A Kubernetes operator that turns a single Workspace resource into a fully isolated multi-tenant environment.
The OtterScale Tenant Operator reconciles the Workspace custom resource (tenant.otterscale.io/v1alpha1) and provisions everything a tenant needs: a dedicated namespace, RBAC bindings, resource quotas, network isolation, and optional image-registry access. The controller stays thin — it fetches the desired state, syncs each concern, and lets Kubernetes garbage collection clean up owned resources when a workspace is removed.
For every Workspace, the operator reconciles:
- Namespace — created with Pod Security Standards labels applied.
- RBAC — RoleBindings for admin, edit, and view roles, grouped by member.
- Resource constraints — ResourceQuota and LimitRange when specified.
- Network isolation — default-deny NetworkPolicies with allow rules for the workspace and approved namespaces.
- Harbor integration (optional) — projects, robot accounts, image-pull secrets, and a Flux
HelmRepositorypointing at the registry. - Configuration — a workspace-level ConfigMap for service-discovery endpoint overrides.
Admission webhooks default and validate Workspace resources — auto-generating namespace names, syncing members to labels, and enforcing creation authorization.
Go and kubebuilder on top of controller-runtime.
Installation, the full Workspace spec, and operational guides will be published in the project documentation.
The Tenant Operator is one component of the OtterScale platform. See the otterscale repository for an overview of the full project and its components.
Contributions are welcome. A contribution guide (CONTRIBUTING.md) will follow; until then, please open an issue or a pull request to get involved.
This project is licensed under the Apache License 2.0.
