A Kubernetes operator that turns a single Workspace resource into a fully isolated multi-tenant environment.
The OtterScale Tenant Operator reconciles the Workspace custom resource (tenant.otterscale.io/v1alpha1) and provisions everything a tenant needs: a dedicated namespace, RBAC bindings, resource quotas, network isolation, and optional image-registry access. The controller stays thin — it fetches the desired state, syncs each concern, and lets Kubernetes garbage collection clean up owned resources when a workspace is removed.
For every Workspace, the operator reconciles:
- Namespace — created with Pod Security Standards labels applied.
- RBAC — RoleBindings for admin, edit, and view roles, grouped by member.
- Resource constraints — ResourceQuota and LimitRange when specified.
- Network isolation — default-deny NetworkPolicies with allow rules for the workspace and approved namespaces.
- Harbor integration (optional) — projects, robot accounts, image-pull secrets, and a Flux
HelmRepositorypointing at the registry. - Configuration — a workspace-level ConfigMap for service-discovery endpoint overrides.
Admission webhooks default and validate Workspace resources — auto-generating namespace names, syncing members to labels, and enforcing creation authorization.
Go and kubebuilder on top of controller-runtime. The Workspace API is defined in otterscale/api.
Installation, the full Workspace spec, and operational guides will be published in the project documentation.
The Tenant Operator is one component of the OtterScale platform; the Workspace CRD it reconciles is defined in otterscale/api. See the otterscale repository for an overview of the full project and its components.
Contributions are welcome. A contribution guide (CONTRIBUTING.md) will follow; until then, please open an issue or a pull request to get involved.
This project is licensed under the Apache License 2.0.
