projectcapsule/capsule v0.15.0

on GitHub

Changelog

⚠️ Security

• GHSA-p8j8-x28r-3c9v Critical: Authorization bypass via namespaces/status and namespaces/finalize, whose ownership gate lives only in the mutating webhook, enabling system-namespace hijack. However these permissions are not provided to users by default. You are only affected if you provide users with these permissions. @euriconicacio
• GHSA-4qv9-xv9f-w5xh High: DRA DeviceClass allow-list bypass: only first device request validated, enabling cross-tenant hardware access @manus-use
• GHSA-wpv2-mpqq-vv52 Moderate: Forgeable projectcapsule.dev/managed-by skip label lets a tenant owner bypass all Capsule enforce rules (e.g. enforce.metadata) on namespaced and cluster-scoped objects @IamwhatIamSY
• GHSA-jc72-9675-pcmv Moderate: Capsule: uncompiled serviceOptions forbidden deniedRegex panics the Service admission webhook (tenant DoS) @manus-pi
• GHSA-793w-c9f9-m6f8 Moderate: Unvalidated Tenant class allowedRegex fields cause regexp.MustCompile panic and persistent tenant admission denial @manus-pi

✨ New Features

• 9b658a9: feat(config): migrate config renovate.json (#2239) (@renovate[bot])
• 4c30567: feat(controller,api): Implement resource-permit functionality (#1959) (@bakito)
• e44a6d9: feat: add AGENTS.md file (#2149) (@oliverbaehler)
• 832937d: feat: add apply policies to g/tr (#2161) (@oliverbaehler)
• 0fd73eb: feat: add ingress cidr enforcement (#2207) (@oliverbaehler)
• a377a22: feat: add networkpolicy cidr enforcement (#2203) (@oliverbaehler)
• 7e63ac2: feat: add pdb enforcement (#2196) (@oliverbaehler)
• 50ff3fc: feat: add pullpolicy mutation (#2192) (@oliverbaehler)
• 5318490: feat: add read-only filesystem mutation (#2191) (@oliverbaehler)
• 958e904: feat: add rules nesting for workloads (#2193) (@oliverbaehler)
• 761e3db: feat: add scheduler mutation (#2184) (@oliverbaehler)
• b89bf7a: feat: add storage volumes rules (#2205) (@oliverbaehler)
• 1056d90: feat: add workload placement api (#2174) (@oliverbaehler)
• 06e0fb9: feat: add workload targets (#2188) (@oliverbaehler)
• dd100ba: feat: migrate openshift e2e from minc to microshift (#2246) (@sandert-k8s)
• e6d8d8e: feat: reconsider conditions api for rules (#2176) (@oliverbaehler)

🐛 Bug fixes

• aabc409: fix(api): match mixed-case allowed list entries (#2165) (@tikket1)
• fa0efd9: fix(chart): use configured kubectl entrypoints in hooks (#2202) (@winrarr)
• ca80b25: fix: avoid nil panics for dra inspection (#2164) (@oliverbaehler)
• 853bd41: fix: avoid pvc selector mutations on update (#2204) (@oliverbaehler)
• b98f74f: fix: coordinate legacy quota recounts with admission reservations (#2250) (@oliverbaehler)
• e391826: fix: correct readme badge urls (#2243) (@bakito)
• 0718f97: fix: dedicated namespace clean up controller (#2171) (@oliverbaehler)
• 05bc718: fix: disallow orphan namespaces on tenant deletion (#2197) (@oliverbaehler)
• 9f69543: fix: do not emit events on dry-run operations (#2210) (@oliverbaehler)
• 3428a26: fix: handle ns subersources actions and disallow metadata bypasses (#2166) (@bakito)
• 061a9c1: fix: prioritize rbac repliciation speed for tenant reconciler (#2245) (@oliverbaehler)
• 0cdfcd4: fix: reduce memory footprint for collectors (#2146) (@oliverbaehler)
• 2a8f08b: fix: require controller identity for rule skips (@oliverbaehler)
• 411472b: fix: validate Service forbidden metadata regexes (#2178) (@oliverbaehler)
• e2b7ce8: fix: validate tenant regular expression on admission (#2169) (@bakito)

🛠 Dependency updates

• fff51ce: fix(deps): update k8s.io/utils digest to cf1189d (#1867) (@renovate[bot])
• b7fd369: fix(deps): update module filippo.io/age to v1.3.2 (#2136) (@renovate[bot])
• 89fdac6: fix(deps): update module github.com/go-sprout/sprout to v1.1.1 (#2122) (@renovate[bot])
• 727b4d4: fix(deps): update module github.com/go-sprout/sprout to v1.1.2 (#2185) (@renovate[bot])
• 2485fbc: fix(deps): update module github.com/prometheus/client_model to v0.6.3 (#2140) (@renovate[bot])
• aa9b481: fix(deps): update module github.com/xhit/go-str2duration/v2 to v2.2.0 (#2173) (@renovate[bot])
• 4831931: fix(deps): update module golang.org/x/sync to v0.24.0 (#2213) (@renovate[bot])

📖 Documentation updates

• afaf980: docs: add gemara assesement structure (#2214) (@oliverbaehler)

🚀 Build process updates

• ff814d6: ci: add osps baseline workflows (#2226) (@oliverbaehler)
• 6e0708a: ci: correct formating for osps baseline publishing (#2236) (@oliverbaehler)
• 631ed36: ci: correct formating for osps baseline publishing (#2237) (@oliverbaehler)

Full Changelog: v0.14.6...v0.15.0

Check out what's new in this release

Docker Images

• ghcr.io/projectcapsule/capsule:0.15.0
• ghcr.io/projectcapsule/capsule:latest

Helm Chart
View this release on Artifact Hub or use the OCI helm chart:

• ghcr.io/projectcapsule/charts/capsule:0.15.0

Review the Major Changes section first before upgrading to a new version

Thanks to all the contributors! 🚀 🦄