github/capsule
1
0
Fork 0
mirror of https://github.com/projectcapsule/capsule.git synced 2026-08-25 16:07:24 +00:00
Code Issues Packages Projects Releases Wiki Activity

chore: add deprecation notices (#2089)

Browse Source 
* fix: revert pv labeling to dircet api reads

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

* fix: revert pv labeling to dircet api reads

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

* feat: add deprecation warnings

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

* chore: implement playground

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

* chore: implement playground

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

---------

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>
This commit is contained in:
Oliver Bähler
2026-08-19 15:08:47 +02:00
committed by GitHub
parent e714dbcc2a
commit 647b113702
85 changed files with 2452 additions and 517 deletions
Download Patch File Download Diff File Expand all files Collapse all files
hack/distro/capsule/example-setup/claims.yaml
-35
View File
@@ -1,35 +0,0 @@
---
apiVersion: capsule.clastix.io/v1beta2
kind: ResourcePoolClaim
metadata:
name: get-me-solar
namespace: solar-test
spec:
pool: "solar-pool"
claim:
requests.cpu: "2"
requests.memory: 2Gi
---
apiVersion: capsule.clastix.io/v1beta2
kind: ResourcePoolClaim
metadata:
name: get-me-solar-2
namespace: solar-test
spec:
pool: "solar-pool"
claim:
requests.cpu: "2"
requests.memory: 2Gi
---
apiVersion: capsule.clastix.io/v1beta2
kind: ResourcePoolClaim
metadata:
name: get-me-customer
annotations:
"projectcapsule.dev/release": "true"
namespace: solar-test
spec:
pool: "customer-pool"
claim:
requests.cpu: "2"
requests.memory: 2Gi
hack/distro/capsule/example-setup/custom-quotas.yaml
-59
View File
@@ -1,59 +0,0 @@
---
apiVersion: capsule.clastix.io/v1beta2
kind: GlobalCustomQuota
metadata:
name: service-aggregate
spec:
limit: 5
namespaceSelectors:
- matchLabels:
capsule.clastix.io/tenant: wind
sources:
- apiVersion: v1
kind: Service
op: count
selectors:
- fieldSelectors:
- .spec.type=="ClusterIP"
---
apiVersion: capsule.clastix.io/v1beta2
kind: GlobalCustomQuota
metadata:
name: storage-aggregate
spec:
limit: 5Gi
namespaceSelectors:
- matchLabels:
capsule.clastix.io/tenant: wind
sources:
- apiVersion: v1
kind: Pod
op: add
path: ".spec.volumes[*].ephemeral.volumeClaimTemplate.spec.resources.requests.storage"
- apiVersion: v1
kind: PersistentVolumeClaim
op: add
path: ".spec.resources.requests.storage"
selectors:
- fieldSelectors:
- '.spec.accessModes[?(@=="ReadWriteOnce")]'
---
apiVersion: capsule.clastix.io/v1beta2
kind: GlobalCustomQuota
metadata:
name: cpu-limits
spec:
limit: 5
namespaceSelectors:
- matchLabels:
capsule.clastix.io/tenant: wind
sources:
- apiVersion: "v1"
kind: Pod
op: add
path: .spec.containers[*].resources.limits.cpu
- apiVersion: "v1"
kind: Pod
op: add
path: .spec.initContainers[*].resources.limits.cpu
hack/distro/capsule/example-setup/global-resource-quotas.yaml
-15
View File
@@ -1,15 +0,0 @@
---
apiVersion: capsule.clastix.io/v1beta2
kind: GlobalResourceQuota
metadata:
name: green-shared-compute
spec:
namespaceSelectors:
- matchLabels:
capsule.clastix.io/tenant: green
quota:
hard:
limits.cpu: "8"
limits.memory: 16Gi
requests.cpu: "8"
requests.memory: 16Gi
hack/distro/capsule/example-setup/kustomization.yaml
-10
View File
@@ -1,10 +0,0 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- owners.yaml
- tenants.yaml
- resource.yaml
- pools.yaml
- global-resource-quotas.yaml
- rbac.yaml
- custom-quotas.yaml
hack/distro/capsule/example-setup/owners.yaml
-30
View File
@@ -1,30 +0,0 @@
---
apiVersion: capsule.clastix.io/v1beta2
kind: TenantOwner
