GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

client

package

v0.14.2 Latest Latest Go to latest Published: Aug 25, 2026 License: Apache-2.0 Imports: 14 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/projectcapsule/capsule

Links

Open Source Insights

Documentation ¶

Index ¶

func ApplyPatches(ctx context.Context, c client.Client, obj client.Object, patches []JSONPatch, ...) (err error)
func CreateOrUpdate(ctx context.Context, c client.Client, obj *unstructured.Unstructured, ...) error
func EscapeJSONPointer(s string) string
func JSONPatchesToJSONPatchOperation(patches []JSONPatch) []jsonpatch.JsonPatchOperation
func JSONPatchesToRawPatch(patches []JSONPatch) (patch []byte, err error)
func JsonPointerDelete(obj map[string]any, p string) error
func JsonPointerGet(obj map[string]any, p string) (any, bool)
func JsonPointerSet(obj map[string]any, p string, val any) error
func LastApplyTimeForManager(obj *unstructured.Unstructured, manager string) *metav1.Time
func MatchIgnorePaths(rules []IgnoreRule, obj *unstructured.Unstructured) []string
func PatchApply(ctx context.Context, c client.Client, obj client.Object, fieldOwner string, ...) error
func PreserveIgnoredPaths(desired, live map[string]any, ptrs []string)
type IgnoreRule
type JSONPatch
type JSONPatchOperation
- func (j JSONPatchOperation) String() string

Constants ¶

This section is empty.

Variables ¶

This section is empty.

Functions ¶

func ApplyPatches ¶

func ApplyPatches(
	ctx context.Context,
	c client.Client,
	obj client.Object,
	patches []JSONPatch,
	manager string,
) (err error)

func CreateOrUpdate ¶

func CreateOrUpdate(
	ctx context.Context,
	c client.Client,
	obj *unstructured.Unstructured,
	labels, annotations map[string]string,
	ignore []IgnoreRule,
) error

CreateOrUpdate Implementation with optional IgnoreRules.

func EscapeJSONPointer ¶

func EscapeJSONPointer(s string) string

func JSONPatchesToJSONPatchOperation ¶

func JSONPatchesToJSONPatchOperation(
	patches []JSONPatch,
) []jsonpatch.JsonPatchOperation

func JSONPatchesToRawPatch ¶

func JSONPatchesToRawPatch(patches []JSONPatch) (patch []byte, err error)

func JsonPointerDelete ¶

func JsonPointerDelete(obj map[string]any, p string) error

func JsonPointerGet ¶

func JsonPointerGet(obj map[string]any, p string) (any, bool)

jsonPointerGet returns (value, true) if JSON pointer p exists.

func JsonPointerSet ¶

func JsonPointerSet(obj map[string]any, p string, val any) error

func LastApplyTimeForManager ¶

func LastApplyTimeForManager(obj *unstructured.Unstructured, manager string) *metav1.Time

Returns timestamp of last apply for a manager.

func MatchIgnorePaths ¶

func MatchIgnorePaths(rules []IgnoreRule, obj *unstructured.Unstructured) []string

func PatchApply ¶

func PatchApply(
	ctx context.Context,
	c client.Client,
	obj client.Object,
	fieldOwner string,
	overwrite bool,
) error

func PreserveIgnoredPaths ¶

func PreserveIgnoredPaths(desired, live map[string]any, ptrs []string)

Types ¶

type IgnoreRule ¶

type IgnoreRule struct {
	// Paths is a list of JSON Pointer (RFC 6901) paths to be excluded from
	// consideration in a Kubernetes object.
	// +required
	Paths []string `json:"paths"`

	// Target is a selector for specifying Kubernetes objects to which this
	// rule applies.
	// If Target is not set, the Paths will be ignored for all Kubernetes
	// objects within the manifest of the Helm release.
	// +optional
	Target *kustomize.Selector `json:"target,omitempty"`
}

+kubebuilder:object:generate=true

func (*IgnoreRule) DeepCopy ¶

func (in *IgnoreRule) DeepCopy() *IgnoreRule

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new IgnoreRule.

func (*IgnoreRule) DeepCopyInto ¶

func (in *IgnoreRule) DeepCopyInto(out *IgnoreRule)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*IgnoreRule) Matches ¶

func (i *IgnoreRule) Matches(obj *unstructured.Unstructured) bool

type JSONPatch ¶

type JSONPatch struct {
	Operation JSONPatchOperation `json:"op"`
	Path      string             `json:"path"`
	Value     any                `json:"value,omitempty"`
}

func AddAnnotationsPatch ¶

func AddAnnotationsPatch(annotations map[string]string, keys map[string]string) []JSONPatch

func AddLabelsPatch ¶

func AddLabelsPatch(labels map[string]string, keys map[string]string) []JSONPatch

func AddOwnerReferencePatch ¶

func AddOwnerReferencePatch(
	ownerrefs []metav1.OwnerReference,
	ownerreference *metav1.OwnerReference,
) []JSONPatch

func PatchRemoveAnnotations ¶

func PatchRemoveAnnotations(annotations map[string]string, keys []string) []JSONPatch

PatchRemoveAnnotations returns a JSONPatch array for removing annotations with matching keys.

func PatchRemoveLabels ¶

func PatchRemoveLabels(labels map[string]string, keys []string) []JSONPatch

PatchRemoveLabels returns a JSONPatch array for removing labels with matching keys.

func RemoveOwnerReferencePatch ¶

func RemoveOwnerReferencePatch(
	ownerRefs []metav1.OwnerReference,
	toRemove *metav1.OwnerReference,
) []JSONPatch

type JSONPatchOperation ¶

type JSONPatchOperation string

const (
	JSONPatchAdd     JSONPatchOperation = "add"
	JSONPatchReplace JSONPatchOperation = "replace"
	JSONPatchRemove  JSONPatchOperation = "remove"
)

func (JSONPatchOperation) String ¶

func (j JSONPatchOperation) String() string

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL