feat(helm): add topologySpreadConstraints

Add support for Capsule deployment topologySpreadConstraints in Capsule Helm Chart.

Signed-off-by: Zadkiel Aharonian <hello@zadkiel.fr>

.github/workflows/ci.yml

@@ -8,7 +8,7 @@ on:
 
 jobs:
   commit_lint:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-20.04
     steps:
       - uses: actions/checkout@v2
         with:
@@ -18,25 +18,25 @@ jobs:
           firstParent: true
   golangci:
     name: lint
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-20.04
     steps:
       - uses: actions/checkout@v2
       - name: Run golangci-lint
         uses: golangci/golangci-lint-action@v2.3.0
         with:
-          version: v1.45.2
+          version: v1.51.2
           only-new-issues: false
-          args: --timeout 2m --config .golangci.yml
+          args: --timeout 5m --config .golangci.yml
   diff:
     name: diff
-    runs-on: ubuntu-18.04
+    runs-on: ubuntu-20.04
     steps:
       - uses: actions/checkout@v2
         with:
           fetch-depth: 0
       - uses: actions/setup-go@v2
         with:
-          go-version: '1.18'
+          go-version: '1.19'
       - run: make installer
       - name: Checking if YAML installer file is not aligned
         run: if [[ $(git diff | wc -l) -gt 0 ]]; then echo ">>> Untracked generated files have not been committed" && git --no-pager diff && exit 1; fi

.github/workflows/e2e.yml

@@ -32,15 +32,15 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        k8s-version: ['v1.16.15', 'v1.17.11', 'v1.18.8', 'v1.19.4', 'v1.20.7', 'v1.21.2', 'v1.22.4', 'v1.23.6', 'v1.24.7', 'v1.25.3', 'v1.26.0']
-    runs-on: ubuntu-18.04
+        k8s-version: ['v1.20.7', 'v1.21.2', 'v1.22.4', 'v1.23.6', 'v1.24.7', 'v1.25.3', 'v1.26.3', 'v1.27.2']
+    runs-on: ubuntu-20.04
     steps:
       - uses: actions/checkout@v2
         with:
           fetch-depth: 0
       - uses: actions/setup-go@v2
         with:
-          go-version: '1.18'
+          go-version: '1.19'
       - run: make manifests
       - name: Checking if manifests are disaligned
         run: test -z "$(git diff 2> /dev/null)"

.github/workflows/gosec.yml

@@ -6,7 +6,7 @@ on:
     branches: [ "*" ]
 jobs:
   tests:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-20.04
     env:
       GO111MODULE: on
     steps:

.github/workflows/helm.yml

@@ -9,7 +9,7 @@ on:
 
 jobs:
   lint:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-20.04
     steps:
       - uses: actions/checkout@v2
         with:
@@ -69,7 +69,7 @@ jobs:
       #  if: steps.list-changed.outputs.changed == 'true'
   release:
     if: startsWith(github.ref, 'refs/tags/helm-v')
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-20.04
     steps:
       - uses: actions/checkout@v2
       - name: Publish Helm chart

.golangci.yml

@@ -39,9 +39,16 @@ linters:
     - testpackage
     - varnamelen
     - wrapcheck
+    - exhaustruct
+    - varcheck
+    - structcheck
+    - nosnakecase
+    - deadcode
+    - ifshort
+    - nonamedreturns
 
 service:
-  golangci-lint-version: 1.45.2
+  golangci-lint-version: 1.51.2
 
 run:
   skip-files:

ADOPTERS.md

@@ -7,5 +7,26 @@ This is a list of companies that have adopted Capsule, feel free to open a Pull-
 ### [Bedag Informatik AG](https://www.bedag.ch/)
 ![Bedag](https://www.bedag.ch/wGlobal/wGlobal/layout/images/logo.svg)
 
+### [Fastweb](https://www.fastweb.it/)
+![Fastweb](https://www.fastweb.it/grandi-aziende/gfx/common/logo-fastweb-header.svg)
+
+### [Klarrio](https://klarrio.com/)
+![Klarrio](https://klarrio.com/wp-content/uploads/klarrio.png)
+
+### [PITS Global Data Recovery Services](https://www.pitsdatarecovery.net)
+![PITS Global Data Recovery Services](https://www.pitsdatarecovery.net/wp-content/uploads/2020/09/pits-logo.svg)
+
+### [Politecnico di Torino](https://www.polito.it/)
+![Politecnico di Torino](https://www.polito.it/themes/custom/polito/logo.svg)
+
+### [Reevo](https://www.reevo.it/)
+![Reevo Cloud and CyberSecurity](https://www.dropbox.com/s/x3q6r0oqstgvtdr/Logo_ReeVo_270x200px.svg)
+
+### [University of Torino](https://www.unito.it)
+![University of Torino](https://www.unito.it/sites/all/themes/bsunito/img/logo_new_2022.svg)
+
+### [Velocity](https://velocity.tech/)
+![Velocity](https://raw.githubusercontent.com/yarelm/velocity-logo/main/velocity.png)
+
 ### [Wargaming.net](https://www.wargaming.net/)
 ![Wargaming.net](https://static-cspbe-eu.wargaming.net/images/logo@2x.png)

Dockerfile

@@ -1,5 +1,5 @@
 # Build the manager binary
-FROM golang:1.18 as builder
+FROM golang:1.19.10 as builder
 
 WORKDIR /workspace
 # Copy the Go Modules manifests

Makefile

@@ -189,7 +189,7 @@ apidocs-gen: ## Download crdoc locally if necessary.
 
 GINKGO = $(shell pwd)/bin/ginkgo
 ginkgo: ## Download ginkgo locally if necessary.
-	$(call go-install-tool,$(GINKGO),github.com/onsi/ginkgo/ginkgo@v1.16.5)
+	$(call go-install-tool,$(GINKGO),github.com/onsi/ginkgo/v2/ginkgo@v2.9.5)
 
 CT = $(shell pwd)/bin/ct
 ct: ## Download ct locally if necessary.
@@ -240,7 +240,7 @@ goimports:
 
 GOLANGCI_LINT = $(shell pwd)/bin/golangci-lint
 golangci-lint: ## Download golangci-lint locally if necessary.
-	$(call go-install-tool,$(GOLANGCI_LINT),github.com/golangci/golangci-lint/cmd/golangci-lint@v1.45.2)
+	$(call go-install-tool,$(GOLANGCI_LINT),github.com/golangci/golangci-lint/cmd/golangci-lint@v1.51.2)
 
 # Linting code as PR is expecting
 .PHONY: golint
@@ -250,7 +250,7 @@ golint: golangci-lint
 # Running e2e tests in a KinD instance
 .PHONY: e2e
 e2e/%: ginkgo
-	$(MAKE) e2e-build/$* && $(MAKE) e2e-exec || $(MAKE) e2e-destroy
+	$(MAKE) e2e-build/$* && $(MAKE) e2e-exec && $(MAKE) e2e-destroy
 
 e2e-build/%:
 	kind create cluster --wait=60s --name capsule --image=kindest/node:$*
@@ -266,6 +266,7 @@ e2e-build/%:
 		--set "manager.image.tag=$(VERSION)" \
 		--set 'manager.livenessProbe.failureThreshold=10' \
 		--set 'manager.readinessProbe.failureThreshold=10' \
+		--set 'podSecurityContext.seccompProfile=null' \
 		capsule \
 		./charts/capsule
 

README.md

@@ -1,5 +1,6 @@
 
 <p align="left">
+  <img src="https://github.com/clastix/capsule/actions/workflows/ci.yml/badge.svg"/>
   <img src="https://img.shields.io/github/license/clastix/capsule"/>
   <img src="https://img.shields.io/github/go-mod/go-version/clastix/capsule"/>
   <a href="https://github.com/clastix/capsule/releases">

api/v1alpha1/conversion_hub.go

@@ -133,7 +133,7 @@ func (in *Tenant) convertV1Alpha1OwnerToV1Beta1() capsulev1beta1.OwnerListSpec {
 	return owners
 }
 
-// nolint:gocognit,gocyclo,cyclop,maintidx
+//nolint:gocognit,gocyclo,cyclop,maintidx
 func (in *Tenant) ConvertTo(dstRaw conversion.Hub) error {
 	dst, ok := dstRaw.(*capsulev1beta1.Tenant)
 	if !ok {
@@ -294,7 +294,7 @@ func (in *Tenant) ConvertTo(dstRaw conversion.Hub) error {
 			dst.Spec.ServiceOptions.AllowedServices = &api.AllowedServices{}
 		}
 
-		dst.Spec.ServiceOptions.AllowedServices.NodePort = pointer.BoolPtr(val)
+		dst.Spec.ServiceOptions.AllowedServices.NodePort = pointer.Bool(val)
 	}
 
 	enableExternalName, ok := annotations[enableExternalNameAnnotation]
@@ -312,7 +312,7 @@ func (in *Tenant) ConvertTo(dstRaw conversion.Hub) error {
 			dst.Spec.ServiceOptions.AllowedServices = &api.AllowedServices{}
 		}
 
-		dst.Spec.ServiceOptions.AllowedServices.ExternalName = pointer.BoolPtr(val)
+		dst.Spec.ServiceOptions.AllowedServices.ExternalName = pointer.Bool(val)
 	}
 
 	loadBalancerService, ok := annotations[enableLoadBalancerAnnotation]
@@ -330,7 +330,7 @@ func (in *Tenant) ConvertTo(dstRaw conversion.Hub) error {
 			dst.Spec.ServiceOptions.AllowedServices = &api.AllowedServices{}
 		}
 
-		dst.Spec.ServiceOptions.AllowedServices.LoadBalancer = pointer.BoolPtr(val)
+		dst.Spec.ServiceOptions.AllowedServices.LoadBalancer = pointer.Bool(val)
 	}
 	// Status
 	dst.Status = capsulev1beta1.TenantStatus{
@@ -365,7 +365,7 @@ func (in *Tenant) ConvertTo(dstRaw conversion.Hub) error {
 	return nil
 }
 
-// nolint:gocognit,gocyclo,cyclop
+//nolint:gocognit,gocyclo,cyclop
 func (in *Tenant) convertV1Beta1OwnerToV1Alpha1(src *capsulev1beta1.Tenant) {
 	ownersAnnotations := map[string][]string{
 		ownerGroupsAnnotation:         nil,

api/v1alpha1/conversion_hub_test.go

@@ -19,7 +19,7 @@ import (
 	"github.com/clastix/capsule/pkg/api"
 )
 
-// nolint:maintidx
+//nolint:maintidx
 func generateTenantsSpecs() (Tenant, capsulev1beta1.Tenant) {
 	var namespaceQuota int32 = 5
 
@@ -53,9 +53,9 @@ func generateTenantsSpecs() (Tenant, capsulev1beta1.Tenant) {
 	v1beta1ServiceOptions := &api.ServiceOptions{
 		AdditionalMetadata: v1beta1AdditionalMetadataSpec,
 		AllowedServices: &api.AllowedServices{
-			NodePort:     pointer.BoolPtr(false),
-			ExternalName: pointer.BoolPtr(false),
-			LoadBalancer: pointer.BoolPtr(false),
+			NodePort:     pointer.Bool(false),
+			ExternalName: pointer.Bool(false),
+			LoadBalancer: pointer.Bool(false),
 		},
 		ExternalServiceIPs: &api.ExternalServiceIPsSpec{
 			Allowed: []api.AllowedIP{"192.168.0.1"},

api/v1beta1/tenant_types.go

@@ -75,9 +75,7 @@ func init() {
 func (in *Tenant) GetNamespaces() (res []string) {
 	res = make([]string, 0, len(in.Status.Namespaces))
 
-	for _, ns := range in.Status.Namespaces {
-		res = append(res, ns)
-	}
+	res = append(res, in.Status.Namespaces...)
 
 	return
 }

api/v1beta2/owner.go

@@ -34,7 +34,7 @@ func (p ProxyOperation) String() string {
 	return string(p)
 }
 
-// +kubebuilder:validation:Enum=Nodes;StorageClasses;IngressClasses;PriorityClasses
+// +kubebuilder:validation:Enum=Nodes;StorageClasses;IngressClasses;PriorityClasses;RuntimeClasses;PersistentVolumes
 type ProxyServiceKind string
 
 func (p ProxyServiceKind) String() string {
@@ -42,10 +42,12 @@ func (p ProxyServiceKind) String() string {
 }
 
 const (
-	NodesProxy           ProxyServiceKind = "Nodes"
-	StorageClassesProxy  ProxyServiceKind = "StorageClasses"
-	IngressClassesProxy  ProxyServiceKind = "IngressClasses"
-	PriorityClassesProxy ProxyServiceKind = "PriorityClasses"
+	NodesProxy             ProxyServiceKind = "Nodes"
+	StorageClassesProxy    ProxyServiceKind = "StorageClasses"
+	IngressClassesProxy    ProxyServiceKind = "IngressClasses"
+	PriorityClassesProxy   ProxyServiceKind = "PriorityClasses"
+	RuntimeClassesProxy    ProxyServiceKind = "RuntimeClasses"
+	PersistentVolumesProxy ProxyServiceKind = "PersistentVolumes"
 
 	ListOperation   ProxyOperation = "List"
 	UpdateOperation ProxyOperation = "Update"

api/v1beta2/tenant_types.go

@@ -76,9 +76,7 @@ type Tenant struct {
 func (in *Tenant) GetNamespaces() (res []string) {
 	res = make([]string, 0, len(in.Status.Namespaces))
 
-	for _, ns := range in.Status.Namespaces {
-		res = append(res, ns)
-	}
+	res = append(res, in.Status.Namespaces...)
 
 	return
 }

api/v1beta2/tenantresource_global.go

@@ -25,8 +25,9 @@ type GlobalTenantResourceStatus struct {
 
 type ProcessedItems []ObjectReferenceStatus
 
-func (p *ProcessedItems) AsSet() sets.String {
-	set := sets.NewString()
+func (p *ProcessedItems) AsSet() sets.Set[string] {
+	set := sets.New[string]()
+
 	for _, i := range *p {
 		set.Insert(i.String())
 	}

charts/capsule/Chart.yaml

@@ -21,8 +21,8 @@ sources:
 
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
-version: 0.3.1
+version: 0.4.6
 
 # This is the version number of the application being deployed.
 # This version number should be incremented each time you make changes to the application.
-appVersion: 0.2.1
+appVersion: 0.3.3

charts/capsule/README.md

@@ -66,15 +66,18 @@ Here the values you can override:
 | certManager.generateCertificates | bool | `false` | Specifies whether capsule webhooks certificates should be generated using cert-manager |
 | customAnnotations | object | `{}` | Additional annotations which will be added to all resources created by Capsule helm chart |
 | customLabels | object | `{}` | Additional labels which will be added to all resources created by Capsule helm chart |
+| imagePullSecrets | list | `[]` | Configuration for `imagePullSecrets` so that you can use a private images registry. |
 | jobs.image.pullPolicy | string | `"IfNotPresent"` | Set the image pull policy of the helm chart job |
 | jobs.image.repository | string | `"clastix/kubectl"` | Set the image repository of the helm chart job |
 | jobs.image.tag | string | `""` | Set the image tag of the helm chart job |
 | mutatingWebhooksTimeoutSeconds | int | `30` | Timeout in seconds for mutating webhooks |
 | nodeSelector | object | `{}` | Set the node selector for the Capsule pod |
 | podAnnotations | object | `{}` | Annotations to add to the capsule pod. |
+| podSecurityContext | object | `{"runAsGroup":1002,"runAsNonRoot":true,"runAsUser":1002,"seccompProfile":{"type":"RuntimeDefault"}}` | Set the securityContext for the Capsule pod |
 | podSecurityPolicy.enabled | bool | `false` | Specify if a Pod Security Policy must be created |
 | priorityClassName | string | `""` | Set the priority class name of the Capsule pod |
 | replicaCount | int | `1` | Set the replica count for capsule pod |
+| securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"readOnlyRootFilesystem":true}` | Set the securityContext for the Capsule container |
 | serviceAccount.annotations | object | `{}` | Annotations to add to the service account. |
 | serviceAccount.create | bool | `true` | Specifies whether a service account should be created. |
 | serviceAccount.name | string | `"capsule"` | The name of the service account to use. If not set and `serviceAccount.create=true`, a name is generated using the fullname template |
@@ -82,6 +85,7 @@ Here the values you can override:
 | tls.enableController | bool | `true` | Start the Capsule controller that injects the CA into mutating and validating webhooks, and CRD as well. |
 | tls.name | string | `""` | Override name of the Capsule TLS Secret name when externally managed. |
 | tolerations | list | `[]` | Set list of tolerations for the Capsule pod |
+| topologySpreadConstraints | list | `[]` | Set topology spread constraints for the Capsule pod |
 | validatingWebhooksTimeoutSeconds | int | `30` | Timeout in seconds for validating webhooks |
 
 ### Manager Parameters
@@ -92,19 +96,20 @@ Here the values you can override:
 | manager.image.pullPolicy | string | `"IfNotPresent"` | Set the image pull policy. |
 | manager.image.repository | string | `"clastix/capsule"` | Set the image repository of the capsule. |
 | manager.image.tag | string | `""` | Overrides the image tag whose default is the chart appVersion. |
-| manager.imagePullSecrets | list | `[]` | Configuration for `imagePullSecrets` so that you can use a private images registry. |
 | manager.kind | string | `"Deployment"` | Set the controller deployment mode as `Deployment` or `DaemonSet`. |
 | manager.livenessProbe | object | `{"httpGet":{"path":"/healthz","port":10080}}` | Configure the liveness probe using Deployment probe spec |
 | manager.options.capsuleUserGroups | list | `["capsule.clastix.io"]` | Override the Capsule user groups |
 | manager.options.forceTenantPrefix | bool | `false` | Boolean, enforces the Tenant owner, during Namespace creation, to name it using the selected Tenant name as prefix, separated by a dash |
 | manager.options.generateCertificates | bool | `true` | Specifies whether capsule webhooks certificates should be generated by capsule operator |
 | manager.options.logLevel | string | `"4"` | Set the log verbosity of the capsule with a value from 1 to 10 |
+| manager.options.nodeMetadata | object | `{"forbiddenAnnotations":{"denied":[],"deniedRegex":""},"forbiddenLabels":{"denied":[],"deniedRegex":""}}` | Allows to set the forbidden metadata for the worker nodes that could be patched by a Tenant |
 | manager.options.protectedNamespaceRegex | string | `""` | If specified, disallows creation of namespaces matching the passed regexp |
 | manager.readinessProbe | object | `{"httpGet":{"path":"/readyz","port":10080}}` | Configure the readiness probe using Deployment probe spec |
 | manager.resources.limits.cpu | string | `"200m"` |  |
 | manager.resources.limits.memory | string | `"128Mi"` |  |
 | manager.resources.requests.cpu | string | `"200m"` |  |
 | manager.resources.requests.memory | string | `"128Mi"` |  |
+| manager.webhookPort | int | `9443` | Set an alternative to the default container port.  Useful for use in some kubernetes clusters (such as GKE Private) with aggregator routing turned on, because pod ports have to be opened manually on the firewall side |
 
 ### ServiceMonitor Parameters
 
@@ -119,8 +124,6 @@ Here the values you can override:
 | serviceMonitor.labels | object | `{}` | Assign additional labels according to Prometheus' serviceMonitorSelector matching labels |
 | serviceMonitor.matchLabels | object | `{}` | Change matching labels |
 | serviceMonitor.namespace | string | `""` | Install the ServiceMonitor into a different Namespace, as the monitoring stack one (default: the release one) |
-| serviceMonitor.serviceAccount.name | string | `"capsule"` | ServiceAccount for Metrics RBAC |
-| serviceMonitor.serviceAccount.namespace | string | `"capsule-system"` | ServiceAccount Namespace for Metrics RBAC |
 | serviceMonitor.targetLabels | list | `[]` | Set targetLabels for the serviceMonitor |
 
 ### Webhook Parameters
@@ -157,6 +160,7 @@ Here the values you can override:
 | webhooks.services.failurePolicy | string | `"Fail"` |  |
 | webhooks.services.namespaceSelector.matchExpressions[0].key | string | `"capsule.clastix.io/tenant"` |  |
 | webhooks.services.namespaceSelector.matchExpressions[0].operator | string | `"Exists"` |  |
+| webhooks.tenantResourceObjects.failurePolicy | string | `"Fail"` |  |
 | webhooks.tenants.failurePolicy | string | `"Fail"` |  |
 
