feat: add ruleset api(#1844)

* fix(controller): decode old object for delete requests Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> * chore: modernize golang Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> * chore: modernize golang Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> * chore: modernize golang Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> * fix(config): remove usergroups default Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> * fix(config): remove usergroups default Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> * sec(ghsa-2ww6-hf35-mfjm): intercept namespace subresource Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> * feat(api): add rulestatus api Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> * chore: conflicts Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> * chore: conflicts Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> * chore: conflicts Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> * chore: conflicts Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> * chore: conflicts Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> * chore: conflicts Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> * chore: conflicts Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> * chore: conflicts Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> * chore: conflicts Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> * chore: conflicts Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> * chore: conflicts Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> * feat(api): add rulestatus api Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> * feat(api): add rulestatus api Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> * feat(api): add rulestatus api Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> * feat(api): add rulestatus api Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> * feat(api): add rulestatus api Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> * feat(api): add rulestatus api Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> --------- Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com>
2026-02-14 18:09:58 +00:00 · 2026-01-27 14:28:48 +01:00
parent b9a14a954d
commit a6b830b1af
284 changed files with 12699 additions and 2162 deletions
--- a/hack/distro/capsule/example-setup/tenants.yaml
+++ b/hack/distro/capsule/example-setup/tenants.yaml
@@ -4,21 +4,38 @@ kind: Tenant
 metadata:
  name: solar
 spec:
+  owners:
+  - name: alice
+    kind: User
  permissions:
    matchOwners:
    - matchLabels:
        team: platform
    - matchLabels:
        tenant: solar
-  owners:
-  - name: alice
-    kind: User
  additionalRoleBindings:
  - clusterRoleName: 'view'
    subjects:
    - apiGroup: rbac.authorization.k8s.io
      kind: User
      name: joe
+  rules:
+    - enforce:
+        registries:
+        - url: "harbor/.*"
+          policy:
+          - "Never"
+    - namespaceSelector:
+        matchExpressions:
+          - key: env
+            operator: In
+            values:
+            - "prod"
+      enforce:
+        registries:
+        - url: "harbor/v2/customer-registry/prod-image/.*"
+          policy:
+          - "Always"
 ---
 apiVersion: capsule.clastix.io/v1beta2
 kind: Tenant
--- a/hack/kind-cluster.yaml
+++ b/hack/kind-cluster.yaml
@@ -0,0 +1,8 @@
+---
+kind: Cluster
+apiVersion: kind.x-k8s.io/v1alpha4
+name: capsule
+featureGates:
+  ImageVolume: true
+nodes:
+- role: control-plane
--- a/hack/kind-cluster.yml
+++ b/hack/kind-cluster.yml
@@ -1,13 +0,0 @@
-# With Kind configuration is used to
-# share a folder between the outside sistem
-# and the internal container (capsule-controller-manager),
-# In this way we will be able to get the metadata
-# generated by harpoon at the end of the e2e tests execution.
-kind: Cluster
-apiVersion: kind.x-k8s.io/v1alpha4
-name: capsule-tracing
-nodes:
- role: control-plane
-  extraMounts:
-  - hostPath: /tmp/results
-    containerPath: /tmp/results