Why Go
- Case Studies
  
  Common problems companies solve with Go
- Use Cases
  
  Stories about how and why companies use Go
- Security
  
  How Go can help keep you secure by default
Learn
Docs
- Effective Go
  
  Tips for writing clear, performant, and idiomatic Go code
- Go User Manual
  
  A complete introduction to building software with Go
- Standard library
  
  Reference documentation for Go's standard library
- Release Notes
  
  Learn what's new in each Go release
- API
  
  Reference documentation for the pkg.go.dev API
Packages
Community
- Recorded Talks
  
  Videos from prior events
- Meetups
  
  Meet other local Go developers
- Conferences
  
  Learn and network with Go developers from around the world
- Go blog
  
  The Go project's official blog.
- Go project
  
  Get help and stay informed from Go
- Get connected

rules

package

Go to main page

Versions in this module

v0

v0.13.9

Jul 6, 2026 GO-2024-3077

GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

v0.13.8

Jul 3, 2026 GO-2024-3077

GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

Changes in this version

+ type MetadataRule struct

+ Annotations map[string]MetadataValueRule

+ Labels map[string]MetadataValueRule

+ func (in *MetadataRule) DeepCopy() *MetadataRule

+ func (in *MetadataRule) DeepCopyInto(out *MetadataRule)

+ type MetadataValueRule struct

+ Required bool

+ Values []runtime.ExpressionMatch

+ func (in *MetadataValueRule) DeepCopy() *MetadataValueRule

+ func (in *MetadataValueRule) DeepCopyInto(out *MetadataValueRule)

type NamespaceRuleEnforceBody

+ Metadata []MetadataRule

v0.13.7

Jun 24, 2026 GO-2024-3077

GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

Changes in this version

type NamespaceRuleEnforceBody

+ Services NamespaceRuleEnforceServicesBody

+ type NamespaceRuleEnforceServicesBody struct

+ ExternalNames *ServiceExternalNameRule

+ LoadBalancers *ServiceLoadBalancerRule

+ NodePorts *ServiceNodePortRule

+ Types []ServiceType

+ func (in *NamespaceRuleEnforceServicesBody) DeepCopy() *NamespaceRuleEnforceServicesBody

+ func (in *NamespaceRuleEnforceServicesBody) DeepCopyInto(out *NamespaceRuleEnforceServicesBody)

type NamespaceRuleEnforceWorkloadsBody

+ Schedulers []api.ExpressionMatch

+ type ServiceExternalNameRule struct

+ Hostnames []api.ExpressionMatch

+ func (in *ServiceExternalNameRule) DeepCopy() *ServiceExternalNameRule

+ func (in *ServiceExternalNameRule) DeepCopyInto(out *ServiceExternalNameRule)

+ type ServiceLoadBalancerRule struct

+ CIDRs []string

+ func (in *ServiceLoadBalancerRule) DeepCopy() *ServiceLoadBalancerRule

+ func (in *ServiceLoadBalancerRule) DeepCopyInto(out *ServiceLoadBalancerRule)

+ type ServiceNodePortRange struct

+ From int32

+ To int32

+ func (in *ServiceNodePortRange) DeepCopy() *ServiceNodePortRange

+ func (in *ServiceNodePortRange) DeepCopyInto(out *ServiceNodePortRange)

+ type ServiceNodePortRule struct

+ Ports []ServiceNodePortRange

+ func (in *ServiceNodePortRule) DeepCopy() *ServiceNodePortRule

+ func (in *ServiceNodePortRule) DeepCopyInto(out *ServiceNodePortRule)

+ type ServiceType string

+ const ServiceTypeClusterIP

+ const ServiceTypeExternalName

+ const ServiceTypeLoadBalancer

+ const ServiceTypeNodePort

v0.13.6

Jun 17, 2026 GO-2024-3077

GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

v0.13.5

Jun 9, 2026 GO-2024-3077 +1 more

GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

GO-2026-5406: Capsule: Incomplete fix of CVE-2026-30963: singular/plural typo leaves namespaces/finalize unprotected in github.com/projectcapsule/capsule

Changes in this version

+ type ActionType string

+ const ActionTypeAllow

+ const ActionTypeAudit

+ const ActionTypeDeny

+ func (a ActionType) OrDefault() ActionType

+ type ImagePullPolicySpec string

+ func (i ImagePullPolicySpec) String() string

+ type NamespaceRuleBodyNamespace struct

+ Enforce *NamespaceRuleEnforceBody

+ func (in *NamespaceRuleBodyNamespace) DeepCopy() *NamespaceRuleBodyNamespace

+ func (in *NamespaceRuleBodyNamespace) DeepCopyInto(out *NamespaceRuleBodyNamespace)

+ type NamespaceRuleBodyTenant struct

+ NamespaceSelector *metav1.LabelSelector

+ Permissions NamespaceRulePermissionBody

+ func (in *NamespaceRuleBodyTenant) DeepCopy() *NamespaceRuleBodyTenant

+ func (in *NamespaceRuleBodyTenant) DeepCopyInto(out *NamespaceRuleBodyTenant)

+ type NamespaceRuleEnforceBody struct

+ Action ActionType

+ Workloads NamespaceRuleEnforceWorkloadsBody

+ func (e NamespaceRuleEnforceBody) GetWorkloadTargets(target WorkloadValidationTarget) bool

+ func (e NamespaceRuleEnforceBody) WorkloadTargetsAny(targets ...WorkloadValidationTarget) bool

+ func (in *NamespaceRuleEnforceBody) DeepCopy() *NamespaceRuleEnforceBody

+ func (in *NamespaceRuleEnforceBody) DeepCopyInto(out *NamespaceRuleEnforceBody)

+ type NamespaceRuleEnforceWorkloadsBody struct

+ QoSClasses []corev1.PodQOSClass

+ Registries []OCIRegistry

+ Targets []WorkloadValidationTarget

+ func (in *NamespaceRuleEnforceWorkloadsBody) DeepCopy() *NamespaceRuleEnforceWorkloadsBody

+ func (in *NamespaceRuleEnforceWorkloadsBody) DeepCopyInto(out *NamespaceRuleEnforceWorkloadsBody)

+ type NamespaceRulePermissionBody struct

+ Promotions []*NamespaceRulePromotionRule

+ func (in *NamespaceRulePermissionBody) DeepCopy() *NamespaceRulePermissionBody

+ func (in *NamespaceRulePermissionBody) DeepCopyInto(out *NamespaceRulePermissionBody)

+ type NamespaceRulePromotionRule struct

+ ClusterRoles []string

+ Selector *metav1.LabelSelector

+ func (in *NamespaceRulePromotionRule) DeepCopy() *NamespaceRulePromotionRule

+ func (in *NamespaceRulePromotionRule) DeepCopyInto(out *NamespaceRulePromotionRule)

+ type OCIRegistry struct

+ Policy []corev1.PullPolicy

+ func (in *OCIRegistry) DeepCopy() *OCIRegistry

+ func (in *OCIRegistry) DeepCopyInto(out *OCIRegistry)

+ func (r OCIRegistry) Expression() api.RegExpression

+ type RuleDecision struct

+ Action ActionType

+ Rule *NamespaceRuleBodyNamespace

+ type WorkloadValidationTarget string

+ const DeprecatedValidateImages

+ const ValidateContainers

+ const ValidateEphemeralContainers

+ const ValidateInitContainers

+ const ValidateVolumes