 ## Created resources

charts/capsule/templates/configuration-default.yaml

@@ -20,3 +20,7 @@ spec:
     - {{ . }}
 {{- end}}
   protectedNamespaceRegex: {{ .Values.manager.options.protectedNamespaceRegex | quote }}
+  {{- with .Values.manager.options.nodeMetadata }}
+  nodeMetadata:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}

charts/capsule/templates/daemonset.yaml

@@ -29,6 +29,10 @@ spec:
         {{- toYaml . | nindent 8 }}
       {{- end }}
       serviceAccountName: {{ include "capsule.serviceAccountName" . }}
+      {{- with .Values.podSecurityContext }}
+      securityContext:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       {{- if .Values.manager.hostNetwork }}
       hostNetwork: true
       dnsPolicy: ClusterFirstWithHostNet
@@ -56,6 +60,7 @@ spec:
           command:
           - /manager
           args:
+          - --webhook-port={{ .Values.manager.webhookPort }}
           - --enable-leader-election
           - --zap-log-level={{ default 4 .Values.manager.options.logLevel }}
           - --configuration-name=default
@@ -68,7 +73,7 @@ spec:
                 fieldPath: metadata.namespace
           ports:
             - name: webhook-server
-              containerPort: 9443
+              containerPort: {{ .Values.manager.webhookPort }}
               protocol: TCP
             - name: metrics
               containerPort: 8080
@@ -84,5 +89,5 @@ spec:
           resources:
             {{- toYaml .Values.manager.resources | nindent 12 }}
           securityContext:
-            allowPrivilegeEscalation: false
+            {{- toYaml .Values.securityContext | nindent 12 }}
 {{- end }}

charts/capsule/templates/deployment.yaml

@@ -28,6 +28,10 @@ spec:
         {{- toYaml . | nindent 8 }}
       {{- end }}
       serviceAccountName: {{ include "capsule.serviceAccountName" . }}
+      {{- with .Values.podSecurityContext }}
+      securityContext:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       {{- if .Values.manager.hostNetwork }}
       hostNetwork: true
       dnsPolicy: ClusterFirstWithHostNet
@@ -45,6 +49,10 @@ spec:
       affinity:
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- with .Values.topologySpreadConstraints }}
+      topologySpreadConstraints:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       volumes:
         - name: cert
           secret:
@@ -55,6 +63,7 @@ spec:
           command:
           - /manager
           args:
+          - --webhook-port={{ .Values.manager.webhookPort }}
           - --enable-leader-election
           - --zap-log-level={{ default 4 .Values.manager.options.logLevel }}
           - --configuration-name=default
@@ -67,7 +76,7 @@ spec:
                 fieldPath: metadata.namespace
           ports:
             - name: webhook-server
-              containerPort: 9443
+              containerPort: {{ .Values.manager.webhookPort }}
               protocol: TCP
             - name: metrics
               containerPort: 8080
@@ -83,5 +92,5 @@ spec:
           resources:
             {{- toYaml .Values.manager.resources | nindent 12 }}
           securityContext:
-            allowPrivilegeEscalation: false
+            {{- toYaml .Values.securityContext | nindent 12 }}
 {{- end }}

charts/capsule/templates/metrics-rbac.yaml

@@ -1,46 +0,0 @@
-{{- if .Values.serviceMonitor.enabled }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  labels:
-    {{- include "capsule.labels" . | nindent 4 }}
-  {{- if .Values.serviceMonitor.labels }}
-    {{- toYaml .Values.serviceMonitor.labels | nindent 4 }}
-  {{- end }}
-  {{- with .Values.customAnnotations }}
-  annotations:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-  name: {{ include "capsule.fullname" . }}-metrics-role
-  namespace: {{ .Values.serviceMonitor.namespace | default .Release.Namespace }}
-rules:
-- apiGroups:
-  - ""
-  resources:
-  - services
-  - endpoints
-  - pods
-  verbs:
-  - get
-  - list
-  - watch
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  labels:
-    {{- include "capsule.labels" . | nindent 4 }}
-    {{- if .Values.serviceMonitor.labels }}
-    {{- toYaml .Values.serviceMonitor.labels | nindent 4 }}
-    {{- end }}
-  name: {{ include "capsule.fullname" . }}-metrics-rolebinding
-  namespace: {{ .Values.serviceMonitor.namespace | default .Release.Namespace }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: {{ include "capsule.fullname" . }}-metrics-role
-subjects:
-- kind: ServiceAccount
-  name: {{ .Values.serviceMonitor.serviceAccount.name }}
-  namespace: {{ .Values.serviceMonitor.serviceAccount.namespace | default .Release.Namespace }}
-{{- end }}

charts/capsule/templates/post-install-job.yaml

@@ -45,5 +45,11 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: metadata.namespace
+        securityContext:
+            {{- toYaml .Values.securityContext | nindent 12 }}
       serviceAccountName: {{ include "capsule.serviceAccountName" . }}
+      {{- with .Values.podSecurityContext }}
+      securityContext:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
 {{- end }}

charts/capsule/templates/pre-delete-job.yaml

@@ -47,4 +47,10 @@ spec:
               valueFrom:
                 fieldRef:
                   fieldPath: metadata.namespace
+          securityContext:
+            {{- toYaml .Values.securityContext | nindent 12 }}
       serviceAccountName: {{ include "capsule.serviceAccountName" . }}
+      {{- with .Values.podSecurityContext }}
+      securityContext:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}

charts/capsule/templates/validatingwebhookconfiguration.yaml

@@ -257,6 +257,38 @@ webhooks:
       scope: Namespaced
   sideEffects: None
   timeoutSeconds: {{ .Values.validatingWebhooksTimeoutSeconds }}
+- admissionReviewVersions:
+    - v1
+  clientConfig:
+{{- if not .Values.certManager.generateCertificates }}
+    caBundle: Cg==
+{{- end }}
+    service:
+      name: capsule-webhook-service
+      namespace: {{ .Release.Namespace }}
+      path: /tenantresource-objects
+  failurePolicy:  {{ .Values.webhooks.tenantResourceObjects.failurePolicy }}
+  name: resource-objects.tenant.capsule.clastix.io
+  namespaceSelector:
+    matchExpressions:
+      - key: capsule.clastix.io/tenant
+        operator: Exists
+  objectSelector:
+    matchExpressions:
+      - key: capsule.clastix.io/resources
+        operator: Exists
+  rules:
+    - apiGroups:
+        - '*'
+      apiVersions:
+        - '*'
+      operations:
+        - UPDATE
+        - DELETE
+      resources:
+        - '*'
+      scope: Namespaced
+  sideEffects: None
 - admissionReviewVersions:
     - v1
     - v1beta1

charts/capsule/templates/webhook-service.yaml

@@ -13,7 +13,7 @@ spec:
   - port: 443
     name: https
     protocol: TCP
-    targetPort: 9443
+    targetPort: {{ .Values.manager.webhookPort }}
   selector:
     {{- include "capsule.selectorLabels" . | nindent 4 }}
   sessionAffinity: None

charts/capsule/values.yaml

@@ -25,9 +25,6 @@ manager:
     # -- Overrides the image tag whose default is the chart appVersion.
     tag: ''
 
-  # -- Configuration for `imagePullSecrets` so that you can use a private images registry.
-  imagePullSecrets: []
-
   # -- Specifies if the container should be started in hostNetwork mode.
   #
   # Required for use in some managed kubernetes clusters (such as AWS EKS) with custom
@@ -35,6 +32,13 @@ manager:
   # with pods' IP CIDR and admission webhooks are not working
   hostNetwork: false
 
+  # -- Set an alternative to the default container port.
+  #
+  # Useful for use in some kubernetes clusters (such as GKE Private) with
+  # aggregator routing turned on, because pod ports have to be opened manually
+  # on the firewall side
+  webhookPort: 9443
+
   # Additional Capsule Controller Options
   options:
     # -- Set the log verbosity of the capsule with a value from 1 to 10
@@ -47,6 +51,14 @@ manager:
     protectedNamespaceRegex: ""
     # -- Specifies whether capsule webhooks certificates should be generated by capsule operator
     generateCertificates: true
+    # -- Allows to set the forbidden metadata for the worker nodes that could be patched by a Tenant
+    nodeMetadata:
+      forbiddenLabels:
+        denied: []
+        deniedRegex: ""
+      forbiddenAnnotations:
+        denied: []
+        deniedRegex: ""
 
   # -- Configure the liveness probe using Deployment probe spec
   livenessProbe:
@@ -68,6 +80,9 @@ manager:
       cpu: 200m
       memory: 128Mi
 
+# -- Configuration for `imagePullSecrets` so that you can use a private images registry.
+imagePullSecrets: []
+
 # -- Annotations to add to the capsule pod.
 podAnnotations: {}
 #  The following annotations guarantee scheduling for critical add-on pods
@@ -77,6 +92,23 @@ podAnnotations: {}
 # -- Set the priority class name of the Capsule pod
 priorityClassName: '' # system-cluster-critical
 
+# -- Set the securityContext for the Capsule pod
+podSecurityContext:
+  seccompProfile:
+    type: "RuntimeDefault"
+  runAsGroup: 1002
+  runAsNonRoot: true
+  runAsUser: 1002
+
+
+# -- Set the securityContext for the Capsule container
+securityContext:
+  capabilities:
+    drop:
+    - ALL
+  allowPrivilegeEscalation: false
+  readOnlyRootFilesystem: true
+
 # -- Set the node selector for the Capsule pod
 nodeSelector: {}
 #  node-role.kubernetes.io/master: ""
@@ -94,6 +126,9 @@ replicaCount: 1
 # -- Set affinity rules for the Capsule pod
 affinity: {}
 
+# -- Set topology spread constraints for the Capsule pod
+topologySpreadConstraints: []
+
 podSecurityPolicy:
   # -- Specify if a Pod Security Policy must be created
   enabled: false
@@ -164,6 +199,8 @@ webhooks:
           operator: Exists
   tenants:
     failurePolicy: Fail
+  tenantResourceObjects:
+    failurePolicy: Fail
   services:
     failurePolicy: Fail
     namespaceSelector:
@@ -212,11 +249,6 @@ serviceMonitor:
   matchLabels: {}
   # -- Set targetLabels for the serviceMonitor
   targetLabels: []
-  serviceAccount:
-    # -- ServiceAccount for Metrics RBAC
-    name: capsule
-    # -- ServiceAccount Namespace for Metrics RBAC
-    namespace: capsule-system
   endpoint:
     # -- Set the scrape interval for the endpoint of the serviceMonitor
     interval: "15s"

config/install.yaml

@@ -790,44 +790,44 @@ spec:
                   description: NetworkPolicySpec provides the specification of a NetworkPolicy
                   properties:
                     egress:
-                      description: List of egress rules to be applied to the selected pods. Outgoing traffic is allowed if there are no NetworkPolicies selecting the pod (and cluster policy otherwise allows the traffic), OR if the traffic matches at least one egress rule across all of the NetworkPolicy objects whose podSelector matches the pod. If this field is empty then this NetworkPolicy limits all outgoing traffic (and serves solely to ensure that the pods it selects are isolated by default). This field is beta-level in 1.8
+                      description: egress is a list of egress rules to be applied to the selected pods. Outgoing traffic is allowed if there are no NetworkPolicies selecting the pod (and cluster policy otherwise allows the traffic), OR if the traffic matches at least one egress rule across all of the NetworkPolicy objects whose podSelector matches the pod. If this field is empty then this NetworkPolicy limits all outgoing traffic (and serves solely to ensure that the pods it selects are isolated by default). This field is beta-level in 1.8
                       items:
                         description: NetworkPolicyEgressRule describes a particular set of traffic that is allowed out of pods matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and to. This type is beta-level in 1.8
                         properties:
                           ports:
-                            description: List of destination ports for outgoing traffic. Each item in this list is combined using a logical OR. If this field is empty or missing, this rule matches all ports (traffic not restricted by port). If this field is present and contains at least one item, then this rule allows traffic only if the traffic matches at least one port in the list.
+                            description: ports is a list of destination ports for outgoing traffic. Each item in this list is combined using a logical OR. If this field is empty or missing, this rule matches all ports (traffic not restricted by port). If this field is present and contains at least one item, then this rule allows traffic only if the traffic matches at least one port in the list.
                             items:
                               description: NetworkPolicyPort describes a port to allow traffic on
                               properties:
                                 endPort:
-                                  description: If set, indicates that the range of ports from port to endPort, inclusive, should be allowed by the policy. This field cannot be defined if the port field is not defined or if the port field is defined as a named (string) port. The endPort must be equal or greater than port. This feature is in Beta state and is enabled by default. It can be disabled using the Feature Gate "NetworkPolicyEndPort".
+                                  description: endPort indicates that the range of ports from port to endPort if set, inclusive, should be allowed by the policy. This field cannot be defined if the port field is not defined or if the port field is defined as a named (string) port. The endPort must be equal or greater than port.
                                   format: int32
                                   type: integer
                                 port:
                                   anyOf:
                                   - type: integer
                                   - type: string
-                                  description: The port on the given protocol. This can either be a numerical or named port on a pod. If this field is not provided, this matches all port names and numbers. If present, only traffic on the specified protocol AND port will be matched.
+                                  description: port represents the port on the given protocol. This can either be a numerical or named port on a pod. If this field is not provided, this matches all port names and numbers. If present, only traffic on the specified protocol AND port will be matched.
                                   x-kubernetes-int-or-string: true
                                 protocol:
                                   default: TCP
-                                  description: The protocol (TCP, UDP, or SCTP) which traffic must match. If not specified, this field defaults to TCP.
+                                  description: protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. If not specified, this field defaults to TCP.
                                   type: string
                               type: object
                             type: array
                           to:
-                            description: List of destinations for outgoing traffic of pods selected for this rule. Items in this list are combined using a logical OR operation. If this field is empty or missing, this rule matches all destinations (traffic not restricted by destination). If this field is present and contains at least one item, this rule allows traffic only if the traffic matches at least one item in the to list.
+                            description: to is a list of destinations for outgoing traffic of pods selected for this rule. Items in this list are combined using a logical OR operation. If this field is empty or missing, this rule matches all destinations (traffic not restricted by destination). If this field is present and contains at least one item, this rule allows traffic only if the traffic matches at least one item in the to list.
                             items:
                               description: NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of fields are allowed
                               properties:
                                 ipBlock:
-                                  description: IPBlock defines policy on a particular IPBlock. If this field is set then neither of the other fields can be.
+                                  description: ipBlock defines policy on a particular IPBlock. If this field is set then neither of the other fields can be.
                                   properties:
                                     cidr:
-                                      description: CIDR is a string representing the IP Block Valid examples are "192.168.1.1/24" or "2001:db9::/64"
+                                      description: cidr is a string representing the IPBlock Valid examples are "192.168.1.0/24" or "2001:db8::/64"
                                       type: string
                                     except:
-                                      description: Except is a slice of CIDRs that should not be included within an IP Block Valid examples are "192.168.1.1/24" or "2001:db9::/64" Except values will be rejected if they are outside the CIDR range
+                                      description: except is a slice of CIDRs that should not be included within an IPBlock Valid examples are "192.168.1.0/24" or "2001:db8::/64" Except values will be rejected if they are outside the cidr range
                                       items:
                                         type: string
                                       type: array
@@ -835,7 +835,7 @@ spec:
                                   - cidr
                                   type: object
                                 namespaceSelector:
-                                  description: "Selects Namespaces using cluster-scoped labels. This field follows standard label selector semantics; if present but empty, it selects all namespaces. \n If PodSelector is also set, then the NetworkPolicyPeer as a whole selects the Pods matching PodSelector in the Namespaces selected by NamespaceSelector. Otherwise it selects all Pods in the Namespaces selected by NamespaceSelector."
+                                  description: "namespaceSelector selects namespaces using cluster-scoped labels. This field follows standard label selector semantics; if present but empty, it selects all namespaces. \n If podSelector is also set, then the NetworkPolicyPeer as a whole selects the pods matching podSelector in the namespaces selected by namespaceSelector. Otherwise it selects all pods in the namespaces selected by namespaceSelector."
                                   properties:
                                     matchExpressions:
                                       description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
@@ -866,7 +866,7 @@ spec:
                                   type: object
                                   x-kubernetes-map-type: atomic
                                 podSelector:
-                                  description: "This is a label selector which selects Pods. This field follows standard label selector semantics; if present but empty, it selects all pods. \n If NamespaceSelector is also set, then the NetworkPolicyPeer as a whole selects the Pods matching PodSelector in the Namespaces selected by NamespaceSelector. Otherwise it selects the Pods matching PodSelector in the policy's own Namespace."
+                                  description: "podSelector is a label selector which selects pods. This field follows standard label selector semantics; if present but empty, it selects all pods. \n If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects the pods matching podSelector in the Namespaces selected by NamespaceSelector. Otherwise it selects the pods matching podSelector in the policy's own namespace."
                                   properties:
                                     matchExpressions:
                                       description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
@@ -901,23 +901,23 @@ spec:
                         type: object
                       type: array
                     ingress:
-                      description: List of ingress rules to be applied to the selected pods. Traffic is allowed to a pod if there are no NetworkPolicies selecting the pod (and cluster policy otherwise allows the traffic), OR if the traffic source is the pod's local node, OR if the traffic matches at least one ingress rule across all of the NetworkPolicy objects whose podSelector matches the pod. If this field is empty then this NetworkPolicy does not allow any traffic (and serves solely to ensure that the pods it selects are isolated by default)
+                      description: ingress is a list of ingress rules to be applied to the selected pods. Traffic is allowed to a pod if there are no NetworkPolicies selecting the pod (and cluster policy otherwise allows the traffic), OR if the traffic source is the pod's local node, OR if the traffic matches at least one ingress rule across all of the NetworkPolicy objects whose podSelector matches the pod. If this field is empty then this NetworkPolicy does not allow any traffic (and serves solely to ensure that the pods it selects are isolated by default)
                       items:
                         description: NetworkPolicyIngressRule describes a particular set of traffic that is allowed to the pods matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and from.
                         properties:
                           from:
-                            description: List of sources which should be able to access the pods selected for this rule. Items in this list are combined using a logical OR operation. If this field is empty or missing, this rule matches all sources (traffic not restricted by source). If this field is present and contains at least one item, this rule allows traffic only if the traffic matches at least one item in the from list.
+                            description: from is a list of sources which should be able to access the pods selected for this rule. Items in this list are combined using a logical OR operation. If this field is empty or missing, this rule matches all sources (traffic not restricted by source). If this field is present and contains at least one item, this rule allows traffic only if the traffic matches at least one item in the from list.
                             items:
                               description: NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of fields are allowed
                               properties:
                                 ipBlock:
-                                  description: IPBlock defines policy on a particular IPBlock. If this field is set then neither of the other fields can be.
+                                  description: ipBlock defines policy on a particular IPBlock. If this field is set then neither of the other fields can be.
                                   properties:
                                     cidr:
-                                      description: CIDR is a string representing the IP Block Valid examples are "192.168.1.1/24" or "2001:db9::/64"
+                                      description: cidr is a string representing the IPBlock Valid examples are "192.168.1.0/24" or "2001:db8::/64"
                                       type: string
                                     except:
-                                      description: Except is a slice of CIDRs that should not be included within an IP Block Valid examples are "192.168.1.1/24" or "2001:db9::/64" Except values will be rejected if they are outside the CIDR range
+                                      description: except is a slice of CIDRs that should not be included within an IPBlock Valid examples are "192.168.1.0/24" or "2001:db8::/64" Except values will be rejected if they are outside the cidr range
                                       items:
                                         type: string
                                       type: array
@@ -925,7 +925,7 @@ spec:
                                   - cidr
                                   type: object
                                 namespaceSelector:
-                                  description: "Selects Namespaces using cluster-scoped labels. This field follows standard label selector semantics; if present but empty, it selects all namespaces. \n If PodSelector is also set, then the NetworkPolicyPeer as a whole selects the Pods matching PodSelector in the Namespaces selected by NamespaceSelector. Otherwise it selects all Pods in the Namespaces selected by NamespaceSelector."
+                                  description: "namespaceSelector selects namespaces using cluster-scoped labels. This field follows standard label selector semantics; if present but empty, it selects all namespaces. \n If podSelector is also set, then the NetworkPolicyPeer as a whole selects the pods matching podSelector in the namespaces selected by namespaceSelector. Otherwise it selects all pods in the namespaces selected by namespaceSelector."
                                   properties:
                                     matchExpressions:
                                       description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
@@ -956,7 +956,7 @@ spec:
                                   type: object
                                   x-kubernetes-map-type: atomic
                                 podSelector:
-                                  description: "This is a label selector which selects Pods. This field follows standard label selector semantics; if present but empty, it selects all pods. \n If NamespaceSelector is also set, then the NetworkPolicyPeer as a whole selects the Pods matching PodSelector in the Namespaces selected by NamespaceSelector. Otherwise it selects the Pods matching PodSelector in the policy's own Namespace."
+                                  description: "podSelector is a label selector which selects pods. This field follows standard label selector semantics; if present but empty, it selects all pods. \n If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects the pods matching podSelector in the Namespaces selected by NamespaceSelector. Otherwise it selects the pods matching podSelector in the policy's own namespace."
                                   properties:
                                     matchExpressions:
                                       description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
@@ -989,30 +989,30 @@ spec:
                               type: object
                             type: array
                           ports:
-                            description: List of ports which should be made accessible on the pods selected for this rule. Each item in this list is combined using a logical OR. If this field is empty or missing, this rule matches all ports (traffic not restricted by port). If this field is present and contains at least one item, then this rule allows traffic only if the traffic matches at least one port in the list.
+                            description: ports is a list of ports which should be made accessible on the pods selected for this rule. Each item in this list is combined using a logical OR. If this field is empty or missing, this rule matches all ports (traffic not restricted by port). If this field is present and contains at least one item, then this rule allows traffic only if the traffic matches at least one port in the list.
                             items:
                               description: NetworkPolicyPort describes a port to allow traffic on
                               properties:
                                 endPort:
-                                  description: If set, indicates that the range of ports from port to endPort, inclusive, should be allowed by the policy. This field cannot be defined if the port field is not defined or if the port field is defined as a named (string) port. The endPort must be equal or greater than port. This feature is in Beta state and is enabled by default. It can be disabled using the Feature Gate "NetworkPolicyEndPort".
+                                  description: endPort indicates that the range of ports from port to endPort if set, inclusive, should be allowed by the policy. This field cannot be defined if the port field is not defined or if the port field is defined as a named (string) port. The endPort must be equal or greater than port.
                                   format: int32
                                   type: integer
                                 port:
                                   anyOf:
                                   - type: integer
                                   - type: string
-                                  description: The port on the given protocol. This can either be a numerical or named port on a pod. If this field is not provided, this matches all port names and numbers. If present, only traffic on the specified protocol AND port will be matched.
+                                  description: port represents the port on the given protocol. This can either be a numerical or named port on a pod. If this field is not provided, this matches all port names and numbers. If present, only traffic on the specified protocol AND port will be matched.
                                   x-kubernetes-int-or-string: true
                                 protocol:
                                   default: TCP
-                                  description: The protocol (TCP, UDP, or SCTP) which traffic must match. If not specified, this field defaults to TCP.
+                                  description: protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. If not specified, this field defaults to TCP.
                                   type: string
                               type: object
                             type: array
                         type: object
                       type: array
                     podSelector:
-                      description: Selects the pods to which this NetworkPolicy object applies. The array of ingress rules is applied to any pods selected by this field. Multiple network policies can select the same set of pods. In this case, the ingress rules for each are combined additively. This field is NOT optional and follows standard label selector semantics. An empty podSelector matches all pods in this namespace.
+                      description: podSelector selects the pods to which this NetworkPolicy object applies. The array of ingress rules is applied to any pods selected by this field. Multiple network policies can select the same set of pods. In this case, the ingress rules for each are combined additively. This field is NOT optional and follows standard label selector semantics. An empty podSelector matches all pods in this namespace.
                       properties:
                         matchExpressions:
                           description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
@@ -1043,7 +1043,7 @@ spec:
                       type: object
                       x-kubernetes-map-type: atomic
                     policyTypes:
-                      description: List of rule types that the NetworkPolicy relates to. Valid options are ["Ingress"], ["Egress"], or ["Ingress", "Egress"]. If this field is not specified, it will default based on the existence of Ingress or Egress rules; policies that contain an Egress section are assumed to affect Egress, and all policies (whether or not they contain an Ingress section) are assumed to affect Ingress. If you want to write an egress-only policy, you must explicitly specify policyTypes [ "Egress" ]. Likewise, if you want to write a policy that specifies that no egress is allowed, you must specify a policyTypes value that include "Egress" (since such a policy would not include an Egress section and would otherwise default to just [ "Ingress" ]). This field is beta-level in 1.8
+                      description: policyTypes is a list of rule types that the NetworkPolicy relates to. Valid options are ["Ingress"], ["Egress"], or ["Ingress", "Egress"]. If this field is not specified, it will default based on the existence of ingress or egress rules; policies that contain an egress section are assumed to affect egress, and all policies (whether or not they contain an ingress section) are assumed to affect ingress. If you want to write an egress-only policy, you must explicitly specify policyTypes [ "Egress" ]. Likewise, if you want to write a policy that specifies that no egress is allowed, you must specify a policyTypes value that include "Egress" (since such a policy would not include an egress section and would otherwise default to just [ "Ingress" ]). This field is beta-level in 1.8
                       items:
                         description: PolicyType string describes the NetworkPolicy type This type is beta-level in 1.8
                         type: string
@@ -1378,44 +1378,44 @@ spec:
                       description: NetworkPolicySpec provides the specification of a NetworkPolicy
                       properties:
                         egress:
-                          description: List of egress rules to be applied to the selected pods. Outgoing traffic is allowed if there are no NetworkPolicies selecting the pod (and cluster policy otherwise allows the traffic), OR if the traffic matches at least one egress rule across all of the NetworkPolicy objects whose podSelector matches the pod. If this field is empty then this NetworkPolicy limits all outgoing traffic (and serves solely to ensure that the pods it selects are isolated by default). This field is beta-level in 1.8
+                          description: egress is a list of egress rules to be applied to the selected pods. Outgoing traffic is allowed if there are no NetworkPolicies selecting the pod (and cluster policy otherwise allows the traffic), OR if the traffic matches at least one egress rule across all of the NetworkPolicy objects whose podSelector matches the pod. If this field is empty then this NetworkPolicy limits all outgoing traffic (and serves solely to ensure that the pods it selects are isolated by default). This field is beta-level in 1.8
                           items:
                             description: NetworkPolicyEgressRule describes a particular set of traffic that is allowed out of pods matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and to. This type is beta-level in 1.8
                             properties:
                               ports:
-                                description: List of destination ports for outgoing traffic. Each item in this list is combined using a logical OR. If this field is empty or missing, this rule matches all ports (traffic not restricted by port). If this field is present and contains at least one item, then this rule allows traffic only if the traffic matches at least one port in the list.
+                                description: ports is a list of destination ports for outgoing traffic. Each item in this list is combined using a logical OR. If this field is empty or missing, this rule matches all ports (traffic not restricted by port). If this field is present and contains at least one item, then this rule allows traffic only if the traffic matches at least one port in the list.
                                 items:
                                   description: NetworkPolicyPort describes a port to allow traffic on
                                   properties:
                                     endPort:
-                                      description: If set, indicates that the range of ports from port to endPort, inclusive, should be allowed by the policy. This field cannot be defined if the port field is not defined or if the port field is defined as a named (string) port. The endPort must be equal or greater than port. This feature is in Beta state and is enabled by default. It can be disabled using the Feature Gate "NetworkPolicyEndPort".
+                                      description: endPort indicates that the range of ports from port to endPort if set, inclusive, should be allowed by the policy. This field cannot be defined if the port field is not defined or if the port field is defined as a named (string) port. The endPort must be equal or greater than port.
                                       format: int32
                                       type: integer
                                     port:
                                       anyOf:
                                       - type: integer
                                       - type: string
-                                      description: The port on the given protocol. This can either be a numerical or named port on a pod. If this field is not provided, this matches all port names and numbers. If present, only traffic on the specified protocol AND port will be matched.
+                                      description: port represents the port on the given protocol. This can either be a numerical or named port on a pod. If this field is not provided, this matches all port names and numbers. If present, only traffic on the specified protocol AND port will be matched.
                                       x-kubernetes-int-or-string: true
                                     protocol:
                                       default: TCP
-                                      description: The protocol (TCP, UDP, or SCTP) which traffic must match. If not specified, this field defaults to TCP.
+                                      description: protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. If not specified, this field defaults to TCP.
                                       type: string
                                   type: object
                                 type: array
                               to:
-                                description: List of destinations for outgoing traffic of pods selected for this rule. Items in this list are combined using a logical OR operation. If this field is empty or missing, this rule matches all destinations (traffic not restricted by destination). If this field is present and contains at least one item, this rule allows traffic only if the traffic matches at least one item in the to list.
+                                description: to is a list of destinations for outgoing traffic of pods selected for this rule. Items in this list are combined using a logical OR operation. If this field is empty or missing, this rule matches all destinations (traffic not restricted by destination). If this field is present and contains at least one item, this rule allows traffic only if the traffic matches at least one item in the to list.
                                 items:
                                   description: NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of fields are allowed
                                   properties:
                                     ipBlock:
-                                      description: IPBlock defines policy on a particular IPBlock. If this field is set then neither of the other fields can be.
+                                      description: ipBlock defines policy on a particular IPBlock. If this field is set then neither of the other fields can be.
                                       properties:
                                         cidr:
-                                          description: CIDR is a string representing the IP Block Valid examples are "192.168.1.1/24" or "2001:db9::/64"
+                                          description: cidr is a string representing the IPBlock Valid examples are "192.168.1.0/24" or "2001:db8::/64"
                                           type: string
                                         except:
-                                          description: Except is a slice of CIDRs that should not be included within an IP Block Valid examples are "192.168.1.1/24" or "2001:db9::/64" Except values will be rejected if they are outside the CIDR range
+                                          description: except is a slice of CIDRs that should not be included within an IPBlock Valid examples are "192.168.1.0/24" or "2001:db8::/64" Except values will be rejected if they are outside the cidr range
                                           items:
                                             type: string
                                           type: array
@@ -1423,7 +1423,7 @@ spec:
                                       - cidr
                                       type: object
                                     namespaceSelector:
-                                      description: "Selects Namespaces using cluster-scoped labels. This field follows standard label selector semantics; if present but empty, it selects all namespaces. \n If PodSelector is also set, then the NetworkPolicyPeer as a whole selects the Pods matching PodSelector in the Namespaces selected by NamespaceSelector. Otherwise it selects all Pods in the Namespaces selected by NamespaceSelector."
+                                      description: "namespaceSelector selects namespaces using cluster-scoped labels. This field follows standard label selector semantics; if present but empty, it selects all namespaces. \n If podSelector is also set, then the NetworkPolicyPeer as a whole selects the pods matching podSelector in the namespaces selected by namespaceSelector. Otherwise it selects all pods in the namespaces selected by namespaceSelector."
                                       properties:
                                         matchExpressions:
                                           description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
@@ -1454,7 +1454,7 @@ spec:
                                       type: object
                                       x-kubernetes-map-type: atomic
                                     podSelector:
-                                      description: "This is a label selector which selects Pods. This field follows standard label selector semantics; if present but empty, it selects all pods. \n If NamespaceSelector is also set, then the NetworkPolicyPeer as a whole selects the Pods matching PodSelector in the Namespaces selected by NamespaceSelector. Otherwise it selects the Pods matching PodSelector in the policy's own Namespace."
+                                      description: "podSelector is a label selector which selects pods. This field follows standard label selector semantics; if present but empty, it selects all pods. \n If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects the pods matching podSelector in the Namespaces selected by NamespaceSelector. Otherwise it selects the pods matching podSelector in the policy's own namespace."
                                       properties:
                                         matchExpressions:
                                           description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
@@ -1489,23 +1489,23 @@ spec:
                             type: object
                           type: array
                         ingress:
-                          description: List of ingress rules to be applied to the selected pods. Traffic is allowed to a pod if there are no NetworkPolicies selecting the pod (and cluster policy otherwise allows the traffic), OR if the traffic source is the pod's local node, OR if the traffic matches at least one ingress rule across all of the NetworkPolicy objects whose podSelector matches the pod. If this field is empty then this NetworkPolicy does not allow any traffic (and serves solely to ensure that the pods it selects are isolated by default)
+                          description: ingress is a list of ingress rules to be applied to the selected pods. Traffic is allowed to a pod if there are no NetworkPolicies selecting the pod (and cluster policy otherwise allows the traffic), OR if the traffic source is the pod's local node, OR if the traffic matches at least one ingress rule across all of the NetworkPolicy objects whose podSelector matches the pod. If this field is empty then this NetworkPolicy does not allow any traffic (and serves solely to ensure that the pods it selects are isolated by default)
                           items:
                             description: NetworkPolicyIngressRule describes a particular set of traffic that is allowed to the pods matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and from.
                             properties:
                               from:
-                                description: List of sources which should be able to access the pods selected for this rule. Items in this list are combined using a logical OR operation. If this field is empty or missing, this rule matches all sources (traffic not restricted by source). If this field is present and contains at least one item, this rule allows traffic only if the traffic matches at least one item in the from list.
+                                description: from is a list of sources which should be able to access the pods selected for this rule. Items in this list are combined using a logical OR operation. If this field is empty or missing, this rule matches all sources (traffic not restricted by source). If this field is present and contains at least one item, this rule allows traffic only if the traffic matches at least one item in the from list.
                                 items:
                                   description: NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of fields are allowed
                                   properties:
                                     ipBlock:
-                                      description: IPBlock defines policy on a particular IPBlock. If this field is set then neither of the other fields can be.
+                                      description: ipBlock defines policy on a particular IPBlock. If this field is set then neither of the other fields can be.
                                       properties:
                                         cidr:
-                                          description: CIDR is a string representing the IP Block Valid examples are "192.168.1.1/24" or "2001:db9::/64"
+                                          description: cidr is a string representing the IPBlock Valid examples are "192.168.1.0/24" or "2001:db8::/64"
                                           type: string
                                         except:
-                                          description: Except is a slice of CIDRs that should not be included within an IP Block Valid examples are "192.168.1.1/24" or "2001:db9::/64" Except values will be rejected if they are outside the CIDR range
+                                          description: except is a slice of CIDRs that should not be included within an IPBlock Valid examples are "192.168.1.0/24" or "2001:db8::/64" Except values will be rejected if they are outside the cidr range
                                           items:
                                             type: string
                                           type: array
@@ -1513,7 +1513,7 @@ spec:
                                       - cidr
                                       type: object
                                     namespaceSelector:
-                                      description: "Selects Namespaces using cluster-scoped labels. This field follows standard label selector semantics; if present but empty, it selects all namespaces. \n If PodSelector is also set, then the NetworkPolicyPeer as a whole selects the Pods matching PodSelector in the Namespaces selected by NamespaceSelector. Otherwise it selects all Pods in the Namespaces selected by NamespaceSelector."
+                                      description: "namespaceSelector selects namespaces using cluster-scoped labels. This field follows standard label selector semantics; if present but empty, it selects all namespaces. \n If podSelector is also set, then the NetworkPolicyPeer as a whole selects the pods matching podSelector in the namespaces selected by namespaceSelector. Otherwise it selects all pods in the namespaces selected by namespaceSelector."
                                       properties:
                                         matchExpressions:
                                           description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
@@ -1544,7 +1544,7 @@ spec:
                                       type: object
                                       x-kubernetes-map-type: atomic
                                     podSelector:
-                                      description: "This is a label selector which selects Pods. This field follows standard label selector semantics; if present but empty, it selects all pods. \n If NamespaceSelector is also set, then the NetworkPolicyPeer as a whole selects the Pods matching PodSelector in the Namespaces selected by NamespaceSelector. Otherwise it selects the Pods matching PodSelector in the policy's own Namespace."
+                                      description: "podSelector is a label selector which selects pods. This field follows standard label selector semantics; if present but empty, it selects all pods. \n If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects the pods matching podSelector in the Namespaces selected by NamespaceSelector. Otherwise it selects the pods matching podSelector in the policy's own namespace."
                                       properties:
                                         matchExpressions:
                                           description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
@@ -1577,30 +1577,30 @@ spec:
                                   type: object
                                 type: array
                               ports:
-                                description: List of ports which should be made accessible on the pods selected for this rule. Each item in this list is combined using a logical OR. If this field is empty or missing, this rule matches all ports (traffic not restricted by port). If this field is present and contains at least one item, then this rule allows traffic only if the traffic matches at least one port in the list.
+                                description: ports is a list of ports which should be made accessible on the pods selected for this rule. Each item in this list is combined using a logical OR. If this field is empty or missing, this rule matches all ports (traffic not restricted by port). If this field is present and contains at least one item, then this rule allows traffic only if the traffic matches at least one port in the list.
                                 items:
                                   description: NetworkPolicyPort describes a port to allow traffic on
                                   properties:
                                     endPort:
-                                      description: If set, indicates that the range of ports from port to endPort, inclusive, should be allowed by the policy. This field cannot be defined if the port field is not defined or if the port field is defined as a named (string) port. The endPort must be equal or greater than port. This feature is in Beta state and is enabled by default. It can be disabled using the Feature Gate "NetworkPolicyEndPort".
+                                      description: endPort indicates that the range of ports from port to endPort if set, inclusive, should be allowed by the policy. This field cannot be defined if the port field is not defined or if the port field is defined as a named (string) port. The endPort must be equal or greater than port.
                                       format: int32
                                       type: integer
                                     port:
                                       anyOf:
                                       - type: integer
                                       - type: string
-                                      description: The port on the given protocol. This can either be a numerical or named port on a pod. If this field is not provided, this matches all port names and numbers. If present, only traffic on the specified protocol AND port will be matched.
+                                      description: port represents the port on the given protocol. This can either be a numerical or named port on a pod. If this field is not provided, this matches all port names and numbers. If present, only traffic on the specified protocol AND port will be matched.
                                       x-kubernetes-int-or-string: true
                                     protocol:
                                       default: TCP
-                                      description: The protocol (TCP, UDP, or SCTP) which traffic must match. If not specified, this field defaults to TCP.
+                                      description: protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. If not specified, this field defaults to TCP.
                                       type: string
                                   type: object
                                 type: array
                             type: object
                           type: array
                         podSelector:
-                          description: Selects the pods to which this NetworkPolicy object applies. The array of ingress rules is applied to any pods selected by this field. Multiple network policies can select the same set of pods. In this case, the ingress rules for each are combined additively. This field is NOT optional and follows standard label selector semantics. An empty podSelector matches all pods in this namespace.
+                          description: podSelector selects the pods to which this NetworkPolicy object applies. The array of ingress rules is applied to any pods selected by this field. Multiple network policies can select the same set of pods. In this case, the ingress rules for each are combined additively. This field is NOT optional and follows standard label selector semantics. An empty podSelector matches all pods in this namespace.
                           properties:
                             matchExpressions:
                               description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
@@ -1631,7 +1631,7 @@ spec:
                           type: object
                           x-kubernetes-map-type: atomic
                         policyTypes:
-                          description: List of rule types that the NetworkPolicy relates to. Valid options are ["Ingress"], ["Egress"], or ["Ingress", "Egress"]. If this field is not specified, it will default based on the existence of Ingress or Egress rules; policies that contain an Egress section are assumed to affect Egress, and all policies (whether or not they contain an Ingress section) are assumed to affect Ingress. If you want to write an egress-only policy, you must explicitly specify policyTypes [ "Egress" ]. Likewise, if you want to write a policy that specifies that no egress is allowed, you must specify a policyTypes value that include "Egress" (since such a policy would not include an Egress section and would otherwise default to just [ "Ingress" ]). This field is beta-level in 1.8
+                          description: policyTypes is a list of rule types that the NetworkPolicy relates to. Valid options are ["Ingress"], ["Egress"], or ["Ingress", "Egress"]. If this field is not specified, it will default based on the existence of ingress or egress rules; policies that contain an egress section are assumed to affect egress, and all policies (whether or not they contain an ingress section) are assumed to affect ingress. If you want to write an egress-only policy, you must explicitly specify policyTypes [ "Egress" ]. Likewise, if you want to write a policy that specifies that no egress is allowed, you must specify a policyTypes value that include "Egress" (since such a policy would not include an egress section and would otherwise default to just [ "Ingress" ]). This field is beta-level in 1.8
                           items:
                             description: PolicyType string describes the NetworkPolicy type This type is beta-level in 1.8
                             type: string
@@ -2116,44 +2116,44 @@ spec:
                       description: NetworkPolicySpec provides the specification of a NetworkPolicy
                       properties:
                         egress:
-                          description: List of egress rules to be applied to the selected pods. Outgoing traffic is allowed if there are no NetworkPolicies selecting the pod (and cluster policy otherwise allows the traffic), OR if the traffic matches at least one egress rule across all of the NetworkPolicy objects whose podSelector matches the pod. If this field is empty then this NetworkPolicy limits all outgoing traffic (and serves solely to ensure that the pods it selects are isolated by default). This field is beta-level in 1.8
+                          description: egress is a list of egress rules to be applied to the selected pods. Outgoing traffic is allowed if there are no NetworkPolicies selecting the pod (and cluster policy otherwise allows the traffic), OR if the traffic matches at least one egress rule across all of the NetworkPolicy objects whose podSelector matches the pod. If this field is empty then this NetworkPolicy limits all outgoing traffic (and serves solely to ensure that the pods it selects are isolated by default). This field is beta-level in 1.8
                           items:
                             description: NetworkPolicyEgressRule describes a particular set of traffic that is allowed out of pods matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and to. This type is beta-level in 1.8
                             properties:
                               ports:
-                                description: List of destination ports for outgoing traffic. Each item in this list is combined using a logical OR. If this field is empty or missing, this rule matches all ports (traffic not restricted by port). If this field is present and contains at least one item, then this rule allows traffic only if the traffic matches at least one port in the list.
+                                description: ports is a list of destination ports for outgoing traffic. Each item in this list is combined using a logical OR. If this field is empty or missing, this rule matches all ports (traffic not restricted by port). If this field is present and contains at least one item, then this rule allows traffic only if the traffic matches at least one port in the list.
                                 items:
                                   description: NetworkPolicyPort describes a port to allow traffic on
                                   properties:
                                     endPort:
-                                      description: If set, indicates that the range of ports from port to endPort, inclusive, should be allowed by the policy. This field cannot be defined if the port field is not defined or if the port field is defined as a named (string) port. The endPort must be equal or greater than port. This feature is in Beta state and is enabled by default. It can be disabled using the Feature Gate "NetworkPolicyEndPort".
+                                      description: endPort indicates that the range of ports from port to endPort if set, inclusive, should be allowed by the policy. This field cannot be defined if the port field is not defined or if the port field is defined as a named (string) port. The endPort must be equal or greater than port.
                                       format: int32
                                       type: integer
                                     port:
                                       anyOf:
                                       - type: integer
                                       - type: string
-                                      description: The port on the given protocol. This can either be a numerical or named port on a pod. If this field is not provided, this matches all port names and numbers. If present, only traffic on the specified protocol AND port will be matched.
+                                      description: port represents the port on the given protocol. This can either be a numerical or named port on a pod. If this field is not provided, this matches all port names and numbers. If present, only traffic on the specified protocol AND port will be matched.
                                       x-kubernetes-int-or-string: true
                                     protocol:
                                       default: TCP
-                                      description: The protocol (TCP, UDP, or SCTP) which traffic must match. If not specified, this field defaults to TCP.
+                                      description: protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. If not specified, this field defaults to TCP.
                                       type: string
                                   type: object
                                 type: array
                               to:
-                                description: List of destinations for outgoing traffic of pods selected for this rule. Items in this list are combined using a logical OR operation. If this field is empty or missing, this rule matches all destinations (traffic not restricted by destination). If this field is present and contains at least one item, this rule allows traffic only if the traffic matches at least one item in the to list.
+                                description: to is a list of destinations for outgoing traffic of pods selected for this rule. Items in this list are combined using a logical OR operation. If this field is empty or missing, this rule matches all destinations (traffic not restricted by destination). If this field is present and contains at least one item, this rule allows traffic only if the traffic matches at least one item in the to list.
                                 items:
                                   description: NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of fields are allowed
                                   properties:
                                     ipBlock:
-                                      description: IPBlock defines policy on a particular IPBlock. If this field is set then neither of the other fields can be.
+                                      description: ipBlock defines policy on a particular IPBlock. If this field is set then neither of the other fields can be.
                                       properties:
                                         cidr:
-                                          description: CIDR is a string representing the IP Block Valid examples are "192.168.1.1/24" or "2001:db9::/64"
+                                          description: cidr is a string representing the IPBlock Valid examples are "192.168.1.0/24" or "2001:db8::/64"
                                           type: string
                                         except:
-                                          description: Except is a slice of CIDRs that should not be included within an IP Block Valid examples are "192.168.1.1/24" or "2001:db9::/64" Except values will be rejected if they are outside the CIDR range
+                                          description: except is a slice of CIDRs that should not be included within an IPBlock Valid examples are "192.168.1.0/24" or "2001:db8::/64" Except values will be rejected if they are outside the cidr range
                                           items:
                                             type: string
                                           type: array
@@ -2161,7 +2161,7 @@ spec:
                                       - cidr
                                       type: object
                                     namespaceSelector:
-                                      description: "Selects Namespaces using cluster-scoped labels. This field follows standard label selector semantics; if present but empty, it selects all namespaces. \n If PodSelector is also set, then the NetworkPolicyPeer as a whole selects the Pods matching PodSelector in the Namespaces selected by NamespaceSelector. Otherwise it selects all Pods in the Namespaces selected by NamespaceSelector."
+                                      description: "namespaceSelector selects namespaces using cluster-scoped labels. This field follows standard label selector semantics; if present but empty, it selects all namespaces. \n If podSelector is also set, then the NetworkPolicyPeer as a whole selects the pods matching podSelector in the namespaces selected by namespaceSelector. Otherwise it selects all pods in the namespaces selected by namespaceSelector."
                                       properties:
                                         matchExpressions:
                                           description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
@@ -2192,7 +2192,7 @@ spec:
                                       type: object
                                       x-kubernetes-map-type: atomic
                                     podSelector:
-                                      description: "This is a label selector which selects Pods. This field follows standard label selector semantics; if present but empty, it selects all pods. \n If NamespaceSelector is also set, then the NetworkPolicyPeer as a whole selects the Pods matching PodSelector in the Namespaces selected by NamespaceSelector. Otherwise it selects the Pods matching PodSelector in the policy's own Namespace."
+                                      description: "podSelector is a label selector which selects pods. This field follows standard label selector semantics; if present but empty, it selects all pods. \n If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects the pods matching podSelector in the Namespaces selected by NamespaceSelector. Otherwise it selects the pods matching podSelector in the policy's own namespace."
                                       properties:
                                         matchExpressions:
                                           description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
@@ -2227,23 +2227,23 @@ spec:
                             type: object
                           type: array
                         ingress:
-                          description: List of ingress rules to be applied to the selected pods. Traffic is allowed to a pod if there are no NetworkPolicies selecting the pod (and cluster policy otherwise allows the traffic), OR if the traffic source is the pod's local node, OR if the traffic matches at least one ingress rule across all of the NetworkPolicy objects whose podSelector matches the pod. If this field is empty then this NetworkPolicy does not allow any traffic (and serves solely to ensure that the pods it selects are isolated by default)
+                          description: ingress is a list of ingress rules to be applied to the selected pods. Traffic is allowed to a pod if there are no NetworkPolicies selecting the pod (and cluster policy otherwise allows the traffic), OR if the traffic source is the pod's local node, OR if the traffic matches at least one ingress rule across all of the NetworkPolicy objects whose podSelector matches the pod. If this field is empty then this NetworkPolicy does not allow any traffic (and serves solely to ensure that the pods it selects are isolated by default)
                           items:
                             description: NetworkPolicyIngressRule describes a particular set of traffic that is allowed to the pods matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and from.
                             properties:
                               from:
-                                description: List of sources which should be able to access the pods selected for this rule. Items in this list are combined using a logical OR operation. If this field is empty or missing, this rule matches all sources (traffic not restricted by source). If this field is present and contains at least one item, this rule allows traffic only if the traffic matches at least one item in the from list.
+                                description: from is a list of sources which should be able to access the pods selected for this rule. Items in this list are combined using a logical OR operation. If this field is empty or missing, this rule matches all sources (traffic not restricted by source). If this field is present and contains at least one item, this rule allows traffic only if the traffic matches at least one item in the from list.
                                 items:
                                   description: NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of fields are allowed
                                   properties:
                                     ipBlock:
-                                      description: IPBlock defines policy on a particular IPBlock. If this field is set then neither of the other fields can be.
+                                      description: ipBlock defines policy on a particular IPBlock. If this field is set then neither of the other fields can be.
                                       properties:
                                         cidr:
-                                          description: CIDR is a string representing the IP Block Valid examples are "192.168.1.1/24" or "2001:db9::/64"
+                                          description: cidr is a string representing the IPBlock Valid examples are "192.168.1.0/24" or "2001:db8::/64"
                                           type: string
                                         except:
-                                          description: Except is a slice of CIDRs that should not be included within an IP Block Valid examples are "192.168.1.1/24" or "2001:db9::/64" Except values will be rejected if they are outside the CIDR range
+                                          description: except is a slice of CIDRs that should not be included within an IPBlock Valid examples are "192.168.1.0/24" or "2001:db8::/64" Except values will be rejected if they are outside the cidr range
                                           items:
                                             type: string
                                           type: array
@@ -2251,7 +2251,7 @@ spec:
                                       - cidr
                                       type: object
                                     namespaceSelector:
-                                      description: "Selects Namespaces using cluster-scoped labels. This field follows standard label selector semantics; if present but empty, it selects all namespaces. \n If PodSelector is also set, then the NetworkPolicyPeer as a whole selects the Pods matching PodSelector in the Namespaces selected by NamespaceSelector. Otherwise it selects all Pods in the Namespaces selected by NamespaceSelector."
+                                      description: "namespaceSelector selects namespaces using cluster-scoped labels. This field follows standard label selector semantics; if present but empty, it selects all namespaces. \n If podSelector is also set, then the NetworkPolicyPeer as a whole selects the pods matching podSelector in the namespaces selected by namespaceSelector. Otherwise it selects all pods in the namespaces selected by namespaceSelector."
                                       properties:
                                         matchExpressions:
                                           description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
@@ -2282,7 +2282,7 @@ spec:
                                       type: object
                                       x-kubernetes-map-type: atomic
                                     podSelector:
-                                      description: "This is a label selector which selects Pods. This field follows standard label selector semantics; if present but empty, it selects all pods. \n If NamespaceSelector is also set, then the NetworkPolicyPeer as a whole selects the Pods matching PodSelector in the Namespaces selected by NamespaceSelector. Otherwise it selects the Pods matching PodSelector in the policy's own Namespace."
+                                      description: "podSelector is a label selector which selects pods. This field follows standard label selector semantics; if present but empty, it selects all pods. \n If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects the pods matching podSelector in the Namespaces selected by NamespaceSelector. Otherwise it selects the pods matching podSelector in the policy's own namespace."
                                       properties:
                                         matchExpressions:
                                           description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
@@ -2315,30 +2315,30 @@ spec:
                                   type: object
                                 type: array
                               ports:
-                                description: List of ports which should be made accessible on the pods selected for this rule. Each item in this list is combined using a logical OR. If this field is empty or missing, this rule matches all ports (traffic not restricted by port). If this field is present and contains at least one item, then this rule allows traffic only if the traffic matches at least one port in the list.
+                                description: ports is a list of ports which should be made accessible on the pods selected for this rule. Each item in this list is combined using a logical OR. If this field is empty or missing, this rule matches all ports (traffic not restricted by port). If this field is present and contains at least one item, then this rule allows traffic only if the traffic matches at least one port in the list.
                                 items:
                                   description: NetworkPolicyPort describes a port to allow traffic on
                                   properties:
                                     endPort:
-                                      description: If set, indicates that the range of ports from port to endPort, inclusive, should be allowed by the policy. This field cannot be defined if the port field is not defined or if the port field is defined as a named (string) port. The endPort must be equal or greater than port. This feature is in Beta state and is enabled by default. It can be disabled using the Feature Gate "NetworkPolicyEndPort".
+                                      description: endPort indicates that the range of ports from port to endPort if set, inclusive, should be allowed by the policy. This field cannot be defined if the port field is not defined or if the port field is defined as a named (string) port. The endPort must be equal or greater than port.
                                       format: int32
                                       type: integer
                                     port:
                                       anyOf:
                                       - type: integer
                                       - type: string
-                                      description: The port on the given protocol. This can either be a numerical or named port on a pod. If this field is not provided, this matches all port names and numbers. If present, only traffic on the specified protocol AND port will be matched.
+                                      description: port represents the port on the given protocol. This can either be a numerical or named port on a pod. If this field is not provided, this matches all port names and numbers. If present, only traffic on the specified protocol AND port will be matched.
                                       x-kubernetes-int-or-string: true
                                     protocol:
                                       default: TCP
-                                      description: The protocol (TCP, UDP, or SCTP) which traffic must match. If not specified, this field defaults to TCP.
+                                      description: protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. If not specified, this field defaults to TCP.
                                       type: string
                                   type: object
                                 type: array
                             type: object
                           type: array
                         podSelector:
-                          description: Selects the pods to which this NetworkPolicy object applies. The array of ingress rules is applied to any pods selected by this field. Multiple network policies can select the same set of pods. In this case, the ingress rules for each are combined additively. This field is NOT optional and follows standard label selector semantics. An empty podSelector matches all pods in this namespace.
+                          description: podSelector selects the pods to which this NetworkPolicy object applies. The array of ingress rules is applied to any pods selected by this field. Multiple network policies can select the same set of pods. In this case, the ingress rules for each are combined additively. This field is NOT optional and follows standard label selector semantics. An empty podSelector matches all pods in this namespace.
                           properties:
                             matchExpressions:
                               description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
@@ -2369,7 +2369,7 @@ spec:
                           type: object
                           x-kubernetes-map-type: atomic
                         policyTypes:
-                          description: List of rule types that the NetworkPolicy relates to. Valid options are ["Ingress"], ["Egress"], or ["Ingress", "Egress"]. If this field is not specified, it will default based on the existence of Ingress or Egress rules; policies that contain an Egress section are assumed to affect Egress, and all policies (whether or not they contain an Ingress section) are assumed to affect Ingress. If you want to write an egress-only policy, you must explicitly specify policyTypes [ "Egress" ]. Likewise, if you want to write a policy that specifies that no egress is allowed, you must specify a policyTypes value that include "Egress" (since such a policy would not include an Egress section and would otherwise default to just [ "Ingress" ]). This field is beta-level in 1.8
+                          description: policyTypes is a list of rule types that the NetworkPolicy relates to. Valid options are ["Ingress"], ["Egress"], or ["Ingress", "Egress"]. If this field is not specified, it will default based on the existence of ingress or egress rules; policies that contain an egress section are assumed to affect egress, and all policies (whether or not they contain an ingress section) are assumed to affect ingress. If you want to write an egress-only policy, you must explicitly specify policyTypes [ "Egress" ]. Likewise, if you want to write a policy that specifies that no egress is allowed, you must specify a policyTypes value that include "Egress" (since such a policy would not include an egress section and would otherwise default to just [ "Ingress" ]). This field is beta-level in 1.8
                           items:
                             description: PolicyType string describes the NetworkPolicy type This type is beta-level in 1.8
                             type: string
@@ -2416,6 +2416,8 @@ spec:
                             - StorageClasses
                             - IngressClasses
                             - PriorityClasses
+                            - RuntimeClasses
+                            - PersistentVolumes
                             type: string
                           operations:
                             items:
@@ -2767,7 +2769,7 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: metadata.namespace
-        image: clastix/capsule:v0.2.1
+        image: clastix/capsule:v0.3.3
         imagePullPolicy: IfNotPresent
         name: manager
         ports:
@@ -3110,6 +3112,35 @@ webhooks:
     - services
     scope: Namespaced
   sideEffects: None
+- admissionReviewVersions:
+  - v1
+  clientConfig:
+    service:
+      name: capsule-webhook-service
+      namespace: capsule-system
+      path: /tenantresource-objects
+  failurePolicy: Fail
+  name: resource-objects.tenant.capsule.clastix.io
+  namespaceSelector:
+    matchExpressions:
+    - key: capsule.clastix.io/tenant
+      operator: Exists
+  objectSelector:
+    matchExpressions:
+    - key: capsule.clastix.io/resources
+      operator: Exists
+  rules:
+  - apiGroups:
+    - '*'
+    apiVersions:
+    - '*'
+    operations:
+    - UPDATE
+    - DELETE
+    resources:
+    - '*'
+    scope: Namespaced
+  sideEffects: None
 - admissionReviewVersions:
   - v1
   clientConfig:

config/manager/kustomization.yaml

@@ -7,4 +7,4 @@ kind: Kustomization
 images:
 - name: controller
   newName: clastix/capsule
-  newTag: v0.2.1
+  newTag: v0.3.3

config/prometheus/kustomization.yaml

@@ -1,4 +1,2 @@
 resources:
 - monitor.yaml
-- role.yaml
-- rolebinding.yaml

config/prometheus/role.yaml

@@ -1,18 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  labels:
-    control-plane: controller-manager
-  name: capsule-metrics-role
-  namespace: capsule-system
-rules:
-- apiGroups:
-  - ""
-  resources:
-  - services
-  - endpoints
-  - pods
-  verbs:
-  - get
-  - list
-  - watch

config/prometheus/rolebinding.yaml

@@ -1,15 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  labels:
-    control-plane: controller-manager
-  name: capsule-metrics-rolebinding
-  namespace: system
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: capsule-metrics-role
-subjects:
-- kind: ServiceAccount
-  name: capsule
-  namespace: capsule-system

config/webhook/manifests.yaml

@@ -253,6 +253,26 @@ webhooks:
     resources:
     - services
   sideEffects: None
+- admissionReviewVersions:
+  - v1
+  clientConfig:
+    service:
+      name: webhook-service
+      namespace: system
+      path: /tenantresource-objects
+  failurePolicy: Fail
+  name: resource-objects.tenant.capsule.clastix.io
+  rules:
+  - apiGroups:
+    - '*'
+    apiVersions:
+    - '*'
+    operations:
+    - UPDATE
+    - DELETE
+    resources:
+    - '*'
+  sideEffects: None
 - admissionReviewVersions:
   - v1
   clientConfig:

config/webhook/patch_validating_ns_selector.yaml

@@ -40,6 +40,18 @@
     matchExpressions:
       - key: capsule.clastix.io/tenant
         operator: Exists
+- op: add
+  path: /webhooks/8/namespaceSelector
+  value:
+    matchExpressions:
+      - key: capsule.clastix.io/tenant
+        operator: Exists
+- op: add
+  path: /webhooks/8/objectSelector
+  value:
+    matchExpressions:
+      - key: capsule.clastix.io/resources
+        operator: Exists
 - op: add
   path: /webhooks/0/rules/0/scope
   value: Namespaced
@@ -58,3 +70,6 @@
 - op: add
   path: /webhooks/7/rules/0/scope
   value: Namespaced
+- op: add
+  path: /webhooks/8/rules/0/scope
+  value: Namespaced

controllers/config/manager.go

@@ -18,18 +18,14 @@ import (
 )
 
 type Manager struct {
-	Log    logr.Logger
-	Client client.Client
-}
+	client client.Client
 
-// InjectClient injects the Client interface, required by the Runnable interface.
-func (c *Manager) InjectClient(client client.Client) error {
-	c.Client = client
-
-	return nil
+	Log logr.Logger
 }
 
 func (c *Manager) SetupWithManager(mgr ctrl.Manager, configurationName string) error {
+	c.client = mgr.GetClient()
+
 	return ctrl.NewControllerManagedBy(mgr).
 		For(&capsulev1beta2.CapsuleConfiguration{}, utils.NamesMatchingPredicate(configurationName)).
 		Complete(c)
@@ -38,7 +34,7 @@ func (c *Manager) SetupWithManager(mgr ctrl.Manager, configurationName string) e
 func (c *Manager) Reconcile(ctx context.Context, request reconcile.Request) (res reconcile.Result, err error) {
 	c.Log.Info("CapsuleConfiguration reconciliation started", "request.name", request.Name)
 
-	cfg := configuration.NewCapsuleConfiguration(ctx, c.Client, request.Name)
+	cfg := configuration.NewCapsuleConfiguration(ctx, c.client, request.Name)
 	// Validating the Capsule Configuration options
 	if _, err = cfg.ProtectedNamespaceRegexp(); err != nil {
 		panic(errors.Wrap(err, "Invalid configuration for protected Namespace regex"))

controllers/rbac/manager.go

@@ -19,7 +19,6 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/event"
 	"sigs.k8s.io/controller-runtime/pkg/handler"
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
-	"sigs.k8s.io/controller-runtime/pkg/source"
 
 	capsulev1beta2 "github.com/clastix/capsule/api/v1beta2"
 	"github.com/clastix/capsule/controllers/utils"
@@ -32,13 +31,6 @@ type Manager struct {
 	Configuration configuration.Configuration
 }
 
-// InjectClient injects the Client interface, required by the Runnable interface.
-func (r *Manager) InjectClient(c client.Client) error {
-	r.Client = c
-
-	return nil
-}
-
 func (r *Manager) SetupWithManager(ctx context.Context, mgr ctrl.Manager, configurationName string) (err error) {
 	namesPredicate := utils.NamesMatchingPredicate(ProvisionerRoleName, DeleterRoleName)
 
@@ -51,8 +43,8 @@ func (r *Manager) SetupWithManager(ctx context.Context, mgr ctrl.Manager, config
 
 	crbErr := ctrl.NewControllerManagedBy(mgr).
 		For(&rbacv1.ClusterRoleBinding{}, namesPredicate).
-		Watches(source.NewKindWithCache(&capsulev1beta2.CapsuleConfiguration{}, mgr.GetCache()), handler.Funcs{
-			UpdateFunc: func(updateEvent event.UpdateEvent, limitingInterface workqueue.RateLimitingInterface) {
+		Watches(&capsulev1beta2.CapsuleConfiguration{}, handler.Funcs{
+			UpdateFunc: func(ctx context.Context, updateEvent event.UpdateEvent, limitingInterface workqueue.RateLimitingInterface) {
 				if updateEvent.ObjectNew.GetName() == configurationName {
 					if crbErr := r.EnsureClusterRoleBindings(ctx); crbErr != nil {
 						r.Log.Error(err, "cannot update ClusterRoleBinding upon CapsuleConfiguration update")

controllers/resources/global.go

@@ -20,7 +20,6 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/handler"
 	ctrllog "sigs.k8s.io/controller-runtime/pkg/log"
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
-	"sigs.k8s.io/controller-runtime/pkg/source"
 
 	capsulev1beta2 "github.com/clastix/capsule/api/v1beta2"
 )
@@ -30,11 +29,11 @@ type Global struct {
 	processor Processor
 }
 
-func (r *Global) enqueueRequestFromTenant(object client.Object) (reqs []reconcile.Request) {
+func (r *Global) enqueueRequestFromTenant(ctx context.Context, object client.Object) (reqs []reconcile.Request) {
 	tnt := object.(*capsulev1beta2.Tenant) //nolint:forcetypeassert
 
 	resList := capsulev1beta2.GlobalTenantResourceList{}
-	if err := r.client.List(context.Background(), &resList); err != nil {
+	if err := r.client.List(ctx, &resList); err != nil {
 		return nil
 	}
 
@@ -70,7 +69,7 @@ func (r *Global) SetupWithManager(mgr ctrl.Manager) error {
 
 	return ctrl.NewControllerManagedBy(mgr).
 		For(&capsulev1beta2.GlobalTenantResource{}).
-		Watches(&source.Kind{Type: &capsulev1beta2.Tenant{}}, handler.EnqueueRequestsFromMapFunc(r.enqueueRequestFromTenant)).
+		Watches(&capsulev1beta2.Tenant{}, handler.EnqueueRequestsFromMapFunc(r.enqueueRequestFromTenant)).
 		Complete(r)
 }
 
@@ -121,7 +120,7 @@ func (r *Global) reconcileNormal(ctx context.Context, tntResource *capsulev1beta
 	}
 
 	if tntResource.Status.ProcessedItems == nil {
-		tntResource.Status.ProcessedItems = make([]capsulev1beta2.ObjectReferenceStatus, 0, 0)
+		tntResource.Status.ProcessedItems = make([]capsulev1beta2.ObjectReferenceStatus, 0)
 	}
 
 	// Retrieving the list of the Tenants up to the selector provided by the GlobalTenantResource resource.
@@ -175,7 +174,7 @@ func (r *Global) reconcileNormal(ctx context.Context, tntResource *capsulev1beta
 		return reconcile.Result{}, err
 	}
 
-	if r.processor.HandlePruning(ctx, tntResource.Status.ProcessedItems.AsSet(), processedItems) {
+	if r.processor.HandlePruning(ctx, tntResource.Status.ProcessedItems.AsSet(), sets.Set[string](processedItems)) {
 		tntResource.Status.ProcessedItems = make([]capsulev1beta2.ObjectReferenceStatus, 0, len(processedItems))
 
 		for _, item := range processedItems.List() {

controllers/resources/namespaced.go

@@ -85,7 +85,7 @@ func (r *Namespaced) reconcileNormal(ctx context.Context, tntResource *capsulev1
 
 	// Adding the default value for the status
 	if tntResource.Status.ProcessedItems == nil {
-		tntResource.Status.ProcessedItems = make([]capsulev1beta2.ObjectReferenceStatus, 0, 0)
+		tntResource.Status.ProcessedItems = make([]capsulev1beta2.ObjectReferenceStatus, 0)
 	}
 
 	// Retrieving the parent of the Tenant Resource:
@@ -132,7 +132,7 @@ func (r *Namespaced) reconcileNormal(ctx context.Context, tntResource *capsulev1
 		return reconcile.Result{}, err
 	}
 
-	if r.processor.HandlePruning(ctx, tntResource.Status.ProcessedItems.AsSet(), processedItems) {
+	if r.processor.HandlePruning(ctx, tntResource.Status.ProcessedItems.AsSet(), sets.Set[string](processedItems)) {
 		tntResource.Status.ProcessedItems = make([]capsulev1beta2.ObjectReferenceStatus, 0, len(processedItems))
 
 		for _, item := range processedItems.List() {

controllers/resources/processor.go

@@ -8,6 +8,7 @@ import (
 	"fmt"
 
 	"github.com/hashicorp/go-multierror"
+	"github.com/valyala/fasttemplate"
 	corev1 "k8s.io/api/core/v1"
 	apierr "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -25,6 +26,7 @@ import (
 )
 
 const (
+	Label     = "capsule.clastix.io/resources"
 	finalizer = "capsule.clastix.io/resources"
 )
 
@@ -32,7 +34,7 @@ type Processor struct {
 	client client.Client
 }
 
-func (r *Processor) HandlePruning(ctx context.Context, current, desired sets.String) (updateStatus bool) {
+func (r *Processor) HandlePruning(ctx context.Context, current, desired sets.Set[string]) (updateStatus bool) {
 	log := ctrllog.FromContext(ctx)
 
 	diff := current.Difference(desired)
@@ -120,7 +122,7 @@ func (r *Processor) HandleSection(ctx context.Context, tnt capsulev1beta2.Tenant
 
 	objAnnotations[tenantLabel] = tnt.GetName()
 
-	objLabels["capsule.clastix.io/resources"] = fmt.Sprintf("%d", resourceIndex)
+	objLabels[Label] = fmt.Sprintf("%d", resourceIndex)
 	objLabels[tenantLabel] = tnt.GetName()
 	// processed will contain the sets of resources replicated, both for the raw and the Namespaced ones:
 	// these are required to perform a final pruning once the replication has been occurred.
@@ -130,81 +132,115 @@ func (r *Processor) HandleSection(ctx context.Context, tnt capsulev1beta2.Tenant
 
 	syncErr := new(multierror.Error)
 
-	for nsIndex, item := range spec.NamespacedItems {
-		keysAndValues := []interface{}{"index", nsIndex, "namespace", item.Namespace}
-		// A TenantResource is created by a TenantOwner, and potentially, they could point to a resource in a non-owned
-		// Namespace: this must be blocked by checking it this is the case.
-		if !allowCrossNamespaceSelection && !tntNamespaces.Has(item.Namespace) {
-			log.Info("skipping processing of namespacedItem, referring a Namespace that is not part of the given Global", keysAndValues...)
-
-			continue
-		}
-		// Namespaced Items are relying on selecting resources, rather than specifying a specific name:
-		// creating it to get used by the client List action.
-		itemSelector, selectorErr := metav1.LabelSelectorAsSelector(&item.Selector)
-		if err != nil {
-			log.Error(selectorErr, "cannot create Selector for namespacedItem", keysAndValues...)
-
-			continue
-		}
-
-		objs := unstructured.UnstructuredList{}
-		objs.SetGroupVersionKind(schema.FromAPIVersionAndKind(item.APIVersion, fmt.Sprintf("%sList", item.Kind)))
-
-		if clientErr := r.client.List(ctx, &objs, client.InNamespace(item.Namespace), client.MatchingLabelsSelector{Selector: itemSelector}); clientErr != nil {
-			log.Error(clientErr, "cannot retrieve object for namespacedItem", keysAndValues...)
-
-			syncErr = multierror.Append(syncErr, clientErr)
-
-			continue
-		}
-
-		multiErr := new(multierror.Group)
-		// Iterating over all the retrieved objects from the resource spec to get replicated in all the selected Namespaces:
-		// in case of error during the create or update function, this will be appended to the list of errors.
-		for _, o := range objs.Items {
-			obj := o
-
-			multiErr.Go(func() error {
-				nsItems, nsErr := r.createOrUpdate(ctx, &obj, objLabels, objAnnotations, namespaces)
-				if nsErr != nil {
-					log.Error(err, "unable to sync namespacedItems", keysAndValues...)
-
-					return nsErr
-				}
-
-				processed.Insert(nsItems...)
-
-				return nil
-			})
-		}
-
-		if objsErr := multiErr.Wait(); objsErr != nil {
-			syncErr = multierror.Append(syncErr, objsErr)
-		}
-	}
-
 	codecFactory := serializer.NewCodecFactory(r.client.Scheme())
 
-	for rawIndex, item := range spec.RawItems {
-		obj, keysAndValues := unstructured.Unstructured{}, []interface{}{"index", rawIndex}
+	for _, ns := range namespaces.Items {
+		for nsIndex, item := range spec.NamespacedItems {
+			keysAndValues := []any{"index", nsIndex, "namespace", item.Namespace}
+			// A TenantResource is created by a TenantOwner, and potentially, they could point to a resource in a non-owned
+			// Namespace: this must be blocked by checking it this is the case.
+			if !allowCrossNamespaceSelection && !tntNamespaces.Has(item.Namespace) {
+				log.Info("skipping processing of namespacedItem, referring a Namespace that is not part of the given Tenant", keysAndValues...)
 
-		if _, _, decodeErr := codecFactory.UniversalDeserializer().Decode(item.Raw, nil, &obj); decodeErr != nil {
-			log.Error(decodeErr, "unable to deserialize rawItem", keysAndValues...)
+				continue
+			}
+			// Namespaced Items are relying on selecting resources, rather than specifying a specific name:
+			// creating it to get used by the client List action.
+			itemSelector, selectorErr := metav1.LabelSelectorAsSelector(&item.Selector)
+			if selectorErr != nil {
+				log.Error(selectorErr, "cannot create Selector for namespacedItem", keysAndValues...)
 
-			syncErr = multierror.Append(syncErr, decodeErr)
+				syncErr = multierror.Append(syncErr, selectorErr)
 
-			continue
+				continue
+			}
+
+			objs := unstructured.UnstructuredList{}
+			objs.SetGroupVersionKind(schema.FromAPIVersionAndKind(item.APIVersion, fmt.Sprintf("%sList", item.Kind)))
+
+			if clientErr := r.client.List(ctx, &objs, client.InNamespace(item.Namespace), client.MatchingLabelsSelector{Selector: itemSelector}); clientErr != nil {
+				log.Error(clientErr, "cannot retrieve object for namespacedItem", keysAndValues...)
+
+				syncErr = multierror.Append(syncErr, clientErr)
+
+				continue
+			}
+
+			multiErr := new(multierror.Group)
+			// Iterating over all the retrieved objects from the resource spec to get replicated in all the selected Namespaces:
+			// in case of error during the create or update function, this will be appended to the list of errors.
+			for _, o := range objs.Items {
+				obj := o
+				obj.SetNamespace(ns.Name)
+				obj.SetOwnerReferences(nil)
+
+				multiErr.Go(func() error {
+					kv := keysAndValues
+					kv = append(kv, "resource", fmt.Sprintf("%s/%s", obj.GetNamespace(), obj.GetNamespace()))
+
+					if opErr := r.createOrUpdate(ctx, &obj, objLabels, objAnnotations); opErr != nil {
+						log.Error(opErr, "unable to sync namespacedItems", kv...)
+
+						return opErr
+					}
+
+					log.Info("resource has been replicated", kv...)
+
+					replicatedItem := &capsulev1beta2.ObjectReferenceStatus{}
+					replicatedItem.Name = obj.GetName()
+					replicatedItem.Kind = obj.GetKind()
+					replicatedItem.Namespace = ns.Name
+					replicatedItem.APIVersion = obj.GetAPIVersion()
+
+					processed.Insert(replicatedItem.String())
+
+					return nil
+				})
+			}
+
+			if objsErr := multiErr.Wait(); objsErr != nil {
+				syncErr = multierror.Append(syncErr, objsErr)
+			}
 		}
 
-		syncedRaw, rawErr := r.createOrUpdate(ctx, &obj, objLabels, objAnnotations, namespaces)
-		if rawErr != nil {
-			log.Info("unable to sync rawItem", keysAndValues...)
-			// In case of error processing an item in one of any selected Namespaces, storing it to report it lately
-			// to the upper call to ensure a partial sync that will be fixed by a subsequent reconciliation.
-			syncErr = multierror.Append(syncErr, rawErr)
-		} else {
-			processed.Insert(syncedRaw...)
+		for rawIndex, item := range spec.RawItems {
+			template := string(item.Raw)
+
+			t := fasttemplate.New(template, "{{ ", " }}")
+
+			tmplString := t.ExecuteString(map[string]interface{}{
+				"tenant.name": tnt.Name,
+				"namespace":   ns.Name,
+			})
+
+			obj, keysAndValues := unstructured.Unstructured{}, []interface{}{"index", rawIndex}
+
+			if _, _, decodeErr := codecFactory.UniversalDeserializer().Decode([]byte(tmplString), nil, &obj); decodeErr != nil {
+				log.Error(decodeErr, "unable to deserialize rawItem", keysAndValues...)
+
+				syncErr = multierror.Append(syncErr, decodeErr)
+
+				continue
+			}
+
+			obj.SetNamespace(ns.Name)
+
+			if rawErr := r.createOrUpdate(ctx, &obj, objLabels, objAnnotations); rawErr != nil {
+				log.Info("unable to sync rawItem", keysAndValues...)
+				// In case of error processing an item in one of any selected Namespaces, storing it to report it lately
+				// to the upper call to ensure a partial sync that will be fixed by a subsequent reconciliation.
+				syncErr = multierror.Append(syncErr, rawErr)
+			} else {
+				log.Info("resource has been replicated", keysAndValues...)
+
+				replicatedItem := &capsulev1beta2.ObjectReferenceStatus{}
+				replicatedItem.Name = obj.GetName()
+				replicatedItem.Kind = obj.GetKind()
+				replicatedItem.Namespace = ns.Name
+				replicatedItem.APIVersion = obj.GetAPIVersion()
+
+				processed.Insert(replicatedItem.String())
+			}
 		}
 	}
 
@@ -214,64 +250,26 @@ func (r *Processor) HandleSection(ctx context.Context, tnt capsulev1beta2.Tenant
 // createOrUpdate replicates the provided unstructured object to all the provided Namespaces:
 // this function mimics the CreateOrUpdate, by retrieving the object to understand if it must be created or updated,
 // along adding the additional metadata, if required.
-func (r *Processor) createOrUpdate(ctx context.Context, obj *unstructured.Unstructured, labels map[string]string, annotations map[string]string, namespaces corev1.NamespaceList) ([]string, error) {
-	log := ctrllog.FromContext(ctx)
+func (r *Processor) createOrUpdate(ctx context.Context, obj *unstructured.Unstructured, labels map[string]string, annotations map[string]string) (err error) {
+	actual, desired := &unstructured.Unstructured{}, obj.DeepCopy()
 
-	errGroup := new(multierror.Group)
+	actual.SetAPIVersion(desired.GetAPIVersion())
+	actual.SetKind(desired.GetKind())
+	actual.SetNamespace(desired.GetNamespace())
+	actual.SetName(desired.GetName())
 
-	var items []string
+	_, err = controllerutil.CreateOrUpdate(ctx, r.client, actual, func() error {
+		UID := actual.GetUID()
+		rv := actual.GetResourceVersion()
 
-	for _, item := range namespaces.Items {
-		ns := item.GetName()
+		actual.SetUnstructuredContent(desired.Object)
+		actual.SetLabels(labels)
+		actual.SetAnnotations(annotations)
+		actual.SetResourceVersion(rv)
+		actual.SetUID(UID)
 
-		errGroup.Go(func() (err error) {
-			actual, desired := obj.DeepCopy(), obj.DeepCopy()
-			// Using a deferred function to properly log the results, and adding the item to the processed set.
-			defer func() {
-				keysAndValues := []interface{}{"resource", fmt.Sprintf("%s/%s", ns, desired.GetName())}
+		return nil
+	})
 
-				if err != nil {
-					log.Error(err, "unable to replicate resource", keysAndValues...)
-
-					return
-				}
-
-				log.Info("resource has been replicated", keysAndValues...)
-
-				replicatedItem := &capsulev1beta2.ObjectReferenceStatus{
-					Name: obj.GetName(),
-				}
-				replicatedItem.Kind = obj.GetKind()
-				replicatedItem.Namespace = ns
-				replicatedItem.APIVersion = obj.GetAPIVersion()
-
-				items = append(items, replicatedItem.String())
-			}()
-
-			actual.SetNamespace(ns)
-
-			_, err = controllerutil.CreateOrUpdate(ctx, r.client, actual, func() error {
-				UID := actual.GetUID()
-				rv := actual.GetResourceVersion()
-
-				actual.SetUnstructuredContent(desired.Object)
-				actual.SetNamespace(ns)
-				actual.SetLabels(labels)
-				actual.SetAnnotations(annotations)
-				actual.SetResourceVersion(rv)
-				actual.SetUID(UID)
-
-				return nil
-			})
-
-			return
-		})
-	}
-	// Wait returns *multierror.Error that implements stdlib error:
-	// the nil check must be performed down here rather than at the caller level to avoid wrong casting.
-	if err := errGroup.Wait(); err != nil {
-		return items, err
-	}
-
-	return items, nil
+	return err
 }

controllers/servicelabels/abstract.go

@@ -30,12 +30,6 @@ type abstractServiceLabelsReconciler struct {
 	log    logr.Logger
 }
 
-func (r *abstractServiceLabelsReconciler) InjectClient(c client.Client) error {
-	r.client = c
-
-	return nil
-}
-
 func (r *abstractServiceLabelsReconciler) Reconcile(ctx context.Context, request ctrl.Request) (ctrl.Result, error) {
 	tenant, err := r.getTenant(ctx, request.NamespacedName, r.client)
 	if err != nil {

controllers/servicelabels/endpoint.go

@@ -19,8 +19,9 @@ type EndpointsLabelsReconciler struct {
 
 func (r *EndpointsLabelsReconciler) SetupWithManager(ctx context.Context, mgr ctrl.Manager) error {
 	r.abstractServiceLabelsReconciler = abstractServiceLabelsReconciler{
-		obj: &corev1.Endpoints{},
-		log: r.Log,
+		obj:    &corev1.Endpoints{},
+		client: mgr.GetClient(),
+		log:    r.Log,
 	}
 
 	return ctrl.NewControllerManagedBy(mgr).

controllers/servicelabels/endpoint_slices.go

@@ -22,7 +22,8 @@ type EndpointSlicesLabelsReconciler struct {
 
 func (r *EndpointSlicesLabelsReconciler) SetupWithManager(ctx context.Context, mgr ctrl.Manager) error {
 	r.abstractServiceLabelsReconciler = abstractServiceLabelsReconciler{
-		log: r.Log,
+		client: mgr.GetClient(),
+		log:    r.Log,
 	}
 
 	switch {

controllers/servicelabels/service.go

@@ -19,8 +19,9 @@ type ServicesLabelsReconciler struct {
 
 func (r *ServicesLabelsReconciler) SetupWithManager(ctx context.Context, mgr ctrl.Manager) error {
 	r.abstractServiceLabelsReconciler = abstractServiceLabelsReconciler{
-		obj: &corev1.Service{},
-		log: r.Log,
+		obj:    &corev1.Service{},
+		client: mgr.GetClient(),
+		log:    r.Log,
 	}
 
 	return ctrl.NewControllerManagedBy(mgr).

controllers/tenant/limitranges.go

@@ -17,9 +17,8 @@ import (
 	"github.com/clastix/capsule/pkg/utils"
 )
 
-// nolint:dupl
 // Ensuring all the LimitRange are applied to each Namespace handled by the Tenant.
-func (r *Manager) syncLimitRanges(ctx context.Context, tenant *capsulev1beta2.Tenant) error {
+func (r *Manager) syncLimitRanges(ctx context.Context, tenant *capsulev1beta2.Tenant) error { //nolint:dupl
 	// getting requested LimitRange keys
 	keys := make([]string, 0, len(tenant.Spec.LimitRanges.Items))
 

controllers/tenant/namespaces.go

@@ -42,7 +42,7 @@ func (r *Manager) syncNamespaces(ctx context.Context, tenant *capsulev1beta2.Ten
 	return
 }
 
-// nolint:gocognit
+//nolint:gocognit
 func (r *Manager) syncNamespaceMetadata(ctx context.Context, namespace string, tnt *capsulev1beta2.Tenant) (err error) {
 	var res controllerutil.OperationResult
 
@@ -158,7 +158,7 @@ func (r *Manager) ensureNamespaceCount(ctx context.Context, tenant *capsulev1bet
 
 		found.Status.Size = tenant.Status.Size
 
-		return r.Client.Status().Update(ctx, found, &client.UpdateOptions{})
+		return r.Client.Status().Update(ctx, found, &client.SubResourceUpdateOptions{})
 	})
 }
 
@@ -176,7 +176,7 @@ func (r *Manager) collectNamespaces(ctx context.Context, tenant *capsulev1beta2.
 		_, err = controllerutil.CreateOrUpdate(ctx, r.Client, tenant.DeepCopy(), func() error {
 			tenant.AssignNamespaces(list.Items)
 
-			return r.Client.Status().Update(ctx, tenant, &client.UpdateOptions{})
+			return r.Client.Status().Update(ctx, tenant, &client.SubResourceUpdateOptions{})
 		})
 
 		return

controllers/tenant/networkpolicies.go

@@ -17,9 +17,8 @@ import (
 	"github.com/clastix/capsule/pkg/utils"
 )
 
-// nolint:dupl
 // Ensuring all the NetworkPolicies are applied to each Namespace handled by the Tenant.
-func (r *Manager) syncNetworkPolicies(ctx context.Context, tenant *capsulev1beta2.Tenant) error {
+func (r *Manager) syncNetworkPolicies(ctx context.Context, tenant *capsulev1beta2.Tenant) error { //nolint:dupl
 	// getting requested NetworkPolicy keys
 	keys := make([]string, 0, len(tenant.Spec.NetworkPolicies.Items))
 

controllers/tenant/resourcequotas.go

@@ -36,8 +36,7 @@ import (
 // the mutateFn along with the CreateOrUpdate to don't perform the update since resources are identical.
 //
 // In case of Namespace-scoped Resource Budget, we're just replicating the resources across all registered Namespaces.
-// nolint:gocognit
-func (r *Manager) syncResourceQuotas(ctx context.Context, tenant *capsulev1beta2.Tenant) (err error) {
+func (r *Manager) syncResourceQuotas(ctx context.Context, tenant *capsulev1beta2.Tenant) (err error) { //nolint:gocognit
 	// getting ResourceQuota labels for the mutateFn
 	var tenantLabel, typeLabel string
 
@@ -48,7 +47,7 @@ func (r *Manager) syncResourceQuotas(ctx context.Context, tenant *capsulev1beta2
 	if typeLabel, err = utils.GetTypeLabel(&corev1.ResourceQuota{}); err != nil {
 		return err
 	}
-	// nolint:nestif
+	//nolint:nestif
 	if tenant.Spec.ResourceQuota.Scope == api.ResourceQuotaScopeTenant {
 		group := new(errgroup.Group)
 

controllers/tenant/resourcequotas_quota.go

@@ -25,7 +25,7 @@ func (r *Manager) syncCustomResourceQuotaUsages(ctx context.Context, tenant *cap
 		group   string
 		version string
 	}
-	// nolint:prealloc
+	//nolint:prealloc
 	var resourceList []resource
 
 	for k := range tenant.GetAnnotations() {

controllers/tls/manager.go

@@ -27,7 +27,6 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/handler"
 	"sigs.k8s.io/controller-runtime/pkg/predicate"
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
-	"sigs.k8s.io/controller-runtime/pkg/source"
 
 	"github.com/clastix/capsule/controllers/utils"
 	"github.com/clastix/capsule/pkg/cert"
@@ -49,7 +48,7 @@ type Reconciler struct {
 }
 
 func (r *Reconciler) SetupWithManager(mgr ctrl.Manager) error {
-	enqueueFn := handler.EnqueueRequestsFromMapFunc(func(client.Object) []reconcile.Request {
+	enqueueFn := handler.EnqueueRequestsFromMapFunc(func(context.Context, client.Object) []reconcile.Request {
 		return []reconcile.Request{
 			{
 				NamespacedName: types.NamespacedName{
@@ -62,13 +61,13 @@ func (r *Reconciler) SetupWithManager(mgr ctrl.Manager) error {
 
 	return ctrl.NewControllerManagedBy(mgr).
 		For(&corev1.Secret{}, utils.NamesMatchingPredicate(r.Configuration.TLSSecretName())).
-		Watches(source.NewKindWithCache(&admissionregistrationv1.ValidatingWebhookConfiguration{}, mgr.GetCache()), enqueueFn, builder.WithPredicates(predicate.NewPredicateFuncs(func(object client.Object) bool {
+		Watches(&admissionregistrationv1.ValidatingWebhookConfiguration{}, enqueueFn, builder.WithPredicates(predicate.NewPredicateFuncs(func(object client.Object) bool {
 			return object.GetName() == r.Configuration.ValidatingWebhookConfigurationName()
 		}))).
-		Watches(source.NewKindWithCache(&admissionregistrationv1.MutatingWebhookConfiguration{}, mgr.GetCache()), enqueueFn, builder.WithPredicates(predicate.NewPredicateFuncs(func(object client.Object) bool {
+		Watches(&admissionregistrationv1.MutatingWebhookConfiguration{}, enqueueFn, builder.WithPredicates(predicate.NewPredicateFuncs(func(object client.Object) bool {
 			return object.GetName() == r.Configuration.MutatingWebhookConfigurationName()
 		}))).
-		Watches(source.NewKindWithCache(&apiextensionsv1.CustomResourceDefinition{}, mgr.GetCache()), enqueueFn, builder.WithPredicates(predicate.NewPredicateFuncs(func(object client.Object) bool {
+		Watches(&apiextensionsv1.CustomResourceDefinition{}, enqueueFn, builder.WithPredicates(predicate.NewPredicateFuncs(func(object client.Object) bool {
 			return object.GetName() == r.Configuration.TenantCRDName()
 		}))).
 		Complete(r)
@@ -235,12 +234,12 @@ func (r *Reconciler) updateTenantCustomResourceDefinition(ctx context.Context, n
 						Service: &apiextensionsv1.ServiceReference{
 							Namespace: r.Namespace,
 							Name:      "capsule-webhook-service",
-							Path:      pointer.StringPtr("/convert"),
-							Port:      pointer.Int32Ptr(443),
+							Path:      pointer.String("/convert"),
+							Port:      pointer.Int32(443),
 						},
 						CABundle: caBundle,
 					},
-					ConversionReviewVersions: []string{"v1alpha1", "v1beta1"},
+					ConversionReviewVersions: []string{"v1alpha1", "v1beta1", "v1beta2"},
 				},
 			}
 

docs/content/contributing/development.md

@@ -4,7 +4,7 @@
 
 Make sure you have these tools installed:
 
-- [Go 1.18+](https://golang.org/dl/)
+- [Go 1.19+](https://golang.org/dl/)
 - [Operator SDK 1.7.2+](https://github.com/operator-framework/operator-sdk), or [Kubebuilder](https://github.com/kubernetes-sigs/kubebuilder)
 - [KinD](https://github.com/kubernetes-sigs/kind) or [k3d](https://k3d.io/), with `kubectl`
 - [ngrok](https://ngrok.com/) (if you want to run locally with remote Kubernetes)

docs/content/general/crds-apis.md

@@ -675,28 +675,28 @@ NetworkPolicySpec provides the specification of a NetworkPolicy
         <td><b><a href="#tenantspecnetworkpoliciesindexpodselector">podSelector</a></b></td>
         <td>object</td>
         <td>
-          Selects the pods to which this NetworkPolicy object applies. The array of ingress rules is applied to any pods selected by this field. Multiple network policies can select the same set of pods. In this case, the ingress rules for each are combined additively. This field is NOT optional and follows standard label selector semantics. An empty podSelector matches all pods in this namespace.<br/>
+          podSelector selects the pods to which this NetworkPolicy object applies. The array of ingress rules is applied to any pods selected by this field. Multiple network policies can select the same set of pods. In this case, the ingress rules for each are combined additively. This field is NOT optional and follows standard label selector semantics. An empty podSelector matches all pods in this namespace.<br/>
         </td>
         <td>true</td>
       </tr><tr>
         <td><b><a href="#tenantspecnetworkpoliciesindexegressindex">egress</a></b></td>
         <td>[]object</td>
         <td>
-          List of egress rules to be applied to the selected pods. Outgoing traffic is allowed if there are no NetworkPolicies selecting the pod (and cluster policy otherwise allows the traffic), OR if the traffic matches at least one egress rule across all of the NetworkPolicy objects whose podSelector matches the pod. If this field is empty then this NetworkPolicy limits all outgoing traffic (and serves solely to ensure that the pods it selects are isolated by default). This field is beta-level in 1.8<br/>
+          egress is a list of egress rules to be applied to the selected pods. Outgoing traffic is allowed if there are no NetworkPolicies selecting the pod (and cluster policy otherwise allows the traffic), OR if the traffic matches at least one egress rule across all of the NetworkPolicy objects whose podSelector matches the pod. If this field is empty then this NetworkPolicy limits all outgoing traffic (and serves solely to ensure that the pods it selects are isolated by default). This field is beta-level in 1.8<br/>
         </td>
         <td>false</td>
       </tr><tr>
         <td><b><a href="#tenantspecnetworkpoliciesindexingressindex">ingress</a></b></td>
         <td>[]object</td>
         <td>
-          List of ingress rules to be applied to the selected pods. Traffic is allowed to a pod if there are no NetworkPolicies selecting the pod (and cluster policy otherwise allows the traffic), OR if the traffic source is the pod's local node, OR if the traffic matches at least one ingress rule across all of the NetworkPolicy objects whose podSelector matches the pod. If this field is empty then this NetworkPolicy does not allow any traffic (and serves solely to ensure that the pods it selects are isolated by default)<br/>
+          ingress is a list of ingress rules to be applied to the selected pods. Traffic is allowed to a pod if there are no NetworkPolicies selecting the pod (and cluster policy otherwise allows the traffic), OR if the traffic source is the pod's local node, OR if the traffic matches at least one ingress rule across all of the NetworkPolicy objects whose podSelector matches the pod. If this field is empty then this NetworkPolicy does not allow any traffic (and serves solely to ensure that the pods it selects are isolated by default)<br/>
         </td>
         <td>false</td>
       </tr><tr>
         <td><b>policyTypes</b></td>
         <td>[]string</td>
         <td>
-          List of rule types that the NetworkPolicy relates to. Valid options are ["Ingress"], ["Egress"], or ["Ingress", "Egress"]. If this field is not specified, it will default based on the existence of Ingress or Egress rules; policies that contain an Egress section are assumed to affect Egress, and all policies (whether or not they contain an Ingress section) are assumed to affect Ingress. If you want to write an egress-only policy, you must explicitly specify policyTypes [ "Egress" ]. Likewise, if you want to write a policy that specifies that no egress is allowed, you must specify a policyTypes value that include "Egress" (since such a policy would not include an Egress section and would otherwise default to just [ "Ingress" ]). This field is beta-level in 1.8<br/>
+          policyTypes is a list of rule types that the NetworkPolicy relates to. Valid options are ["Ingress"], ["Egress"], or ["Ingress", "Egress"]. If this field is not specified, it will default based on the existence of ingress or egress rules; policies that contain an egress section are assumed to affect egress, and all policies (whether or not they contain an ingress section) are assumed to affect ingress. If you want to write an egress-only policy, you must explicitly specify policyTypes [ "Egress" ]. Likewise, if you want to write a policy that specifies that no egress is allowed, you must specify a policyTypes value that include "Egress" (since such a policy would not include an egress section and would otherwise default to just [ "Ingress" ]). This field is beta-level in 1.8<br/>
         </td>
         <td>false</td>
       </tr></tbody>
@@ -707,7 +707,7 @@ NetworkPolicySpec provides the specification of a NetworkPolicy
 
 
 
-Selects the pods to which this NetworkPolicy object applies. The array of ingress rules is applied to any pods selected by this field. Multiple network policies can select the same set of pods. In this case, the ingress rules for each are combined additively. This field is NOT optional and follows standard label selector semantics. An empty podSelector matches all pods in this namespace.
+podSelector selects the pods to which this NetworkPolicy object applies. The array of ingress rules is applied to any pods selected by this field. Multiple network policies can select the same set of pods. In this case, the ingress rules for each are combined additively. This field is NOT optional and follows standard label selector semantics. An empty podSelector matches all pods in this namespace.
 
 <table>
     <thead>
@@ -795,14 +795,14 @@ NetworkPolicyEgressRule describes a particular set of traffic that is allowed ou
         <td><b><a href="#tenantspecnetworkpoliciesindexegressindexportsindex">ports</a></b></td>
         <td>[]object</td>
         <td>
-          List of destination ports for outgoing traffic. Each item in this list is combined using a logical OR. If this field is empty or missing, this rule matches all ports (traffic not restricted by port). If this field is present and contains at least one item, then this rule allows traffic only if the traffic matches at least one port in the list.<br/>
+          ports is a list of destination ports for outgoing traffic. Each item in this list is combined using a logical OR. If this field is empty or missing, this rule matches all ports (traffic not restricted by port). If this field is present and contains at least one item, then this rule allows traffic only if the traffic matches at least one port in the list.<br/>
         </td>
         <td>false</td>
       </tr><tr>
         <td><b><a href="#tenantspecnetworkpoliciesindexegressindextoindex">to</a></b></td>
         <td>[]object</td>
         <td>
-          List of destinations for outgoing traffic of pods selected for this rule. Items in this list are combined using a logical OR operation. If this field is empty or missing, this rule matches all destinations (traffic not restricted by destination). If this field is present and contains at least one item, this rule allows traffic only if the traffic matches at least one item in the to list.<br/>
+          to is a list of destinations for outgoing traffic of pods selected for this rule. Items in this list are combined using a logical OR operation. If this field is empty or missing, this rule matches all destinations (traffic not restricted by destination). If this field is present and contains at least one item, this rule allows traffic only if the traffic matches at least one item in the to list.<br/>
         </td>
         <td>false</td>
       </tr></tbody>
@@ -828,7 +828,7 @@ NetworkPolicyPort describes a port to allow traffic on
         <td><b>endPort</b></td>
         <td>integer</td>
         <td>
-          If set, indicates that the range of ports from port to endPort, inclusive, should be allowed by the policy. This field cannot be defined if the port field is not defined or if the port field is defined as a named (string) port. The endPort must be equal or greater than port. This feature is in Beta state and is enabled by default. It can be disabled using the Feature Gate "NetworkPolicyEndPort".<br/>
+          endPort indicates that the range of ports from port to endPort if set, inclusive, should be allowed by the policy. This field cannot be defined if the port field is not defined or if the port field is defined as a named (string) port. The endPort must be equal or greater than port.<br/>
           <br/>
             <i>Format</i>: int32<br/>
         </td>
@@ -837,14 +837,14 @@ NetworkPolicyPort describes a port to allow traffic on
         <td><b>port</b></td>
         <td>int or string</td>
         <td>
-          The port on the given protocol. This can either be a numerical or named port on a pod. If this field is not provided, this matches all port names and numbers. If present, only traffic on the specified protocol AND port will be matched.<br/>
+          port represents the port on the given protocol. This can either be a numerical or named port on a pod. If this field is not provided, this matches all port names and numbers. If present, only traffic on the specified protocol AND port will be matched.<br/>
         </td>
         <td>false</td>
       </tr><tr>
         <td><b>protocol</b></td>
         <td>string</td>
         <td>
-          The protocol (TCP, UDP, or SCTP) which traffic must match. If not specified, this field defaults to TCP.<br/>
+          protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. If not specified, this field defaults to TCP.<br/>
           <br/>
             <i>Default</i>: TCP<br/>
         </td>
@@ -872,23 +872,23 @@ NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combin
         <td><b><a href="#tenantspecnetworkpoliciesindexegressindextoindexipblock">ipBlock</a></b></td>
         <td>object</td>
         <td>
-          IPBlock defines policy on a particular IPBlock. If this field is set then neither of the other fields can be.<br/>
+          ipBlock defines policy on a particular IPBlock. If this field is set then neither of the other fields can be.<br/>
         </td>
         <td>false</td>
       </tr><tr>
         <td><b><a href="#tenantspecnetworkpoliciesindexegressindextoindexnamespaceselector">namespaceSelector</a></b></td>
         <td>object</td>
         <td>
-          Selects Namespaces using cluster-scoped labels. This field follows standard label selector semantics; if present but empty, it selects all namespaces. 
- If PodSelector is also set, then the NetworkPolicyPeer as a whole selects the Pods matching PodSelector in the Namespaces selected by NamespaceSelector. Otherwise it selects all Pods in the Namespaces selected by NamespaceSelector.<br/>
+          namespaceSelector selects namespaces using cluster-scoped labels. This field follows standard label selector semantics; if present but empty, it selects all namespaces. 
+ If podSelector is also set, then the NetworkPolicyPeer as a whole selects the pods matching podSelector in the namespaces selected by namespaceSelector. Otherwise it selects all pods in the namespaces selected by namespaceSelector.<br/>
         </td>
         <td>false</td>
       </tr><tr>
         <td><b><a href="#tenantspecnetworkpoliciesindexegressindextoindexpodselector">podSelector</a></b></td>
         <td>object</td>
         <td>
-          This is a label selector which selects Pods. This field follows standard label selector semantics; if present but empty, it selects all pods. 
- If NamespaceSelector is also set, then the NetworkPolicyPeer as a whole selects the Pods matching PodSelector in the Namespaces selected by NamespaceSelector. Otherwise it selects the Pods matching PodSelector in the policy's own Namespace.<br/>
+          podSelector is a label selector which selects pods. This field follows standard label selector semantics; if present but empty, it selects all pods. 
+ If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects the pods matching podSelector in the Namespaces selected by NamespaceSelector. Otherwise it selects the pods matching podSelector in the policy's own namespace.<br/>
         </td>
         <td>false</td>
       </tr></tbody>
@@ -899,7 +899,7 @@ NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combin
 
 
 
-IPBlock defines policy on a particular IPBlock. If this field is set then neither of the other fields can be.
+ipBlock defines policy on a particular IPBlock. If this field is set then neither of the other fields can be.
 
 <table>
     <thead>
@@ -914,14 +914,14 @@ IPBlock defines policy on a particular IPBlock. If this field is set then neithe
         <td><b>cidr</b></td>
         <td>string</td>
         <td>
-          CIDR is a string representing the IP Block Valid examples are "192.168.1.1/24" or "2001:db9::/64"<br/>
+          cidr is a string representing the IPBlock Valid examples are "192.168.1.0/24" or "2001:db8::/64"<br/>
         </td>
         <td>true</td>
       </tr><tr>
         <td><b>except</b></td>
         <td>[]string</td>
         <td>
-          Except is a slice of CIDRs that should not be included within an IP Block Valid examples are "192.168.1.1/24" or "2001:db9::/64" Except values will be rejected if they are outside the CIDR range<br/>
+          except is a slice of CIDRs that should not be included within an IPBlock Valid examples are "192.168.1.0/24" or "2001:db8::/64" Except values will be rejected if they are outside the cidr range<br/>
         </td>
         <td>false</td>
       </tr></tbody>
@@ -932,8 +932,8 @@ IPBlock defines policy on a particular IPBlock. If this field is set then neithe
 
 
 
-Selects Namespaces using cluster-scoped labels. This field follows standard label selector semantics; if present but empty, it selects all namespaces. 
- If PodSelector is also set, then the NetworkPolicyPeer as a whole selects the Pods matching PodSelector in the Namespaces selected by NamespaceSelector. Otherwise it selects all Pods in the Namespaces selected by NamespaceSelector.
+namespaceSelector selects namespaces using cluster-scoped labels. This field follows standard label selector semantics; if present but empty, it selects all namespaces. 
+ If podSelector is also set, then the NetworkPolicyPeer as a whole selects the pods matching podSelector in the namespaces selected by namespaceSelector. Otherwise it selects all pods in the namespaces selected by namespaceSelector.
 
 <table>
     <thead>
@@ -1006,8 +1006,8 @@ A label selector requirement is a selector that contains values, a key, and an o
 
 
 
-This is a label selector which selects Pods. This field follows standard label selector semantics; if present but empty, it selects all pods. 
- If NamespaceSelector is also set, then the NetworkPolicyPeer as a whole selects the Pods matching PodSelector in the Namespaces selected by NamespaceSelector. Otherwise it selects the Pods matching PodSelector in the policy's own Namespace.
+podSelector is a label selector which selects pods. This field follows standard label selector semantics; if present but empty, it selects all pods. 
+ If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects the pods matching podSelector in the Namespaces selected by NamespaceSelector. Otherwise it selects the pods matching podSelector in the policy's own namespace.
 
 <table>
     <thead>
@@ -1095,14 +1095,14 @@ NetworkPolicyIngressRule describes a particular set of traffic that is allowed t
         <td><b><a href="#tenantspecnetworkpoliciesindexingressindexfromindex">from</a></b></td>
         <td>[]object</td>
         <td>
-          List of sources which should be able to access the pods selected for this rule. Items in this list are combined using a logical OR operation. If this field is empty or missing, this rule matches all sources (traffic not restricted by source). If this field is present and contains at least one item, this rule allows traffic only if the traffic matches at least one item in the from list.<br/>
+          from is a list of sources which should be able to access the pods selected for this rule. Items in this list are combined using a logical OR operation. If this field is empty or missing, this rule matches all sources (traffic not restricted by source). If this field is present and contains at least one item, this rule allows traffic only if the traffic matches at least one item in the from list.<br/>
         </td>
         <td>false</td>
       </tr><tr>
         <td><b><a href="#tenantspecnetworkpoliciesindexingressindexportsindex">ports</a></b></td>
         <td>[]object</td>
         <td>
-          List of ports which should be made accessible on the pods selected for this rule. Each item in this list is combined using a logical OR. If this field is empty or missing, this rule matches all ports (traffic not restricted by port). If this field is present and contains at least one item, then this rule allows traffic only if the traffic matches at least one port in the list.<br/>
+          ports is a list of ports which should be made accessible on the pods selected for this rule. Each item in this list is combined using a logical OR. If this field is empty or missing, this rule matches all ports (traffic not restricted by port). If this field is present and contains at least one item, then this rule allows traffic only if the traffic matches at least one port in the list.<br/>
         </td>
         <td>false</td>
       </tr></tbody>
@@ -1128,23 +1128,23 @@ NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combin
         <td><b><a href="#tenantspecnetworkpoliciesindexingressindexfromindexipblock">ipBlock</a></b></td>
         <td>object</td>
         <td>
-          IPBlock defines policy on a particular IPBlock. If this field is set then neither of the other fields can be.<br/>
+          ipBlock defines policy on a particular IPBlock. If this field is set then neither of the other fields can be.<br/>
         </td>
         <td>false</td>
       </tr><tr>
         <td><b><a href="#tenantspecnetworkpoliciesindexingressindexfromindexnamespaceselector">namespaceSelector</a></b></td>
         <td>object</td>
         <td>
-          Selects Namespaces using cluster-scoped labels. This field follows standard label selector semantics; if present but empty, it selects all namespaces. 
- If PodSelector is also set, then the NetworkPolicyPeer as a whole selects the Pods matching PodSelector in the Namespaces selected by NamespaceSelector. Otherwise it selects all Pods in the Namespaces selected by NamespaceSelector.<br/>
+          namespaceSelector selects namespaces using cluster-scoped labels. This field follows standard label selector semantics; if present but empty, it selects all namespaces. 
+ If podSelector is also set, then the NetworkPolicyPeer as a whole selects the pods matching podSelector in the namespaces selected by namespaceSelector. Otherwise it selects all pods in the namespaces selected by namespaceSelector.<br/>
         </td>
         <td>false</td>
       </tr><tr>
         <td><b><a href="#tenantspecnetworkpoliciesindexingressindexfromindexpodselector">podSelector</a></b></td>
         <td>object</td>
         <td>
-          This is a label selector which selects Pods. This field follows standard label selector semantics; if present but empty, it selects all pods. 
- If NamespaceSelector is also set, then the NetworkPolicyPeer as a whole selects the Pods matching PodSelector in the Namespaces selected by NamespaceSelector. Otherwise it selects the Pods matching PodSelector in the policy's own Namespace.<br/>
+          podSelector is a label selector which selects pods. This field follows standard label selector semantics; if present but empty, it selects all pods. 
+ If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects the pods matching podSelector in the Namespaces selected by NamespaceSelector. Otherwise it selects the pods matching podSelector in the policy's own namespace.<br/>
         </td>
         <td>false</td>
       </tr></tbody>
@@ -1155,7 +1155,7 @@ NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combin
 
 
 
-IPBlock defines policy on a particular IPBlock. If this field is set then neither of the other fields can be.
+ipBlock defines policy on a particular IPBlock. If this field is set then neither of the other fields can be.
 
 <table>
     <thead>
@@ -1170,14 +1170,14 @@ IPBlock defines policy on a particular IPBlock. If this field is set then neithe
         <td><b>cidr</b></td>
         <td>string</td>
         <td>
-          CIDR is a string representing the IP Block Valid examples are "192.168.1.1/24" or "2001:db9::/64"<br/>
+          cidr is a string representing the IPBlock Valid examples are "192.168.1.0/24" or "2001:db8::/64"<br/>
         </td>
         <td>true</td>
       </tr><tr>
         <td><b>except</b></td>
         <td>[]string</td>
         <td>
-          Except is a slice of CIDRs that should not be included within an IP Block Valid examples are "192.168.1.1/24" or "2001:db9::/64" Except values will be rejected if they are outside the CIDR range<br/>
+          except is a slice of CIDRs that should not be included within an IPBlock Valid examples are "192.168.1.0/24" or "2001:db8::/64" Except values will be rejected if they are outside the cidr range<br/>
         </td>
         <td>false</td>
       </tr></tbody>
@@ -1188,8 +1188,8 @@ IPBlock defines policy on a particular IPBlock. If this field is set then neithe
 
 
 
-Selects Namespaces using cluster-scoped labels. This field follows standard label selector semantics; if present but empty, it selects all namespaces. 
- If PodSelector is also set, then the NetworkPolicyPeer as a whole selects the Pods matching PodSelector in the Namespaces selected by NamespaceSelector. Otherwise it selects all Pods in the Namespaces selected by NamespaceSelector.
+namespaceSelector selects namespaces using cluster-scoped labels. This field follows standard label selector semantics; if present but empty, it selects all namespaces. 
+ If podSelector is also set, then the NetworkPolicyPeer as a whole selects the pods matching podSelector in the namespaces selected by namespaceSelector. Otherwise it selects all pods in the namespaces selected by namespaceSelector.
 
 <table>
     <thead>
@@ -1262,8 +1262,8 @@ A label selector requirement is a selector that contains values, a key, and an o
 
 
 
-This is a label selector which selects Pods. This field follows standard label selector semantics; if present but empty, it selects all pods. 
- If NamespaceSelector is also set, then the NetworkPolicyPeer as a whole selects the Pods matching PodSelector in the Namespaces selected by NamespaceSelector. Otherwise it selects the Pods matching PodSelector in the policy's own Namespace.
+podSelector is a label selector which selects pods. This field follows standard label selector semantics; if present but empty, it selects all pods. 
+ If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects the pods matching podSelector in the Namespaces selected by NamespaceSelector. Otherwise it selects the pods matching podSelector in the policy's own namespace.
 
 <table>
     <thead>
@@ -1351,7 +1351,7 @@ NetworkPolicyPort describes a port to allow traffic on
         <td><b>endPort</b></td>
         <td>integer</td>
         <td>
-          If set, indicates that the range of ports from port to endPort, inclusive, should be allowed by the policy. This field cannot be defined if the port field is not defined or if the port field is defined as a named (string) port. The endPort must be equal or greater than port. This feature is in Beta state and is enabled by default. It can be disabled using the Feature Gate "NetworkPolicyEndPort".<br/>
+          endPort indicates that the range of ports from port to endPort if set, inclusive, should be allowed by the policy. This field cannot be defined if the port field is not defined or if the port field is defined as a named (string) port. The endPort must be equal or greater than port.<br/>
           <br/>
             <i>Format</i>: int32<br/>
         </td>
@@ -1360,14 +1360,14 @@ NetworkPolicyPort describes a port to allow traffic on
         <td><b>port</b></td>
         <td>int or string</td>
         <td>
-          The port on the given protocol. This can either be a numerical or named port on a pod. If this field is not provided, this matches all port names and numbers. If present, only traffic on the specified protocol AND port will be matched.<br/>
+          port represents the port on the given protocol. This can either be a numerical or named port on a pod. If this field is not provided, this matches all port names and numbers. If present, only traffic on the specified protocol AND port will be matched.<br/>
         </td>
         <td>false</td>
       </tr><tr>
         <td><b>protocol</b></td>
         <td>string</td>
         <td>
-          The protocol (TCP, UDP, or SCTP) which traffic must match. If not specified, this field defaults to TCP.<br/>
+          protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. If not specified, this field defaults to TCP.<br/>
           <br/>
             <i>Default</i>: TCP<br/>
         </td>
@@ -3081,7 +3081,7 @@ TenantSpec defines the desired state of Tenant.
         <td>
           <br/>
           <br/>
-            <i>Enum</i>: Nodes, StorageClasses, IngressClasses, PriorityClasses<br/>
+            <i>Enum</i>: Nodes, StorageClasses, IngressClasses, PriorityClasses, RuntimeClasses, PersistentVolumes<br/>
         </td>
         <td>true</td>
       </tr><tr>
@@ -3696,28 +3696,28 @@ NetworkPolicySpec provides the specification of a NetworkPolicy
         <td><b><a href="#tenantspecnetworkpoliciesitemsindexpodselector-1">podSelector</a></b></td>
         <td>object</td>
         <td>
-          Selects the pods to which this NetworkPolicy object applies. The array of ingress rules is applied to any pods selected by this field. Multiple network policies can select the same set of pods. In this case, the ingress rules for each are combined additively. This field is NOT optional and follows standard label selector semantics. An empty podSelector matches all pods in this namespace.<br/>
+          podSelector selects the pods to which this NetworkPolicy object applies. The array of ingress rules is applied to any pods selected by this field. Multiple network policies can select the same set of pods. In this case, the ingress rules for each are combined additively. This field is NOT optional and follows standard label selector semantics. An empty podSelector matches all pods in this namespace.<br/>
         </td>
         <td>true</td>
       </tr><tr>
         <td><b><a href="#tenantspecnetworkpoliciesitemsindexegressindex-1">egress</a></b></td>
         <td>[]object</td>
         <td>
-          List of egress rules to be applied to the selected pods. Outgoing traffic is allowed if there are no NetworkPolicies selecting the pod (and cluster policy otherwise allows the traffic), OR if the traffic matches at least one egress rule across all of the NetworkPolicy objects whose podSelector matches the pod. If this field is empty then this NetworkPolicy limits all outgoing traffic (and serves solely to ensure that the pods it selects are isolated by default). This field is beta-level in 1.8<br/>
+          egress is a list of egress rules to be applied to the selected pods. Outgoing traffic is allowed if there are no NetworkPolicies selecting the pod (and cluster policy otherwise allows the traffic), OR if the traffic matches at least one egress rule across all of the NetworkPolicy objects whose podSelector matches the pod. If this field is empty then this NetworkPolicy limits all outgoing traffic (and serves solely to ensure that the pods it selects are isolated by default). This field is beta-level in 1.8<br/>
         </td>
         <td>false</td>
       </tr><tr>
         <td><b><a href="#tenantspecnetworkpoliciesitemsindexingressindex-1">ingress</a></b></td>
         <td>[]object</td>
         <td>
-          List of ingress rules to be applied to the selected pods. Traffic is allowed to a pod if there are no NetworkPolicies selecting the pod (and cluster policy otherwise allows the traffic), OR if the traffic source is the pod's local node, OR if the traffic matches at least one ingress rule across all of the NetworkPolicy objects whose podSelector matches the pod. If this field is empty then this NetworkPolicy does not allow any traffic (and serves solely to ensure that the pods it selects are isolated by default)<br/>
+          ingress is a list of ingress rules to be applied to the selected pods. Traffic is allowed to a pod if there are no NetworkPolicies selecting the pod (and cluster policy otherwise allows the traffic), OR if the traffic source is the pod's local node, OR if the traffic matches at least one ingress rule across all of the NetworkPolicy objects whose podSelector matches the pod. If this field is empty then this NetworkPolicy does not allow any traffic (and serves solely to ensure that the pods it selects are isolated by default)<br/>
         </td>
         <td>false</td>
       </tr><tr>
         <td><b>policyTypes</b></td>
         <td>[]string</td>
         <td>
-          List of rule types that the NetworkPolicy relates to. Valid options are ["Ingress"], ["Egress"], or ["Ingress", "Egress"]. If this field is not specified, it will default based on the existence of Ingress or Egress rules; policies that contain an Egress section are assumed to affect Egress, and all policies (whether or not they contain an Ingress section) are assumed to affect Ingress. If you want to write an egress-only policy, you must explicitly specify policyTypes [ "Egress" ]. Likewise, if you want to write a policy that specifies that no egress is allowed, you must specify a policyTypes value that include "Egress" (since such a policy would not include an Egress section and would otherwise default to just [ "Ingress" ]). This field is beta-level in 1.8<br/>
+          policyTypes is a list of rule types that the NetworkPolicy relates to. Valid options are ["Ingress"], ["Egress"], or ["Ingress", "Egress"]. If this field is not specified, it will default based on the existence of ingress or egress rules; policies that contain an egress section are assumed to affect egress, and all policies (whether or not they contain an ingress section) are assumed to affect ingress. If you want to write an egress-only policy, you must explicitly specify policyTypes [ "Egress" ]. Likewise, if you want to write a policy that specifies that no egress is allowed, you must specify a policyTypes value that include "Egress" (since such a policy would not include an egress section and would otherwise default to just [ "Ingress" ]). This field is beta-level in 1.8<br/>
         </td>
         <td>false</td>
       </tr></tbody>
@@ -3728,7 +3728,7 @@ NetworkPolicySpec provides the specification of a NetworkPolicy
 
