Thread by @klarr_io

We did a comparative study of #MultiTenancy solutions for #Kubernetes, comparing single namespace, hierarchical namespaces, virtual #cluster, Loft cluster, Loft Kiosk, and Clastix capsule.

Check out the thread ⬇️to learn which solution we found best 👌

And our winner was... 🥁

#Capsule. For our use case, sharing a single cluster with multiple teams was the best fit.

Capsule offers the right mix between isolation, security and usability.

More details to follow ⬇️

#Testing for #UseCaseSharing a #SingleCluster with multiple teams: hierarchical namespaces

⛔️Limitations: #ResourceQuota are inherited by subnamespaces➡️each new namespace grants additional quota.

✅What we loved: self-service, tenant administrators can create subnamespaces.

(More details on hierarchical namespaces: github.com/kubernetes-sig…)

#Testing for #UseCaseSharing a #SingleCluster with multiple teams: virtual cluster

⛔️Limitations: the #VirtualCluster hides shared infrastructure by default.

✅What we loved: great self-service, native feel, & completeness: even cluster-wide resources are supported.

(More information on virtual clusters: github.com/kubernetes-sig…).

#Testing for #UseCaseSharing a #SingleCluster with multiple teams: Loft Kiosk (github.com/loft-sh/kiosk, @loft_sh)

⛔️Limitations in native feel: it uses a custom space resource instead of a plain namespace.

✅What we loved: per-tenant accounting in resource quota.

#Testing for #UseCaseSharing a #SingleCluster with multiple teams: Clastix capsule, @clastixio

No limitations.

✅What we loved: self-service, manual access support, per-tenant accounting in #ResourceQuota & its native feel.

❤️What we really, really loved about Clastix capsule, @clastixio: #Capsule proxy can even allow tenant admins to list selected cluster-wide resources (namespaces etc.) with appropriate filtering.

More information: capsule.clastix.io