Affected by GO-2024-3077 and 6 other vulnerabilities

GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

GO-2026-5406: Capsule: Incomplete fix of CVE-2026-30963: singular/plural typo leaves namespaces/finalize unprotected in github.com/projectcapsule/capsule

GO-2026-6155: Capsule: CapsuleConfiguration NodeMetadata regex fields lack webhook validation, allowing MustCompile panic on all Node admission requests in github.com/projectcapsule/capsule

GO-2026-6157: Capsule has an incomplete fix of CVE-2026-22872: TenantResource RawItems and Generators still allow cluster-scoped resource creation (cross-tenant privilege escalation) in github.com/projectcapsule/capsule

GO-2026-6519: Capsule: hostnameRegexHandler.OnUpdate validates stale (old) Tenant regex, allowing invalid AllowedHostnames regex to bypass webhook validation in github.com/projectcapsule/capsule

GO-2026-6520: Capsule: Tenant owner bypasses Capsule's forbidden namespace/service/node label and annotation enforcement in github.com/projectcapsule/capsule

GO-2026-6521: Capsule: Malformed ForbiddenAnnotations.Regex can bypass Tenant validation and trigger namespace admission panic in github.com/projectcapsule/capsule

validation

package

v0.13.4 Latest Latest Go to latest Published: Jun 5, 2026 License: Apache-2.0 Imports: 22 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/projectcapsule/capsule

Links

Open Source Insights

Documentation ¶

Index ¶

func ContainerRegistryRegexHandler() handlers.TypedHandler[*capsulev1beta2.Tenant]
func ForbiddenAnnotationsRegexHandler() handlers.TypedHandler[*capsulev1beta2.Tenant]
func FreezedEmitter() handlers.TypedHandler[*capsulev1beta2.Tenant]
func Handler(configuration configuration.Configuration, ...) handlers.Handler
func HostnameRegexHandler() handlers.TypedHandler[*capsulev1beta2.Tenant]
func IngressClassRegexHandler() handlers.TypedHandler[*capsulev1beta2.Tenant]
func NameHandler() handlers.TypedHandler[*capsulev1beta2.Tenant]
func NamespaceMetadataHandler() handlers.TypedHandler[*capsulev1beta2.Tenant]
func ProtectedHandler() handlers.TypedHandler[*capsulev1beta2.Tenant]
func RemainingNamespaceHandler() handlers.TypedHandler[*capsulev1beta2.Tenant]
func RequiredMetadataHandler() handlers.TypedHandler[*capsulev1beta2.Tenant]
func RoleBindingRegexHandler() handlers.TypedHandler[*capsulev1beta2.Tenant]
func RuleHandler() handlers.TypedHandler[*capsulev1beta2.Tenant]
func ServiceAccountNameHandler() handlers.TypedHandler[*capsulev1beta2.Tenant]
func StorageClassRegexHandler() handlers.TypedHandler[*capsulev1beta2.Tenant]
func ValidateRule(tnt *capsulev1beta2.Tenant, req admission.Request) *admission.Response
func WarningHandler(cfg configuration.Configuration) handlers.TypedHandler[*capsulev1beta2.Tenant]
type RuleValidationHandler

Constants ¶

This section is empty.

Variables ¶

This section is empty.

Functions ¶

func ContainerRegistryRegexHandler ¶

func ContainerRegistryRegexHandler() handlers.TypedHandler[*capsulev1beta2.Tenant]

func ForbiddenAnnotationsRegexHandler ¶

func ForbiddenAnnotationsRegexHandler() handlers.TypedHandler[*capsulev1beta2.Tenant]

func FreezedEmitter ¶

func FreezedEmitter() handlers.TypedHandler[*capsulev1beta2.Tenant]

func Handler ¶ added in v0.13.0

func Handler(configuration configuration.Configuration, handlers ...handlers.TypedHandler[*capsulev1beta2.Tenant]) handlers.Handler

func HostnameRegexHandler ¶

func HostnameRegexHandler() handlers.TypedHandler[*capsulev1beta2.Tenant]

func IngressClassRegexHandler ¶

func IngressClassRegexHandler() handlers.TypedHandler[*capsulev1beta2.Tenant]

func NameHandler ¶

func NameHandler() handlers.TypedHandler[*capsulev1beta2.Tenant]

func NamespaceMetadataHandler ¶ added in v0.13.0

func NamespaceMetadataHandler() handlers.TypedHandler[*capsulev1beta2.Tenant]

func ProtectedHandler ¶

func ProtectedHandler() handlers.TypedHandler[*capsulev1beta2.Tenant]

func RemainingNamespaceHandler ¶ added in v0.13.0

func RemainingNamespaceHandler() handlers.TypedHandler[*capsulev1beta2.Tenant]

func RequiredMetadataHandler ¶ added in v0.13.0

func RequiredMetadataHandler() handlers.TypedHandler[*capsulev1beta2.Tenant]

func RoleBindingRegexHandler ¶

func RoleBindingRegexHandler() handlers.TypedHandler[*capsulev1beta2.Tenant]

func RuleHandler ¶ added in v0.13.0

func RuleHandler() handlers.TypedHandler[*capsulev1beta2.Tenant]

func ServiceAccountNameHandler ¶

func ServiceAccountNameHandler() handlers.TypedHandler[*capsulev1beta2.Tenant]

func StorageClassRegexHandler ¶

func StorageClassRegexHandler() handlers.TypedHandler[*capsulev1beta2.Tenant]

func ValidateRule ¶ added in v0.13.0

func ValidateRule(tnt *capsulev1beta2.Tenant, req admission.Request) *admission.Response

func WarningHandler ¶

func WarningHandler(cfg configuration.Configuration) handlers.TypedHandler[*capsulev1beta2.Tenant]

Types ¶

type RuleValidationHandler ¶ added in v0.13.0

type RuleValidationHandler struct{}

func (*RuleValidationHandler) OnCreate ¶ added in v0.13.0

func (h *RuleValidationHandler) OnCreate(
	_ client.Client,
	_ client.Reader,
	tnt *capsulev1beta2.Tenant,
	decoder admission.Decoder,
	_ events.EventRecorder,
) handlers.Func

func (*RuleValidationHandler) OnDelete ¶ added in v0.13.0

func (h *RuleValidationHandler) OnDelete(
	client.Client,
	client.Reader,
	*capsulev1beta2.Tenant,
	admission.Decoder,
	events.EventRecorder,
) handlers.Func

func (*RuleValidationHandler) OnUpdate ¶ added in v0.13.0

func (h *RuleValidationHandler) OnUpdate(
	_ client.Client,
	_ client.Reader,
	tnt *capsulev1beta2.Tenant,
	old *capsulev1beta2.Tenant,
	decoder admission.Decoder,
	_ events.EventRecorder,
) handlers.Func

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL