v1beta2

Jul 6, 2026 GO-2024-3077

  GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

Jul 3, 2026 GO-2024-3077

  GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

Jun 24, 2026 GO-2024-3077

  GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

Changes in this version

type CapsuleConfigurationSpec

+ Events EventsConfiguration

+ type EventsConfiguration struct

+ ClusterEventNamespace string

+ func (in *EventsConfiguration) DeepCopy() *EventsConfiguration

+ func (in *EventsConfiguration) DeepCopyInto(out *EventsConfiguration)

Jun 17, 2026 GO-2024-3077

  GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

Jun 9, 2026 GO-2024-3077 +1 more

  GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

  GO-2026-5406: Capsule: Incomplete fix of CVE-2026-30963: singular/plural typo leaves namespaces/finalize unprotected in github.com/projectcapsule/capsule

Changes in this version

type RuleStatusStatus

+ Rules []*rules.NamespaceRuleBodyNamespace

Jun 5, 2026 GO-2024-3077 +1 more

  GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

  GO-2026-5406: Capsule: Incomplete fix of CVE-2026-30963: singular/plural typo leaves namespaces/finalize unprotected in github.com/projectcapsule/capsule

Jun 4, 2026 GO-2024-3077 +1 more

  GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

  GO-2026-5406: Capsule: Incomplete fix of CVE-2026-30963: singular/plural typo leaves namespaces/finalize unprotected in github.com/projectcapsule/capsule

Jun 3, 2026 GO-2024-3077 +1 more

  GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

  GO-2026-5406: Capsule: Incomplete fix of CVE-2026-30963: singular/plural typo leaves namespaces/finalize unprotected in github.com/projectcapsule/capsule

Changes in this version

type CapsuleConfigurationStatus

+ Conditions meta.ConditionList

+ ObservedGeneration int64

+ Tenants []string

type CustomQuotaStatus

+ ObservedGeneration int64

type ResourcePoolClaimStatus

+ ObservedGeneration int64

type ResourcePoolStatus

+ ObservedGeneration int64

+ type RuleStatusStatus struct

+ Conditions meta.ConditionList

+ ObservedGeneration int64

+ Rule api.NamespaceRuleBodyNamespace

+ func (in *RuleStatusStatus) DeepCopy() *RuleStatusStatus

+ func (in *RuleStatusStatus) DeepCopyInto(out *RuleStatusStatus)

type TenantOwnerStatus

+ Conditions meta.ConditionList

+ ObservedGeneration int64

+ Tenants []string

type TenantResourceCommonStatus

+ ObservedGeneration int64

type TenantStatus

+ ObservedGeneration int64

May 29, 2026 GO-2024-3077 +1 more

  GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

  GO-2026-5406: Capsule: Incomplete fix of CVE-2026-30963: singular/plural typo leaves namespaces/finalize unprotected in github.com/projectcapsule/capsule

May 28, 2026 GO-2024-3077 +1 more

  GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

  GO-2026-5406: Capsule: Incomplete fix of CVE-2026-30963: singular/plural typo leaves namespaces/finalize unprotected in github.com/projectcapsule/capsule

Changes in this version

+ const TenantStateTerminating

type CapsuleConfiguration

+ Status CapsuleConfigurationStatus

type CapsuleConfigurationSpec

+ Admission DynamicAdmission

+ CacheInvalidation metav1.Duration

+ Impersonation ServiceAccountClient

+ RBAC *RBACConfiguration

+ type CapsuleConfigurationStatus struct

+ Users rbac.UserListSpec

+ func (in *CapsuleConfigurationStatus) DeepCopy() *CapsuleConfigurationStatus

+ func (in *CapsuleConfigurationStatus) DeepCopyInto(out *CapsuleConfigurationStatus)

+ type CustomQuota struct

+ Spec CustomQuotaSpec

+ Status CustomQuotaStatus

+ func (in *CustomQuota) DeepCopy() *CustomQuota

+ func (in *CustomQuota) DeepCopyInto(out *CustomQuota)

+ func (in *CustomQuota) DeepCopyObject() runtime.Object

+ type CustomQuotaClaimItem struct

+ Usage resource.Quantity

+ func (in *CustomQuotaClaimItem) DeepCopy() *CustomQuotaClaimItem

+ func (in *CustomQuotaClaimItem) DeepCopyInto(out *CustomQuotaClaimItem)

+ type CustomQuotaList struct

+ Items []CustomQuota

+ func (in *CustomQuotaList) DeepCopy() *CustomQuotaList

+ func (in *CustomQuotaList) DeepCopyInto(out *CustomQuotaList)

+ func (in *CustomQuotaList) DeepCopyObject() runtime.Object

+ type CustomQuotaOptionsSpec struct

+ EmitPerClaimMetrics bool

+ func (in *CustomQuotaOptionsSpec) DeepCopy() *CustomQuotaOptionsSpec

+ func (in *CustomQuotaOptionsSpec) DeepCopyInto(out *CustomQuotaOptionsSpec)

+ type CustomQuotaSpec struct

+ Limit resource.Quantity

+ Options *CustomQuotaOptionsSpec

+ ScopeSelectors []metav1.LabelSelector

+ Sources []CustomQuotaSpecSource

+ func (c *CustomQuotaSpec) CollectJSONPathExpressions() (expressions []string)

+ func (in *CustomQuotaSpec) DeepCopy() *CustomQuotaSpec

+ func (in *CustomQuotaSpec) DeepCopyInto(out *CustomQuotaSpec)

+ type CustomQuotaSpecSource struct

+ func (in *CustomQuotaSpecSource) DeepCopy() *CustomQuotaSpecSource

+ func (in *CustomQuotaSpecSource) DeepCopyInto(out *CustomQuotaSpecSource)

+ type CustomQuotaSpecSourceConfig struct

+ Operation quota.Operation

+ Path string

+ Selectors []selectors.SelectorWithFields

+ func (in *CustomQuotaSpecSourceConfig) DeepCopy() *CustomQuotaSpecSourceConfig

+ func (in *CustomQuotaSpecSourceConfig) DeepCopyInto(out *CustomQuotaSpecSourceConfig)

+ type CustomQuotaStatus struct

+ Claims []CustomQuotaClaimItem

+ Conditions meta.ConditionList

+ Targets []CustomQuotaStatusTarget

+ Usage CustomQuotaStatusUsage

+ func (in *CustomQuotaStatus) DeepCopy() *CustomQuotaStatus

+ func (in *CustomQuotaStatus) DeepCopyInto(out *CustomQuotaStatus)

+ func (s *CustomQuotaStatus) HasClaimUID(uid types.UID) bool

+ type CustomQuotaStatusTarget struct

+ Scope k8smeta.RESTScopeName

+ func (in *CustomQuotaStatusTarget) DeepCopy() *CustomQuotaStatusTarget

+ func (in *CustomQuotaStatusTarget) DeepCopyInto(out *CustomQuotaStatusTarget)

+ type CustomQuotaStatusUsage struct

+ Available resource.Quantity

+ Used resource.Quantity

+ func (in *CustomQuotaStatusUsage) DeepCopy() *CustomQuotaStatusUsage

+ func (in *CustomQuotaStatusUsage) DeepCopyInto(out *CustomQuotaStatusUsage)

+ type DynamicAdmission struct

+ Mutating *DynamicMutatingAdmissionConfig

+ ServiceName string

+ Validating *DynamicValidatingAdmissionConfig

+ func (in *DynamicAdmission) DeepCopy() *DynamicAdmission

+ func (in *DynamicAdmission) DeepCopyInto(out *DynamicAdmission)

+ type DynamicMutatingAdmissionConfig struct

+ Webhooks []*admission.MutatingWebhook

+ func (in *DynamicMutatingAdmissionConfig) DeepCopy() *DynamicMutatingAdmissionConfig

+ func (in *DynamicMutatingAdmissionConfig) DeepCopyInto(out *DynamicMutatingAdmissionConfig)

+ type DynamicValidatingAdmissionConfig struct

+ Webhooks []*admission.ValidatingWebhook

+ func (in *DynamicValidatingAdmissionConfig) DeepCopy() *DynamicValidatingAdmissionConfig

+ func (in *DynamicValidatingAdmissionConfig) DeepCopyInto(out *DynamicValidatingAdmissionConfig)

+ type GlobalCustomQuota struct

+ Spec GlobalCustomQuotaSpec

+ Status GlobalCustomQuotaStatus

+ func (in *GlobalCustomQuota) DeepCopy() *GlobalCustomQuota

+ func (in *GlobalCustomQuota) DeepCopyInto(out *GlobalCustomQuota)

+ func (in *GlobalCustomQuota) DeepCopyObject() runtime.Object

+ type GlobalCustomQuotaList struct

+ Items []GlobalCustomQuota

+ func (in *GlobalCustomQuotaList) DeepCopy() *GlobalCustomQuotaList

+ func (in *GlobalCustomQuotaList) DeepCopyInto(out *GlobalCustomQuotaList)

+ func (in *GlobalCustomQuotaList) DeepCopyObject() runtime.Object

+ type GlobalCustomQuotaSpec struct

+ NamespaceSelectors []selectors.NamespaceSelector

+ func (in *GlobalCustomQuotaSpec) DeepCopy() *GlobalCustomQuotaSpec

+ func (in *GlobalCustomQuotaSpec) DeepCopyInto(out *GlobalCustomQuotaSpec)

+ type GlobalCustomQuotaStatus struct

+ Namespaces []string

+ func (g *GlobalCustomQuotaStatus) NamespacePresent(ns string) bool

+ func (in *GlobalCustomQuotaStatus) DeepCopy() *GlobalCustomQuotaStatus

+ func (in *GlobalCustomQuotaStatus) DeepCopyInto(out *GlobalCustomQuotaStatus)

type GlobalTenantResource

+ func (in *GlobalTenantResource) AssignTenants(tnts []Tenant)

type GlobalTenantResourceSpec

+ Scope api.ResourceScope

+ ServiceAccount *meta.NamespacedRFC1123ObjectReferenceWithNamespace

type NamespaceOptions

+ RequiredMetadata *RequiredMetadata

type Permissions

+ AllowOwnerPromotion bool

+ type QuantityLedger struct

+ Spec QuantityLedgerSpec

+ Status QuantityLedgerStatus

+ func (in *QuantityLedger) DeepCopy() *QuantityLedger

+ func (in *QuantityLedger) DeepCopyInto(out *QuantityLedger)

+ func (in *QuantityLedger) DeepCopyObject() runtime.Object

+ type QuantityLedgerList struct

+ Items []QuantityLedger

+ func (in *QuantityLedgerList) DeepCopy() *QuantityLedgerList

+ func (in *QuantityLedgerList) DeepCopyInto(out *QuantityLedgerList)

+ func (in *QuantityLedgerList) DeepCopyObject() runtime.Object

+ type QuantityLedgerObjectRef struct

+ APIGroup string

+ APIVersion string

+ Kind string

+ Name string

+ Namespace string

+ UID types.UID

+ func (in *QuantityLedgerObjectRef) DeepCopy() *QuantityLedgerObjectRef

+ func (in *QuantityLedgerObjectRef) DeepCopyInto(out *QuantityLedgerObjectRef)

+ type QuantityLedgerPendingDelete struct

+ CreatedAt metav1.Time

+ ObjectRef QuantityLedgerObjectRef

+ func (in *QuantityLedgerPendingDelete) DeepCopy() *QuantityLedgerPendingDelete

+ func (in *QuantityLedgerPendingDelete) DeepCopyInto(out *QuantityLedgerPendingDelete)

+ type QuantityLedgerReservation struct

+ CreatedAt metav1.Time

+ ExpiresAt *metav1.Time

+ ID string

+ ObjectRef QuantityLedgerObjectRef

+ UpdatedAt metav1.Time

+ Usage resource.Quantity

+ func (in *QuantityLedgerReservation) DeepCopy() *QuantityLedgerReservation

+ func (in *QuantityLedgerReservation) DeepCopyInto(out *QuantityLedgerReservation)

+ type QuantityLedgerSpec struct

+ TargetRef QuantityLedgerTargetRef

+ func (in *QuantityLedgerSpec) DeepCopy() *QuantityLedgerSpec

+ func (in *QuantityLedgerSpec) DeepCopyInto(out *QuantityLedgerSpec)

+ type QuantityLedgerStatus struct

+ Allocated resource.Quantity

+ Conditions meta.ConditionList

+ PendingDeletes []QuantityLedgerPendingDelete

+ Reservations []QuantityLedgerReservation

+ Reserved resource.Quantity

+ func (in *QuantityLedgerStatus) DeepCopy() *QuantityLedgerStatus

+ func (in *QuantityLedgerStatus) DeepCopyInto(out *QuantityLedgerStatus)

+ type QuantityLedgerTargetRef struct

+ APIGroup string

+ Kind string

+ Name string

+ Namespace string

+ UID types.UID

+ func (in *QuantityLedgerTargetRef) DeepCopy() *QuantityLedgerTargetRef

+ func (in *QuantityLedgerTargetRef) DeepCopyInto(out *QuantityLedgerTargetRef)

+ type RBACConfiguration struct

+ AdministrationClusterRoles []string

+ DeleterClusterRole string

+ PromotionClusterRoles []string

+ ProvisionerClusterRole string

+ func (in *RBACConfiguration) DeepCopy() *RBACConfiguration

+ func (in *RBACConfiguration) DeepCopyInto(out *RBACConfiguration)

+ type RequiredMetadata struct

+ Annotations map[string]string

+ Labels map[string]string

+ func (in *RequiredMetadata) DeepCopy() *RequiredMetadata

+ func (in *RequiredMetadata) DeepCopyInto(out *RequiredMetadata)

type ResourcePoolClaim

+ func (r *ResourcePoolClaim) GetPool() string

+ func (r *ResourcePoolClaim) IsAssignedInResourcePool() bool

+ func (r *ResourcePoolClaim) IsBoundInResourcePool() bool

+ func (r *ResourcePoolClaim) IsExhaustedInResourcePool() bool

type ResourcePoolClaimStatus

+ Allocation ResourcePoolQuotaStatus

+ Conditions meta.ConditionList

type ResourcePoolStatus

+ Conditions meta.ConditionList

type ResourceSpec

+ Context *tpl.TemplateContext

+ Generators []TemplateItemSpec

+ type RuleStatus struct

+ Spec []*api.NamespaceRuleBodyNamespace

+ Status RuleStatusSpec

+ func (in *RuleStatus) DeepCopy() *RuleStatus

+ func (in *RuleStatus) DeepCopyInto(out *RuleStatus)

+ func (in *RuleStatus) DeepCopyObject() runtime.Object

+ type RuleStatusList struct

+ Items []RuleStatus

+ func (in *RuleStatusList) DeepCopy() *RuleStatusList

+ func (in *RuleStatusList) DeepCopyInto(out *RuleStatusList)

+ func (in *RuleStatusList) DeepCopyObject() runtime.Object

+ type RuleStatusSpec struct

+ Conditions meta.ConditionList

+ Rule api.NamespaceRuleBodyNamespace

+ func (in *RuleStatusSpec) DeepCopy() *RuleStatusSpec

+ func (in *RuleStatusSpec) DeepCopyInto(out *RuleStatusSpec)

+ type ServiceAccountClient struct

+ CASecretKey string

+ CASecretName meta.RFC1123Name

+ CASecretNamespace meta.RFC1123SubdomainName

+ Endpoint string

+ GlobalDefaultServiceAccount meta.RFC1123Name

+ GlobalDefaultServiceAccountNamespace meta.RFC1123SubdomainName

+ SkipTLSVerify bool

+ TenantDefaultServiceAccount meta.RFC1123Name

+ func (in *ServiceAccountClient) DeepCopy() *ServiceAccountClient

+ func (in *ServiceAccountClient) DeepCopyInto(out *ServiceAccountClient)

+ type TemplateItemSpec struct

+ MissingKey tpl.MissingKeyOption

+ Template string

+ func (in *TemplateItemSpec) DeepCopy() *TemplateItemSpec

+ func (in *TemplateItemSpec) DeepCopyInto(out *TemplateItemSpec)

type Tenant

+ func (in *Tenant) GetNamespaceObjects(ctx context.Context, c client.Reader) (namespaces []corev1.Namespace, err error)

+ func (in *Tenant) GetPromotionRoleBindings() []rbac.AdditionalRoleBindingsWithNamespaceSpec

+ func (in *Tenant) GetRoleBindings() []rbac.AdditionalRoleBindingsSpec

type TenantOwnerSpec

+ Aggregate bool

+ type TenantResourceCommonSpec struct

+ Cordoned *bool

+ DependsOn []meta.LocalRFC1123ObjectReference

+ PruningOnDelete *bool

+ Resources []ResourceSpec

+ ResyncPeriod metav1.Duration

+ Settings TenantResourceCommonSpecSettings

+ func (in *TenantResourceCommonSpec) DeepCopy() *TenantResourceCommonSpec

+ func (in *TenantResourceCommonSpec) DeepCopyInto(out *TenantResourceCommonSpec)

+ type TenantResourceCommonSpecSettings struct

+ Adopt *bool

+ Force *bool

+ func (in *TenantResourceCommonSpecSettings) DeepCopy() *TenantResourceCommonSpecSettings

+ func (in *TenantResourceCommonSpecSettings) DeepCopyInto(out *TenantResourceCommonSpecSettings)

+ type TenantResourceCommonStatus struct

+ Conditions meta.ConditionList

+ ProcessedItems meta.ProcessedItems

+ ServiceAccount *meta.NamespacedRFC1123ObjectReferenceWithNamespace

+ Size uint

+ func (in *TenantResourceCommonStatus) DeepCopy() *TenantResourceCommonStatus

+ func (in *TenantResourceCommonStatus) DeepCopyInto(out *TenantResourceCommonStatus)

+ func (s *TenantResourceCommonStatus) UpdateStats()

type TenantResourceSpec

+ ServiceAccount *meta.LocalRFC1123ObjectReference

type TenantSpec

+ Data apiextensionsv1.JSON

+ Rules []*api.NamespaceRuleBodyTenant

type TenantStatus

+ Promotions rbac.PromotionStatusListSpec

+ type TenantStatusNamespaceEnforcement struct

+ Registries []api.OCIRegistry

+ func (in *TenantStatusNamespaceEnforcement) DeepCopy() *TenantStatusNamespaceEnforcement

+ func (in *TenantStatusNamespaceEnforcement) DeepCopyInto(out *TenantStatusNamespaceEnforcement)

type TenantStatusNamespaceItem

+ Enforce TenantStatusNamespaceEnforcement

+ type TenantStatusRuleStatusItem struct

+ Promotions rbac.OwnerStatusListSpec

+ TargetNamespaces []meta.RFC1123SubdomainName

+ func (in *TenantStatusRuleStatusItem) DeepCopy() *TenantStatusRuleStatusItem

+ func (in *TenantStatusRuleStatusItem) DeepCopyInto(out *TenantStatusRuleStatusItem)

Dec 19, 2025 GO-2024-3077 +2 more

  GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

  GO-2026-5043: Capsule Namespace Hijacking via subresource in github.com/projectcapsule/capsule

  GO-2026-5584: Capsule TenantResource RawItems Cluster-Scoped Resource Creation Vulnerability in github.com/projectcapsule/capsule

Dec 11, 2025 GO-2024-3077 +2 more

  GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

  GO-2026-5043: Capsule Namespace Hijacking via subresource in github.com/projectcapsule/capsule

  GO-2026-5584: Capsule TenantResource RawItems Cluster-Scoped Resource Creation Vulnerability in github.com/projectcapsule/capsule

Dec 10, 2025 GO-2024-3077 +2 more

  GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

  GO-2026-5043: Capsule Namespace Hijacking via subresource in github.com/projectcapsule/capsule

  GO-2026-5584: Capsule TenantResource RawItems Cluster-Scoped Resource Creation Vulnerability in github.com/projectcapsule/capsule

Dec 9, 2025 GO-2024-3077 +2 more

  GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

  GO-2026-5043: Capsule Namespace Hijacking via subresource in github.com/projectcapsule/capsule

  GO-2026-5584: Capsule TenantResource RawItems Cluster-Scoped Resource Creation Vulnerability in github.com/projectcapsule/capsule

Dec 5, 2025 GO-2024-3077 +2 more

  GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

  GO-2026-5043: Capsule Namespace Hijacking via subresource in github.com/projectcapsule/capsule

  GO-2026-5584: Capsule TenantResource RawItems Cluster-Scoped Resource Creation Vulnerability in github.com/projectcapsule/capsule

Changes in this version

type CapsuleConfigurationSpec

+ Administrators api.UserListSpec

+ Users api.UserListSpec

+ type Permissions struct

+ MatchOwners []*metav1.LabelSelector

+ func (in *Permissions) DeepCopy() *Permissions

+ func (in *Permissions) DeepCopyInto(out *Permissions)

+ func (p *Permissions) ListMatchingOwners(ctx context.Context, c client.Client, opts ...client.ListOption) ([]*TenantOwner, error)

type ResourcePool

+ func (r *ResourcePool) GetQuotaName() string

type Tenant

+ func (in *Tenant) CollectOwners(ctx context.Context, c client.Client, allowPromotion bool, ...) (api.OwnerStatusListSpec, error)

+ type TenantAvailableClassesStatus struct

+ DeviceClasses []string

+ GatewayClasses []string

+ PriorityClasses []string

+ RuntimeClasses []string

+ StorageClasses []string

+ func (in *TenantAvailableClassesStatus) DeepCopy() *TenantAvailableClassesStatus

+ func (in *TenantAvailableClassesStatus) DeepCopyInto(out *TenantAvailableClassesStatus)

+ type TenantAvailableStatus struct

+ Classes TenantAvailableClassesStatus

+ func (in *TenantAvailableStatus) DeepCopy() *TenantAvailableStatus

+ func (in *TenantAvailableStatus) DeepCopyInto(out *TenantAvailableStatus)

