GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

pod

package

v0.11.2 Latest Latest Go to latest Published: Oct 26, 2025 License: Apache-2.0 Imports: 17 Imported by: 0

Details

This section is empty.

This section is empty.

func ContainerRegistry(configuration configuration.Configuration) capsulewebhook.Handler

func ImagePullPolicy() capsulewebhook.Handler

func NewContainerRegistryForbidden(image string, spec api.AllowedListSpec) error

func NewImagePullPolicyForbidden(usedPullPolicy, containerName string, allowedPullPolicies []string) error

func NewMissingContainerRegistryError(image string) error

func NewPodPriorityClassForbidden(priorityClassName string, spec api.DefaultAllowedListSpec) error

func NewPodRuntimeClassForbidden(runtimeClassName string, spec api.DefaultAllowedListSpec) error

func PriorityClass() capsulewebhook.Handler

func RuntimeClass() capsulewebhook.Handler

type PullPolicy interface {
	IsPolicySupported(policy string) bool
	AllowedPullPolicies() []string
}

func NewPullPolicy(tenant *capsulev1beta2.Tenant) PullPolicy

type Registry interface {
	Registry() string
	Repository() string
	Image() string
	Tag() string
	FQCI() string
}

func NewRegistry(value string, cfg configuration.Configuration) Registry