https://deploy-preview-179--docs-projectcapsule.netlify.app/docs/operating/setup/Recent content in Setup on CapsuleHugo -- gohugo.ioenhttps://deploy-preview-179--docs-projectcapsule.netlify.app/docs/operating/setup/installation/Mon, 01 Jan 0001 00:00:00 +0000https://deploy-preview-179--docs-projectcapsule.netlify.app/docs/operating/setup/installation/Requirements Helm 3 is required when installing the Capsule Operator chart. Follow Helm’s official documentation for installing Helm on your operating system. A Kubernetes cluster (v1.16+) with the following Admission Controllers enabled: PodNodeSelector LimitRanger ResourceQuota MutatingAdmissionWebhook ValidatingAdmissionWebhook A Kubeconfig file accessing the Kubernetes cluster with cluster admin permissions. Cert-Manager is required by default but can be disabled. It is used to manage the TLS certificates for the Capsule Admission Webhooks. Installation We officially only support the installation of Capsule using the Helm chart.https://deploy-preview-179--docs-projectcapsule.netlify.app/docs/operating/setup/configuration/Mon, 01 Jan 0001 00:00:00 +0000https://deploy-preview-179--docs-projectcapsule.netlify.app/docs/operating/setup/configuration/The configuration for the capsule controller is done via its dedicated configuration Custom Resource. You can explain the configuration options and how to use them: CapsuleConfiguration The configuration for Capsule is done via its dedicated configuration Custom Resource. You can explain the configuration options and how to use them: kubectl explain capsuleConfiguration.spec administrators These entities are automatically owners for all existing tenants. Meaning they can add namespaces to any tenant. However they must be specific by using the capsule label for interacting with namespaces.https://deploy-preview-179--docs-projectcapsule.netlify.app/docs/operating/setup/authentication/Mon, 01 Jan 0001 00:00:00 +0000https://deploy-preview-179--docs-projectcapsule.netlify.app/docs/operating/setup/authentication/Capsule does not care about the authentication strategy used in the cluster and all the Kubernetes methods of authentication are supported. The only requirement to use Capsule is to assign tenant users to the group defined by userGroups option in the CapsuleConfiguration, which defaults to projectcapsule.dev. OIDC In the following guide, we’ll use Keycloak an Open Source Identity and Access Management server capable to authenticate users via OIDC and release JWT tokens as proof of authentication.https://deploy-preview-179--docs-projectcapsule.netlify.app/docs/operating/setup/openshift/Mon, 01 Jan 0001 00:00:00 +0000https://deploy-preview-179--docs-projectcapsule.netlify.app/docs/operating/setup/openshift/Introduction This guide shows how to deploy Capsule and the Capsule Proxy on OpenShift with a single Helm chart and one OpenShift toggle, so workloads run under the OpenShift SCCs. It also covers the recommended tenant settings to keep OpenShift-managed metadata protected, and optional customizations of the OpenShift Console. Why Capsule on OpenShift Capsule and OpenShift complement each other. Capsule brings the tenancy model, with rules and policy enforcement for tenants.https://deploy-preview-179--docs-projectcapsule.netlify.app/docs/operating/setup/rancher/Mon, 01 Jan 0001 00:00:00 +0000https://deploy-preview-179--docs-projectcapsule.netlify.app/docs/operating/setup/rancher/The integration between Rancher and Capsule, aims to provide a multi-tenant Kubernetes service to users, enabling: a self-service approach access to cluster-wide resources to end-users. Tenant users will have the ability to access Kubernetes resources through: Rancher UI Rancher Shell Kubernetes CLI On the other side, administrators need to manage the Kubernetes clusters through Rancher. Rancher provides a feature called Projects to segregate resources inside a common domain. At the same time Projects doesn’t provide way to segregate Kubernetes cluster-scope resources.https://deploy-preview-179--docs-projectcapsule.netlify.app/docs/operating/setup/managed-kubernetes/Mon, 01 Jan 0001 00:00:00 +0000https://deploy-preview-179--docs-projectcapsule.netlify.app/docs/operating/setup/managed-kubernetes/Capsule Operator can be easily installed on a Managed Kubernetes Service. Since you do not have access to the Kubernetes APIs Server, you should check with the provider of the service: the default cluster-admin ClusterRole is accessible the following Admission Webhooks are enabled on the APIs Server: PodNodeSelector LimitRanger ResourceQuota MutatingAdmissionWebhook ValidatingAdmissionWebhook AWS EKS This is an example of how to install AWS EKS cluster and one user manged by Capsule.