+ type TenantOwner struct

+ Spec TenantOwnerSpec

+ Status TenantOwnerStatus

+ func (in *TenantOwner) DeepCopy() *TenantOwner

+ func (in *TenantOwner) DeepCopyInto(out *TenantOwner)

+ func (in *TenantOwner) DeepCopyObject() runtime.Object

+ type TenantOwnerList struct

+ Items []TenantOwner

+ func (in *TenantOwnerList) DeepCopy() *TenantOwnerList

+ func (in *TenantOwnerList) DeepCopyInto(out *TenantOwnerList)

+ func (in *TenantOwnerList) DeepCopyObject() runtime.Object

+ type TenantOwnerSpec struct

+ func (in *TenantOwnerSpec) DeepCopy() *TenantOwnerSpec

+ func (in *TenantOwnerSpec) DeepCopyInto(out *TenantOwnerSpec)

+ type TenantOwnerStatus struct

+ func (in *TenantOwnerStatus) DeepCopy() *TenantOwnerStatus

+ func (in *TenantOwnerStatus) DeepCopyInto(out *TenantOwnerStatus)

type TenantSpec

+ DeviceClasses *api.SelectorAllowedListSpec

+ Permissions Permissions

type TenantStatus

+ Owners api.OwnerStatusListSpec

Oct 26, 2025 GO-2024-3077 +2 more

  GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

  GO-2026-5043: Capsule Namespace Hijacking via subresource in github.com/projectcapsule/capsule

  GO-2026-5584: Capsule TenantResource RawItems Cluster-Scoped Resource Creation Vulnerability in github.com/projectcapsule/capsule

Oct 23, 2025 GO-2024-3077 +2 more

  GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

  GO-2026-5043: Capsule Namespace Hijacking via subresource in github.com/projectcapsule/capsule

  GO-2026-5584: Capsule TenantResource RawItems Cluster-Scoped Resource Creation Vulnerability in github.com/projectcapsule/capsule

Oct 20, 2025 GO-2024-3077 +2 more

  GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

  GO-2026-5043: Capsule Namespace Hijacking via subresource in github.com/projectcapsule/capsule

  GO-2026-5584: Capsule TenantResource RawItems Cluster-Scoped Resource Creation Vulnerability in github.com/projectcapsule/capsule

Changes in this version

type CapsuleConfigurationSpec

+ AllowServiceAccountPromotion bool

type NamespaceOptions

+ ManagedMetadataOnly bool

type OwnerSpec

+ Annotations map[string]string

+ Labels map[string]string

type TenantStatus

+ Conditions meta.ConditionList

+ Spaces []*TenantStatusNamespaceItem

+ func (ms *TenantStatus) GetInstance(stat *TenantStatusNamespaceItem) *TenantStatusNamespaceItem

+ func (ms *TenantStatus) RemoveInstance(stat *TenantStatusNamespaceItem)

+ func (ms *TenantStatus) UpdateInstance(stat *TenantStatusNamespaceItem)

+ type TenantStatusNamespaceItem struct

+ Conditions meta.ConditionList

+ Metadata *TenantStatusNamespaceMetadata

+ Name string

+ UID k8stypes.UID

+ func (in *TenantStatusNamespaceItem) DeepCopy() *TenantStatusNamespaceItem

+ func (in *TenantStatusNamespaceItem) DeepCopyInto(out *TenantStatusNamespaceItem)

+ type TenantStatusNamespaceMetadata struct

+ Annotations map[string]string

+ Labels map[string]string

+ func (in *TenantStatusNamespaceMetadata) DeepCopy() *TenantStatusNamespaceMetadata

+ func (in *TenantStatusNamespaceMetadata) DeepCopyInto(out *TenantStatusNamespaceMetadata)

Sep 4, 2025 GO-2024-3077 +2 more

  GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

  GO-2026-5043: Capsule Namespace Hijacking via subresource in github.com/projectcapsule/capsule

  GO-2026-5584: Capsule TenantResource RawItems Cluster-Scoped Resource Creation Vulnerability in github.com/projectcapsule/capsule

Aug 25, 2025 GO-2024-3077 +2 more

  GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

  GO-2026-5043: Capsule Namespace Hijacking via subresource in github.com/projectcapsule/capsule

  GO-2026-5584: Capsule TenantResource RawItems Cluster-Scoped Resource Creation Vulnerability in github.com/projectcapsule/capsule

Aug 22, 2025 GO-2024-3077 +2 more

  GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

  GO-2026-5043: Capsule Namespace Hijacking via subresource in github.com/projectcapsule/capsule

  GO-2026-5584: Capsule TenantResource RawItems Cluster-Scoped Resource Creation Vulnerability in github.com/projectcapsule/capsule

Changes in this version

type CapsuleConfigurationSpec

+ UserNames []string

Aug 20, 2025 GO-2024-3077 +2 more

  GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

  GO-2026-5043: Capsule Namespace Hijacking via subresource in github.com/projectcapsule/capsule

  GO-2026-5584: Capsule TenantResource RawItems Cluster-Scoped Resource Creation Vulnerability in github.com/projectcapsule/capsule

Aug 18, 2025 GO-2024-3077 +2 more

  GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

  GO-2026-5043: Capsule Namespace Hijacking via subresource in github.com/projectcapsule/capsule

  GO-2026-5584: Capsule TenantResource RawItems Cluster-Scoped Resource Creation Vulnerability in github.com/projectcapsule/capsule

Changes in this version

type CapsuleConfigurationSpec

+ IgnoreUserWithGroups []string

Aug 14, 2025 GO-2024-3077 +2 more

  GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

  GO-2026-5043: Capsule Namespace Hijacking via subresource in github.com/projectcapsule/capsule

  GO-2026-5584: Capsule TenantResource RawItems Cluster-Scoped Resource Creation Vulnerability in github.com/projectcapsule/capsule

Aug 1, 2025 GO-2024-3077 +3 more

  GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

  GO-2025-3893: Capsule tenant owners with "patch namespace" permission can hijack system namespaces label in github.com/projectcapsule/capsule

  GO-2026-5043: Capsule Namespace Hijacking via subresource in github.com/projectcapsule/capsule

  GO-2026-5584: Capsule TenantResource RawItems Cluster-Scoped Resource Creation Vulnerability in github.com/projectcapsule/capsule

Jul 21, 2025 GO-2024-3077 +3 more

  GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

  GO-2025-3893: Capsule tenant owners with "patch namespace" permission can hijack system namespaces label in github.com/projectcapsule/capsule

  GO-2026-5043: Capsule Namespace Hijacking via subresource in github.com/projectcapsule/capsule

  GO-2026-5584: Capsule TenantResource RawItems Cluster-Scoped Resource Creation Vulnerability in github.com/projectcapsule/capsule

Jul 1, 2025 GO-2024-3077 +3 more

  GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

  GO-2025-3893: Capsule tenant owners with "patch namespace" permission can hijack system namespaces label in github.com/projectcapsule/capsule

  GO-2026-5043: Capsule Namespace Hijacking via subresource in github.com/projectcapsule/capsule

  GO-2026-5584: Capsule TenantResource RawItems Cluster-Scoped Resource Creation Vulnerability in github.com/projectcapsule/capsule

