https://deploy-preview-131--docs-projectcapsule.netlify.app/docs/operating/best-practices/Recent content in Best Practices on CapsuleHugo -- gohugo.ioenhttps://deploy-preview-131--docs-projectcapsule.netlify.app/docs/operating/best-practices/admission-policies/Mon, 01 Jan 0001 00:00:00 +0000https://deploy-preview-131--docs-projectcapsule.netlify.app/docs/operating/best-practices/admission-policies/As Capsule we try to provide a secure multi-tenant environment out of the box, there are however some additional Admission Policies you should consider to enforce best practices in your cluster. Since Capsule only covers the core multi-tenancy features, such as Namespaces, Resource Quotas, Network Policies, and Container Registries, Classes, you should consider using an additional Admission Controller to enforce best practices on workloads and other resources. Custom Create custom Policies and reuse data provided via Tenant Status to enforce your own rules.https://deploy-preview-131--docs-projectcapsule.netlify.app/docs/operating/best-practices/workloads/Mon, 01 Jan 0001 00:00:00 +0000https://deploy-preview-131--docs-projectcapsule.netlify.app/docs/operating/best-practices/workloads/Resource Management Resource settings are both a scheduling contract and a runtime safety boundary. Kubernetes schedules a Pod from its resource requests, while the kubelet and container runtime enforce its resource limits. Correct values help the scheduler place Pods safely, keep one workload from affecting its neighbours, and give autoscalers meaningful data. CPU and memory need different treatment: CPU is compressible. Under contention, a container receives CPU time in proportion to its request; without contention, it can use spare CPU.https://deploy-preview-131--docs-projectcapsule.netlify.app/docs/operating/best-practices/networking/Mon, 01 Jan 0001 00:00:00 +0000https://deploy-preview-131--docs-projectcapsule.netlify.app/docs/operating/best-practices/networking/Network-Policies It’s a best practice to not allow any traffic outside of a tenant (or a tenant’s namespace). For this we can use Tenant Replications to ensure we have for every namespace Networkpolicies in place. The following NetworkPolicy is distributed to all namespaces which belong to a Capsule tenant: apiVersion: capsule.clastix.io/v1beta2 kind: GlobalTenantResource metadata: name: default-networkpolicies namespace: solar-system spec: resyncPeriod: 60s resources: - rawItems: - apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: default-policy spec: # Apply to all pods in this namespace podSelector: {} policyTypes: - Ingress - Egress ingress: # Allow traffic from the same namespace (intra-namespace communication) - from: - podSelector: {} # Allow traffic from all namespaces within the tenant - from: - namespaceSelector: matchLabels: capsule.https://deploy-preview-131--docs-projectcapsule.netlify.app/docs/operating/best-practices/images/Mon, 01 Jan 0001 00:00:00 +0000https://deploy-preview-131--docs-projectcapsule.netlify.app/docs/operating/best-practices/images/Until this issue is resolved (might be in Kubernetes 1.34) it’s recommended to use the ImagePullPolicy Always for private registries on shared nodes. This ensures that no images can be used which are already pulled to the node.