projectcapsule/capsule

Health v2 · maintenance only

Adoption not part of the score

2162 stars · 217 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

Capsule is a Kubernetes Operator that turns a single cluster into a shared multi-tenant platform by grouping namespaces into Tenant abstractions with inherited RBAC, quotas, and admission policies. It is a CNCF Sandbox project written in Go that enforces governance via Kubernetes admission controllers without custom binaries or extra tooling.

Use cases

• run multiple teams on a single kubernetes cluster with strong isolation
• prevent cluster sprawl by sharing one cluster across departments
• let developers self-provision namespaces within assigned boundaries
• enforce image registries and security contexts via admission policies
• propagate rbac roles and network policies across tenant namespaces
• manage cpu memory and storage budgets per tenant

When to choose

• you need hierarchical multi-tenancy on a single kubernetes cluster
• you want policy enforcement using only native kubernetes primitives
• you prefer a declarative GitOps-ready operator over custom tooling
• you want to give teams self-service while admins keep control

When to avoid

• you need hard isolation between tenants with separate control planes
• you run a single-tenant cluster with no namespace governance needs
• you require multi-cluster tenant management rather than in-cluster tenancy

Facets

framework · maturity active

middleware security configuration-management deployment cloud-computing self-hosted cloud self-hosted go kubernetes-operator multi-tenancy policy-enforcement tenant-management namespace-governance rbac resource-quotas gitops cncf-sandbox containers devops kubernetes docker

Member repositories

For agents

markdown · JSON · MCP: product_card(name="projectcapsule/capsule")