GO-2022-1135: Capsule vulnerable to privilege escalation by ServiceAccount deployed in a Tenant Namespace in github.com/clastix/capsule

secret

package

v0.1.1 Latest Latest Go to latest Published: Jan 11, 2022 License: Apache-2.0 Imports: 25 Imported by: 0

Details

View Source

const (
	CASecretName  = "capsule-ca"
	TLSSecretName = "capsule-tls"
)

This section is empty.

This section is empty.

type CAReconciler struct {
	client.Client
	Log       logr.Logger
	Scheme    *runtime.Scheme
	Namespace string
}

func (r CAReconciler) Reconcile(ctx context.Context, request ctrl.Request) (ctrl.Result, error)

func (r *CAReconciler) SetupWithManager(mgr ctrl.Manager) error

func (r *CAReconciler) UpdateCustomResourceDefinition(caBundle []byte) error

By default helm doesn't allow to use templates in CRD (https://helm.sh/docs/chart_best_practices/custom_resource_definitions/#method-1-let-helm-do-it-for-you). In order to overcome this, we are setting conversion strategy in helm chart to None, and then update it with CA and namespace information.

func (r CAReconciler) UpdateMutatingWebhookConfiguration(caBundle []byte) error

func (r CAReconciler) UpdateValidatingWebhookConfiguration(caBundle []byte) error

type MissingCaError struct {
}

func (MissingCaError) Error() string

type TLSReconciler struct {
	client.Client
	Log       logr.Logger
	Scheme    *runtime.Scheme
	Namespace string
}

func (r TLSReconciler) Reconcile(ctx context.Context, request ctrl.Request) (ctrl.Result, error)

func (r *TLSReconciler) SetupWithManager(mgr ctrl.Manager) error