rules

Sep 3, 2026 GO-2024-3077

  GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

Aug 31, 2026 GO-2024-3077

  GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

Aug 25, 2026 GO-2024-3077

  GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

Aug 25, 2026 GO-2024-3077

  GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

Changes in this version

type NamespaceRuleEnforceServicesBody

+ ExternalIPs *ServiceExternalIPRule

+ type ServiceExternalIPRule struct

+ CIDRs []string

+ func (in *ServiceExternalIPRule) DeepCopy() *ServiceExternalIPRule

+ func (in *ServiceExternalIPRule) DeepCopyInto(out *ServiceExternalIPRule)

Aug 21, 2026 GO-2024-3077

  GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

Changes in this version

type NamespaceRuleBodyNamespace

+ Quota []ResourceQuotaRule

type NamespaceRuleEnforceWorkloadsBody

+ Resources *WorkloadResourceRules

+ type ResourceQuotaRule struct

+ Name string

+ func (in *ResourceQuotaRule) DeepCopy() *ResourceQuotaRule

+ func (in *ResourceQuotaRule) DeepCopyInto(out *ResourceQuotaRule)

+ type WorkloadResourceLimitPolicy struct

+ Policy WorkloadResourceLimitPolicyType

+ Value *resource.Quantity

+ func (in *WorkloadResourceLimitPolicy) DeepCopy() *WorkloadResourceLimitPolicy

+ func (in *WorkloadResourceLimitPolicy) DeepCopyInto(out *WorkloadResourceLimitPolicy)

+ type WorkloadResourceLimitPolicyType string

+ const WorkloadResourceLimitPolicyDefault

+ const WorkloadResourceLimitPolicyMatchRequest

+ const WorkloadResourceLimitPolicyPreserve

+ const WorkloadResourceLimitPolicyRatio

+ const WorkloadResourceLimitPolicyRemove

+ type WorkloadResourceRequestPolicy struct

+ Policy WorkloadResourceRequestPolicyType

+ Value *resource.Quantity

+ func (in *WorkloadResourceRequestPolicy) DeepCopy() *WorkloadResourceRequestPolicy

+ func (in *WorkloadResourceRequestPolicy) DeepCopyInto(out *WorkloadResourceRequestPolicy)

+ type WorkloadResourceRequestPolicyType string

+ const WorkloadResourceRequestPolicyDefault

+ const WorkloadResourceRequestPolicyPreserve

+ const WorkloadResourceRequestPolicyRemove

+ type WorkloadResourceRules struct

+ Limits map[corev1.ResourceName]WorkloadResourceLimitPolicy

+ Requests map[corev1.ResourceName]WorkloadResourceRequestPolicy

+ func (in *WorkloadResourceRules) DeepCopy() *WorkloadResourceRules

+ func (in *WorkloadResourceRules) DeepCopyInto(out *WorkloadResourceRules)

type WorkloadValidationTarget

+ const ValidatePod

Jul 28, 2026 GO-2024-3077

  GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

Jul 22, 2026 GO-2024-3077

  GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

Changes in this version

+ func MetadataKeyExpression(selector string) runtime.ExpressionRegex

+ type Audience struct

+ Kind AudienceKind

+ Name string

+ func (in *Audience) DeepCopy() *Audience

+ func (in *Audience) DeepCopyInto(out *Audience)

+ type AudienceKind string

+ const AudienceKindCustom

+ const AudienceKindGroup

+ const AudienceKindServiceAccount

+ const AudienceKindUser

+ type CustomAudience string

+ const CustomAudienceAdministrator

+ const CustomAudienceCapsuleUser

+ const CustomAudienceController

+ const CustomAudienceTenantOwner

+ type IngressType string

+ const IngressTypeGRPCRoute

+ const IngressTypeGateway

+ const IngressTypeHTTPRoute

+ const IngressTypeIngress

+ const IngressTypeListenerSet

+ const IngressTypeRoute

+ const IngressTypeTLSRoute

type MetadataRule

+ func (r MetadataRule) MatchesGroupVersionKind(gvk schema.GroupVersionKind) bool

type MetadataValueRule

+ Default *string

+ Managed *string

type NamespaceRuleBodyNamespace

+ Audience []Audience

type NamespaceRuleEnforceBody

+ Ingress NamespaceRuleEnforceIngressBody

+ type NamespaceRuleEnforceIngressBody struct

+ Hostnames []runtime.ExpressionMatch

+ Types []IngressType

+ func (in *NamespaceRuleEnforceIngressBody) DeepCopy() *NamespaceRuleEnforceIngressBody

