client

Sep 3, 2026 GO-2024-3077

  GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

Aug 31, 2026 GO-2024-3077

  GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

Aug 25, 2026 GO-2024-3077

  GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

Aug 25, 2026 GO-2024-3077

  GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

Aug 21, 2026 GO-2024-3077

  GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

Jul 28, 2026 GO-2024-3077

  GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

Jul 22, 2026 GO-2024-3077

  GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

Jul 6, 2026 GO-2024-3077

  GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

Jul 3, 2026 GO-2024-3077

  GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

Jun 24, 2026 GO-2024-3077 +2 more

  GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

  GO-2026-6155: Capsule: CapsuleConfiguration NodeMetadata regex fields lack webhook validation, allowing MustCompile panic on all Node admission requests in github.com/projectcapsule/capsule

  GO-2026-6157: Capsule has an incomplete fix of CVE-2026-22872: TenantResource RawItems and Generators still allow cluster-scoped resource creation (cross-tenant privilege escalation) in github.com/projectcapsule/capsule

Jun 17, 2026 GO-2024-3077 +2 more

  GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

  GO-2026-6155: Capsule: CapsuleConfiguration NodeMetadata regex fields lack webhook validation, allowing MustCompile panic on all Node admission requests in github.com/projectcapsule/capsule

  GO-2026-6157: Capsule has an incomplete fix of CVE-2026-22872: TenantResource RawItems and Generators still allow cluster-scoped resource creation (cross-tenant privilege escalation) in github.com/projectcapsule/capsule

Jun 9, 2026 GO-2024-3077 +3 more

  GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

  GO-2026-5406: Capsule: Incomplete fix of CVE-2026-30963: singular/plural typo leaves namespaces/finalize unprotected in github.com/projectcapsule/capsule

  GO-2026-6155: Capsule: CapsuleConfiguration NodeMetadata regex fields lack webhook validation, allowing MustCompile panic on all Node admission requests in github.com/projectcapsule/capsule

  GO-2026-6157: Capsule has an incomplete fix of CVE-2026-22872: TenantResource RawItems and Generators still allow cluster-scoped resource creation (cross-tenant privilege escalation) in github.com/projectcapsule/capsule

Jun 5, 2026 GO-2024-3077 +3 more

  GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

  GO-2026-5406: Capsule: Incomplete fix of CVE-2026-30963: singular/plural typo leaves namespaces/finalize unprotected in github.com/projectcapsule/capsule

  GO-2026-6155: Capsule: CapsuleConfiguration NodeMetadata regex fields lack webhook validation, allowing MustCompile panic on all Node admission requests in github.com/projectcapsule/capsule

  GO-2026-6157: Capsule has an incomplete fix of CVE-2026-22872: TenantResource RawItems and Generators still allow cluster-scoped resource creation (cross-tenant privilege escalation) in github.com/projectcapsule/capsule

Jun 4, 2026 GO-2024-3077 +3 more

  GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

  GO-2026-5406: Capsule: Incomplete fix of CVE-2026-30963: singular/plural typo leaves namespaces/finalize unprotected in github.com/projectcapsule/capsule

  GO-2026-6155: Capsule: CapsuleConfiguration NodeMetadata regex fields lack webhook validation, allowing MustCompile panic on all Node admission requests in github.com/projectcapsule/capsule

  GO-2026-6157: Capsule has an incomplete fix of CVE-2026-22872: TenantResource RawItems and Generators still allow cluster-scoped resource creation (cross-tenant privilege escalation) in github.com/projectcapsule/capsule

Jun 3, 2026 GO-2024-3077 +3 more

  GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

  GO-2026-5406: Capsule: Incomplete fix of CVE-2026-30963: singular/plural typo leaves namespaces/finalize unprotected in github.com/projectcapsule/capsule

  GO-2026-6155: Capsule: CapsuleConfiguration NodeMetadata regex fields lack webhook validation, allowing MustCompile panic on all Node admission requests in github.com/projectcapsule/capsule

