Affected by GO-2024-3077 and 2 other vulnerabilities

GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

GO-2026-5043: Capsule Namespace Hijacking via subresource in github.com/projectcapsule/capsule

GO-2026-5584: Capsule TenantResource RawItems Cluster-Scoped Resource Creation Vulnerability in github.com/projectcapsule/capsule

meta

package

v0.12.0 Latest Latest Go to latest Published: Dec 5, 2025 License: Apache-2.0 Imports: 5 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/projectcapsule/capsule

Links

Open Source Insights

Documentation ¶

Index ¶

Constants
func ControllerFieldOwner() string
func ControllerFieldOwnerPrefix(fieldowner string) string
func FreezeLabelRemove(obj client.Object)
func FreezeLabelTriggers(obj client.Object) bool
func HasLooseOwnerReference(obj client.Object, owner client.Object) bool
func NewAssignedCondition(obj client.Object) metav1.Condition
func NewBoundCondition(obj client.Object) metav1.Condition
func OwnerPromotionLabelRemove(obj client.Object)
func OwnerPromotionLabelTriggers(obj client.Object) bool
func ReleaseAnnotationRemove(obj client.Object)
func ReleaseAnnotationTriggers(obj client.Object) bool
func RemoveLooseOwnerReference(obj client.Object, owner client.Object)
func SetLooseOwnerReference(obj client.Object, owner client.Object, schema *runtime.Scheme) (err error)
type Condition
- func NewCordonedCondition(obj client.Object) Condition
- func NewReadyCondition(obj client.Object) Condition
type ConditionList

Constants ¶

View Source

const (
	ReleaseAnnotation        = "projectcapsule.dev/release"
	ReleaseAnnotationTrigger = "true"

	AvailableIngressClassesAnnotation       = "capsule.clastix.io/ingress-classes"
	AvailableIngressClassesRegexpAnnotation = "capsule.clastix.io/ingress-classes-regexp"
	AvailableStorageClassesAnnotation       = "capsule.clastix.io/storage-classes"
	AvailableStorageClassesRegexpAnnotation = "capsule.clastix.io/storage-classes-regexp"
	AllowedRegistriesAnnotation             = "capsule.clastix.io/allowed-registries"
	AllowedRegistriesRegexpAnnotation       = "capsule.clastix.io/allowed-registries-regexp"

	ForbiddenNamespaceLabelsAnnotation            = "capsule.clastix.io/forbidden-namespace-labels"
	ForbiddenNamespaceLabelsRegexpAnnotation      = "capsule.clastix.io/forbidden-namespace-labels-regexp"
	ForbiddenNamespaceAnnotationsAnnotation       = "capsule.clastix.io/forbidden-namespace-annotations"
	ForbiddenNamespaceAnnotationsRegexpAnnotation = "capsule.clastix.io/forbidden-namespace-annotations-regexp"
	ProtectedTenantAnnotation                     = "capsule.clastix.io/protected"
)

View Source

const (
	// ReadyCondition indicates the resource is ready and fully reconciled.
	ReadyCondition    string = "Ready"
	CordonedCondition string = "Cordoned"
	NotReadyCondition string = "NotReady"

	AssignedCondition string = "Assigned"
	BoundCondition    string = "Bound"

	// FailedReason indicates a condition or event observed a failure (Claim Rejected).
	SucceededReason          string = "Succeeded"
	FailedReason             string = "Failed"
	ActiveReason             string = "Active"
	CordonedReason           string = "Cordoned"
	PoolExhaustedReason      string = "PoolExhausted"
	QueueExhaustedReason     string = "QueueExhausted"
	NamespaceExhaustedReason string = "NamespaceExhausted"
)

View Source

const (
	TenantNameLabel = "kubernetes.io/metadata.name"
	TenantLabel     = "capsule.clastix.io/tenant"

	ResourcePoolLabel = "projectcapsule.dev/pool"