Changes in this version

type ResourcePoolStatus

+ Exhaustions map[string]api.PoolExhaustionResource

May 22, 2025 GO-2024-3077 +3 more

  GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

  GO-2025-3893: Capsule tenant owners with "patch namespace" permission can hijack system namespaces label in github.com/projectcapsule/capsule

  GO-2026-5043: Capsule Namespace Hijacking via subresource in github.com/projectcapsule/capsule

  GO-2026-5584: Capsule TenantResource RawItems Cluster-Scoped Resource Creation Vulnerability in github.com/projectcapsule/capsule

Changes in this version

+ type GatewayOptions struct

+ AllowedClasses *api.SelectionListWithDefaultSpec

+ func (in *GatewayOptions) DeepCopy() *GatewayOptions

+ func (in *GatewayOptions) DeepCopyInto(out *GatewayOptions)

+ type ResourcePool struct

+ Spec ResourcePoolSpec

+ Status ResourcePoolStatus

+ func (in *ResourcePool) DeepCopy() *ResourcePool

+ func (in *ResourcePool) DeepCopyInto(out *ResourcePool)

+ func (in *ResourcePool) DeepCopyObject() runtime.Object

+ func (r *ResourcePool) AddClaimToStatus(claim *ResourcePoolClaim)

+ func (r *ResourcePool) AssignClaims()

+ func (r *ResourcePool) AssignNamespaces(namespaces []corev1.Namespace)

+ func (r *ResourcePool) CalculateAvailableResources()

+ func (r *ResourcePool) CalculateClaimedResources()

+ func (r *ResourcePool) CanClaimFromPool(claim corev1.ResourceList) []error

+ func (r *ResourcePool) GetAvailableClaimableResources() corev1.ResourceList

+ func (r *ResourcePool) GetClaimFromStatus(cl *ResourcePoolClaim) *ResourcePoolClaimsItem

+ func (r *ResourcePool) GetClaimedByNamespaceClaims() (claims map[string]corev1.ResourceList)

+ func (r *ResourcePool) GetNamespaceClaims(namespace string) (claims map[string]*ResourcePoolClaimsItem, ...)

+ func (r *ResourcePool) GetResourceQuotaHardResources(namespace string) corev1.ResourceList

+ func (r *ResourcePool) RemoveClaimFromStatus(claim *ResourcePoolClaim)

+ type ResourcePoolClaim struct

+ Spec ResourcePoolClaimSpec

+ Status ResourcePoolClaimStatus

+ func (in *ResourcePoolClaim) DeepCopy() *ResourcePoolClaim

+ func (in *ResourcePoolClaim) DeepCopyInto(out *ResourcePoolClaim)

+ func (in *ResourcePoolClaim) DeepCopyObject() runtime.Object

+ func (r *ResourcePoolClaim) IsBoundToResourcePool() bool

+ type ResourcePoolClaimList struct

+ Items []ResourcePoolClaim

+ func (in *ResourcePoolClaimList) DeepCopy() *ResourcePoolClaimList

+ func (in *ResourcePoolClaimList) DeepCopyInto(out *ResourcePoolClaimList)

+ func (in *ResourcePoolClaimList) DeepCopyObject() runtime.Object

+ type ResourcePoolClaimSpec struct

+ Pool string

+ ResourceClaims corev1.ResourceList

+ func (in *ResourcePoolClaimSpec) DeepCopy() *ResourcePoolClaimSpec

+ func (in *ResourcePoolClaimSpec) DeepCopyInto(out *ResourcePoolClaimSpec)

+ type ResourcePoolClaimStatus struct

+ Condition metav1.Condition

+ Pool api.StatusNameUID

+ func (in *ResourcePoolClaimStatus) DeepCopy() *ResourcePoolClaimStatus

+ func (in *ResourcePoolClaimStatus) DeepCopyInto(out *ResourcePoolClaimStatus)

+ type ResourcePoolClaimsItem struct

+ Claims corev1.ResourceList

+ func (in *ResourcePoolClaimsItem) DeepCopy() *ResourcePoolClaimsItem

+ func (in *ResourcePoolClaimsItem) DeepCopyInto(out *ResourcePoolClaimsItem)

+ type ResourcePoolClaimsList []*ResourcePoolClaimsItem

+ func (in ResourcePoolClaimsList) DeepCopy() ResourcePoolClaimsList

+ func (in ResourcePoolClaimsList) DeepCopyInto(out *ResourcePoolClaimsList)

+ func (r *ResourcePoolClaimsList) GetClaimByUID(uid types.UID) *ResourcePoolClaimsItem

+ type ResourcePoolList struct

+ Items []ResourcePool

+ func (in *ResourcePoolList) DeepCopy() *ResourcePoolList

+ func (in *ResourcePoolList) DeepCopyInto(out *ResourcePoolList)

+ func (in *ResourcePoolList) DeepCopyObject() runtime.Object

+ type ResourcePoolNamespaceClaimsStatus map[string]ResourcePoolClaimsList

+ func (in ResourcePoolNamespaceClaimsStatus) DeepCopy() ResourcePoolNamespaceClaimsStatus

+ func (in ResourcePoolNamespaceClaimsStatus) DeepCopyInto(out *ResourcePoolNamespaceClaimsStatus)

+ type ResourcePoolQuotaStatus struct

+ Available corev1.ResourceList

+ Claimed corev1.ResourceList

+ Hard corev1.ResourceList

+ func (in *ResourcePoolQuotaStatus) DeepCopy() *ResourcePoolQuotaStatus

+ func (in *ResourcePoolQuotaStatus) DeepCopyInto(out *ResourcePoolQuotaStatus)

+ type ResourcePoolSpec struct

+ Config ResourcePoolSpecConfiguration

+ Defaults corev1.ResourceList

+ Quota corev1.ResourceQuotaSpec

+ Selectors []api.NamespaceSelector

+ func (in *ResourcePoolSpec) DeepCopy() *ResourcePoolSpec

+ func (in *ResourcePoolSpec) DeepCopyInto(out *ResourcePoolSpec)

+ type ResourcePoolSpecConfiguration struct

+ DefaultsAssignZero *bool

+ DeleteBoundResources *bool

+ OrderedQueue *bool

+ func (in *ResourcePoolSpecConfiguration) DeepCopy() *ResourcePoolSpecConfiguration

+ func (in *ResourcePoolSpecConfiguration) DeepCopyInto(out *ResourcePoolSpecConfiguration)

+ type ResourcePoolStatus struct

+ Allocation ResourcePoolQuotaStatus

+ ClaimSize uint

+ Claims ResourcePoolNamespaceClaimsStatus

+ NamespaceSize uint

+ Namespaces []string

+ func (in *ResourcePoolStatus) DeepCopy() *ResourcePoolStatus

+ func (in *ResourcePoolStatus) DeepCopyInto(out *ResourcePoolStatus)

type TenantSpec

+ GatewayOptions GatewayOptions

May 9, 2025 GO-2024-3077 +3 more

  GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

  GO-2025-3893: Capsule tenant owners with "patch namespace" permission can hijack system namespaces label in github.com/projectcapsule/capsule

  GO-2026-5043: Capsule Namespace Hijacking via subresource in github.com/projectcapsule/capsule

  GO-2026-5584: Capsule TenantResource RawItems Cluster-Scoped Resource Creation Vulnerability in github.com/projectcapsule/capsule

Changes in this version

type NamespaceOptions

+ AdditionalMetadataList []api.AdditionalMetadataSelectorSpec

May 1, 2025 GO-2024-3077 +3 more

  GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

  GO-2025-3893: Capsule tenant owners with "patch namespace" permission can hijack system namespaces label in github.com/projectcapsule/capsule

  GO-2026-5043: Capsule Namespace Hijacking via subresource in github.com/projectcapsule/capsule

  GO-2026-5584: Capsule TenantResource RawItems Cluster-Scoped Resource Creation Vulnerability in github.com/projectcapsule/capsule

Apr 30, 2025 GO-2024-3077 +3 more

  GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

  GO-2025-3893: Capsule tenant owners with "patch namespace" permission can hijack system namespaces label in github.com/projectcapsule/capsule

  GO-2026-5043: Capsule Namespace Hijacking via subresource in github.com/projectcapsule/capsule

  GO-2026-5584: Capsule TenantResource RawItems Cluster-Scoped Resource Creation Vulnerability in github.com/projectcapsule/capsule

Feb 10, 2025 GO-2024-3077 +3 more

  GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

  GO-2025-3893: Capsule tenant owners with "patch namespace" permission can hijack system namespaces label in github.com/projectcapsule/capsule

  GO-2026-5043: Capsule Namespace Hijacking via subresource in github.com/projectcapsule/capsule

  GO-2026-5584: Capsule TenantResource RawItems Cluster-Scoped Resource Creation Vulnerability in github.com/projectcapsule/capsule

Feb 5, 2025 GO-2024-3077 +3 more

  GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

  GO-2025-3893: Capsule tenant owners with "patch namespace" permission can hijack system namespaces label in github.com/projectcapsule/capsule

  GO-2026-5043: Capsule Namespace Hijacking via subresource in github.com/projectcapsule/capsule

  GO-2026-5584: Capsule TenantResource RawItems Cluster-Scoped Resource Creation Vulnerability in github.com/projectcapsule/capsule

Changes in this version

type TenantSpec

+ ForceTenantPrefix *bool

Oct 23, 2024 GO-2024-3077 +3 more

  GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

  GO-2025-3893: Capsule tenant owners with "patch namespace" permission can hijack system namespaces label in github.com/projectcapsule/capsule

  GO-2026-5043: Capsule Namespace Hijacking via subresource in github.com/projectcapsule/capsule

  GO-2026-5584: Capsule TenantResource RawItems Cluster-Scoped Resource Creation Vulnerability in github.com/projectcapsule/capsule

Changes in this version

type Tenant

+ func (in *Tenant) GetClusterRolesBySubject(ignoreOwnerKind []OwnerKind) (maps map[string]map[string]api.TenantSubjectRoles)

+ func (in *Tenant) GetSubjectsByClusterRoles(ignoreOwnerKind []OwnerKind) (rolePerms map[string][]rbacv1.Subject)

Aug 25, 2024 GO-2024-3077 +3 more

  GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

  GO-2025-3893: Capsule tenant owners with "patch namespace" permission can hijack system namespaces label in github.com/projectcapsule/capsule

  GO-2026-5043: Capsule Namespace Hijacking via subresource in github.com/projectcapsule/capsule

  GO-2026-5584: Capsule TenantResource RawItems Cluster-Scoped Resource Creation Vulnerability in github.com/projectcapsule/capsule

Jun 24, 2024 GO-2024-3077 +3 more

  GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

  GO-2025-3893: Capsule tenant owners with "patch namespace" permission can hijack system namespaces label in github.com/projectcapsule/capsule

  GO-2026-5043: Capsule Namespace Hijacking via subresource in github.com/projectcapsule/capsule

  GO-2026-5584: Capsule TenantResource RawItems Cluster-Scoped Resource Creation Vulnerability in github.com/projectcapsule/capsule

May 14, 2024 GO-2024-3077 +3 more

  GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

  GO-2025-3893: Capsule tenant owners with "patch namespace" permission can hijack system namespaces label in github.com/projectcapsule/capsule

  GO-2026-5043: Capsule Namespace Hijacking via subresource in github.com/projectcapsule/capsule

  GO-2026-5584: Capsule TenantResource RawItems Cluster-Scoped Resource Creation Vulnerability in github.com/projectcapsule/capsule

Mar 28, 2024 GO-2024-3077 +3 more

  GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

  GO-2025-3893: Capsule tenant owners with "patch namespace" permission can hijack system namespaces label in github.com/projectcapsule/capsule

  GO-2026-5043: Capsule Namespace Hijacking via subresource in github.com/projectcapsule/capsule

  GO-2026-5584: Capsule TenantResource RawItems Cluster-Scoped Resource Creation Vulnerability in github.com/projectcapsule/capsule

Feb 27, 2024 GO-2024-3077 +3 more

  GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

  GO-2025-3893: Capsule tenant owners with "patch namespace" permission can hijack system namespaces label in github.com/projectcapsule/capsule

  GO-2026-5043: Capsule Namespace Hijacking via subresource in github.com/projectcapsule/capsule

  GO-2026-5584: Capsule TenantResource RawItems Cluster-Scoped Resource Creation Vulnerability in github.com/projectcapsule/capsule

Feb 27, 2024 GO-2024-3077 +3 more

  GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

  GO-2025-3893: Capsule tenant owners with "patch namespace" permission can hijack system namespaces label in github.com/projectcapsule/capsule

  GO-2026-5043: Capsule Namespace Hijacking via subresource in github.com/projectcapsule/capsule

  GO-2026-5584: Capsule TenantResource RawItems Cluster-Scoped Resource Creation Vulnerability in github.com/projectcapsule/capsule

Feb 18, 2024 GO-2024-3077 +3 more

  GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

  GO-2025-3893: Capsule tenant owners with "patch namespace" permission can hijack system namespaces label in github.com/projectcapsule/capsule

  GO-2026-5043: Capsule Namespace Hijacking via subresource in github.com/projectcapsule/capsule

  GO-2026-5584: Capsule TenantResource RawItems Cluster-Scoped Resource Creation Vulnerability in github.com/projectcapsule/capsule

Dec 7, 2023 GO-2024-3077 +3 more

  GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

  GO-2025-3893: Capsule tenant owners with "patch namespace" permission can hijack system namespaces label in github.com/projectcapsule/capsule

  GO-2026-5043: Capsule Namespace Hijacking via subresource in github.com/projectcapsule/capsule

  GO-2026-5584: Capsule TenantResource RawItems Cluster-Scoped Resource Creation Vulnerability in github.com/projectcapsule/capsule

Changes in this version

+ const TenantProxy

type TenantSpec

+ PodOptions *api.PodOptions

Nov 21, 2023 GO-2024-3077 +3 more

  GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

  GO-2025-3893: Capsule tenant owners with "patch namespace" permission can hijack system namespaces label in github.com/projectcapsule/capsule

  GO-2026-5043: Capsule Namespace Hijacking via subresource in github.com/projectcapsule/capsule

  GO-2026-5584: Capsule TenantResource RawItems Cluster-Scoped Resource Creation Vulnerability in github.com/projectcapsule/capsule

Changes in this version

+ const HardCapsuleQuotaAnnotation

+ const UsedCapsuleQuotaAnnotation

Nov 9, 2023 GO-2024-3077 +3 more

  GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

  GO-2025-3893: Capsule tenant owners with "patch namespace" permission can hijack system namespaces label in github.com/projectcapsule/capsule

  GO-2026-5043: Capsule Namespace Hijacking via subresource in github.com/projectcapsule/capsule

  GO-2026-5584: Capsule TenantResource RawItems Cluster-Scoped Resource Creation Vulnerability in github.com/projectcapsule/capsule

Nov 6, 2023 GO-2024-3077 +3 more

  GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

  GO-2025-3893: Capsule tenant owners with "patch namespace" permission can hijack system namespaces label in github.com/projectcapsule/capsule

  GO-2026-5043: Capsule Namespace Hijacking via subresource in github.com/projectcapsule/capsule

  GO-2026-5584: Capsule TenantResource RawItems Cluster-Scoped Resource Creation Vulnerability in github.com/projectcapsule/capsule

Changes in this version

+ const DeleteOperation

+ const GroupOwner

+ const IngressClassesProxy

+ const ListOperation

+ const NodesProxy

+ const PersistentVolumesProxy

+ const PriorityClassesProxy

+ const ResourceQuotaAnnotationPrefix

+ const ResourceUsedAnnotationPrefix

+ const RuntimeClassesProxy

+ const ServiceAccountOwner

+ const StorageClassesProxy

+ const TenantStateActive

+ const TenantStateCordoned

+ const UpdateOperation

+ const UserOwner

+ var AddToScheme = SchemeBuilder.AddToScheme

+ var GroupVersion = schema.GroupVersion

+ var SchemeBuilder = &scheme.Builder

+ func GetLimitResourceFromTenant(tenant Tenant, kindGroup string) (int64, error)

+ func GetTypeLabel(t metav1.Object) (label string, err error)

+ func GetUsedResourceFromTenant(tenant Tenant, kindGroup string) (int64, error)

+ func HardQuotaFor(resource fmt.Stringer) (string, error)

+ func LimitAnnotationForResource(kindGroup string) string

+ func UsedAnnotationForResource(kindGroup string) string

+ func UsedQuotaFor(resource fmt.Stringer) (string, error)

+ type AdditionalRoleBindingsSpec struct

+ ClusterRoleName string

+ Subjects []rbacv1.Subject

+ func (in *AdditionalRoleBindingsSpec) DeepCopy() *AdditionalRoleBindingsSpec

+ func (in *AdditionalRoleBindingsSpec) DeepCopyInto(out *AdditionalRoleBindingsSpec)

+ type ByKindAndName OwnerListSpec

+ func (b ByKindAndName) Len() int

+ func (b ByKindAndName) Less(i, j int) bool

+ func (b ByKindAndName) Swap(i, j int)

+ func (in ByKindAndName) DeepCopy() ByKindAndName

+ func (in ByKindAndName) DeepCopyInto(out *ByKindAndName)

+ type CapsuleConfiguration struct

+ Spec CapsuleConfigurationSpec

+ func (in *CapsuleConfiguration) ConvertFrom(raw conversion.Hub) error

+ func (in *CapsuleConfiguration) ConvertTo(raw conversion.Hub) error

+ func (in *CapsuleConfiguration) DeepCopy() *CapsuleConfiguration

+ func (in *CapsuleConfiguration) DeepCopyInto(out *CapsuleConfiguration)

+ func (in *CapsuleConfiguration) DeepCopyObject() runtime.Object

+ type CapsuleConfigurationList struct

+ Items []CapsuleConfiguration

+ func (in *CapsuleConfigurationList) DeepCopy() *CapsuleConfigurationList

+ func (in *CapsuleConfigurationList) DeepCopyInto(out *CapsuleConfigurationList)

+ func (in *CapsuleConfigurationList) DeepCopyObject() runtime.Object

+ type CapsuleConfigurationSpec struct

+ CapsuleResources CapsuleResources

+ EnableTLSReconciler bool

+ ForceTenantPrefix bool

+ NodeMetadata *NodeMetadata

+ ProtectedNamespaceRegexpString string

+ UserGroups []string

+ func (in *CapsuleConfigurationSpec) DeepCopy() *CapsuleConfigurationSpec

+ func (in *CapsuleConfigurationSpec) DeepCopyInto(out *CapsuleConfigurationSpec)

+ type CapsuleResources struct

+ MutatingWebhookConfigurationName string

+ TLSSecretName string

+ ValidatingWebhookConfigurationName string

+ func (in *CapsuleResources) DeepCopy() *CapsuleResources

+ func (in *CapsuleResources) DeepCopyInto(out *CapsuleResources)

+ type GlobalTenantResource struct

+ Spec GlobalTenantResourceSpec

+ Status GlobalTenantResourceStatus

+ func (in *GlobalTenantResource) DeepCopy() *GlobalTenantResource

+ func (in *GlobalTenantResource) DeepCopyInto(out *GlobalTenantResource)

+ func (in *GlobalTenantResource) DeepCopyObject() runtime.Object

+ type GlobalTenantResourceList struct

+ Items []GlobalTenantResource

+ func (in *GlobalTenantResourceList) DeepCopy() *GlobalTenantResourceList

+ func (in *GlobalTenantResourceList) DeepCopyInto(out *GlobalTenantResourceList)

+ func (in *GlobalTenantResourceList) DeepCopyObject() runtime.Object

+ type GlobalTenantResourceSpec struct

+ TenantSelector metav1.LabelSelector

+ func (in *GlobalTenantResourceSpec) DeepCopy() *GlobalTenantResourceSpec

+ func (in *GlobalTenantResourceSpec) DeepCopyInto(out *GlobalTenantResourceSpec)

+ type GlobalTenantResourceStatus struct

+ ProcessedItems ProcessedItems

+ SelectedTenants []string

+ func (in *GlobalTenantResourceStatus) DeepCopy() *GlobalTenantResourceStatus

+ func (in *GlobalTenantResourceStatus) DeepCopyInto(out *GlobalTenantResourceStatus)

+ type IngressOptions struct

+ AllowWildcardHostnames bool

+ AllowedClasses *api.DefaultAllowedListSpec

+ AllowedHostnames *api.AllowedListSpec

+ HostnameCollisionScope api.HostnameCollisionScope

+ func (in *IngressOptions) DeepCopy() *IngressOptions

+ func (in *IngressOptions) DeepCopyInto(out *IngressOptions)

+ type NamespaceOptions struct

+ AdditionalMetadata *api.AdditionalMetadataSpec

+ ForbiddenAnnotations api.ForbiddenListSpec

+ ForbiddenLabels api.ForbiddenListSpec

+ Quota *int32

+ func (in *NamespaceOptions) DeepCopy() *NamespaceOptions

+ func (in *NamespaceOptions) DeepCopyInto(out *NamespaceOptions)

+ type NodeMetadata struct

+ ForbiddenAnnotations api.ForbiddenListSpec

+ ForbiddenLabels api.ForbiddenListSpec

+ func (in *NodeMetadata) DeepCopy() *NodeMetadata

+ func (in *NodeMetadata) DeepCopyInto(out *NodeMetadata)

+ type NonLimitedResourceError struct

+ func NewNonLimitedResourceError(kindGroup string) *NonLimitedResourceError

+ func (in *NonLimitedResourceError) DeepCopy() *NonLimitedResourceError

+ func (in *NonLimitedResourceError) DeepCopyInto(out *NonLimitedResourceError)

+ func (n NonLimitedResourceError) Error() string

+ type ObjectReference struct

+ Selector metav1.LabelSelector

+ func (in *ObjectReference) DeepCopy() *ObjectReference

+ func (in *ObjectReference) DeepCopyInto(out *ObjectReference)

