GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

pod

package

v0.12.4 Latest Latest Go to latest Published: Dec 19, 2025 License: Apache-2.0 Imports: 16 Imported by: 0

Details

This section is empty.

This section is empty.

func ContainerRegistry(configuration configuration.Configuration) capsulewebhook.TypedHandlerWithTenant[*corev1.Pod]

func Handler(handlers ...webhook.TypedHandlerWithTenant[*corev1.Pod]) webhook.Handler

func ImagePullPolicy() capsulewebhook.TypedHandlerWithTenant[*corev1.Pod]

func NewContainerRegistryForbidden(image string, spec api.AllowedListSpec) error

func NewImagePullPolicyForbidden(usedPullPolicy, containerName string, allowedPullPolicies []string) error

func NewMissingContainerRegistryError(image string) error

func NewPodPriorityClassForbidden(priorityClassName string, spec api.DefaultAllowedListSpec) error

func NewPodRuntimeClassForbidden(runtimeClassName string, spec api.DefaultAllowedListSpec) error

func PriorityClass() capsulewebhook.TypedHandlerWithTenant[*corev1.Pod]

func RuntimeClass() capsulewebhook.TypedHandlerWithTenant[*corev1.Pod]

type PullPolicy interface {
	IsPolicySupported(policy string) bool
	AllowedPullPolicies() []string
}

func NewPullPolicy(tenant *capsulev1beta2.Tenant) PullPolicy

type Registry interface {
	Registry() string
	Repository() string
	Image() string
	Tag() string
	FQCI() string
}

func NewRegistry(value string, cfg configuration.Configuration) Registry