GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

validation

package

v0.13.8 Latest Latest Go to latest Published: Jul 3, 2026 License: Apache-2.0 Imports: 23 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/projectcapsule/capsule

Links

Open Source Insights

Documentation ¶

Index ¶

func ContainerRegistryRegexHandler() handlers.TypedHandler[*capsulev1beta2.Tenant]
func ForbiddenAnnotationsRegexHandler() handlers.TypedHandler[*capsulev1beta2.Tenant]
func FreezedEmitter() handlers.TypedHandler[*capsulev1beta2.Tenant]
func Handler(configuration configuration.Configuration, ...) handlers.Handler
func HostnameRegexHandler() handlers.TypedHandler[*capsulev1beta2.Tenant]
func IngressClassRegexHandler() handlers.TypedHandler[*capsulev1beta2.Tenant]
func NameHandler() handlers.TypedHandler[*capsulev1beta2.Tenant]
func NamespaceMetadataHandler() handlers.TypedHandler[*capsulev1beta2.Tenant]
func OwnersHandler() handlers.TypedHandler[*capsulev1beta2.Tenant]
func ProtectedHandler() handlers.TypedHandler[*capsulev1beta2.Tenant]
func RequiredMetadataHandler() handlers.TypedHandler[*capsulev1beta2.Tenant]
func RoleBindingRegexHandler() handlers.TypedHandler[*capsulev1beta2.Tenant]
func RuleHandler(mapper k8smeta.RESTMapper) handlers.TypedHandler[*capsulev1beta2.Tenant]
func StorageClassRegexHandler() handlers.TypedHandler[*capsulev1beta2.Tenant]
func WarningHandler(cfg configuration.Configuration) handlers.TypedHandler[*capsulev1beta2.Tenant]
type RuleValidationHandler

Constants ¶

This section is empty.

Variables ¶

This section is empty.

Functions ¶

func ContainerRegistryRegexHandler ¶

func ContainerRegistryRegexHandler() handlers.TypedHandler[*capsulev1beta2.Tenant]

func ForbiddenAnnotationsRegexHandler ¶

func ForbiddenAnnotationsRegexHandler() handlers.TypedHandler[*capsulev1beta2.Tenant]

func FreezedEmitter ¶

func FreezedEmitter() handlers.TypedHandler[*capsulev1beta2.Tenant]

func Handler ¶ added in v0.13.0

func Handler(configuration configuration.Configuration, handlers ...handlers.TypedHandler[*capsulev1beta2.Tenant]) handlers.Handler

func HostnameRegexHandler ¶

func HostnameRegexHandler() handlers.TypedHandler[*capsulev1beta2.Tenant]

func IngressClassRegexHandler ¶

func IngressClassRegexHandler() handlers.TypedHandler[*capsulev1beta2.Tenant]

func NameHandler ¶

func NameHandler() handlers.TypedHandler[*capsulev1beta2.Tenant]

func NamespaceMetadataHandler ¶ added in v0.13.0

func NamespaceMetadataHandler() handlers.TypedHandler[*capsulev1beta2.Tenant]

func OwnersHandler ¶ added in v0.13.6

func OwnersHandler() handlers.TypedHandler[*capsulev1beta2.Tenant]

func ProtectedHandler ¶

func ProtectedHandler() handlers.TypedHandler[*capsulev1beta2.Tenant]

func RequiredMetadataHandler ¶ added in v0.13.0

func RequiredMetadataHandler() handlers.TypedHandler[*capsulev1beta2.Tenant]

func RoleBindingRegexHandler ¶

func RoleBindingRegexHandler() handlers.TypedHandler[*capsulev1beta2.Tenant]

func RuleHandler ¶ added in v0.13.0

func RuleHandler(mapper k8smeta.RESTMapper) handlers.TypedHandler[*capsulev1beta2.Tenant]

func StorageClassRegexHandler ¶

func StorageClassRegexHandler() handlers.TypedHandler[*capsulev1beta2.Tenant]

func WarningHandler ¶

func WarningHandler(cfg configuration.Configuration) handlers.TypedHandler[*capsulev1beta2.Tenant]

Types ¶

type RuleValidationHandler ¶ added in v0.13.0

type RuleValidationHandler struct {
	// contains filtered or unexported fields
}

func (*RuleValidationHandler) OnCreate ¶ added in v0.13.0

func (h *RuleValidationHandler) OnCreate(
	_ client.Client,
	_ client.Reader,
	tnt *capsulev1beta2.Tenant,
	decoder admission.Decoder,
	_ events.EventRecorder,
) handlers.Func

func (*RuleValidationHandler) OnDelete ¶ added in v0.13.0

func (h *RuleValidationHandler) OnDelete(
	client.Client,
	client.Reader,
	*capsulev1beta2.Tenant,
	admission.Decoder,
	events.EventRecorder,
) handlers.Func

func (*RuleValidationHandler) OnUpdate ¶ added in v0.13.0

func (h *RuleValidationHandler) OnUpdate(
	_ client.Client,
	_ client.Reader,
	tnt *capsulev1beta2.Tenant,
	old *capsulev1beta2.Tenant,
	decoder admission.Decoder,
	_ events.EventRecorder,
) handlers.Func

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL