tenantplaneThe open platform for explainable Kubernetes multi-tenancy
Coming from vcluster or Kamaji? See how tenantplane is different →
tenantplane is an open source virtual Kubernetes tenant platform for modern platform engineering teams. It provides a lightweight, inspectable control plane for managing virtual tenants while keeping synchronization, isolation, and operations predictable and explainable.
Each tenant runs its own small control plane inside a host namespace. tenantplane reconciles it, enforces an explicit isolation boundary, and deterministically maps tenant resources onto the host — recording a decision for every action, so you can always ask why a host object exists.
One controller, nothing hidden
Three custom resources reconciled into an isolation boundary, a lightweight control plane, and a deterministic sync of tenant resources onto the host.
The tenantplane controller reconciles TenantCluster, IsolationProfile, and SyncPolicy into host-cluster reality.
Transparent by design
Explainable sync
Deterministic virtual-to-host mapping with offline dry-run planning. Ask why any host object exists and get an answer.
Explicit isolation
Isolation profiles compose NetworkPolicy, ResourceQuota, LimitRange, and Pod Security into one auditable boundary.
Lightweight control planes
Each tenant runs a small k3s control plane in a host namespace — easy to understand, audit, and extend.
Day-2 by design
Reconciliation, drift correction, and orphan garbage collection built for the operational realities of multi-tenancy.
Migration paths
Evolve tenants across shared, dedicated, and private isolation models without recreating tenant API state.
Observable
Decisions as Kubernetes Events today; OpenTelemetry and Prometheus on the roadmap.
A convergence pass, fully explained
For every resource kind your SyncPolicy marks toHost, the engine runs the same four deterministic steps — and records a decision for each one.
List
Enumerate tenant objects of the kind, skipping the tenant's own system namespaces.
Transform
Deep-copy, apply the deterministic host name, merge reverse-mapping metadata, strip host-owned fields.
Apply
Create the host object if absent, otherwise update it in place with a conflict-checked write.
Garbage-collect
Delete managed host objects whose tenant source is gone. Foreign objects are never touched.
Ask why. Get an answer.
Host placement is deterministic, so tenantplane can tell you where a tenant resource will land before anything is applied — offline, in CI, or during an audit.
- Predict the host namespace, name, labels, and annotations.
- Trace any host object back to its tenant source.
- Audit every sync action through decision Events.
$ tenantplane explain-sync --tenant dev --tenant-namespace team-dev \
--virtual-namespace default --kind Pod --name nginx
hostResource:
namespace: team-dev
name: nginx-x-default-x-dev
reason:
stable name from resource + virtual namespace + tenant;
labels preserve the reverse mapping.# A tenant, an isolation level, a sync policy
apiVersion: tenantplane.io/v1alpha1
kind: TenantCluster
metadata:
name: dev
namespace: team-dev
spec:
mode: shared
isolationProfileRef: { name: restricted }
syncPolicyRef: { name: default }
controlPlane:
replicas: 1
datastore: { type: sqlite }Three resources, nothing hidden
tenantplane's entire API is three custom resources. Declare intent; the controller makes it real and tells you what it did.
- TenantCluster — the lifecycle of one virtual tenant.
- IsolationProfile — the security and fairness boundary.
- SyncPolicy — what crosses the boundary, and how.
Built for real platform work
Internal developer platforms
Hand every team a cluster-like environment without running a cluster per team.
CI & preview environments
High-density, ephemeral tenants that spin up fast and clean up predictably.
Regulated & audited estates
Answer “what runs where, and why” with explicit isolation and decision records.
Ready in minutes on a kind cluster
Install the CRDs, apply a sample tenant, and watch the control plane come up.
Read the quickstart →