metadata:
labels:
team: devops
name: devops-user
spec:
kind: User
name: "some@user.com"
---
apiVersion: capsule.clastix.io/v1beta2
kind: TenantOwner
metadata:
labels:
team: devops
name: devops
spec:
kind: Group
name: "oidc:org:devops"
---
apiVersion: capsule.clastix.io/v1beta2
kind: TenantOwner
metadata:
labels:
team: platform
name: platform
spec:
kind: Group
name: "oidc:org:platform"
hack/distro/capsule/example-setup/pools.yaml
-32
View File
@@ -1,32 +0,0 @@
---
apiVersion: capsule.clastix.io/v1beta2
kind: ResourcePool
metadata:
name: solar-pool
spec:
quota:
hard:
limits.cpu: "2"
limits.memory: 2Gi
requests.cpu: "2"
requests.memory: 2Gi
requests.storage: "5Gi"
selectors:
- matchLabels:
capsule.clastix.io/tenant: solar
---
apiVersion: capsule.clastix.io/v1beta2
kind: ResourcePool
metadata:
name: customer-pool
spec:
quota:
hard:
limits.cpu: "2"
limits.memory: 2Gi
requests.cpu: "2"
requests.memory: 2Gi
requests.storage: "5Gi"
selectors:
- matchLabels:
customer: a
hack/distro/capsule/example-setup/rbac.yaml
-31
View File
@@ -1,31 +0,0 @@
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: configmap-replicator
labels:
projectcapsule.dev/aggregate-to-controller: "true"
rules:
- apiGroups: [""]
resources: ["configmaps"]
verbs: ["get", "create", "patch", "watch", "list", "delete"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: secret-replicator
labels:
projectcapsule.dev/aggregate-to-controller: "true"
rules:
- apiGroups: [""]
resources: ["secrets"]
verbs: ["get", "create", "patch", "watch", "list", "delete"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: custom:proxy-viewer
rules:
- apiGroups: [""]
resources: ["*"]
verbs: ["list"]
hack/distro/capsule/example-setup/resource-legacy.yaml
-42
View File
@@ -1,42 +0,0 @@
---
apiVersion: capsule.clastix.io/v1beta2
kind: GlobalTenantResource
metadata:
name: custom-cm
spec:
resyncPeriod: 60s
resources:
- additionalMetadata:
labels:
"replicated-by": "capsule"
rawItems:
- apiVersion: v1
kind: ConfigMap
metadata:
name: game-demo
data:
# property-like keys; each key maps to a simple value
player_initial_lives: "3"
ui_properties_file_name: "user-interface.properties"
---
apiVersion: capsule.clastix.io/v1beta2
kind: GlobalTenantResource
metadata:
name: gitops-owners
spec:
resyncPeriod: 60s
resources:
- additionalMetadata:
labels:
"replicated-by": "capsule"
rawItems:
- apiVersion: capsule.clastix.io/v1beta2
kind: TenantOwner
metadata:
name: "{{tenant.name}}-{{namespace}}"
spec:
clusterRoles:
- capsule-namespace-deleter
- admin
kind: ServiceAccount
name: "system:serviceaccount:{{namespace}}:gitops-reconciler"
hack/distro/capsule/example-setup/resource.yaml
-43
View File
@@ -1,43 +0,0 @@
---
apiVersion: capsule.clastix.io/v1beta2
kind: GlobalTenantResource
metadata:
name: gitops-owners
spec:
resyncPeriod: 60s
resources:
- additionalMetadata:
labels:
"replicated-by": "capsule"
rawItems:
- apiVersion: capsule.clastix.io/v1beta2
kind: TenantOwner
metadata:
name: "{{tenant.name}}-{{namespace}}"
spec:
clusterRoles:
- capsule-namespace-deleter
- admin
kind: ServiceAccount
name: "system:serviceaccount:{{namespace}}:gitops-reconciler"
---
apiVersion: capsule.clastix.io/v1beta2
kind: GlobalTenantResource
metadata:
name: cluster-replication
spec:
resyncPeriod: 60s
resources:
- generators:
- template: |
{{ $$key := generateAgeKey }}
---
apiVersion: v1
kind: ConfigMap
metadata:
name: "cluster-replication"
namespace: "default"
data:
data: |
identity: {{ $$key.Identity | quote }}
recipient: {{ $$key.Recipient | quote }}
hack/distro/capsule/example-setup/tenants.yaml
-195
View File
@@ -1,195 +0,0 @@
---
apiVersion: capsule.clastix.io/v1beta2
kind: Tenant
metadata:
name: solar
labels:
customer: a
spec:
owners:
- name: alice
kind: User
rules:
- namespaceSelector:
matchExpressions:
- key: env
operator: In
values:
- "test"
quota:
- name: "max-pods"
hard:
pods: "10"
permissions:
promotions:
- clusterRoles:
- "secret-replicator"
- quota:
- name: shared-compute
hard:
limits.cpu: "8"
limits.memory: 16Gi
requests.cpu: "8"
requests.memory: 16Gi
# classes:
# cluster:
# - matchLabels:
# team: platform
# namespaceSelector:
# matchExpressions:
# - key: env
# operator: In
# values:
# - "test"
# classes:
# gateway:
# - matchLabels:
# team: platform
# ingress:
# - matchLabels:
# team: platform
# storage:
# - matchLabels:
# team: platform
# priority:
# - matchLabels:
# team: platform
# runtime:
# - matchLabels:
# team: platform
# cluster:
# - matchLabels:
# team: platform
# namespaceSelector:
# matchExpressions:
# - key: env
# operator: In
# values:
# - "test"
permissions:
bindings:
- clusterRoleName: 'custom:proxy-viewer'
subjects:
- apiGroup: rbac.authorization.k8s.io
kind: User
name: joe
labels:
reflection.proxy.projectcapsule.dev/enabled: "true"
enforce:
action: deny
metadata:
- apiGroups:
- "v1"
kinds:
- "Namespace"
labels:
pod-security.kubernetes.io/enforce:
managed: "baseline"
- audience:
- kind: "Custom"
name: "CapsuleUser"
enforce:
action: deny
metadata:
- apiGroups:
- "v1"
kinds:
- "Namespace"
labels:
"openshift.io/*":
required: false
values:
- exp: "^.*$"
- namespaceSelector:
matchExpressions:
- key: env
operator: In
values:
- "test"
permissions:
promotions:
- clusterRoles:
- "secret-replicator"
permissions:
matchOwners:
- matchLabels:
team: platform
- matchLabels:
tenant: solar
namespaceOptions:
additionalMetadata:
labels:
team: platform
annotations:
owner: "team-platform"
additionalMetadataList:
- labels:
customer: a
---
apiVersion: capsule.clastix.io/v1beta2
kind: Tenant
metadata:
name: green
labels:
customer: a
spec:
permissions:
matchOwners:
- matchLabels:
team: devops
- matchLabels:
tenant: green
owners:
- name: bob
kind: User
rules:
- permissions:
bindings:
- clusterRoleName: 'custom:proxy-viewer'
subjects:
- apiGroup: rbac.authorization.k8s.io
kind: User
name: alice
labels:
reflection.proxy.projectcapsule.dev/enabled: "true"
- enforce:
action: "allow"
services:
types: ["ClusterIP", "NodePort", "LoadBalancer", "ExternalName"]
loadBalancers:
cidrs:
- 10.0.0.2/32
externalNames:
hostnames:
- exp: ".*\\.example\\.com"
exact:
- "internal.git.com"
nodePorts:
ports:
- from: 30000
to: 32767
---
apiVersion: capsule.clastix.io/v1beta2
kind: Tenant
metadata:
name: wind
spec:
permissions:
matchOwners:
- matchLabels:
team: devops
- matchLabels:
tenant: wind
owners:
- name: joe
kind: User
rules:
- permissions:
bindings:
- clusterRoleName: 'view'
subjects:
- apiGroup: rbac.authorization.k8s.io
kind: Group
name: wind-users
hack/distro/capsule/kustomization.yaml
-4
View File
@@ -1,4 +0,0 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- release.flux.yaml
hack/distro/capsule/release.flux.yaml
-42
View File
@@ -1,42 +0,0 @@
---
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: capsule
namespace: flux-system
spec:
serviceAccountName: kustomize-controller
interval: 30s
timeout: 10m
targetNamespace: capsule-system
releaseName: "capsule"
chart:
spec:
chart: capsule
version: "0.12.4"
sourceRef:
kind: HelmRepository
name: capsule
interval: 24h
install:
createNamespace: true
remediation:
retries: -1
upgrade:
remediation:
remediateLastFailure: true
retries: -1
driftDetection:
mode: enabled
ignore:
- paths: ["/spec/replicas"]
---
apiVersion: source.toolkit.fluxcd.io/v1
kind: HelmRepository
metadata:
name: capsule
namespace: flux-system
spec:
type: "oci"
interval: 12h0m0s
url: oci://ghcr.io/projectcapsule/charts