 
 
-Selects the pods to which this NetworkPolicy object applies. The array of ingress rules is applied to any pods selected by this field. Multiple network policies can select the same set of pods. In this case, the ingress rules for each are combined additively. This field is NOT optional and follows standard label selector semantics. An empty podSelector matches all pods in this namespace.
+podSelector selects the pods to which this NetworkPolicy object applies. The array of ingress rules is applied to any pods selected by this field. Multiple network policies can select the same set of pods. In this case, the ingress rules for each are combined additively. This field is NOT optional and follows standard label selector semantics. An empty podSelector matches all pods in this namespace.
 
 <table>
     <thead>
@@ -3816,14 +3816,14 @@ NetworkPolicyEgressRule describes a particular set of traffic that is allowed ou
         <td><b><a href="#tenantspecnetworkpoliciesitemsindexegressindexportsindex-1">ports</a></b></td>
         <td>[]object</td>
         <td>
-          List of destination ports for outgoing traffic. Each item in this list is combined using a logical OR. If this field is empty or missing, this rule matches all ports (traffic not restricted by port). If this field is present and contains at least one item, then this rule allows traffic only if the traffic matches at least one port in the list.<br/>
+          ports is a list of destination ports for outgoing traffic. Each item in this list is combined using a logical OR. If this field is empty or missing, this rule matches all ports (traffic not restricted by port). If this field is present and contains at least one item, then this rule allows traffic only if the traffic matches at least one port in the list.<br/>
         </td>
         <td>false</td>
       </tr><tr>
         <td><b><a href="#tenantspecnetworkpoliciesitemsindexegressindextoindex-1">to</a></b></td>
         <td>[]object</td>
         <td>
-          List of destinations for outgoing traffic of pods selected for this rule. Items in this list are combined using a logical OR operation. If this field is empty or missing, this rule matches all destinations (traffic not restricted by destination). If this field is present and contains at least one item, this rule allows traffic only if the traffic matches at least one item in the to list.<br/>
+          to is a list of destinations for outgoing traffic of pods selected for this rule. Items in this list are combined using a logical OR operation. If this field is empty or missing, this rule matches all destinations (traffic not restricted by destination). If this field is present and contains at least one item, this rule allows traffic only if the traffic matches at least one item in the to list.<br/>
         </td>
         <td>false</td>
       </tr></tbody>
@@ -3849,7 +3849,7 @@ NetworkPolicyPort describes a port to allow traffic on
         <td><b>endPort</b></td>
         <td>integer</td>
         <td>
-          If set, indicates that the range of ports from port to endPort, inclusive, should be allowed by the policy. This field cannot be defined if the port field is not defined or if the port field is defined as a named (string) port. The endPort must be equal or greater than port. This feature is in Beta state and is enabled by default. It can be disabled using the Feature Gate "NetworkPolicyEndPort".<br/>
+          endPort indicates that the range of ports from port to endPort if set, inclusive, should be allowed by the policy. This field cannot be defined if the port field is not defined or if the port field is defined as a named (string) port. The endPort must be equal or greater than port.<br/>
           <br/>
             <i>Format</i>: int32<br/>
         </td>
@@ -3858,14 +3858,14 @@ NetworkPolicyPort describes a port to allow traffic on
         <td><b>port</b></td>
         <td>int or string</td>
         <td>
-          The port on the given protocol. This can either be a numerical or named port on a pod. If this field is not provided, this matches all port names and numbers. If present, only traffic on the specified protocol AND port will be matched.<br/>
+          port represents the port on the given protocol. This can either be a numerical or named port on a pod. If this field is not provided, this matches all port names and numbers. If present, only traffic on the specified protocol AND port will be matched.<br/>
         </td>
         <td>false</td>
       </tr><tr>
         <td><b>protocol</b></td>
         <td>string</td>
         <td>
-          The protocol (TCP, UDP, or SCTP) which traffic must match. If not specified, this field defaults to TCP.<br/>
+          protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. If not specified, this field defaults to TCP.<br/>
           <br/>
             <i>Default</i>: TCP<br/>
         </td>
@@ -3893,23 +3893,23 @@ NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combin
         <td><b><a href="#tenantspecnetworkpoliciesitemsindexegressindextoindexipblock-1">ipBlock</a></b></td>
         <td>object</td>
         <td>
-          IPBlock defines policy on a particular IPBlock. If this field is set then neither of the other fields can be.<br/>
+          ipBlock defines policy on a particular IPBlock. If this field is set then neither of the other fields can be.<br/>
         </td>
         <td>false</td>
       </tr><tr>
         <td><b><a href="#tenantspecnetworkpoliciesitemsindexegressindextoindexnamespaceselector-1">namespaceSelector</a></b></td>
         <td>object</td>
         <td>
-          Selects Namespaces using cluster-scoped labels. This field follows standard label selector semantics; if present but empty, it selects all namespaces. 
- If PodSelector is also set, then the NetworkPolicyPeer as a whole selects the Pods matching PodSelector in the Namespaces selected by NamespaceSelector. Otherwise it selects all Pods in the Namespaces selected by NamespaceSelector.<br/>
+          namespaceSelector selects namespaces using cluster-scoped labels. This field follows standard label selector semantics; if present but empty, it selects all namespaces. 
+ If podSelector is also set, then the NetworkPolicyPeer as a whole selects the pods matching podSelector in the namespaces selected by namespaceSelector. Otherwise it selects all pods in the namespaces selected by namespaceSelector.<br/>
         </td>
         <td>false</td>
       </tr><tr>
         <td><b><a href="#tenantspecnetworkpoliciesitemsindexegressindextoindexpodselector-1">podSelector</a></b></td>
         <td>object</td>
         <td>
-          This is a label selector which selects Pods. This field follows standard label selector semantics; if present but empty, it selects all pods. 
- If NamespaceSelector is also set, then the NetworkPolicyPeer as a whole selects the Pods matching PodSelector in the Namespaces selected by NamespaceSelector. Otherwise it selects the Pods matching PodSelector in the policy's own Namespace.<br/>
+          podSelector is a label selector which selects pods. This field follows standard label selector semantics; if present but empty, it selects all pods. 
+ If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects the pods matching podSelector in the Namespaces selected by NamespaceSelector. Otherwise it selects the pods matching podSelector in the policy's own namespace.<br/>
         </td>
         <td>false</td>
       </tr></tbody>
@@ -3920,7 +3920,7 @@ NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combin
 
 
 
-IPBlock defines policy on a particular IPBlock. If this field is set then neither of the other fields can be.
+ipBlock defines policy on a particular IPBlock. If this field is set then neither of the other fields can be.
 
 <table>
     <thead>
@@ -3935,14 +3935,14 @@ IPBlock defines policy on a particular IPBlock. If this field is set then neithe
         <td><b>cidr</b></td>
         <td>string</td>
         <td>
-          CIDR is a string representing the IP Block Valid examples are "192.168.1.1/24" or "2001:db9::/64"<br/>
+          cidr is a string representing the IPBlock Valid examples are "192.168.1.0/24" or "2001:db8::/64"<br/>
         </td>
         <td>true</td>
       </tr><tr>
         <td><b>except</b></td>
         <td>[]string</td>
         <td>
-          Except is a slice of CIDRs that should not be included within an IP Block Valid examples are "192.168.1.1/24" or "2001:db9::/64" Except values will be rejected if they are outside the CIDR range<br/>
+          except is a slice of CIDRs that should not be included within an IPBlock Valid examples are "192.168.1.0/24" or "2001:db8::/64" Except values will be rejected if they are outside the cidr range<br/>
         </td>
         <td>false</td>
       </tr></tbody>
@@ -3953,8 +3953,8 @@ IPBlock defines policy on a particular IPBlock. If this field is set then neithe
 
 
 
-Selects Namespaces using cluster-scoped labels. This field follows standard label selector semantics; if present but empty, it selects all namespaces. 
- If PodSelector is also set, then the NetworkPolicyPeer as a whole selects the Pods matching PodSelector in the Namespaces selected by NamespaceSelector. Otherwise it selects all Pods in the Namespaces selected by NamespaceSelector.
+namespaceSelector selects namespaces using cluster-scoped labels. This field follows standard label selector semantics; if present but empty, it selects all namespaces. 
+ If podSelector is also set, then the NetworkPolicyPeer as a whole selects the pods matching podSelector in the namespaces selected by namespaceSelector. Otherwise it selects all pods in the namespaces selected by namespaceSelector.
 
 <table>
     <thead>
@@ -4027,8 +4027,8 @@ A label selector requirement is a selector that contains values, a key, and an o
 
 
 
-This is a label selector which selects Pods. This field follows standard label selector semantics; if present but empty, it selects all pods. 
- If NamespaceSelector is also set, then the NetworkPolicyPeer as a whole selects the Pods matching PodSelector in the Namespaces selected by NamespaceSelector. Otherwise it selects the Pods matching PodSelector in the policy's own Namespace.
+podSelector is a label selector which selects pods. This field follows standard label selector semantics; if present but empty, it selects all pods. 
+ If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects the pods matching podSelector in the Namespaces selected by NamespaceSelector. Otherwise it selects the pods matching podSelector in the policy's own namespace.
 
 <table>
     <thead>
@@ -4116,14 +4116,14 @@ NetworkPolicyIngressRule describes a particular set of traffic that is allowed t
         <td><b><a href="#tenantspecnetworkpoliciesitemsindexingressindexfromindex-1">from</a></b></td>
         <td>[]object</td>
         <td>
-          List of sources which should be able to access the pods selected for this rule. Items in this list are combined using a logical OR operation. If this field is empty or missing, this rule matches all sources (traffic not restricted by source). If this field is present and contains at least one item, this rule allows traffic only if the traffic matches at least one item in the from list.<br/>
+          from is a list of sources which should be able to access the pods selected for this rule. Items in this list are combined using a logical OR operation. If this field is empty or missing, this rule matches all sources (traffic not restricted by source). If this field is present and contains at least one item, this rule allows traffic only if the traffic matches at least one item in the from list.<br/>
         </td>
         <td>false</td>
       </tr><tr>
         <td><b><a href="#tenantspecnetworkpoliciesitemsindexingressindexportsindex-1">ports</a></b></td>
         <td>[]object</td>
         <td>
-          List of ports which should be made accessible on the pods selected for this rule. Each item in this list is combined using a logical OR. If this field is empty or missing, this rule matches all ports (traffic not restricted by port). If this field is present and contains at least one item, then this rule allows traffic only if the traffic matches at least one port in the list.<br/>
+          ports is a list of ports which should be made accessible on the pods selected for this rule. Each item in this list is combined using a logical OR. If this field is empty or missing, this rule matches all ports (traffic not restricted by port). If this field is present and contains at least one item, then this rule allows traffic only if the traffic matches at least one port in the list.<br/>
         </td>
         <td>false</td>
       </tr></tbody>
@@ -4149,23 +4149,23 @@ NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combin
         <td><b><a href="#tenantspecnetworkpoliciesitemsindexingressindexfromindexipblock-1">ipBlock</a></b></td>
         <td>object</td>
         <td>
-          IPBlock defines policy on a particular IPBlock. If this field is set then neither of the other fields can be.<br/>
+          ipBlock defines policy on a particular IPBlock. If this field is set then neither of the other fields can be.<br/>
         </td>
         <td>false</td>
       </tr><tr>
         <td><b><a href="#tenantspecnetworkpoliciesitemsindexingressindexfromindexnamespaceselector-1">namespaceSelector</a></b></td>
         <td>object</td>
         <td>
-          Selects Namespaces using cluster-scoped labels. This field follows standard label selector semantics; if present but empty, it selects all namespaces. 
- If PodSelector is also set, then the NetworkPolicyPeer as a whole selects the Pods matching PodSelector in the Namespaces selected by NamespaceSelector. Otherwise it selects all Pods in the Namespaces selected by NamespaceSelector.<br/>
+          namespaceSelector selects namespaces using cluster-scoped labels. This field follows standard label selector semantics; if present but empty, it selects all namespaces. 
+ If podSelector is also set, then the NetworkPolicyPeer as a whole selects the pods matching podSelector in the namespaces selected by namespaceSelector. Otherwise it selects all pods in the namespaces selected by namespaceSelector.<br/>
         </td>
         <td>false</td>
       </tr><tr>
         <td><b><a href="#tenantspecnetworkpoliciesitemsindexingressindexfromindexpodselector-1">podSelector</a></b></td>
         <td>object</td>
         <td>
-          This is a label selector which selects Pods. This field follows standard label selector semantics; if present but empty, it selects all pods. 
- If NamespaceSelector is also set, then the NetworkPolicyPeer as a whole selects the Pods matching PodSelector in the Namespaces selected by NamespaceSelector. Otherwise it selects the Pods matching PodSelector in the policy's own Namespace.<br/>
+          podSelector is a label selector which selects pods. This field follows standard label selector semantics; if present but empty, it selects all pods. 
+ If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects the pods matching podSelector in the Namespaces selected by NamespaceSelector. Otherwise it selects the pods matching podSelector in the policy's own namespace.<br/>
         </td>
         <td>false</td>
       </tr></tbody>
@@ -4176,7 +4176,7 @@ NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combin
 
 
 
-IPBlock defines policy on a particular IPBlock. If this field is set then neither of the other fields can be.
+ipBlock defines policy on a particular IPBlock. If this field is set then neither of the other fields can be.
 
 <table>
     <thead>
@@ -4191,14 +4191,14 @@ IPBlock defines policy on a particular IPBlock. If this field is set then neithe
         <td><b>cidr</b></td>
         <td>string</td>
         <td>
-          CIDR is a string representing the IP Block Valid examples are "192.168.1.1/24" or "2001:db9::/64"<br/>
+          cidr is a string representing the IPBlock Valid examples are "192.168.1.0/24" or "2001:db8::/64"<br/>
         </td>
         <td>true</td>
       </tr><tr>
         <td><b>except</b></td>
         <td>[]string</td>
         <td>
-          Except is a slice of CIDRs that should not be included within an IP Block Valid examples are "192.168.1.1/24" or "2001:db9::/64" Except values will be rejected if they are outside the CIDR range<br/>
+          except is a slice of CIDRs that should not be included within an IPBlock Valid examples are "192.168.1.0/24" or "2001:db8::/64" Except values will be rejected if they are outside the cidr range<br/>
         </td>
         <td>false</td>
       </tr></tbody>
@@ -4209,8 +4209,8 @@ IPBlock defines policy on a particular IPBlock. If this field is set then neithe
 
 
 
-Selects Namespaces using cluster-scoped labels. This field follows standard label selector semantics; if present but empty, it selects all namespaces. 
- If PodSelector is also set, then the NetworkPolicyPeer as a whole selects the Pods matching PodSelector in the Namespaces selected by NamespaceSelector. Otherwise it selects all Pods in the Namespaces selected by NamespaceSelector.
+namespaceSelector selects namespaces using cluster-scoped labels. This field follows standard label selector semantics; if present but empty, it selects all namespaces. 
+ If podSelector is also set, then the NetworkPolicyPeer as a whole selects the pods matching podSelector in the namespaces selected by namespaceSelector. Otherwise it selects all pods in the namespaces selected by namespaceSelector.
 
 <table>
     <thead>
@@ -4283,8 +4283,8 @@ A label selector requirement is a selector that contains values, a key, and an o
 
 
 
-This is a label selector which selects Pods. This field follows standard label selector semantics; if present but empty, it selects all pods. 
- If NamespaceSelector is also set, then the NetworkPolicyPeer as a whole selects the Pods matching PodSelector in the Namespaces selected by NamespaceSelector. Otherwise it selects the Pods matching PodSelector in the policy's own Namespace.
+podSelector is a label selector which selects pods. This field follows standard label selector semantics; if present but empty, it selects all pods. 
+ If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects the pods matching podSelector in the Namespaces selected by NamespaceSelector. Otherwise it selects the pods matching podSelector in the policy's own namespace.
 
 <table>
     <thead>
@@ -4372,7 +4372,7 @@ NetworkPolicyPort describes a port to allow traffic on
         <td><b>endPort</b></td>
         <td>integer</td>
         <td>
-          If set, indicates that the range of ports from port to endPort, inclusive, should be allowed by the policy. This field cannot be defined if the port field is not defined or if the port field is defined as a named (string) port. The endPort must be equal or greater than port. This feature is in Beta state and is enabled by default. It can be disabled using the Feature Gate "NetworkPolicyEndPort".<br/>
+          endPort indicates that the range of ports from port to endPort if set, inclusive, should be allowed by the policy. This field cannot be defined if the port field is not defined or if the port field is defined as a named (string) port. The endPort must be equal or greater than port.<br/>
           <br/>
             <i>Format</i>: int32<br/>
         </td>
@@ -4381,14 +4381,14 @@ NetworkPolicyPort describes a port to allow traffic on
         <td><b>port</b></td>
         <td>int or string</td>
         <td>
-          The port on the given protocol. This can either be a numerical or named port on a pod. If this field is not provided, this matches all port names and numbers. If present, only traffic on the specified protocol AND port will be matched.<br/>
+          port represents the port on the given protocol. This can either be a numerical or named port on a pod. If this field is not provided, this matches all port names and numbers. If present, only traffic on the specified protocol AND port will be matched.<br/>
         </td>
         <td>false</td>
       </tr><tr>
         <td><b>protocol</b></td>
         <td>string</td>
         <td>
-          The protocol (TCP, UDP, or SCTP) which traffic must match. If not specified, this field defaults to TCP.<br/>
+          protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. If not specified, this field defaults to TCP.<br/>
           <br/>
             <i>Default</i>: TCP<br/>
         </td>
@@ -5703,28 +5703,28 @@ NetworkPolicySpec provides the specification of a NetworkPolicy
         <td><b><a href="#tenantspecnetworkpoliciesitemsindexpodselector">podSelector</a></b></td>
         <td>object</td>
         <td>
-          Selects the pods to which this NetworkPolicy object applies. The array of ingress rules is applied to any pods selected by this field. Multiple network policies can select the same set of pods. In this case, the ingress rules for each are combined additively. This field is NOT optional and follows standard label selector semantics. An empty podSelector matches all pods in this namespace.<br/>
+          podSelector selects the pods to which this NetworkPolicy object applies. The array of ingress rules is applied to any pods selected by this field. Multiple network policies can select the same set of pods. In this case, the ingress rules for each are combined additively. This field is NOT optional and follows standard label selector semantics. An empty podSelector matches all pods in this namespace.<br/>
         </td>
         <td>true</td>
       </tr><tr>
         <td><b><a href="#tenantspecnetworkpoliciesitemsindexegressindex">egress</a></b></td>
         <td>[]object</td>
         <td>
-          List of egress rules to be applied to the selected pods. Outgoing traffic is allowed if there are no NetworkPolicies selecting the pod (and cluster policy otherwise allows the traffic), OR if the traffic matches at least one egress rule across all of the NetworkPolicy objects whose podSelector matches the pod. If this field is empty then this NetworkPolicy limits all outgoing traffic (and serves solely to ensure that the pods it selects are isolated by default). This field is beta-level in 1.8<br/>
+          egress is a list of egress rules to be applied to the selected pods. Outgoing traffic is allowed if there are no NetworkPolicies selecting the pod (and cluster policy otherwise allows the traffic), OR if the traffic matches at least one egress rule across all of the NetworkPolicy objects whose podSelector matches the pod. If this field is empty then this NetworkPolicy limits all outgoing traffic (and serves solely to ensure that the pods it selects are isolated by default). This field is beta-level in 1.8<br/>
         </td>
         <td>false</td>
       </tr><tr>
         <td><b><a href="#tenantspecnetworkpoliciesitemsindexingressindex">ingress</a></b></td>
         <td>[]object</td>
         <td>
-          List of ingress rules to be applied to the selected pods. Traffic is allowed to a pod if there are no NetworkPolicies selecting the pod (and cluster policy otherwise allows the traffic), OR if the traffic source is the pod's local node, OR if the traffic matches at least one ingress rule across all of the NetworkPolicy objects whose podSelector matches the pod. If this field is empty then this NetworkPolicy does not allow any traffic (and serves solely to ensure that the pods it selects are isolated by default)<br/>
+          ingress is a list of ingress rules to be applied to the selected pods. Traffic is allowed to a pod if there are no NetworkPolicies selecting the pod (and cluster policy otherwise allows the traffic), OR if the traffic source is the pod's local node, OR if the traffic matches at least one ingress rule across all of the NetworkPolicy objects whose podSelector matches the pod. If this field is empty then this NetworkPolicy does not allow any traffic (and serves solely to ensure that the pods it selects are isolated by default)<br/>
         </td>
         <td>false</td>
       </tr><tr>
         <td><b>policyTypes</b></td>
         <td>[]string</td>
         <td>
-          List of rule types that the NetworkPolicy relates to. Valid options are ["Ingress"], ["Egress"], or ["Ingress", "Egress"]. If this field is not specified, it will default based on the existence of Ingress or Egress rules; policies that contain an Egress section are assumed to affect Egress, and all policies (whether or not they contain an Ingress section) are assumed to affect Ingress. If you want to write an egress-only policy, you must explicitly specify policyTypes [ "Egress" ]. Likewise, if you want to write a policy that specifies that no egress is allowed, you must specify a policyTypes value that include "Egress" (since such a policy would not include an Egress section and would otherwise default to just [ "Ingress" ]). This field is beta-level in 1.8<br/>
+          policyTypes is a list of rule types that the NetworkPolicy relates to. Valid options are ["Ingress"], ["Egress"], or ["Ingress", "Egress"]. If this field is not specified, it will default based on the existence of ingress or egress rules; policies that contain an egress section are assumed to affect egress, and all policies (whether or not they contain an ingress section) are assumed to affect ingress. If you want to write an egress-only policy, you must explicitly specify policyTypes [ "Egress" ]. Likewise, if you want to write a policy that specifies that no egress is allowed, you must specify a policyTypes value that include "Egress" (since such a policy would not include an egress section and would otherwise default to just [ "Ingress" ]). This field is beta-level in 1.8<br/>
         </td>
         <td>false</td>
       </tr></tbody>
@@ -5735,7 +5735,7 @@ NetworkPolicySpec provides the specification of a NetworkPolicy
 
 
 
-Selects the pods to which this NetworkPolicy object applies. The array of ingress rules is applied to any pods selected by this field. Multiple network policies can select the same set of pods. In this case, the ingress rules for each are combined additively. This field is NOT optional and follows standard label selector semantics. An empty podSelector matches all pods in this namespace.
+podSelector selects the pods to which this NetworkPolicy object applies. The array of ingress rules is applied to any pods selected by this field. Multiple network policies can select the same set of pods. In this case, the ingress rules for each are combined additively. This field is NOT optional and follows standard label selector semantics. An empty podSelector matches all pods in this namespace.
 