	FreezeLabel        = "projectcapsule.dev/freeze"
	FreezeLabelTrigger = "true"

	OwnerPromotionLabel        = "owner.projectcapsule.dev/promote"
	OwnerPromotionLabelTrigger = "true"

	CordonedLabel        = "projectcapsule.dev/cordoned"
	CordonedLabelTrigger = "true"

	ManagedByCapsuleLabel = "capsule.clastix.io/managed-by"

	LimitRangeLabel    = "capsule.clastix.io/limit-range"
	NetworkPolicyLabel = "capsule.clastix.io/network-policy"
	ResourceQuotaLabel = "capsule.clastix.io/resource-quota"
	RolebindingLabel   = "capsule.clastix.io/role-binding"
)

View Source

const (
	CapsuleFieldOwnerPrefix = "capsule"
)

View Source

const (
	ControllerFinalizer = "controller.projectcapsule.dev/finalize"
)

Variables ¶

This section is empty.

Functions ¶

func ControllerFieldOwner ¶

func ControllerFieldOwner() string

func ControllerFieldOwnerPrefix ¶

func ControllerFieldOwnerPrefix(fieldowner string) string

func FreezeLabelRemove ¶

func FreezeLabelRemove(obj client.Object)

func FreezeLabelTriggers ¶

func FreezeLabelTriggers(obj client.Object) bool

func HasLooseOwnerReference ¶

func HasLooseOwnerReference(
	obj client.Object,
	owner client.Object,
) bool

If not returns false.

func NewAssignedCondition ¶

func NewAssignedCondition(obj client.Object) metav1.Condition

func NewBoundCondition ¶

func NewBoundCondition(obj client.Object) metav1.Condition

func OwnerPromotionLabelRemove ¶

func OwnerPromotionLabelRemove(obj client.Object)

func OwnerPromotionLabelTriggers ¶

func OwnerPromotionLabelTriggers(obj client.Object) bool

func ReleaseAnnotationRemove ¶

func ReleaseAnnotationRemove(obj client.Object)

func ReleaseAnnotationTriggers ¶

func ReleaseAnnotationTriggers(obj client.Object) bool

func RemoveLooseOwnerReference ¶

func RemoveLooseOwnerReference(
	obj client.Object,
	owner client.Object,
)

Removes a Loose Ownerreference based on UID.

func SetLooseOwnerReference ¶

func SetLooseOwnerReference(
	obj client.Object,
	owner client.Object,
	schema *runtime.Scheme,
) (err error)

Adds an ownerreferences, which does not delete the object when the owner is deleted.

Types ¶

type Condition ¶

type Condition metav1.Condition

+kubebuilder:object:generate=true

func NewCordonedCondition ¶

func NewCordonedCondition(obj client.Object) Condition

func NewReadyCondition ¶

func NewReadyCondition(obj client.Object) Condition

func (*Condition) DeepCopy ¶

func (in *Condition) DeepCopy() *Condition

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Condition.

func (*Condition) DeepCopyInto ¶

func (in *Condition) DeepCopyInto(out *Condition)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*Condition) UpdateCondition ¶

func (c *Condition) UpdateCondition(condition Condition) (updated bool)

Disregards fields like LastTransitionTime and Version, which are not relevant for the API.

type ConditionList ¶

type ConditionList []Condition

func (ConditionList) DeepCopy ¶

func (in ConditionList) DeepCopy() ConditionList

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConditionList.

func (ConditionList) DeepCopyInto ¶

func (in ConditionList) DeepCopyInto(out *ConditionList)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*ConditionList) GetConditionByType ¶

func (c *ConditionList) GetConditionByType(conditionType string) *Condition

Adds a condition by type.

func (*ConditionList) RemoveConditionByType ¶

func (c *ConditionList) RemoveConditionByType(condition Condition)

Removes a condition by type.

func (*ConditionList) UpdateConditionByType ¶

func (c *ConditionList) UpdateConditionByType(condition Condition)

Adds a condition by type.

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL