GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

handlers

package

v0.13.9 Latest Latest Go to latest Published: Jul 6, 2026 License: Apache-2.0 Imports: 14 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/projectcapsule/capsule

Links

Open Source Insights

Documentation ¶

Index ¶

func ErroredResponse(err error) *admission.Response
func ResolveAdmissionUser(ctx context.Context, c client.Client, req admission.Request, ...) users.AdmissionUser
type Func
type Handler
- func InCapsuleGroups(configuration configuration.Configuration, handlers ...Handler) Handler
- func IsNotPrivileged(configuration configuration.Configuration, handlers ...Handler) Handler
type HandlerWithTenant
type NewObjectFunc
type TypedHandler
type TypedHandlerWithTenant
type TypedHandlerWithTenantUser
type TypedHandlerWithTenantWithRuleset
type TypedHandlerWithUser
type TypedTenantHandler
type TypedTenantWithRulesetHandler
type TypedTenantWithUserHandler
type Webhook

Constants ¶

This section is empty.

Variables ¶

This section is empty.

Functions ¶

func ErroredResponse ¶

func ErroredResponse(err error) *admission.Response

func ResolveAdmissionUser ¶

func ResolveAdmissionUser(
	ctx context.Context,
	c client.Client,
	req admission.Request,
	config configuration.Configuration,
) users.AdmissionUser

Types ¶

type Func ¶

type Func func(ctx context.Context, req admission.Request) *admission.Response

type Handler ¶

type Handler interface {
	OnCreate(client client.Client, reader client.Reader, decoder admission.Decoder, recorder events.EventRecorder) Func
	OnDelete(client client.Client, reader client.Reader, decoder admission.Decoder, recorder events.EventRecorder) Func
	OnUpdate(client client.Client, reader client.Reader, decoder admission.Decoder, recorder events.EventRecorder) Func
}

func InCapsuleGroups ¶

func InCapsuleGroups(configuration configuration.Configuration, handlers ...Handler) Handler

func IsNotPrivileged ¶

func IsNotPrivileged(configuration configuration.Configuration, handlers ...Handler) Handler

type HandlerWithTenant ¶ added in v0.13.5

type HandlerWithTenant interface {
	OnCreate(c client.Client, reader client.Reader, decoder admission.Decoder, recorder events.EventRecorder, tnt *capsulev1beta2.Tenant) Func
	OnUpdate(c client.Client, reader client.Reader, decoder admission.Decoder, recorder events.EventRecorder, tnt *capsulev1beta2.Tenant) Func
	OnDelete(c client.Client, reader client.Reader, decoder admission.Decoder, recorder events.EventRecorder, tnt *capsulev1beta2.Tenant) Func
}

type NewObjectFunc ¶

type NewObjectFunc[T client.Object] func() T

type TypedHandler ¶

type TypedHandler[T client.Object] interface {
	OnCreate(c client.Client, reader client.Reader, obj T, decoder admission.Decoder, recorder events.EventRecorder) Func
	OnUpdate(c client.Client, reader client.Reader, obj T, old T, decoder admission.Decoder, recorder events.EventRecorder) Func
	OnDelete(c client.Client, reader client.Reader, obj T, decoder admission.Decoder, recorder events.EventRecorder) Func
}

type TypedHandlerWithTenant ¶

type TypedHandlerWithTenant[T client.Object] interface {
	OnCreate(c client.Client, reader client.Reader, obj T, decoder admission.Decoder, recorder events.EventRecorder, tnt *capsulev1beta2.Tenant) Func
	OnUpdate(c client.Client, reader client.Reader, obj T, old T, decoder admission.Decoder, recorder events.EventRecorder, tnt *capsulev1beta2.Tenant) Func
	OnDelete(c client.Client, reader client.Reader, obj T, decoder admission.Decoder, recorder events.EventRecorder, tnt *capsulev1beta2.Tenant) Func
}

type TypedHandlerWithTenantUser ¶

type TypedHandlerWithTenantUser[T client.Object] interface {
	OnCreate(c client.Client, reader client.Reader, user users.AdmissionUser, obj T, decoder admission.Decoder, recorder events.EventRecorder, tnt *capsulev1beta2.Tenant) Func
	OnUpdate(c client.Client, reader client.Reader, user users.AdmissionUser, obj T, old T, decoder admission.Decoder, recorder events.EventRecorder, tnt *capsulev1beta2.Tenant) Func
	OnDelete(c client.Client, reader client.Reader, user users.AdmissionUser, obj T, decoder admission.Decoder, recorder events.EventRecorder, tnt *capsulev1beta2.Tenant) Func
}

type TypedHandlerWithTenantWithRuleset ¶

type TypedHandlerWithTenantWithRuleset[T client.Object] interface {
	OnCreate(
		c client.Client,
		reader client.Reader,
		obj T,
		decoder admission.Decoder,
		recorder events.EventRecorder,
		tnt *capsulev1beta2.Tenant,
		ruleBlocks []*rules.NamespaceRuleBodyNamespace,
	) Func

