github/capsule
1
0
Fork 0
mirror of https://github.com/projectcapsule/capsule.git synced 2026-08-19 12:36:39 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(helm): add ignoreuserwithgroups as option in values (#1599)

Browse Source 
Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com>
This commit is contained in:
Oliver Bähler
2025-08-20 16:10:04 +02:00
committed by GitHub
parent 920d8dd587
commit 651305725d
4 changed files with 14 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/capsule/README.md
+1
View File
@@ -165,6 +165,7 @@ Here the values you can override:
| manager.options.capsuleUserGroups | list | `["projectcapsule.dev"]` | Override the Capsule user groups |
| manager.options.forceTenantPrefix | bool | `false` | Boolean, enforces the Tenant owner, during Namespace creation, to name it using the selected Tenant name as prefix, separated by a dash |
| manager.options.generateCertificates | bool | `true` | Specifies whether capsule webhooks certificates should be generated by capsule operator |
| manager.options.ignoreUserWithGroups | list | `[]` | Define groups which when found in the request of a user will be ignored by the Capsule this might be useful if you have one group where all the users are in, but you want to separate administrators from normal users with additional groups. |
| manager.options.logLevel | string | `"4"` | Set the log verbosity of the capsule with a value from 1 to 10 |
| manager.options.nodeMetadata | object | `{"forbiddenAnnotations":{"denied":[],"deniedRegex":""},"forbiddenLabels":{"denied":[],"deniedRegex":""}}` | Allows to set the forbidden metadata for the worker nodes that could be patched by a Tenant |
| manager.options.protectedNamespaceRegex | string | `""` | If specified, disallows creation of namespaces matching the passed regexp |
charts/capsule/templates/configuration-default.yaml
+6 -2
View File
@@ -17,9 +17,13 @@ spec:
validatingWebhookConfigurationName: {{ include "capsule.fullname" . }}-validating-webhook-configuration
forceTenantPrefix: {{ .Values.manager.options.forceTenantPrefix }}
userGroups:
{{- range .Values.manager.options.capsuleUserGroups }}
{{- range .Values.manager.options.capsuleUserGroups }}
- {{ . }}
{{- end}}
{{- end }}
ignoreUserWithGroups:
{{- range .Values.manager.options.ignoreUserWithGroups }}
- {{ . }}
{{- end }}
protectedNamespaceRegex: {{ .Values.manager.options.protectedNamespaceRegex | quote }}
{{- with .Values.manager.options.nodeMetadata }}
nodeMetadata:
charts/capsule/values.schema.json
+4
View File
@@ -263,6 +263,10 @@
"description": "Specifies whether capsule webhooks certificates should be generated by capsule operator",
"type": "boolean"
},
"ignoreUserWithGroups": {
"description": "Define groups which when found in the request of a user will be ignored by the Capsule this might be useful if you have one group where all the users are in, but you want to separate administrators from normal users with additional groups.",
"type": "array"
},
"logLevel": {
"description": "Set the log verbosity of the capsule with a value from 1 to 10",
"type": "string"
charts/capsule/values.yaml
+3
View File
@@ -143,6 +143,9 @@ manager:
forceTenantPrefix: false
# -- Override the Capsule user groups
capsuleUserGroups: ["projectcapsule.dev"]
# -- Define groups which when found in the request of a user will be ignored by the Capsule
# this might be useful if you have one group where all the users are in, but you want to separate administrators from normal users with additional groups.
ignoreUserWithGroups: []
# -- If specified, disallows creation of namespaces matching the passed regexp
protectedNamespaceRegex: ""
# -- Specifies whether capsule webhooks certificates should be generated by capsule operator