GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

mutation

package

v0.14.3 Latest Latest Go to latest Published: Aug 31, 2026 License: Apache-2.0 Imports: 21 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/projectcapsule/capsule

Links

Open Source Insights

Documentation ¶

Index ¶

Constants
func MetadataRules() handlers.TypedHandlerWithTenantWithRuleset[*unstructured.Unstructured]
func MutateMetadata(obj metav1.Object, gvk schema.GroupVersionKind, ...) bool
func MutatePodResources(pod *corev1.Pod, bodies []*apirules.NamespaceRuleBodyNamespace) (bool, error)
func MutateWorkloadResources(obj *unstructured.Unstructured, gvk schema.GroupVersionKind, ...) (bool, error)
func Register(cfg configuration.Configuration) handlers.Webhook

Constants ¶

View Source

const Path = "/rules/generic/mutating"

Variables ¶

This section is empty.

Functions ¶

func MetadataRules ¶

func MetadataRules() handlers.TypedHandlerWithTenantWithRuleset[*unstructured.Unstructured]

func MutateMetadata ¶

func MutateMetadata(
	obj metav1.Object,
	gvk schema.GroupVersionKind,
	bodies []*apirules.NamespaceRuleBodyNamespace,
) bool

func MutatePodResources ¶ added in v0.14.0

func MutatePodResources(
	pod *corev1.Pod,
	bodies []*apirules.NamespaceRuleBodyNamespace,
) (bool, error)

func MutateWorkloadResources ¶ added in v0.14.0

func MutateWorkloadResources(
	obj *unstructured.Unstructured,
	gvk schema.GroupVersionKind,
	bodies []*apirules.NamespaceRuleBodyNamespace,
) (bool, error)

func Register ¶

func Register(cfg configuration.Configuration) handlers.Webhook

Types ¶

This section is empty.

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL