{"id":28074371,"url":"https://github.com/projectcapsule/capsule-addon-fluxcd","last_synced_at":"2025-05-12T23:34:43.853Z","repository":{"id":214621443,"uuid":"724300603","full_name":"projectcapsule/capsule-addon-fluxcd","owner":"projectcapsule","description":null,"archived":false,"fork":false,"pushed_at":"2024-12-22T08:38:05.000Z","size":136,"stargazers_count":1,"open_issues_count":10,"forks_count":2,"subscribers_count":1,"default_branch":"main","last_synced_at":"2024-12-22T09:27:17.581Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"https://capsule.clastix.io/docs/guides/flux2-capsule","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/projectcapsule.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2023-11-27T20:00:23.000Z","updated_at":"2024-12-22T08:36:40.000Z","dependencies_parsed_at":"2024-12-22T09:25:38.379Z","dependency_job_id":"7fa9e664-e805-4225-99ed-fb78e31e94ca","html_url":"https://github.com/projectcapsule/capsule-addon-fluxcd","commit_stats":null,"previous_names":["maxgio92/capsule-addon-fluxcd"],"tags_count":7,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/projectcapsule%2Fcapsule-addon-fluxcd","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/projectcapsule%2Fcapsule-addon-fluxcd/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/projectcapsule%2Fcapsule-addon-fluxcd/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/projectcapsule%2Fcapsule-addon-fluxcd/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/projectcapsule","download_url":"https://codeload.github.com/projectcapsule/capsule-addon-fluxcd/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":253842504,"owners_count":21972839,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2025-05-12T23:34:41.309Z","updated_at":"2025-05-12T23:34:43.835Z","avatar_url":"https://github.com/projectcapsule.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"[![Latest release](https://img.shields.io/github/v/release/projectcapsule/capsule-addon-fluxcd?style=for-the-badge)](https://github.com/projectcapsule/capsule-addon-fluxcd/releases/latest)\n[![License](https://img.shields.io/github/license/projectcapsule/capsule-addon-fluxcd?style=for-the-badge)](COPYING)\n![Go version](https://img.shields.io/github/go-mod/go-version/projectcapsule/capsule-addon-fluxcd?style=for-the-badge)\n![GitHub Workflow Status (with event)](https://img.shields.io/github/actions/workflow/status/projectcapsule/capsule-addon-fluxcd/scan-code.yml?style=for-the-badge\u0026label=GoSec)\n\n# Capsule addon for Flux CD\n\nThis addon enables smooth integration of multi-tenancy in Kubernetes with [Capsule](https://capsule.clastix.io/), the GitOps-way with [Flux CD](https://fluxcd.io/).\n\nIn particular enables `Tenant`s to manage their resources, including creating `Namespace`s, respecting the Flux [multi-tenancy lockdown](https://fluxcd.io/flux/installation/configuration/multitenancy/).\n\nTenant resources, represented as `Kustomization` / `HelmRelease` / etc. can be reconciled as Tenant owners.\n\nThis way tenants can be provided Namespace-as-a-Service in a GitOps fashion.\n\n## Install\n\n```shell\nhelm install -n capsule-system capsule-addon-fluxcd oci://ghcr.io/projectcapsule/charts/capsule-addon-fluxcd\n```\n\n## How it works\n\nWith the addon, you as platform admin, for the *oil* `Tenant` just need a `ServiceAccount` with the `capsule.addon.fluxcd/enabled=true` annotation:\n\n```yml\n---\napiVersion: v1\nkind: Namespace\nmetadata:\n  name: oil-system\n---\napiVersion: v1\nkind: ServiceAccount\nmetadata:\n  name: gitops-reconciler\n  namespace: oil-system\n  annotations:\n    capsule.addon.fluxcd/enabled: \"true\"\n```\n\nand set it as a valid *oil* `Tenant` owner:\n\n```yml\n---\napiVersion: capsule.clastix.io/v1beta2\nkind: Tenant\nmetadata:\n  name: oil\nspec:\n  additionalRoleBindings:\n  - clusterRoleName: cluster-admin\n    subjects:\n    - name: gitops-reconciler\n      kind: ServiceAccount\n      namespace: oil-system\n  owners:\n  - name: system:serviceaccount:oil-system:gitops-reconciler\n    kind: ServiceAccount\n---\napiVersion: capsule.clastix.io/v1beta2\nkind: CapsuleConfiguration\nmetadata:\n  name: default\nspec:\n  userGroups:\n  - capsule.clastix.io\n  - system:serviceaccounts:oil-system\n```\n\nWithout the addon you would need to manually manage RBAC and kubeConfig for the Tenant owner.\n\nThe addon will automate the permissions and the `kubeConfig` `Secret` for the **ServiceAccount Tenant owner** in order to be used by Flux when reconciling Tenant resources.\n\nLet's go through examples.\n\n## Examples\n\nConsider a `Tenant` named *oil* that has a dedicated Git repository that contains oil's configurations.\n\nYou want to provide to the *oil* `Tenant` a Namespace-as-a-Service with a GitOps experience, allowing the tenant to version the configurations in a Git repository.\n\nYou, as platform admin and Tenant owner, can configure Flux [reconciliation](https://fluxcd.io/flux/concepts/#reconciliation) resources to be applied as Tenant owner:\n\n```yml\n---\napiVersion: kustomize.toolkit.fluxcd.io/v1beta2\nkind: Kustomization\nmetadata:\n  name: oil-apps\n  namespace: oil-system\nspec:\n  serviceAccountName: gitops-reconciler\n  kubeConfig:\n    secretRef:\n      name: gitops-reconciler-kubeconfig\n      key: kubeconfig\n  sourceRef:\n    kind: GitRepository\n    name: oil\n---\napiVersion: source.toolkit.fluxcd.io/v1beta2\nkind: GitRepository\nmetadata:\n  name: oil\n  namespace: oil-system\nspec:\n  url: https://github.com/oil/oil-apps\n```\n\nLet's analyze the setup field by field:\n- the `GitRepository` and the `Kustomization` are in a Tenant system `Namespace`\n- the `Kustomization` refers to a `ServiceAccount` to be impersonated when reconciling the resources the `Kustomization` refers to: this ServiceAccount is a *oil* **Tenant owner**\n- the `Kustomization` refers also to a `kubeConfig` to be used when reconciling the resources the `Kustomization` refers to: this is needed to make requests through the **Capsule proxy** in order to operate on cluster-wide resources as a Tenant\n\nThe *oil* tenant can also declare new `Namespace`s thanks to the segregation provided by Capsule.\n\n\u003e Note: it can be avoided to explicitely set the the service account name when it's set as default Service Account name at Flux's [kustomize-controller level](https://fluxcd.io/flux/installation/configuration/multitenancy/#how-to-configure-flux-multi-tenancy) via the `default-service-account` flag.\n\n## Additional features\n\n### kubeConfig across Tenant Namespaces\n\nThe addon can also automate the distribution of the Tenant owner's kubeConfig `Secret` across all Tenant's `Namespaces`s.\n\nThis is implemented with Capsule's `GlobalTenantResource` custom resource.\n\nYou just need to add the annotation `capsule.addon.fluxcd/kubeconfig-global=true` to the Tenant owner `ServiceAccount`.\n\n## Documentation\n\nMore information in the Capsule official guide [Multi-tenancy the GitOps way](https://capsule.clastix.io/docs/guides/flux2-capsule/#the-ingredients-of-the-recipe).\n\n## Development\n\n### Linting\n\n```shell\nmake lint\n```\n\n### End-to-end testing\n\n```shell\nmake e2e\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fprojectcapsule%2Fcapsule-addon-fluxcd","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fprojectcapsule%2Fcapsule-addon-fluxcd","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fprojectcapsule%2Fcapsule-addon-fluxcd/lists"}