GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

pod

package

v0.15.1 Latest Latest Go to latest Published: Oct 22, 2026 License: Apache-2.0 Imports: 18 Imported by: 0

Details

This section is empty.

This section is empty.

func ContainerRegistryLegacy(configuration configuration.Configuration) handlers.TypedHandlerWithTenantWithRuleset[*corev1.Pod]

func Handler(cfg configuration.Configuration, handler ...handlers.TypedHandlerWithTenantWithRuleset[*corev1.Pod]) handlers.Handler

func ImagePullPolicy() handlers.TypedHandlerWithTenantWithRuleset[*corev1.Pod]

func PriorityClass() handlers.TypedHandlerWithTenantWithRuleset[*corev1.Pod]

func RuntimeClass() handlers.TypedHandlerWithTenantWithRuleset[*corev1.Pod]

type PullPolicy interface {
	IsPolicySupported(policy string) bool
	AllowedPullPolicies() []string
}

func NewPullPolicy(tenant *capsulev1beta2.Tenant) PullPolicy

type Registry interface {
	Registry() string
	Repository() string
	Image() string
	Tag() string
	FQCI() string
}

func NewRegistry(value string, cfg configuration.Configuration) Registry