+ func (in *NamespaceRuleEnforceIngressBody) DeepCopyInto(out *NamespaceRuleEnforceIngressBody)

type NamespaceRulePermissionBody

+ Bindings []rbac.AdditionalRoleBindingsSpec

Jul 6, 2026 GO-2024-3077

  GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

Jul 3, 2026 GO-2024-3077

  GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

Changes in this version

+ type MetadataRule struct

+ Annotations map[string]MetadataValueRule

+ Labels map[string]MetadataValueRule

+ func (in *MetadataRule) DeepCopy() *MetadataRule

+ func (in *MetadataRule) DeepCopyInto(out *MetadataRule)

+ type MetadataValueRule struct

+ Required bool

+ Values []runtime.ExpressionMatch

+ func (in *MetadataValueRule) DeepCopy() *MetadataValueRule

+ func (in *MetadataValueRule) DeepCopyInto(out *MetadataValueRule)

type NamespaceRuleEnforceBody

+ Metadata []MetadataRule

Jun 24, 2026 GO-2024-3077 +2 more

  GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

  GO-2026-6155: Capsule: CapsuleConfiguration NodeMetadata regex fields lack webhook validation, allowing MustCompile panic on all Node admission requests in github.com/projectcapsule/capsule

  GO-2026-6157: Capsule has an incomplete fix of CVE-2026-22872: TenantResource RawItems and Generators still allow cluster-scoped resource creation (cross-tenant privilege escalation) in github.com/projectcapsule/capsule

Changes in this version

type NamespaceRuleEnforceBody

+ Services NamespaceRuleEnforceServicesBody

+ type NamespaceRuleEnforceServicesBody struct

+ ExternalNames *ServiceExternalNameRule

+ LoadBalancers *ServiceLoadBalancerRule

+ NodePorts *ServiceNodePortRule

+ Types []ServiceType

+ func (in *NamespaceRuleEnforceServicesBody) DeepCopy() *NamespaceRuleEnforceServicesBody

+ func (in *NamespaceRuleEnforceServicesBody) DeepCopyInto(out *NamespaceRuleEnforceServicesBody)

type NamespaceRuleEnforceWorkloadsBody

+ Schedulers []api.ExpressionMatch

+ type ServiceExternalNameRule struct

+ Hostnames []api.ExpressionMatch

+ func (in *ServiceExternalNameRule) DeepCopy() *ServiceExternalNameRule

+ func (in *ServiceExternalNameRule) DeepCopyInto(out *ServiceExternalNameRule)

+ type ServiceLoadBalancerRule struct

+ CIDRs []string

+ func (in *ServiceLoadBalancerRule) DeepCopy() *ServiceLoadBalancerRule

+ func (in *ServiceLoadBalancerRule) DeepCopyInto(out *ServiceLoadBalancerRule)

+ type ServiceNodePortRange struct

+ From int32

+ To int32

+ func (in *ServiceNodePortRange) DeepCopy() *ServiceNodePortRange

+ func (in *ServiceNodePortRange) DeepCopyInto(out *ServiceNodePortRange)

+ type ServiceNodePortRule struct

+ Ports []ServiceNodePortRange

+ func (in *ServiceNodePortRule) DeepCopy() *ServiceNodePortRule

+ func (in *ServiceNodePortRule) DeepCopyInto(out *ServiceNodePortRule)

+ type ServiceType string

+ const ServiceTypeClusterIP

+ const ServiceTypeExternalName

+ const ServiceTypeLoadBalancer

+ const ServiceTypeNodePort

Jun 17, 2026 GO-2024-3077 +2 more

  GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

  GO-2026-6155: Capsule: CapsuleConfiguration NodeMetadata regex fields lack webhook validation, allowing MustCompile panic on all Node admission requests in github.com/projectcapsule/capsule

  GO-2026-6157: Capsule has an incomplete fix of CVE-2026-22872: TenantResource RawItems and Generators still allow cluster-scoped resource creation (cross-tenant privilege escalation) in github.com/projectcapsule/capsule

Jun 9, 2026 GO-2024-3077 +3 more

  GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

  GO-2026-5406: Capsule: Incomplete fix of CVE-2026-30963: singular/plural typo leaves namespaces/finalize unprotected in github.com/projectcapsule/capsule

  GO-2026-6155: Capsule: CapsuleConfiguration NodeMetadata regex fields lack webhook validation, allowing MustCompile panic on all Node admission requests in github.com/projectcapsule/capsule

  GO-2026-6157: Capsule has an incomplete fix of CVE-2026-22872: TenantResource RawItems and Generators still allow cluster-scoped resource creation (cross-tenant privilege escalation) in github.com/projectcapsule/capsule

Changes in this version

+ type ActionType string

+ const ActionTypeAllow

+ const ActionTypeAudit

+ const ActionTypeDeny

+ func (a ActionType) OrDefault() ActionType

+ type ImagePullPolicySpec string

+ func (i ImagePullPolicySpec) String() string

+ type NamespaceRuleBodyNamespace struct

+ Enforce *NamespaceRuleEnforceBody

+ func (in *NamespaceRuleBodyNamespace) DeepCopy() *NamespaceRuleBodyNamespace

+ func (in *NamespaceRuleBodyNamespace) DeepCopyInto(out *NamespaceRuleBodyNamespace)

+ type NamespaceRuleBodyTenant struct

+ NamespaceSelector *metav1.LabelSelector

+ Permissions NamespaceRulePermissionBody

+ func (in *NamespaceRuleBodyTenant) DeepCopy() *NamespaceRuleBodyTenant

+ func (in *NamespaceRuleBodyTenant) DeepCopyInto(out *NamespaceRuleBodyTenant)

+ type NamespaceRuleEnforceBody struct

+ Action ActionType

+ Workloads NamespaceRuleEnforceWorkloadsBody

+ func (e NamespaceRuleEnforceBody) GetWorkloadTargets(target WorkloadValidationTarget) bool

+ func (e NamespaceRuleEnforceBody) WorkloadTargetsAny(targets ...WorkloadValidationTarget) bool

+ func (in *NamespaceRuleEnforceBody) DeepCopy() *NamespaceRuleEnforceBody

+ func (in *NamespaceRuleEnforceBody) DeepCopyInto(out *NamespaceRuleEnforceBody)

+ type NamespaceRuleEnforceWorkloadsBody struct

+ QoSClasses []corev1.PodQOSClass

+ Registries []OCIRegistry

+ Targets []WorkloadValidationTarget

+ func (in *NamespaceRuleEnforceWorkloadsBody) DeepCopy() *NamespaceRuleEnforceWorkloadsBody

+ func (in *NamespaceRuleEnforceWorkloadsBody) DeepCopyInto(out *NamespaceRuleEnforceWorkloadsBody)

+ type NamespaceRulePermissionBody struct

+ Promotions []*NamespaceRulePromotionRule

+ func (in *NamespaceRulePermissionBody) DeepCopy() *NamespaceRulePermissionBody

+ func (in *NamespaceRulePermissionBody) DeepCopyInto(out *NamespaceRulePermissionBody)

+ type NamespaceRulePromotionRule struct

+ ClusterRoles []string

+ Selector *metav1.LabelSelector

+ func (in *NamespaceRulePromotionRule) DeepCopy() *NamespaceRulePromotionRule

+ func (in *NamespaceRulePromotionRule) DeepCopyInto(out *NamespaceRulePromotionRule)

+ type OCIRegistry struct

+ Policy []corev1.PullPolicy

+ func (in *OCIRegistry) DeepCopy() *OCIRegistry

+ func (in *OCIRegistry) DeepCopyInto(out *OCIRegistry)

+ func (r OCIRegistry) Expression() api.RegExpression

+ type RuleDecision struct

+ Action ActionType

+ Rule *NamespaceRuleBodyNamespace

+ type WorkloadValidationTarget string

+ const DeprecatedValidateImages

+ const ValidateContainers

+ const ValidateEphemeralContainers

+ const ValidateInitContainers

+ const ValidateVolumes