github/capsule
1
0
Fork 0
mirror of https://github.com/projectcapsule/capsule.git synced 2026-08-18 20:17:04 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(rules): improve metadata enforcement and add ingress rules (#2050)

Browse Source 
* feat: implement namespace metadata enforcement

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

* feat: add ingress enforcment

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

* feat: add ingress enforcment

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

* feat: add ingress enforcment

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

* feat: add ingress enforcment

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

* feat: add ingress enforcment

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

* feat: add ingress enforcment

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

* feat: add ingress enforcment

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

* feat: add ingress enforcment

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

* feat: add ingress enforcment

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

* feat: add ingress enforcment

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

* feat: add ingress enforcment

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

---------

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>
This commit is contained in:
Oliver Bähler
2026-07-22 22:24:54 +02:00
committed by GitHub
parent 8c26b409a1
commit f1b760a87a
47 changed files with 5007 additions and 298 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cmd/controller/main.go
+12 -6
View File
@@ -76,6 +76,7 @@ import (
"github.com/projectcapsule/capsule/internal/webhook/pvc"
"github.com/projectcapsule/capsule/internal/webhook/resourcepool"
"github.com/projectcapsule/capsule/internal/webhook/route"
rulesgenericmutation "github.com/projectcapsule/capsule/internal/webhook/rules/generic/mutation"
rulesgenericvalidation "github.com/projectcapsule/capsule/internal/webhook/rules/generic/validation"
podrules "github.com/projectcapsule/capsule/internal/webhook/rules/pods/validation"
servicerules "github.com/projectcapsule/capsule/internal/webhook/rules/services/validation"
@@ -685,11 +686,12 @@ func main() {
// webhooks: the order matters, don't change it and just append
webhooksList := append(
make([]handlers.Webhook, 0),
rulesgenericvalidation.Register(regexCache),
rulesgenericmutation.Register(cfg),
rulesgenericvalidation.Register(regexCache, cfg),
route.GenericReplicasHandler(),
route.GenericManagedHandler(cfg),
route.Pod(
pod.Handler(
pod.Handler(cfg,
podrules.PodRules(regexCache, registryCache),
pod.ImagePullPolicy(),
pod.ContainerRegistryLegacy(cfg),
@@ -710,7 +712,7 @@ func main() {
),
),
route.Service(
service.Handler(
service.Handler(cfg,
servicerules.ServiceRules(regexCache),
service.Validating(),
),
@@ -759,6 +761,7 @@ func main() {
namespacevalidation.CordoningHandler(cfg),
namespacevalidation.QuotaHandler(),
namespacevalidation.PrefixHandler(cfg),
namespacevalidation.RulesMetadataHandler(regexCache, cfg),
namespacevalidation.UserMetadataHandler(),
namespacevalidation.RequiredMetadataHandler(),
),
@@ -768,6 +771,8 @@ func main() {
cfg,
namespacemutation.OwnerReferenceHandler(cfg),
namespacemutation.MetadataHandler(cfg),
// Tenant metadata must be resolved before applying namespace rules.
namespacemutation.RulesMetadataHandler(cfg),
namespacemutation.NamespacePatchGuardHandler(cfg),
),
),
@@ -887,9 +892,10 @@ func main() {
}
if err = (&rulestatuscontroller.Manager{
Client: manager.GetClient(),
Log: ctrl.Log.WithName("capsule.ctrl").WithName("ruleset"),
Metrics: metrics.MustMakeRuleStatusRecorder(),
Client: manager.GetClient(),
RESTConfig: manager.GetConfig(),
Log: ctrl.Log.WithName("capsule.ctrl").WithName("ruleset"),
Metrics: metrics.MustMakeRuleStatusRecorder(),
}).SetupWithManager(manager, controllerConfig); err != nil {
setupLog.Error(err, "unable to create controller", "controller", "RuleSet")
os.Exit(1)