github/capsule
1
0
Fork 0
mirror of https://github.com/projectcapsule/capsule.git synced 2026-08-25 16:07:24 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat: add metadata enforcement (#1990)

Browse Source 
* fix(controller): decode old object for delete requests

Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com>

* chore: modernize golang

Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com>

* chore: modernize golang

Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com>

* chore: modernize golang

Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com>

* fix: preserve ca-bundles injected from external providers

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

* feat: add metadata enforcement

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

* feat: add metadata enforcement

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

* fix: add resourcepoolclaim validation

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

* fix: add resourcepoolclaim validation

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

* fix: add resourcepoolclaim validation

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

* Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

* fix: add resourcepoolclaim validation

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

---------

Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com>
Signed-off-by: Oliver Baehler <oliver@sudo-i.net>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
This commit is contained in:
Oliver Bähler
2026-07-02 13:42:08 +02:00
committed by GitHub
co-authored by Copilot Autofix powered by AI
parent 6fbd472f27
commit 77d1810bb9
89 changed files with 12731 additions and 556 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/template/reference.go
+2 -2
View File
@@ -16,14 +16,14 @@ import (
"sigs.k8s.io/controller-runtime/pkg/client"
"sigs.k8s.io/controller-runtime/pkg/log"
"github.com/projectcapsule/capsule/pkg/runtime/gvk"
"github.com/projectcapsule/capsule/pkg/api/runtime"
"github.com/projectcapsule/capsule/pkg/runtime/selectors"
)
// Reference
// +kubebuilder:object:generate=true
type ResourceReference struct {
gvk.VersionKind `json:",inline"`
runtime.VersionKind `json:",inline"`
// Name of the values referent. This is useful
// when you traying to get a specific resource
pkg/template/rules_test.go
+9 -9
View File
@@ -9,8 +9,8 @@ import (
corev1 "k8s.io/api/core/v1"
"github.com/projectcapsule/capsule/pkg/api"
"github.com/projectcapsule/capsule/pkg/api/rules"
"github.com/projectcapsule/capsule/pkg/api/runtime"
)
func TestRenderNamespaceRuleBodies(t *testing.T) {
@@ -57,7 +57,7 @@ func TestRenderNamespaceRuleBodies(t *testing.T) {
Workloads: rules.NamespaceRuleEnforceWorkloadsBody{
Registries: []rules.OCIRegistry{
{
ExpressionMatch: api.ExpressionMatch{
ExpressionMatch: runtime.ExpressionMatch{
Exact: []string{
"{{ .tenant.metadata.name }}/{{ .namespace.metadata.name }}/app:1",
},
@@ -114,7 +114,7 @@ func TestRenderNamespaceRuleBodies(t *testing.T) {
Workloads: rules.NamespaceRuleEnforceWorkloadsBody{
Registries: []rules.OCIRegistry{
{
ExpressionMatch: api.ExpressionMatch{
ExpressionMatch: runtime.ExpressionMatch{
Exact: []string{
`{{ index .namespace.metadata.labels "registry-prefix" }}/app:1`,
},
@@ -151,8 +151,8 @@ func TestRenderNamespaceRuleBodies(t *testing.T) {
Workloads: rules.NamespaceRuleEnforceWorkloadsBody{
Registries: []rules.OCIRegistry{
{
ExpressionMatch: api.ExpressionMatch{
ExpressionRegex: api.ExpressionRegex{
ExpressionMatch: runtime.ExpressionMatch{
ExpressionRegex: runtime.ExpressionRegex{
Expression: "{{ .tenant.metadata.name }}/allow/.*",
},
},
@@ -170,8 +170,8 @@ func TestRenderNamespaceRuleBodies(t *testing.T) {
},
Registries: []rules.OCIRegistry{
{
ExpressionMatch: api.ExpressionMatch{
ExpressionRegex: api.ExpressionRegex{
ExpressionMatch: runtime.ExpressionMatch{
ExpressionRegex: runtime.ExpressionRegex{
Expression: "{{ .tenant.metadata.name }}/deny/.*",
},
},
@@ -229,7 +229,7 @@ func TestRenderNamespaceRuleBodies(t *testing.T) {
Workloads: rules.NamespaceRuleEnforceWorkloadsBody{
Registries: []rules.OCIRegistry{
{
ExpressionMatch: api.ExpressionMatch{
ExpressionMatch: runtime.ExpressionMatch{
Exact: []string{
"{{ .namespace.metadata.labels.registry }}/app:1",
},
@@ -284,7 +284,7 @@ func TestRenderNamespaceRuleBodies_DoesNotMutateInput(t *testing.T) {
Workloads: rules.NamespaceRuleEnforceWorkloadsBody{
Registries: []rules.OCIRegistry{
{
ExpressionMatch: api.ExpressionMatch{
ExpressionMatch: runtime.ExpressionMatch{
Exact: []string{
"{{ .tenant.metadata.name }}/app:1",
},