{"id":18677830,"url":"https://github.com/clastix/flux2-capsule-multi-tenancy","last_synced_at":"2025-11-07T09:30:28.609Z","repository":{"id":47764363,"uuid":"516285758","full_name":"clastix/flux2-capsule-multi-tenancy","owner":"clastix","description":null,"archived":false,"fork":false,"pushed_at":"2022-09-05T14:21:12.000Z","size":708,"stargazers_count":9,"open_issues_count":1,"forks_count":5,"subscribers_count":3,"default_branch":"main","last_synced_at":"2024-12-27T21:13:35.076Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/clastix.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2022-07-21T08:22:17.000Z","updated_at":"2024-06-13T17:01:45.000Z","dependencies_parsed_at":"2022-09-20T21:50:21.873Z","dependency_job_id":null,"html_url":"https://github.com/clastix/flux2-capsule-multi-tenancy","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/clastix%2Fflux2-capsule-multi-tenancy","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/clastix%2Fflux2-capsule-multi-tenancy/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/clastix%2Fflux2-capsule-multi-tenancy/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/clastix%2Fflux2-capsule-multi-tenancy/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/clastix","download_url":"https://codeload.github.com/clastix/flux2-capsule-multi-tenancy/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":239525383,"owners_count":19653317,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-07T09:35:07.188Z","updated_at":"2025-11-07T09:30:28.570Z","avatar_url":"https://github.com/clastix.png","language":null,"funding_links":[],"categories":[],"sub_categories":[],"readme":"# GitOps multi-tenancy with [Flux v2](https://github.com/fluxcd/flux) and [Capsule](https://github.com/clastix/capsule)\n\n**Provide Namespace-as-a-Service to tenants, the GitOps way.**\n\nIntroduce the Tenant concept to GitOps multi-tenancy scenario with Flux v2.\n\n\u003e This repository is a fork of [fluxcd/flux2-multi-tenancy](https://github.com/fluxcd/flux2-multi-tenancy).\n\n## Space declaration\n\nThe setup enables unprivileged tenant space, that tenants are able to declare and let Flux reconcile in a secure way.\n\n![configuration](./img/flux-reconciliation-resources-hierarchy.png)\n\n## Space reconciliation\n\nThe secure way of reconciliation is enabled by use of Kubernetes unprivileged-User impersonation and Capsule, that provides boundaries between tenants.\n\n![reconciliation](./img/reconciliation.png)\n\nFor more details please see the [architecture](./docs/ARCHITECTURE.md)\n\n## Quickstart\n\n### 1. Fork this repository\n\n#### 1.1. Update platform Sync configurations to point to the fork\n\n`GitRepository.spec.url` in `clusters/staging/flux-system/gotk-sync.yaml`\n\n#### 1.2. Update tenants Sync configurations to point to the fork\n\n`GitRepository.spec.url` in `tenants/base/dev-team/sync.yaml`\n\n### 2. Create a personal access token\n\nThis is needed to bootstrap Flux configuration to the forked repository and add a deploy key to read from it.\n\nThe access token is then discarded and can be revoked.\n\n### 3. Provision a cluster\n\n```\nkind create cluster\n```\n\n### 4. Bootstrap Flux\n\n```\nexport GITHUB_USER=\u003cyour-username\u003e\nexport GITHUB_REPO=\u003crepository-name\u003e\n\nflux bootstrap github \\\n    --owner=${GITHUB_USER} \\\n    --repository=${GITHUB_REPO} \\\n    --branch=main \\\n    --personal \\\n    --path=clusters/staging\n```\n\n### 5. Overwite Flux configuration with multitenancy lockdown (from local repo)\n\n```\ngit push origin main -f\n```\n\n### 6. Create the Secret with kubeconfig for Tenant GitOps reconciler\n\nYou need to create a `Secret` containing the `kubeconfig` that specifies:\n- `server`: Capsule Proxy `Service` URL\n- `token`: the token of the `Tenant` GitOps reconciler\n\nTo easy the task let's use `proxy-kubeconfig-generator` utility:\n\n```\ngo install github.com/maxgio92/proxy-kubeconfig-generator@latest\nproxy-kubeconfig-generator \\\n  --kubeconfig-secret-key kubeconfig \\\n  --namespace dev-team \\\n  --server 'https://capsule-proxy.flux-system.svc:9001' \\\n  --server-tls-secret-namespace flux-system \\\n  --server-tls-secret-name capsule-proxy \\\n  --serviceaccount gitops-reconciler\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fclastix%2Fflux2-capsule-multi-tenancy","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fclastix%2Fflux2-capsule-multi-tenancy","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fclastix%2Fflux2-capsule-multi-tenancy/lists"}