Open source · Apache 2.0

Turn Kubernetes into
Tenant as a Service.

Give every team an isolated Kubernetes cluster — own API server, own CRDs, own RBAC — on the clusters you already run. No new VMs, no cluster sprawl, no waiting for the platform team.

helm install kubespaces Star on GitHub

spacectl

$ spacectl tenant create team-atlas --cpu 8 --memory 16Gi
tenant/team-atlas created
$ spacectl tenant get team-atlas --wait
PHASE  Provisioning … Ready (41s)
$ spacectl tenant kubeconfig team-atlas --merge
✔ context "kubespaces-team-atlas" written
$ kubectl config use-context kubespaces-team-atlas
$ kubectl get namespaces
NAME              STATUS   AGE
default           Active   45s
kube-system       Active   45s

01The multi-tenancy trap

A cluster per team

Real isolation — and a fleet of half-idle control planes, each with its own upgrades, add-ons, bills and 3 a.m. pages. Sprawl is the tax.

A namespace per team

Cheap — until two teams need different CRD versions, cluster-wide controllers, or admin inside their slice. Namespaces don't isolate.

A tenant per team

A full virtual cluster inside your existing one: dedicated API server, CRDs and RBAC, scheduled as pods. Isolation of a cluster, cost of a namespace.

02How it works

Ask for a tenant

Portal, spacectl, or kubectl apply — a tenant is just a Tenant custom resource. Put it in git and it's GitOps like everything else.
The operator reconciles

Namespace, quotas, limits, a vCluster control plane, routing — provisioned and repaired continuously. State lives in the CR, not in a database you have to trust.
Ship

Download the kubeconfig and it's a normal cluster: install operators, create CRDs, break things — inside the walls. Expose apps through the shared gateway with hostname policy enforced.

03What's in the box

Real isolation: Per-tenant API server, CRDs, RBAC and versions — powered by vCluster.
Self-service portal: Create, inspect and delete tenants without filing a ticket.
GitOps-native: tenants.kubespaces.io CRD — Flux and Argo speak it natively.
SSO from day one: Keycloak bundled, or bring any OIDC provider.
Quotas & limits: CPU, memory and storage budgets per tenant, enforced by the host.
One helm install: API, portal, Postgres, Keycloak and operator in a single umbrella chart.
Gateway API routing: Tenant API servers and apps exposed through modern, standard networking.
Actually open: Every component Apache 2.0. No paywalled control plane, no seat limits.

04Ten minutes to your first tenant

helm install kubespaces oci://ghcr.io/kubespaces-io/charts/kubespaces \
  --namespace kubespaces --create-namespace

kubectl apply -f - <<EOF
apiVersion: kubespaces.io/v1alpha1
kind: Tenant
metadata:
  name: demo
spec:
  owner: you@example.com
EOF

Works on kind. No domain, no load balancer, no cloud account required — those come when you're ready to go to production. Read the docs →

Turn Kubernetes intoTenant as a Service.