Recommended Free Tools
Capsule implements soft multi-tenancy inside one Amazon EKS cluster. It groups namespaces into a Capsule Tenant, then applies tenant-level ownership, quotas, limit ranges, RBAC, and network or security policies across those namespaces. This gives teams self-service without running a cluster per team, but the EKS cluster remains the stronger security boundary. To keep one tenant’s workloads off another tenant’s nodes, combine node labels with admission policies that inject and validate node affinity and tolerations.
What Capsule isolates—and what it does not
Capsule’s controller aggregates several Kubernetes namespaces into a lightweight Tenant abstraction. A tenant owner can create namespaces through a separate kubeconfig, while Capsule’s policy engine carries tenant controls into each namespace. This is logical isolation, not a separate control plane.
- Provided by Capsule and Kubernetes: namespace ownership, RBAC, resource quotas, limit ranges, and inherited network or security policies.
- Not provided by namespaces alone: a hard security boundary between tenants. AWS describes Kubernetes as a single-tenant orchestrator at the control-plane level: every tenant shares the cluster’s control plane.
- Important consequence: a host compromise can expose mounted Secrets, ConfigMaps, and volumes and enable lateral movement. Use separate clusters when that risk is unacceptable.
Namespace is globally scoped, so a tenant cannot receive a filtered list containing only its own namespaces. CoreDNS also allows service discovery queries across namespaces by default. Treat both behaviors as design constraints.
Reference implementation flow
The official Capsule managed-Kubernetes example (page metadata updated January 15, 2026) follows this order. The region, instance type, and volume size below are demonstration values, not recommended defaults.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minute#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
- Create a managed EKS cluster with
eksctl. - Create an IAM identity for the tenant owner and produce a kubeconfig with only the permissions that owner needs.
- Export an administrator kubeconfig and install Capsule.
- Apply a Capsule Tenant resource that names the owner.
- Use the owner’s kubeconfig to create a namespace and verify the control path.
Create the illustrative EKS cluster
The example uses eu-west-1, managed nodes of type t3.small, and a 20-GiB node volume:
eksctl create cluster
--name capsule-demo
--region eu-west-1
--managed
--node-type t3.small
--node-volume-size 20Choose the node count, Kubernetes version, subnets, instance family, and storage size for your workload and availability requirements. Small nodes are useful for a walkthrough but can create artificial scheduling pressure in production.
Separate administrator and tenant credentials
Keep the administrator kubeconfig out of tenant automation. Generate it explicitly, for example:
aws eks update-kubeconfig
--region eu-west-1
--name capsule-demo
--kubeconfig admin.kubeconfigCreate the tenant owner’s IAM identity and Kubernetes authorization separately. Grant only the permissions required for Capsule tenant ownership and namespace self-service; do not reuse cluster-admin credentials. Store each kubeconfig as a protected secret and select it with --kubeconfig or KUBECONFIG when testing.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
Install and verify Capsule
Install the Capsule release compatible with your Kubernetes version using the project’s current release instructions. Before creating tenants, confirm that the Capsule controller and its admission components are running and that the Tenant custom resource definition is established:
kubectl get pods -A | grep -i capsule
kubectl get crd | grep -i tenantIf the controller is not ready, stop here. A tenant manifest can be accepted by the API server only after the CRD and controller are available.
Define a Tenant and its owner
Apply a Tenant resource using the API version supported by your installed Capsule release. This example gives user alice ownership of tenant-x:
apiVersion: capsule.clastix.io/v1beta2
kind: Tenant
metadata:
name: tenant-x
spec:
owners:
- name: alice
kind: Userkubectl --kubeconfig admin.kubeconfig apply -f tenant-x.yaml
kubectl --kubeconfig admin.kubeconfig get tenant tenant-xDo not assume the API version or owner syntax is identical across Capsule releases; check the CRD served by your cluster before applying this example.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
Prove tenant self-service
With Alice’s kubeconfig, create a namespace and confirm that it is associated with her Tenant:
kubectl --kubeconfig alice.kubeconfig create namespace alice-app
kubectl --kubeconfig alice.kubeconfig get namespace alice-app
kubectl --kubeconfig admin.kubeconfig get namespace alice-app --show-labelsThe successful namespace creation is the key control-path test in the managed-Kubernetes walkthrough: Alice can self-provision within the boundaries assigned by Capsule, while the administrator retains cluster-wide control.
Keep a tenant’s pods on its own nodes
Capsule’s namespace grouping does not change the Kubernetes scheduler. To prevent tenant workloads from landing on another tenant’s nodes, enforce placement with labels and admission policy.
Label the dedicated node pool
Give nodes reserved for tenant-x a stable label. Apply labels to every node in the pool and make the label immutable through your node-provisioning process:
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
kubectl label nodes <node-1> tenant=tenants-x
kubectl get nodes -l tenant=tenants-xA taint can add a second guard against unrelated workloads, but every legitimate tenant workload must then receive the matching toleration.
Mutate requests at admission
A policy-management tool can inspect inbound API-server requests for the tenants-x namespace and inject both of these pod-spec fields:
- Required node affinity matching
tenant=tenants-x. - A matching toleration for the dedicated node pool’s taint, if you tainted those nodes.
Required affinity is more reliable than a preferred rule: a pod that cannot find a matching node remains pending instead of silently running on another tenant’s capacity. Apply the mutation to every workload path that creates pods, including Deployments, Jobs, CronJobs, StatefulSets, and admission-generated pods.
Validate and audit the mutation
A mutating policy alone is not sufficient. Pair it with:
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
- Validating policy: reject a request if the required affinity or toleration is absent or altered before persistence.
- Audit policy: record existing objects and detect configurations that bypassed or predated the mutation.
- Negative tests: submit a pod in
tenants-xwith a conflicting node selector and verify that it is rejected or remains unschedulable rather than running on another tenant’s nodes.
Admission webhooks must answer within their configured timeout. Decide and document fail-open versus fail-close behavior: fail-open can allow an unmutated request when the webhook is unavailable, while fail-close preserves enforcement at the cost of blocking requests during an outage. Monitor webhook latency and availability as production dependencies.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Network and namespace controls
Start each tenant namespace with a default-deny network policy, then add only the traffic the application needs. Permit DNS explicitly to the cluster DNS service; otherwise normal name resolution can fail. Add narrowly scoped rules for application-to-application traffic inside the same tenant, and make cross-tenant traffic an explicit exception rather than an implicit default.
- Use Capsule’s inherited policy model so new namespaces receive the tenant baseline.
- Set resource quotas to cap aggregate CPU, memory, and object counts.
- Use limit ranges to impose per-container defaults and bounds.
- Review RBAC bindings so tenant owners administer only their own namespaces.
- Remember that network policies do not protect a compromised node or an overly privileged workload.
Choosing between namespaces, node isolation, and separate clusters
| Design | Security boundary | Scheduling and noisy-neighbor control | Cost and utilization | Operations | Tenant self-service |
|---|---|---|---|---|---|
| Capsule namespaces (soft tenancy) | Shared cluster boundary; logical controls only | Shared nodes unless additional policies are added | Best packing and lowest infrastructure overhead | One cluster and policy stack | Strong; owners can create namespaces within limits |
| Capsule plus policy-driven node isolation | Still a shared cluster; stronger placement control | Dedicated labels, affinity, tolerations, and admission enforcement | Dedicated capacity costs more and may be underused | Admission webhooks, validation, auditing, and failure-mode management | Strong after policy templates are established |
| Separate EKS clusters | Strongest of these options because the control planes and nodes are separate | Physical cluster scheduling boundary | Higher control-plane and baseline-resource cost; fragmentation can reduce utilization | Fleet upgrades, identity, networking, logging, and policy must be repeated | Depends on the platform built around each cluster |
Use Capsule soft tenancy when efficient sharing and delegated namespace creation matter more than a hard boundary. Add node isolation when placement and noisy-neighbor risk justify dedicated capacity. Choose separate clusters for tenants that require materially stronger isolation, independent upgrade lifecycles, or regulatory separation.
Production readiness checklist
- Document the threat model and state explicitly that the cluster—not the namespace—is the primary security boundary.
- Test tenant-owner kubeconfigs with both allowed and forbidden namespace actions.
- Verify default-deny networking, DNS allowance, and intended cross-namespace exceptions.
- Check that every tenant node pool has the expected labels and, where used, taints.
- Test mutating, validating, and audit policies after upgrades.
- Set webhook timeouts and failure behavior deliberately, then alert on errors and latency.
- Watch pending pods, quota consumption, and node utilization so dedicated pools do not become hidden capacity waste.
- Reassess whether a tenant’s data sensitivity or incident model now requires a separate cluster.
Bottom line
Capsule makes one EKS cluster workable for multiple teams by turning namespaces into governed Tenants and allowing controlled self-service. It does not convert shared Kubernetes into hard isolation. For tenant-aware placement, label dedicated nodes and enforce required affinity and tolerations through admission mutation, validation, and audit. When the cluster boundary is not sufficient, separate EKS clusters remain the stronger—though more expensive and operationally heavier—choice.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
