Affected by GO-2024-3077 and 6 other vulnerabilities

GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

GO-2026-5406: Capsule: Incomplete fix of CVE-2026-30963: singular/plural typo leaves namespaces/finalize unprotected in github.com/projectcapsule/capsule

GO-2026-6155: Capsule: CapsuleConfiguration NodeMetadata regex fields lack webhook validation, allowing MustCompile panic on all Node admission requests in github.com/projectcapsule/capsule

GO-2026-6157: Capsule has an incomplete fix of CVE-2026-22872: TenantResource RawItems and Generators still allow cluster-scoped resource creation (cross-tenant privilege escalation) in github.com/projectcapsule/capsule

GO-2026-6519: Capsule: hostnameRegexHandler.OnUpdate validates stale (old) Tenant regex, allowing invalid AllowedHostnames regex to bypass webhook validation in github.com/projectcapsule/capsule

GO-2026-6520: Capsule: Tenant owner bypasses Capsule's forbidden namespace/service/node label and annotation enforcement in github.com/projectcapsule/capsule

GO-2026-6521: Capsule: Malformed ForbiddenAnnotations.Regex can bypass Tenant validation and trigger namespace admission panic in github.com/projectcapsule/capsule

cert

package

v0.13.1 Latest Latest Go to latest Published: May 29, 2026 License: Apache-2.0 Imports: 9 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/projectcapsule/capsule

Links

Open Source Insights

Documentation ¶

Index ¶

func GetCertificateFromBytes(certBytes []byte) (*x509.Certificate, error)
func GetCertificateWithPrivateKeyFromBytes(certBytes, keyBytes []byte) (*x509.Certificate, *rsa.PrivateKey, error)
func GetPrivateKeyFromBytes(keyBytes []byte) (*rsa.PrivateKey, error)
func ValidateCertificate(cert *x509.Certificate, key *rsa.PrivateKey, expirationThreshold time.Duration) error
type CA
type CapsuleCA
- func GenerateCertificateAuthority() (s *CapsuleCA, err error)
- func NewCertificateAuthorityFromBytes(certBytes, keyBytes []byte) (*CapsuleCA, error)
type CertificateOptions
- func NewCertOpts(expirationDate time.Time, dnsNames ...string) CertificateOptions

Constants ¶

This section is empty.

Variables ¶

This section is empty.

Functions ¶

func GetCertificateFromBytes ¶

func GetCertificateFromBytes(certBytes []byte) (*x509.Certificate, error)

func GetCertificateWithPrivateKeyFromBytes ¶

func GetCertificateWithPrivateKeyFromBytes(certBytes, keyBytes []byte) (*x509.Certificate, *rsa.PrivateKey, error)

func GetPrivateKeyFromBytes ¶

func GetPrivateKeyFromBytes(keyBytes []byte) (*rsa.PrivateKey, error)

func ValidateCertificate ¶

func ValidateCertificate(cert *x509.Certificate, key *rsa.PrivateKey, expirationThreshold time.Duration) error

Types ¶

type CA ¶

type CA interface {
	GenerateCertificate(opts CertificateOptions) (certificatePem *bytes.Buffer, certificateKey *bytes.Buffer, err error)
	CACertificatePem() (b *bytes.Buffer, err error)
	CAPrivateKeyPem() (b *bytes.Buffer, err error)
	ExpiresIn(now time.Time) (time.Duration, error)
	ValidateCert(certificate *x509.Certificate) error
}

type CapsuleCA ¶

type CapsuleCA struct {
	// contains filtered or unexported fields
}

func GenerateCertificateAuthority ¶

func GenerateCertificateAuthority() (s *CapsuleCA, err error)

func NewCertificateAuthorityFromBytes ¶

func NewCertificateAuthorityFromBytes(certBytes, keyBytes []byte) (*CapsuleCA, error)

func (CapsuleCA) CACertificatePem ¶

func (c CapsuleCA) CACertificatePem() (b *bytes.Buffer, err error)

func (CapsuleCA) CAPrivateKeyPem ¶

func (c CapsuleCA) CAPrivateKeyPem() (b *bytes.Buffer, err error)

func (*CapsuleCA) ExpiresIn ¶

func (c *CapsuleCA) ExpiresIn(now time.Time) (time.Duration, error)

func (*CapsuleCA) GenerateCertificate ¶

func (c *CapsuleCA) GenerateCertificate(opts CertificateOptions) (certificatePem *bytes.Buffer, certificateKey *bytes.Buffer, err error)

func (*CapsuleCA) ValidateCert ¶

func (c *CapsuleCA) ValidateCert(certificate *x509.Certificate) error

type CertificateOptions ¶

type CertificateOptions interface {
	DNSNames() []string
	ExpirationDate() time.Time
}

func NewCertOpts ¶

func NewCertOpts(expirationDate time.Time, dnsNames ...string) CertificateOptions

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL