GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

validation

package

v0.15.0 Latest Latest Go to latest Published: Oct 21, 2026 License: Apache-2.0 Imports: 27 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/projectcapsule/capsule

Links

Open Source Insights

Documentation ¶

Index ¶

func ContainerRegistryRegexHandler() handlers.TypedHandler[*capsulev1beta2.Tenant]
func DeviceClassRegexHandler() handlers.TypedHandler[*capsulev1beta2.Tenant]
func ForbiddenAnnotationsRegexHandler() handlers.TypedHandler[*capsulev1beta2.Tenant]
func FreezedEmitter() handlers.TypedHandler[*capsulev1beta2.Tenant]
func GatewayClassRegexHandler() handlers.TypedHandler[*capsulev1beta2.Tenant]
func Handler(configuration configuration.Configuration, ...) handlers.Handler
func HostnameRegexHandler() handlers.TypedHandler[*capsulev1beta2.Tenant]
func IngressClassRegexHandler() handlers.TypedHandler[*capsulev1beta2.Tenant]
func NameHandler() handlers.TypedHandler[*capsulev1beta2.Tenant]
func NamespaceMetadataHandler() handlers.TypedHandler[*capsulev1beta2.Tenant]
func OwnersHandler() handlers.TypedHandler[*capsulev1beta2.Tenant]
func PriorityClassRegexHandler() handlers.TypedHandler[*capsulev1beta2.Tenant]
func ProtectedHandler() handlers.TypedHandler[*capsulev1beta2.Tenant]
func RequiredMetadataHandler() handlers.TypedHandler[*capsulev1beta2.Tenant]
func RoleBindingRegexHandler() handlers.TypedHandler[*capsulev1beta2.Tenant]
func RuleHandler(mapper k8smeta.RESTMapper, compiler ruleengine.ConditionCompiler) handlers.TypedHandler[*capsulev1beta2.Tenant]
func RuntimeClassRegexHandler() handlers.TypedHandler[*capsulev1beta2.Tenant]
func StorageClassRegexHandler() handlers.TypedHandler[*capsulev1beta2.Tenant]
func WarningHandler(cfg configuration.Configuration) handlers.TypedHandler[*capsulev1beta2.Tenant]
type RuleValidationHandler
- func (h *RuleValidationHandler) OnCreate(_ client.Client, _ client.Reader, tnt *capsulev1beta2.Tenant, ...) handlers.Func
- func (h *RuleValidationHandler) OnDelete(client.Client, client.Reader, *capsulev1beta2.Tenant, admission.Decoder, ...) handlers.Func
- func (h *RuleValidationHandler) OnUpdate(c client.Client, reader client.Reader, tnt *capsulev1beta2.Tenant, ...) handlers.Func

Constants ¶

This section is empty.

Variables ¶

This section is empty.

Functions ¶

func ContainerRegistryRegexHandler ¶

func ContainerRegistryRegexHandler() handlers.TypedHandler[*capsulev1beta2.Tenant]

func DeviceClassRegexHandler ¶ added in v0.15.0

func DeviceClassRegexHandler() handlers.TypedHandler[*capsulev1beta2.Tenant]

func ForbiddenAnnotationsRegexHandler ¶

func ForbiddenAnnotationsRegexHandler() handlers.TypedHandler[*capsulev1beta2.Tenant]

func FreezedEmitter ¶

func FreezedEmitter() handlers.TypedHandler[*capsulev1beta2.Tenant]

func GatewayClassRegexHandler ¶ added in v0.15.0

func GatewayClassRegexHandler() handlers.TypedHandler[*capsulev1beta2.Tenant]

func Handler ¶ added in v0.13.0

func Handler(configuration configuration.Configuration, handlers ...handlers.TypedHandler[*capsulev1beta2.Tenant]) handlers.Handler

func HostnameRegexHandler ¶

func HostnameRegexHandler() handlers.TypedHandler[*capsulev1beta2.Tenant]

func IngressClassRegexHandler ¶

func IngressClassRegexHandler() handlers.TypedHandler[*capsulev1beta2.Tenant]

func NameHandler ¶

func NameHandler() handlers.TypedHandler[*capsulev1beta2.Tenant]

func NamespaceMetadataHandler ¶ added in v0.13.0

func NamespaceMetadataHandler() handlers.TypedHandler[*capsulev1beta2.Tenant]

func OwnersHandler ¶ added in v0.13.6

func OwnersHandler() handlers.TypedHandler[*capsulev1beta2.Tenant]

func PriorityClassRegexHandler ¶ added in v0.15.0

func PriorityClassRegexHandler() handlers.TypedHandler[*capsulev1beta2.Tenant]

func ProtectedHandler ¶

func ProtectedHandler() handlers.TypedHandler[*capsulev1beta2.Tenant]

func RequiredMetadataHandler ¶ added in v0.13.0

func RequiredMetadataHandler() handlers.TypedHandler[*capsulev1beta2.Tenant]

func RoleBindingRegexHandler ¶

func RoleBindingRegexHandler() handlers.TypedHandler[*capsulev1beta2.Tenant]

func RuleHandler ¶ added in v0.13.0

func RuleHandler(mapper k8smeta.RESTMapper, compiler ruleengine.ConditionCompiler) handlers.TypedHandler[*capsulev1beta2.Tenant]

func RuntimeClassRegexHandler ¶ added in v0.15.0

func RuntimeClassRegexHandler() handlers.TypedHandler[*capsulev1beta2.Tenant]

func StorageClassRegexHandler ¶

func StorageClassRegexHandler() handlers.TypedHandler[*capsulev1beta2.Tenant]

func WarningHandler ¶

func WarningHandler(cfg configuration.Configuration) handlers.TypedHandler[*capsulev1beta2.Tenant]

Types ¶

type RuleValidationHandler ¶ added in v0.13.0

type RuleValidationHandler struct {
	// contains filtered or unexported fields
}

func (*RuleValidationHandler) OnCreate ¶ added in v0.13.0

func (h *RuleValidationHandler) OnCreate(
	_ client.Client,
	_ client.Reader,
	tnt *capsulev1beta2.Tenant,
	decoder admission.Decoder,
	_ events.EventRecorder,
) handlers.Func

func (*RuleValidationHandler) OnDelete ¶ added in v0.13.0

func (h *RuleValidationHandler) OnDelete(
	client.Client,
	client.Reader,
	*capsulev1beta2.Tenant,
	admission.Decoder,
	events.EventRecorder,
) handlers.Func

func (*RuleValidationHandler) OnUpdate ¶ added in v0.13.0

func (h *RuleValidationHandler) OnUpdate(
	c client.Client,
	reader client.Reader,
	tnt *capsulev1beta2.Tenant,
	old *capsulev1beta2.Tenant,
	decoder admission.Decoder,
	_ events.EventRecorder,
) handlers.Func

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL