    name: alice
  networkPolicies:
    items:
    - podSelector: {}
      policyTypes:
      - Ingress
      - Egress
    - egress:
      - to:
        - namespaceSelector:
            matchLabels:
              capsule.clastix.io/tenant: oil
      ingress:
      - from:
        - namespaceSelector:
            matchLabels:
              capsule.clastix.io/tenant: oil
      podSelector: {}
      policyTypes:
      - Egress
      - Ingress
```

--------------------------------

### ObjectBucketClaim Example

Source: https://projectcapsule.dev/docs/operating/admission-policies

An example of a namespaced ObjectBucketClaim resource. This is used to demonstrate the need for validating specific fields like storageClassName.

```yaml
apiVersion: objectbucket.io/v1alpha1
kind: ObjectBucketClaim
metadata:
  name: admission-class
  namespace: solar-production
  finalizers:
    - objectbucket.io/finalizer
  labels:
    bucket-provisioner: openshift-storage.ceph.rook.io-bucket
spec:
  additionalConfig:
    maxSize: 2G
  bucketName: test-some-uid
  generateBucketName: test
  objectBucketName: obc-test-test
  storageClassName: ocs-storagecluster-ceph-rgw

```

--------------------------------

### Example Admitted Pod

Source: https://projectcapsule.dev/docs/tenants/rules/enforcement

A Pod using a scheduler name specified in the allow-list (`tenant-scheduler`) will be admitted.

```yaml
apiVersion: v1
kind: Pod
metadata:
  name: scheduled-by-tenant
spec:
  schedulerName: tenant-scheduler
  containers:
    - name: shell
      image: harbor/platform/debian:latest
      command: ["sleep", "infinity"]

```

--------------------------------

### TenantResource Adoption Success Example

Source: https://projectcapsule.dev/docs/_print

This output shows successful modification of resources after enabling adoption. The `status.status` for the `app-demo` ConfigMap in `wind-test` is now `True`.

```yaml
  processedItems:
  - kind: ConfigMap
    name: app-demo
    namespace: wind-prod
    origin: 0/generator-0-0
    status:
      created: true
      lastApply: "2026-02-10T17:59:46Z"
      status: "True"
      type: Ready
    tenant: wind
    version: v1
  - kind: ConfigMap
    name: app-demo
    namespace: wind-test
    origin: 0/generator-0-0
    status:
      lastApply: "2026-02-10T18:01:31Z"
      status: "True"
      type: Ready
    tenant: wind
    version: v1


```

--------------------------------

### Install Capsule Operator (Helm)

Source: https://projectcapsule.dev/docs/operating/setup/_print

Installs the Capsule operator using the Helm chart, creating the namespace if it doesn't exist.

```bash
helm install capsule projectcapsule/capsule --version 0.12.4 -n capsule-system --create-namespace

```

--------------------------------

### Create ClusterRole per Tenant

Source: https://projectcapsule.dev/docs/replications/_print

A simple example demonstrating how to create a Kubernetes ClusterRole for each Tenant using a Go template.

```yaml
---
apiVersion: capsule.clastix.io/v1beta2
kind: GlobalTenantResource
metadata:
  name: tenant-cluster-rbac
spec:
  scope: Tenant
  resources:
    - generators:
        - missingKey: error
          template: |
            apiVersion: rbac.authorization.k8s.io/v1
            kind: ClusterRole
            metadata:
              name: tenant:{{$.tenant.metadata.name}}:reader
            rules:
            - apiGroups: [""]
              resources: ["secrets"]
              verbs: ["get", "watch", "list"]

```

--------------------------------

### ServiceAccount Owner Status Example

Source: https://projectcapsule.dev/docs/tenants/_print

This JSON output shows an example of the status.owners field after a ServiceAccount has been successfully promoted to a Tenant Owner.

```json
[
  {
    "clusterRoles": [
      "capsule-namespace-provisioner",
      "capsule-namespace-deleter"
    ],
    "kind": "ServiceAccount",
    "name": "system:serviceaccount:green-test:gitops-reconcile"
  },
 {
    "clusterRoles": [
      "view",
      "tenant-resources"
    ],
    "kind": "User",
    "name": "joe"
  }
]
```

--------------------------------

### Create Deployment within Quota Limits

Source: https://projectcapsule.dev/docs/tenants/quotas

Example of creating a Kubernetes deployment. This command should succeed if the requested resources are within the defined quotas for the namespace.

```bash
kubectl -n solar-production create deployment nginx --image nginx:latest --replicas 4

```

--------------------------------

### Example BestEffort Pod

Source: https://projectcapsule.dev/docs/tenants/rules/enforcement

An example Pod definition that would be classified as 'BestEffort' due to the absence of CPU or memory requests and limits.

