GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

configuration

package

v0.13.9 Latest Latest Go to latest Published: Jul 6, 2026 License: Apache-2.0 Imports: 17 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/projectcapsule/capsule

Links

Open Source Insights

Documentation ¶

Index ¶

Constants
func ControllerNamespace() (namespace string)
func ControllerServiceAccount() (name string, namespace string)
func DefaultCapsuleConfiguration() capsulev1beta2.CapsuleConfigurationSpec
func IsControllerServiceAccount(name string, namespace string) bool
type Configuration
- func NewCapsuleConfiguration(ctx context.Context, c client.Client, reader client.Reader, rest *rest.Config, ...) Configuration

Constants ¶

View Source

const (
	EnvironmentServiceaccountName  string = "SERVICE_ACCOUNT"
	EnvironmentControllerNamespace string = "NAMESPACE"
)

View Source

const (
	TenantCRDName = "tenants.capsule.clastix.io"
)

Variables ¶

This section is empty.

Functions ¶

func ControllerNamespace ¶

func ControllerNamespace() (namespace string)

func ControllerServiceAccount ¶

func ControllerServiceAccount() (name string, namespace string)

func DefaultCapsuleConfiguration ¶

func DefaultCapsuleConfiguration() capsulev1beta2.CapsuleConfigurationSpec

func IsControllerServiceAccount ¶

func IsControllerServiceAccount(name string, namespace string) bool

Types ¶

type Configuration ¶

type Configuration interface {
	GetConfigObject() *capsulev1beta2.CapsuleConfiguration

	ProtectedNamespaceRegexp() (*regexp.Regexp, error)
	ForceTenantPrefix() bool
	// EnableTLSConfiguration enabled the TLS reconciler, responsible for creating CA and TLS certificate required
	// for the CRD conversion and webhooks.
	EnableTLSConfiguration() bool
	AllowServiceAccountPromotion() bool
	TLSSecretName() string
	MutatingWebhookConfigurationName() string
	ValidatingWebhookConfigurationName() string
	TenantCRDName() string
	UserNames() []string
	UserGroups() []string
	Users() rbac.UserListSpec
	GetUsersByStatus() rbac.UserListSpec
	IgnoreUserWithGroups() []string
	ForbiddenUserNodeLabels() *capsuleapi.ForbiddenListSpec
	ForbiddenUserNodeAnnotations() *capsuleapi.ForbiddenListSpec
	Administrators() rbac.UserListSpec
	ServiceAccountClientProperties() capsulev1beta2.ServiceAccountClient
	ServiceAccountClient(context.Context) (*rest.Config, error)
	Admission() capsulev1beta2.DynamicAdmission
	Events() capsulev1beta2.EventsConfiguration
	RBAC() *capsulev1beta2.RBACConfiguration
	CacheInvalidation() metav1.Duration
}

func NewCapsuleConfiguration ¶

func NewCapsuleConfiguration(ctx context.Context, c client.Client, reader client.Reader, rest *rest.Config, name string) Configuration

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL