This feature is available in Enterprise Edition only.
This feature is actively developed. It might significantly change in the future.

Default project templates

The following project templates are included in the Deckhouse Kubernetes Platform:

  • default — a template that covers basic project use cases:
    • resource limitation;
    • network isolation;
    • automatic alerts and log collection;
    • choice of security profile;
    • project administrators setup.
  • secure — includes all the capabilities of the default template and additional features:
    • setting up permissible UID/GID for the project;
    • audit rules for project users’ access to the Linux kernel;
    • scanning of launched container images for CVE presence.
  • secure-with-dedicated-nodes — includes all the capabilities of the secure template and additional features:
    • defining the node selector for all the pods in the project: if a pod is created, the node selector pod will be substituted with the project’s node selector automatically;
    • defining the default toleration for all the pods in the project: if a pod is created, the default toleration will be added to the pod automatically.

To list all available parameters for a project template, execute the command:

kubectl get projecttemplates <PROJECT_TEMPLATE_NAME> -o jsonpath='{.spec.parametersSchema.openAPIV3Schema}' | jq

Creating a project

  1. To create a project, create the Project resource by specifying the name of the project template in .spec.projectTemplateName field.
  2. In the .spec.parameters field of the Project resource, specify the parameter values suitable for the ProjectTemplate .spec.parametersSchema.openAPIV3Schema.

    Example of creating a project using the Project resource from the default ProjectTemplate:

    kind: Project
      name: my-project
      description: This is an example from the Deckhouse documentation.
      projectTemplateName: default
            cpu: 5
            memory: 5Gi
            storage: 1Gi
            cpu: 5
            memory: 5Gi
        networkPolicy: Isolated
        podSecurityProfile: Restricted
        extendedMonitoringEnabled: true
        - subject: Group
          name: k8s-admins
  3. To check the status of the project, execute the command:

    kubectl get projects my-project

    A successfully created project should be in the Sync state. If the state equals Error, add the -o yaml argument to the command (e.g., kubectl get projects my-project -o yaml) to get more detailed information about the error.

Creating your own project template

Default templates cover basic project use cases and serve as a good example of template capabilities.

To create your own template:

  1. Take one of the default templates as a basis, for example, default.
  2. Copy it to a separate file, for example, my-project-template.yaml using the command:

    kubectl get projecttemplates default -o yaml > my-project-template.yaml
  3. Edit the my-project-template.yaml file, make the necessary changes.

    It is necessary to change not only the template, but also the scheme of input parameters for it.

    Project templates support all Helm templating functions.

  4. Change the template name in the field.
  5. Apply your new template with the command:

    kubectl apply -f my-project-template.yaml
  6. Check the availability of the new template with the command:

    kubectl get projecttemplates <NEW_TEMPLATE_NAME>