```yaml
apiVersion: v1
kind: Pod
metadata:
  name: best-effort
spec:
  containers:
    - name: shell
      image: harbor/platform/debian:latest
      command: ["sleep", "infinity"]

```

--------------------------------

### Tenant Configuration with Registry Enforcement

Source: https://projectcapsule.dev/docs/tenants/rules/enforcement

Example Tenant configuration demonstrating complex registry enforcement rules including allow, deny, audit actions, and namespace selectors.

```yaml
---
apiVersion: capsule.clastix.io/v1beta2
kind: Tenant
metadata:
  name: solar
spec:
  ...
  rules:
    - enforce:
        action: allow
        workloads:
          registries:
            - exp: "harbor/.*"

    - enforce:
        action: deny
        workloads:
          targets:
            - pod/containers
            - pod/volumes
          registries:
            - exp: "harbor/customer/.*"

    - enforce:
        action: allow
        workloads:
          targets:
            - pod/containers
          registries:
            - exp: "audit/.*"

    - enforce:
        action: audit
        workloads:
          targets:
            - pod/containers
          registries:
            - exp: "audit/.*"

    - namespaceSelector:
        matchExpressions:
          - key: env
            operator: In
            values: ["prod"]
      enforce:
        action: allow
        workloads:
          targets:
            - pod/containers
            - pod/volumes
          registries:
            - exp: "harbor/customer/prod-image/.*"
              policy: ["Always"]


```

--------------------------------

### Install Capsule Operator (OCI)

Source: https://projectcapsule.dev/docs/operating/setup/_print

Installs the Capsule operator using the OCI-compatible Helm chart, creating the namespace if it doesn't exist.

```bash
helm install capsule oci://ghcr.io/projectcapsule/charts/capsule --version 0.12.4 -n capsule-system --create-namespace

```

--------------------------------

### Create Tenant with Resource Quotas

Source: https://projectcapsule.dev/docs/_print

Use this command to create a new tenant named 'oil' and define its resource quotas for CPU, memory, and storage. This ensures isolation and fairness across tenant namespaces.

```bash
kubectl create -f - <<EOF
apiVersion: capsule.clastix.io/v1beta2
kind: Tenant
metadata:
  name: oil
spec:
  owners:
  - kind: User
    name: alice
  resourceQuotas:
    items:
    - hard:
        limits.cpu: "8"
        limits.memory: 16Gi
        requests.cpu: "8"
        requests.memory: 16Gi
    - hard:
        requests.storage: 100Gi
EOF

./create-user.sh alice oil
```

--------------------------------

### CustomQuota Definition Example

Source: https://projectcapsule.dev/docs/resource-management/customquotas/_print

An example YAML definition for a CustomQuota that limits the count of Pods in a namespace. This definition is used as a basis for the Prometheus metrics.

```yaml
apiVersion: capsule.clastix.io/v1beta2
kind: CustomQuota
metadata:
  name: pod-count-limit
  namespace: wind-test
spec:
  limit: 3
  options:
    emitMetricPerClaimUsage: false
  sources:
  - apiVersion: "v1"
    kind: Pod
    op: count
status:
  claims:
  - group: ""
    kind: Pod
    name: nginx-deployment-77bc6bd484-4qm4h
    namespace: wind-test
    uid: c6df70ce-f483-4b02-af65-c8c150d22ed2
    usage: "1"
    version: v1
  - group: ""
    kind: Pod
    name: nginx-deployment-77bc6bd484-f8qcv
    namespace: wind-test
    uid: eeae006b-5ce8-442b-b6c3-f208387545a7
    usage: "1"
    version: v1
  - group: ""
    kind: Pod
    name: nginx-deployment-77bc6bd484-bsnfz
    namespace: wind-test
    uid: 9e1135a7-b286-4768-becd-147b37c999f8
    usage: "1"
    version: v1
  conditions:
  - lastTransitionTime: "2026-04-23T09:21:29Z"
    message: reconciled
    reason: Succeeded
    status: "True"
    type: Ready
  targets:
  - group: ""
    kind: Pod
    op: count
    scope: namespace
    version: v1
  usage:
    available: "0"
    used: "3"
```

--------------------------------

### Install Capsule Addon for FluxCD

Source: https://projectcapsule.dev/docs/_print

Install the FluxCD addon using Helm. This command deploys the necessary components for GitOps operations with Capsule.

```bash
helm install -n capsule-system capsule-addon-fluxcd \
  oci://ghcr.io/projectcapsule/charts/capsule-addon-fluxcd

```