Use the Capsule Operator for easily implementing, managing, and maintaining multitenancy and access control in Kubernetes.

• Helm 3 is required when installing the Capsule Operator chart. Follow Helm’s official steps for installing helm on your particular operating system.

• A Kubernetes cluster 1.16+ with following Admission Controllers enabled:

  • PodNodeSelector
  • LimitRanger
  • ResourceQuota
  • MutatingAdmissionWebhook
  • ValidatingAdmissionWebhook

• A kubeconfig file accessing the Kubernetes cluster with cluster admin permissions.

In the following sections you see actions which are required when you are upgrading to a specific version.

Introduces a new methode to manage all capsule CRDs and their lifecycle. We are no longer relying on the native CRD hook with the Helm Chart. The hook only allows to manage CRDs on install and uninstall but we can't deliver updates to the CRDs. When you newly install the chart we recommend to set crds.install to true. This will manage the CRDs with the Helm Chart. This behavior is the new default.

The following Values have changed key or Value:

• All values from previous releases under webhooks have moved to webhooks.hooks.
• mutatingWebhooksTimeoutSeconds has moved to webhooks.mutatingWebhooksTimeoutSeconds
• validatingWebhooksTimeoutSeconds has moved to webhooks.validatingWebhooksTimeoutSeconds

The Capsule Operator requires it's CRDs to be installed before the operator itself. Since the Helm CRD lifecycle has limitations, we recommend to install the CRDs separately. Our chart supports the installation of crds via a dedicated Release. The Capsule Operator Chart can be used to instantly deploy the Capsule Operator on your Kubernetes cluster.

1. Add this repository:

    $ helm repo add projectcapsule https://projectcapsule.github.io/charts
   

2. Install Capsule:

    $ helm install capsule projectcapsule/capsule --version 0.7.0 -n capsule-system --create-namespace
   
    or
   
    $ helm install capsule oci://ghcr.io/projectcapsule/charts/capsule --version 0.7.0  -n capsule-system --create-namespace
   

3. Show the status:

    $ helm status capsule -n capsule-system
   

4. Upgrade the Chart

    $ helm upgrade capsule projectcapsule/capsule -n capsule-system
   
    or
   
    $ helm upgrade capsule oci://ghcr.io/projectcapsule/charts/capsule --version 0.4.7
   

5. Uninstall the Chart

    $ helm uninstall capsule -n capsule-system
   

There are two methods for specifying overrides of values during chart installation: --values and --set.

The --values option is the preferred method because it allows you to keep your overrides in a YAML file, rather than specifying them all on the command line. Create a copy of the YAML file values.yaml and add your overrides to it.

Specify your overrides file when you install the chart:

    $ helm install capsule capsule-helm-chart --values myvalues.yaml -n capsule-system

The values in your overrides file myvalues.yaml will override their counterparts in the chart's values.yaml file. Any values in values.yaml that weren’t overridden will keep their defaults.

If you only need to make minor customizations, you can specify them on the command line by using the --set option. For example:

    $ helm install capsule capsule-helm-chart --set manager.options.forceTenantPrefix=false -n capsule-system

Here the values you can override:

This Helm Chart creates the following Kubernetes resources in the release namespace:

• Capsule Namespace
• Capsule Operator Deployment
• Capsule Service
• CA Secret
• Certificate Secret
• Tenant Custom Resource Definition
• CapsuleConfiguration Custom Resource Definition
• MutatingWebHookConfiguration
• ValidatingWebHookConfiguration
• RBAC Cluster Roles
• Metrics Service

And optionally, depending on the values set:

• Capsule ServiceAccount
• Capsule Service Monitor
• PodSecurityPolicy
• RBAC ClusterRole and RoleBinding for pod security policy
• RBAC Role and Rolebinding for metrics scrape

Capsule, as many other add-ons, defines its own set of Custom Resource Definitions (CRDs). Helm3 removed the old CRDs installation method for a more simple methodology. In the Helm Chart, there is now a special directory called crds to hold the CRDs. These CRDs are not templated, but will be installed by default when running a helm install for the chart. If the CRDs already exist (for example, you already executed helm install), it will be skipped with a warning. When you wish to skip the CRDs installation, and do not see the warning, you can pass the --skip-crds flag to the helm install command.

You can enable the generation of certificates using cert-manager as follows.

helm upgrade --install capsule projectcapsule/capsule --namespace capsule-system --create-namespace \
  --set "certManager.generateCertificates=true" \
  --set "tls.create=false" \
  --set "tls.enableController=false"

With the usage of tls.enableController=false value, you're delegating the injection of the Validating and Mutating Webhooks' CA to cert-manager. Since Helm3 doesn't allow to template CRDs, you have to patch manually the Custom Resource Definition tenants.capsule.clastix.io adding the proper annotation (YMMV).

apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.5.0
    cert-manager.io/inject-ca-from: capsule-system/capsule-webhook-cert
  creationTimestamp: "2022-07-22T08:32:51Z"
  generation: 45
  name: tenants.capsule.clastix.io
  resourceVersion: "9832"
  uid: 61e287df-319b-476d-88d5-bdb8dc14d4a6

See Capsule tutorial for more information about how to use Capsule.