  GO-2026-6157: Capsule has an incomplete fix of CVE-2026-22872: TenantResource RawItems and Generators still allow cluster-scoped resource creation (cross-tenant privilege escalation) in github.com/projectcapsule/capsule

May 29, 2026 GO-2024-3077 +3 more

  GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

  GO-2026-5406: Capsule: Incomplete fix of CVE-2026-30963: singular/plural typo leaves namespaces/finalize unprotected in github.com/projectcapsule/capsule

  GO-2026-6155: Capsule: CapsuleConfiguration NodeMetadata regex fields lack webhook validation, allowing MustCompile panic on all Node admission requests in github.com/projectcapsule/capsule

  GO-2026-6157: Capsule has an incomplete fix of CVE-2026-22872: TenantResource RawItems and Generators still allow cluster-scoped resource creation (cross-tenant privilege escalation) in github.com/projectcapsule/capsule

May 28, 2026 GO-2024-3077 +3 more

  GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

  GO-2026-5406: Capsule: Incomplete fix of CVE-2026-30963: singular/plural typo leaves namespaces/finalize unprotected in github.com/projectcapsule/capsule

  GO-2026-6155: Capsule: CapsuleConfiguration NodeMetadata regex fields lack webhook validation, allowing MustCompile panic on all Node admission requests in github.com/projectcapsule/capsule

  GO-2026-6157: Capsule has an incomplete fix of CVE-2026-22872: TenantResource RawItems and Generators still allow cluster-scoped resource creation (cross-tenant privilege escalation) in github.com/projectcapsule/capsule

Changes in this version

+ func ApplyPatches(ctx context.Context, c client.Client, obj client.Object, patches []JSONPatch, ...) (err error)

+ func CreateOrUpdate(ctx context.Context, c client.Client, obj *unstructured.Unstructured, ...) error

+ func EscapeJSONPointer(s string) string

+ func JSONPatchesToJSONPatchOperation(patches []JSONPatch) []jsonpatch.JsonPatchOperation

+ func JSONPatchesToRawPatch(patches []JSONPatch) (patch []byte, err error)

+ func JsonPointerDelete(obj map[string]any, p string) error

+ func JsonPointerGet(obj map[string]any, p string) (any, bool)

+ func JsonPointerSet(obj map[string]any, p string, val any) error

+ func LastApplyTimeForManager(obj *unstructured.Unstructured, manager string) *metav1.Time

+ func MatchIgnorePaths(rules []IgnoreRule, obj *unstructured.Unstructured) []string

+ func PatchApply(ctx context.Context, c client.Client, obj client.Object, fieldOwner string, ...) error

+ func PreserveIgnoredPaths(desired, live map[string]any, ptrs []string)

+ type IgnoreRule struct

+ Paths []string

+ Target *kustomize.Selector

+ func (i *IgnoreRule) Matches(obj *unstructured.Unstructured) bool

+ func (in *IgnoreRule) DeepCopy() *IgnoreRule

+ func (in *IgnoreRule) DeepCopyInto(out *IgnoreRule)

+ type JSONPatch struct

+ Operation JSONPatchOperation

+ Path string

+ Value any

+ func AddAnnotationsPatch(annotations map[string]string, keys map[string]string) []JSONPatch

+ func AddLabelsPatch(labels map[string]string, keys map[string]string) []JSONPatch

+ func AddOwnerReferencePatch(ownerrefs []metav1.OwnerReference, ownerreference *metav1.OwnerReference) []JSONPatch

+ func PatchRemoveAnnotations(annotations map[string]string, keys []string) []JSONPatch

+ func PatchRemoveLabels(labels map[string]string, keys []string) []JSONPatch

+ func RemoveOwnerReferencePatch(ownerRefs []metav1.OwnerReference, toRemove *metav1.OwnerReference) []JSONPatch

+ type JSONPatchOperation string

+ const JSONPatchAdd

+ const JSONPatchRemove

+ const JSONPatchReplace

+ func (j JSONPatchOperation) String() string