+ type ObjectReferenceAbstract struct

+ APIVersion string

+ Kind string

+ Namespace string

+ func (in *ObjectReferenceAbstract) DeepCopy() *ObjectReferenceAbstract

+ func (in *ObjectReferenceAbstract) DeepCopyInto(out *ObjectReferenceAbstract)

+ type ObjectReferenceStatus struct

+ Name string

+ func (in *ObjectReferenceStatus) DeepCopy() *ObjectReferenceStatus

+ func (in *ObjectReferenceStatus) DeepCopyInto(out *ObjectReferenceStatus)

+ func (in *ObjectReferenceStatus) ParseFromString(value string) error

+ func (in *ObjectReferenceStatus) String() string

+ type OwnerKind string

+ func (k OwnerKind) String() string

+ type OwnerListSpec []OwnerSpec

+ func (in OwnerListSpec) DeepCopy() OwnerListSpec

+ func (in OwnerListSpec) DeepCopyInto(out *OwnerListSpec)

+ func (o OwnerListSpec) FindOwner(name string, kind OwnerKind) (owner OwnerSpec)

+ type OwnerSpec struct

+ ClusterRoles []string

+ Kind OwnerKind

+ Name string

+ ProxyOperations []ProxySettings

+ func (in *OwnerSpec) DeepCopy() *OwnerSpec

+ func (in *OwnerSpec) DeepCopyInto(out *OwnerSpec)

+ type ProcessedItems []ObjectReferenceStatus

+ func (in ProcessedItems) DeepCopy() ProcessedItems

+ func (in ProcessedItems) DeepCopyInto(out *ProcessedItems)

+ func (p *ProcessedItems) AsSet() sets.Set[string]

+ type ProxyOperation string

+ func (p ProxyOperation) String() string

+ type ProxyServiceKind string

+ func (p ProxyServiceKind) String() string

+ type ProxySettings struct

+ Kind ProxyServiceKind

+ Operations []ProxyOperation

+ func (in *ProxySettings) DeepCopy() *ProxySettings

+ func (in *ProxySettings) DeepCopyInto(out *ProxySettings)

+ type RawExtension struct

+ func (in *RawExtension) DeepCopy() *RawExtension

+ func (in *RawExtension) DeepCopyInto(out *RawExtension)

+ type ResourceSpec struct

+ AdditionalMetadata *api.AdditionalMetadataSpec

+ NamespaceSelector *metav1.LabelSelector

+ NamespacedItems []ObjectReference

+ RawItems []RawExtension

+ func (in *ResourceSpec) DeepCopy() *ResourceSpec

+ func (in *ResourceSpec) DeepCopyInto(out *ResourceSpec)

+ type Tenant struct

+ Spec TenantSpec

+ Status TenantStatus

+ func (in *Tenant) AssignNamespaces(namespaces []corev1.Namespace)

+ func (in *Tenant) ConvertFrom(raw conversion.Hub) error

+ func (in *Tenant) ConvertTo(raw conversion.Hub) error

+ func (in *Tenant) DeepCopy() *Tenant

+ func (in *Tenant) DeepCopyInto(out *Tenant)

+ func (in *Tenant) DeepCopyObject() runtime.Object

+ func (in *Tenant) GetNamespaces() (res []string)

+ func (in *Tenant) GetOwnerProxySettings(name string, kind OwnerKind) []ProxySettings

+ func (in *Tenant) IsFull() bool

+ type TenantList struct

+ Items []Tenant

+ func (in *TenantList) DeepCopy() *TenantList

+ func (in *TenantList) DeepCopyInto(out *TenantList)

+ func (in *TenantList) DeepCopyObject() runtime.Object

+ type TenantResource struct

+ Spec TenantResourceSpec

+ Status TenantResourceStatus

+ func (in *TenantResource) DeepCopy() *TenantResource

+ func (in *TenantResource) DeepCopyInto(out *TenantResource)

+ func (in *TenantResource) DeepCopyObject() runtime.Object

+ type TenantResourceList struct

+ Items []TenantResource

+ func (in *TenantResourceList) DeepCopy() *TenantResourceList

+ func (in *TenantResourceList) DeepCopyInto(out *TenantResourceList)

+ func (in *TenantResourceList) DeepCopyObject() runtime.Object

+ type TenantResourceSpec struct

+ PruningOnDelete *bool

+ Resources []ResourceSpec

+ ResyncPeriod metav1.Duration

+ func (in *TenantResourceSpec) DeepCopy() *TenantResourceSpec

+ func (in *TenantResourceSpec) DeepCopyInto(out *TenantResourceSpec)

+ type TenantResourceStatus struct

+ ProcessedItems ProcessedItems

+ func (in *TenantResourceStatus) DeepCopy() *TenantResourceStatus

+ func (in *TenantResourceStatus) DeepCopyInto(out *TenantResourceStatus)

+ type TenantSpec struct

+ AdditionalRoleBindings []api.AdditionalRoleBindingsSpec

+ ContainerRegistries *api.AllowedListSpec

+ Cordoned bool

+ ImagePullPolicies []api.ImagePullPolicySpec

+ IngressOptions IngressOptions

+ LimitRanges api.LimitRangesSpec

+ NamespaceOptions *NamespaceOptions

+ NetworkPolicies api.NetworkPolicySpec

+ NodeSelector map[string]string

+ Owners OwnerListSpec

+ PreventDeletion bool

+ PriorityClasses *api.DefaultAllowedListSpec

+ ResourceQuota api.ResourceQuotaSpec

+ RuntimeClasses *api.SelectorAllowedListSpec

+ ServiceOptions *api.ServiceOptions

+ StorageClasses *api.DefaultAllowedListSpec

+ func (in *TenantSpec) DeepCopy() *TenantSpec

+ func (in *TenantSpec) DeepCopyInto(out *TenantSpec)

+ type TenantStatus struct

+ Namespaces []string

+ Size uint

+ State tenantState

+ func (in *TenantStatus) DeepCopy() *TenantStatus

+ func (in *TenantStatus) DeepCopyInto(out *TenantStatus)

Oct 26, 2023 GO-2024-3077 +3 more

  GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

  GO-2025-3893: Capsule tenant owners with "patch namespace" permission can hijack system namespaces label in github.com/projectcapsule/capsule

  GO-2026-5043: Capsule Namespace Hijacking via subresource in github.com/projectcapsule/capsule

  GO-2026-5584: Capsule TenantResource RawItems Cluster-Scoped Resource Creation Vulnerability in github.com/projectcapsule/capsule

Oct 23, 2023 GO-2024-3077 +3 more

  GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

  GO-2025-3893: Capsule tenant owners with "patch namespace" permission can hijack system namespaces label in github.com/projectcapsule/capsule

  GO-2026-5043: Capsule Namespace Hijacking via subresource in github.com/projectcapsule/capsule

  GO-2026-5584: Capsule TenantResource RawItems Cluster-Scoped Resource Creation Vulnerability in github.com/projectcapsule/capsule

Oct 20, 2023 GO-2024-3077 +3 more

  GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

  GO-2025-3893: Capsule tenant owners with "patch namespace" permission can hijack system namespaces label in github.com/projectcapsule/capsule

  GO-2026-5043: Capsule Namespace Hijacking via subresource in github.com/projectcapsule/capsule

  GO-2026-5584: Capsule TenantResource RawItems Cluster-Scoped Resource Creation Vulnerability in github.com/projectcapsule/capsule