	OnUpdate(
		c client.Client,
		reader client.Reader,
		old T,
		obj T,
		decoder admission.Decoder,
		recorder events.EventRecorder,
		tnt *capsulev1beta2.Tenant,
		ruleBlocks []*rules.NamespaceRuleBodyNamespace,
	) Func

	OnDelete(
		c client.Client,
		reader client.Reader,
		obj T,
		decoder admission.Decoder,
		recorder events.EventRecorder,
		tnt *capsulev1beta2.Tenant,
		ruleBlocks []*rules.NamespaceRuleBodyNamespace,
	) Func
}

type TypedHandlerWithUser ¶

type TypedHandlerWithUser[T client.Object] interface {
	OnCreate(c client.Client, reader client.Reader, user users.AdmissionUser, obj T, decoder admission.Decoder, recorder events.EventRecorder) Func
	OnUpdate(c client.Client, reader client.Reader, user users.AdmissionUser, obj T, old T, decoder admission.Decoder, recorder events.EventRecorder) Func
	OnDelete(c client.Client, reader client.Reader, user users.AdmissionUser, obj T, decoder admission.Decoder, recorder events.EventRecorder) Func
}

type TypedTenantHandler ¶

type TypedTenantHandler[T client.Object] struct {
	Factory  NewObjectFunc[T]
	Handlers []TypedHandlerWithTenant[T]
}

func (*TypedTenantHandler[T]) OnCreate ¶

func (h *TypedTenantHandler[T]) OnCreate(c client.Client, reader client.Reader, decoder admission.Decoder, recorder events.EventRecorder) Func

func (*TypedTenantHandler[T]) OnDelete ¶

func (h *TypedTenantHandler[T]) OnDelete(c client.Client, reader client.Reader, decoder admission.Decoder, recorder events.EventRecorder) Func

func (*TypedTenantHandler[T]) OnUpdate ¶

func (h *TypedTenantHandler[T]) OnUpdate(c client.Client, reader client.Reader, decoder admission.Decoder, recorder events.EventRecorder) Func

type TypedTenantWithRulesetHandler ¶

type TypedTenantWithRulesetHandler[T client.Object] struct {
	Factory  NewObjectFunc[T]
	Handlers []TypedHandlerWithTenantWithRuleset[T]
}

func (*TypedTenantWithRulesetHandler[T]) OnCreate ¶

func (h *TypedTenantWithRulesetHandler[T]) OnCreate(
	c client.Client,
	reader client.Reader,
	decoder admission.Decoder,
	recorder events.EventRecorder,
) Func

func (*TypedTenantWithRulesetHandler[T]) OnDelete ¶

func (h *TypedTenantWithRulesetHandler[T]) OnDelete(
	c client.Client,
	reader client.Reader,
	decoder admission.Decoder,
	recorder events.EventRecorder,
) Func

func (*TypedTenantWithRulesetHandler[T]) OnUpdate ¶

func (h *TypedTenantWithRulesetHandler[T]) OnUpdate(
	c client.Client,
	reader client.Reader,
	decoder admission.Decoder,
	recorder events.EventRecorder,
) Func

type TypedTenantWithUserHandler ¶

type TypedTenantWithUserHandler[T client.Object] struct {
	Factory       NewObjectFunc[T]
	Handlers      []TypedHandlerWithTenantUser[T]
	Configuration configuration.Configuration
}

func (*TypedTenantWithUserHandler[T]) OnCreate ¶

func (h *TypedTenantWithUserHandler[T]) OnCreate(c client.Client, reader client.Reader, decoder admission.Decoder, recorder events.EventRecorder) Func

func (*TypedTenantWithUserHandler[T]) OnDelete ¶

func (h *TypedTenantWithUserHandler[T]) OnDelete(c client.Client, reader client.Reader, decoder admission.Decoder, recorder events.EventRecorder) Func

func (*TypedTenantWithUserHandler[T]) OnUpdate ¶

func (h *TypedTenantWithUserHandler[T]) OnUpdate(c client.Client, reader client.Reader, decoder admission.Decoder, recorder events.EventRecorder) Func

type Webhook ¶

type Webhook interface {
	GetPath() string
	GetHandlers() []Handler
}

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL