Kubernetes Multi-Tenancy, Simplified.

A cluster-scoped custom resource that groups one or more namespaces under a shared set of boundaries. Everything defined on the Tenant is inherited automatically by all of its namespaces: role bindings, resource quotas and limits, admission rules such as allowed registries and pull policies, and templated resource distribution. Namespaces carry an owner reference back to the Tenant and a tenant label.

Capsule Proxy is an add-on that closes a gap in Kubernetes RBAC. Kubernetes cannot list only the cluster-scoped resources you own, because there is no ACL-filtered API, so granting list on namespaces would expose every namespace in the cluster. Without the proxy, a tenant user running a namespace listing gets a forbidden error. With it, standard commands return only that user’s own resources, including listing pods across all their namespaces and the persistent volumes backing their claims. The design goal is to keep the same user experience across every Kubernetes distribution rather than introducing mirrored custom resources and lock-in.

Capsule can apply a resource quota at tenant scope, aggregating usage across every namespace in the tenant rather than applying a fixed quota per namespace, which is the behavior most platform teams actually want. The current recommended model is ResourcePools, which are cluster-scoped resources defining a pool of resources plus the namespaces permitted to claim from it, with claiming done through a namespaced ResourcePoolClaim. Bound claims stack additional resources on top of the quota provisioned into the claiming namespace, and claim lifecycle is deliberately decoupled from pool lifecycle. Global and custom quota resources are also available in the current release line.

Yes, and it is a stated design goal: Capsule is completely declarative and GitOps ready, with no special requirements for Argo CD or Flux. With Argo CD, specific sync options are needed on the Capsule configuration resource because Argo validates before the CRDs are installed, and a separate Capsule Argo add-on translates Tenants into Argo AppProjects automatically. With Flux, the documented pattern is a Helm release from the OCI repository with drift detection enabled, and a Capsule Flux add-on lets tenants manage their own resources, including creating namespaces, from their own Git repositories without escaping tenant policy.

Several things, stated plainly in its own documentation. Tenant owners cannot create custom resource definitions, because that requires cluster-admin, and this is described as a known limitation of any multi-tenancy model built on a single shared control plane. There is no hierarchy of Tenants, since all Tenants sit at the same level, although multiple Tenants can share an owner. Capsule is not a general-purpose admission policy engine and does not attempt to enforce every possible security standard, which is why Kyverno is a documented companion. All tenants share one API server and one etcd, so custom resource definitions and API extensions are shared and can conflict. Namespaces cannot be moved between tenants by default and are deleted with their Tenant.

The project describes itself as stable, following the Kubernetes definition of stable, and states that although it is under frequent development it is ready for use in production and is currently used in both public and private deployments.