 <table>
     <thead>
@@ -5823,14 +5823,14 @@ NetworkPolicyEgressRule describes a particular set of traffic that is allowed ou
         <td><b><a href="#tenantspecnetworkpoliciesitemsindexegressindexportsindex">ports</a></b></td>
         <td>[]object</td>
         <td>
-          List of destination ports for outgoing traffic. Each item in this list is combined using a logical OR. If this field is empty or missing, this rule matches all ports (traffic not restricted by port). If this field is present and contains at least one item, then this rule allows traffic only if the traffic matches at least one port in the list.<br/>
+          ports is a list of destination ports for outgoing traffic. Each item in this list is combined using a logical OR. If this field is empty or missing, this rule matches all ports (traffic not restricted by port). If this field is present and contains at least one item, then this rule allows traffic only if the traffic matches at least one port in the list.<br/>
         </td>
         <td>false</td>
       </tr><tr>
         <td><b><a href="#tenantspecnetworkpoliciesitemsindexegressindextoindex">to</a></b></td>
         <td>[]object</td>
         <td>
-          List of destinations for outgoing traffic of pods selected for this rule. Items in this list are combined using a logical OR operation. If this field is empty or missing, this rule matches all destinations (traffic not restricted by destination). If this field is present and contains at least one item, this rule allows traffic only if the traffic matches at least one item in the to list.<br/>
+          to is a list of destinations for outgoing traffic of pods selected for this rule. Items in this list are combined using a logical OR operation. If this field is empty or missing, this rule matches all destinations (traffic not restricted by destination). If this field is present and contains at least one item, this rule allows traffic only if the traffic matches at least one item in the to list.<br/>
         </td>
         <td>false</td>
       </tr></tbody>
@@ -5856,7 +5856,7 @@ NetworkPolicyPort describes a port to allow traffic on
         <td><b>endPort</b></td>
         <td>integer</td>
         <td>
-          If set, indicates that the range of ports from port to endPort, inclusive, should be allowed by the policy. This field cannot be defined if the port field is not defined or if the port field is defined as a named (string) port. The endPort must be equal or greater than port. This feature is in Beta state and is enabled by default. It can be disabled using the Feature Gate "NetworkPolicyEndPort".<br/>
+          endPort indicates that the range of ports from port to endPort if set, inclusive, should be allowed by the policy. This field cannot be defined if the port field is not defined or if the port field is defined as a named (string) port. The endPort must be equal or greater than port.<br/>
           <br/>
             <i>Format</i>: int32<br/>
         </td>
@@ -5865,14 +5865,14 @@ NetworkPolicyPort describes a port to allow traffic on
         <td><b>port</b></td>
         <td>int or string</td>
         <td>
-          The port on the given protocol. This can either be a numerical or named port on a pod. If this field is not provided, this matches all port names and numbers. If present, only traffic on the specified protocol AND port will be matched.<br/>
+          port represents the port on the given protocol. This can either be a numerical or named port on a pod. If this field is not provided, this matches all port names and numbers. If present, only traffic on the specified protocol AND port will be matched.<br/>
         </td>
         <td>false</td>
       </tr><tr>
         <td><b>protocol</b></td>
         <td>string</td>
         <td>
-          The protocol (TCP, UDP, or SCTP) which traffic must match. If not specified, this field defaults to TCP.<br/>
+          protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. If not specified, this field defaults to TCP.<br/>
           <br/>
             <i>Default</i>: TCP<br/>
         </td>
@@ -5900,23 +5900,23 @@ NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combin
         <td><b><a href="#tenantspecnetworkpoliciesitemsindexegressindextoindexipblock">ipBlock</a></b></td>
         <td>object</td>
         <td>
-          IPBlock defines policy on a particular IPBlock. If this field is set then neither of the other fields can be.<br/>
+          ipBlock defines policy on a particular IPBlock. If this field is set then neither of the other fields can be.<br/>
         </td>
         <td>false</td>
       </tr><tr>
         <td><b><a href="#tenantspecnetworkpoliciesitemsindexegressindextoindexnamespaceselector">namespaceSelector</a></b></td>
         <td>object</td>
         <td>
-          Selects Namespaces using cluster-scoped labels. This field follows standard label selector semantics; if present but empty, it selects all namespaces. 
- If PodSelector is also set, then the NetworkPolicyPeer as a whole selects the Pods matching PodSelector in the Namespaces selected by NamespaceSelector. Otherwise it selects all Pods in the Namespaces selected by NamespaceSelector.<br/>
+          namespaceSelector selects namespaces using cluster-scoped labels. This field follows standard label selector semantics; if present but empty, it selects all namespaces. 
+ If podSelector is also set, then the NetworkPolicyPeer as a whole selects the pods matching podSelector in the namespaces selected by namespaceSelector. Otherwise it selects all pods in the namespaces selected by namespaceSelector.<br/>
         </td>
         <td>false</td>
       </tr><tr>
         <td><b><a href="#tenantspecnetworkpoliciesitemsindexegressindextoindexpodselector">podSelector</a></b></td>
         <td>object</td>
         <td>
-          This is a label selector which selects Pods. This field follows standard label selector semantics; if present but empty, it selects all pods. 
- If NamespaceSelector is also set, then the NetworkPolicyPeer as a whole selects the Pods matching PodSelector in the Namespaces selected by NamespaceSelector. Otherwise it selects the Pods matching PodSelector in the policy's own Namespace.<br/>
+          podSelector is a label selector which selects pods. This field follows standard label selector semantics; if present but empty, it selects all pods. 
+ If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects the pods matching podSelector in the Namespaces selected by NamespaceSelector. Otherwise it selects the pods matching podSelector in the policy's own namespace.<br/>
         </td>
         <td>false</td>
       </tr></tbody>
@@ -5927,7 +5927,7 @@ NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combin
 
 
 
-IPBlock defines policy on a particular IPBlock. If this field is set then neither of the other fields can be.
+ipBlock defines policy on a particular IPBlock. If this field is set then neither of the other fields can be.
 
 <table>
     <thead>
@@ -5942,14 +5942,14 @@ IPBlock defines policy on a particular IPBlock. If this field is set then neithe
         <td><b>cidr</b></td>
         <td>string</td>
         <td>
-          CIDR is a string representing the IP Block Valid examples are "192.168.1.1/24" or "2001:db9::/64"<br/>
+          cidr is a string representing the IPBlock Valid examples are "192.168.1.0/24" or "2001:db8::/64"<br/>
         </td>
         <td>true</td>
       </tr><tr>
         <td><b>except</b></td>
         <td>[]string</td>
         <td>
-          Except is a slice of CIDRs that should not be included within an IP Block Valid examples are "192.168.1.1/24" or "2001:db9::/64" Except values will be rejected if they are outside the CIDR range<br/>
+          except is a slice of CIDRs that should not be included within an IPBlock Valid examples are "192.168.1.0/24" or "2001:db8::/64" Except values will be rejected if they are outside the cidr range<br/>
         </td>
         <td>false</td>
       </tr></tbody>
@@ -5960,8 +5960,8 @@ IPBlock defines policy on a particular IPBlock. If this field is set then neithe
 
 
 
-Selects Namespaces using cluster-scoped labels. This field follows standard label selector semantics; if present but empty, it selects all namespaces. 
- If PodSelector is also set, then the NetworkPolicyPeer as a whole selects the Pods matching PodSelector in the Namespaces selected by NamespaceSelector. Otherwise it selects all Pods in the Namespaces selected by NamespaceSelector.
+namespaceSelector selects namespaces using cluster-scoped labels. This field follows standard label selector semantics; if present but empty, it selects all namespaces. 
+ If podSelector is also set, then the NetworkPolicyPeer as a whole selects the pods matching podSelector in the namespaces selected by namespaceSelector. Otherwise it selects all pods in the namespaces selected by namespaceSelector.
 
 <table>
     <thead>
@@ -6034,8 +6034,8 @@ A label selector requirement is a selector that contains values, a key, and an o
 
 
 
-This is a label selector which selects Pods. This field follows standard label selector semantics; if present but empty, it selects all pods. 
- If NamespaceSelector is also set, then the NetworkPolicyPeer as a whole selects the Pods matching PodSelector in the Namespaces selected by NamespaceSelector. Otherwise it selects the Pods matching PodSelector in the policy's own Namespace.
+podSelector is a label selector which selects pods. This field follows standard label selector semantics; if present but empty, it selects all pods. 
+ If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects the pods matching podSelector in the Namespaces selected by NamespaceSelector. Otherwise it selects the pods matching podSelector in the policy's own namespace.
 
 <table>
     <thead>
@@ -6123,14 +6123,14 @@ NetworkPolicyIngressRule describes a particular set of traffic that is allowed t
         <td><b><a href="#tenantspecnetworkpoliciesitemsindexingressindexfromindex">from</a></b></td>
         <td>[]object</td>
         <td>
-          List of sources which should be able to access the pods selected for this rule. Items in this list are combined using a logical OR operation. If this field is empty or missing, this rule matches all sources (traffic not restricted by source). If this field is present and contains at least one item, this rule allows traffic only if the traffic matches at least one item in the from list.<br/>
+          from is a list of sources which should be able to access the pods selected for this rule. Items in this list are combined using a logical OR operation. If this field is empty or missing, this rule matches all sources (traffic not restricted by source). If this field is present and contains at least one item, this rule allows traffic only if the traffic matches at least one item in the from list.<br/>
         </td>
         <td>false</td>
       </tr><tr>
         <td><b><a href="#tenantspecnetworkpoliciesitemsindexingressindexportsindex">ports</a></b></td>
         <td>[]object</td>
         <td>
-          List of ports which should be made accessible on the pods selected for this rule. Each item in this list is combined using a logical OR. If this field is empty or missing, this rule matches all ports (traffic not restricted by port). If this field is present and contains at least one item, then this rule allows traffic only if the traffic matches at least one port in the list.<br/>
+          ports is a list of ports which should be made accessible on the pods selected for this rule. Each item in this list is combined using a logical OR. If this field is empty or missing, this rule matches all ports (traffic not restricted by port). If this field is present and contains at least one item, then this rule allows traffic only if the traffic matches at least one port in the list.<br/>
         </td>
         <td>false</td>
       </tr></tbody>
@@ -6156,23 +6156,23 @@ NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combin
         <td><b><a href="#tenantspecnetworkpoliciesitemsindexingressindexfromindexipblock">ipBlock</a></b></td>
         <td>object</td>
         <td>
-          IPBlock defines policy on a particular IPBlock. If this field is set then neither of the other fields can be.<br/>
+          ipBlock defines policy on a particular IPBlock. If this field is set then neither of the other fields can be.<br/>
         </td>
         <td>false</td>
       </tr><tr>
         <td><b><a href="#tenantspecnetworkpoliciesitemsindexingressindexfromindexnamespaceselector">namespaceSelector</a></b></td>
         <td>object</td>
         <td>
-          Selects Namespaces using cluster-scoped labels. This field follows standard label selector semantics; if present but empty, it selects all namespaces. 
- If PodSelector is also set, then the NetworkPolicyPeer as a whole selects the Pods matching PodSelector in the Namespaces selected by NamespaceSelector. Otherwise it selects all Pods in the Namespaces selected by NamespaceSelector.<br/>
+          namespaceSelector selects namespaces using cluster-scoped labels. This field follows standard label selector semantics; if present but empty, it selects all namespaces. 
+ If podSelector is also set, then the NetworkPolicyPeer as a whole selects the pods matching podSelector in the namespaces selected by namespaceSelector. Otherwise it selects all pods in the namespaces selected by namespaceSelector.<br/>
         </td>
         <td>false</td>
       </tr><tr>
         <td><b><a href="#tenantspecnetworkpoliciesitemsindexingressindexfromindexpodselector">podSelector</a></b></td>
         <td>object</td>
         <td>
-          This is a label selector which selects Pods. This field follows standard label selector semantics; if present but empty, it selects all pods. 
- If NamespaceSelector is also set, then the NetworkPolicyPeer as a whole selects the Pods matching PodSelector in the Namespaces selected by NamespaceSelector. Otherwise it selects the Pods matching PodSelector in the policy's own Namespace.<br/>
+          podSelector is a label selector which selects pods. This field follows standard label selector semantics; if present but empty, it selects all pods. 
+ If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects the pods matching podSelector in the Namespaces selected by NamespaceSelector. Otherwise it selects the pods matching podSelector in the policy's own namespace.<br/>
         </td>
         <td>false</td>
       </tr></tbody>
@@ -6183,7 +6183,7 @@ NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combin
 
 
 
-IPBlock defines policy on a particular IPBlock. If this field is set then neither of the other fields can be.
+ipBlock defines policy on a particular IPBlock. If this field is set then neither of the other fields can be.
 
 <table>
     <thead>
@@ -6198,14 +6198,14 @@ IPBlock defines policy on a particular IPBlock. If this field is set then neithe
         <td><b>cidr</b></td>
         <td>string</td>
         <td>
-          CIDR is a string representing the IP Block Valid examples are "192.168.1.1/24" or "2001:db9::/64"<br/>
+          cidr is a string representing the IPBlock Valid examples are "192.168.1.0/24" or "2001:db8::/64"<br/>
         </td>
         <td>true</td>
       </tr><tr>
         <td><b>except</b></td>
         <td>[]string</td>
         <td>
-          Except is a slice of CIDRs that should not be included within an IP Block Valid examples are "192.168.1.1/24" or "2001:db9::/64" Except values will be rejected if they are outside the CIDR range<br/>
+          except is a slice of CIDRs that should not be included within an IPBlock Valid examples are "192.168.1.0/24" or "2001:db8::/64" Except values will be rejected if they are outside the cidr range<br/>
         </td>
         <td>false</td>
       </tr></tbody>
@@ -6216,8 +6216,8 @@ IPBlock defines policy on a particular IPBlock. If this field is set then neithe
 
 
 
-Selects Namespaces using cluster-scoped labels. This field follows standard label selector semantics; if present but empty, it selects all namespaces. 
- If PodSelector is also set, then the NetworkPolicyPeer as a whole selects the Pods matching PodSelector in the Namespaces selected by NamespaceSelector. Otherwise it selects all Pods in the Namespaces selected by NamespaceSelector.
+namespaceSelector selects namespaces using cluster-scoped labels. This field follows standard label selector semantics; if present but empty, it selects all namespaces. 
+ If podSelector is also set, then the NetworkPolicyPeer as a whole selects the pods matching podSelector in the namespaces selected by namespaceSelector. Otherwise it selects all pods in the namespaces selected by namespaceSelector.
 
 <table>
     <thead>
@@ -6290,8 +6290,8 @@ A label selector requirement is a selector that contains values, a key, and an o
 
 
 
-This is a label selector which selects Pods. This field follows standard label selector semantics; if present but empty, it selects all pods. 
- If NamespaceSelector is also set, then the NetworkPolicyPeer as a whole selects the Pods matching PodSelector in the Namespaces selected by NamespaceSelector. Otherwise it selects the Pods matching PodSelector in the policy's own Namespace.
+podSelector is a label selector which selects pods. This field follows standard label selector semantics; if present but empty, it selects all pods. 
+ If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects the pods matching podSelector in the Namespaces selected by NamespaceSelector. Otherwise it selects the pods matching podSelector in the policy's own namespace.
 
 <table>
     <thead>
@@ -6379,7 +6379,7 @@ NetworkPolicyPort describes a port to allow traffic on
         <td><b>endPort</b></td>
         <td>integer</td>
         <td>
-          If set, indicates that the range of ports from port to endPort, inclusive, should be allowed by the policy. This field cannot be defined if the port field is not defined or if the port field is defined as a named (string) port. The endPort must be equal or greater than port. This feature is in Beta state and is enabled by default. It can be disabled using the Feature Gate "NetworkPolicyEndPort".<br/>
+          endPort indicates that the range of ports from port to endPort if set, inclusive, should be allowed by the policy. This field cannot be defined if the port field is not defined or if the port field is defined as a named (string) port. The endPort must be equal or greater than port.<br/>
           <br/>
             <i>Format</i>: int32<br/>
         </td>
@@ -6388,14 +6388,14 @@ NetworkPolicyPort describes a port to allow traffic on
         <td><b>port</b></td>
         <td>int or string</td>
         <td>
-          The port on the given protocol. This can either be a numerical or named port on a pod. If this field is not provided, this matches all port names and numbers. If present, only traffic on the specified protocol AND port will be matched.<br/>
+          port represents the port on the given protocol. This can either be a numerical or named port on a pod. If this field is not provided, this matches all port names and numbers. If present, only traffic on the specified protocol AND port will be matched.<br/>
         </td>
         <td>false</td>
       </tr><tr>
         <td><b>protocol</b></td>
         <td>string</td>
         <td>
-          The protocol (TCP, UDP, or SCTP) which traffic must match. If not specified, this field defaults to TCP.<br/>
+          protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. If not specified, this field defaults to TCP.<br/>
           <br/>
             <i>Default</i>: TCP<br/>
         </td>

docs/content/general/proxy.md

@@ -10,7 +10,7 @@ Error from server (Forbidden): namespaces is forbidden:
 User "alice" cannot list resource "namespaces" in API group "" at the cluster scope
 ```
 
-However, the user can have permissions on some namespaces
+However, the user can have permission on some namespaces
 
 ```
 $ kubectl auth can-i [get|list|watch|delete] ns oil-production
@@ -21,13 +21,13 @@ The reason, as the error message reported, is that the RBAC _list_ action is ava
 
 To overcome this problem, many Kubernetes distributions introduced mirrored custom resources supported by a custom set of ACL-filtered APIs. However, this leads to radically change the user's experience of Kubernetes by introducing hard customizations that make it painful to move from one distribution to another.
 
-With **Capsule**, we took a different approach. As one of the key goals, we want to keep the same user's experience on all the distributions of Kubernetes. We want people to use the standard tools they already know and love and it should just work.
+With **Capsule**, we took a different approach. As one of the key goals, we want to keep the same user experience on all the distributions of Kubernetes. We want people to use the standard tools they already know and love and it should just work.
 
 ## How it works
 
 The `capsule-proxy` implements a simple reverse proxy that intercepts only specific requests to the APIs server and Capsule does all the magic behind the scenes.
 
-Current implementation filters the following requests:
+The current implementation filters the following requests:
 
 * `/api/scheduling.k8s.io/{v1}/priorityclasses{/name}`
 * `/api/v1/namespaces{/name}`
@@ -37,13 +37,16 @@ Current implementation filters the following requests:
 * `/apis/metrics.k8s.io/{v1beta1}/nodes{/name}`
 * `/apis/networking.k8s.io/{v1,v1beta1}/ingressclasses{/name}`
 * `/apis/storage.k8s.io/v1/storageclasses{/name}`
+* `/apis/node.k8s.io/v1/runtimeclasses{/name}`
+* `/api/v1/persistentvolumes{/name}`
 
-All other requests are proxied transparently to the APIs server, so no side effects are expected. We're planning to add new APIs in the future, so [PRs are welcome](https://github.com/clastix/capsule-proxy)!
+All other requests are proxy-passed transparently to the API server, so no side effects are expected.
+We're planning to add new APIs in the future, so [PRs are welcome](https://github.com/clastix/capsule-proxy)!
 
 ## Installation
 
 Capsule Proxy is an optional add-on of the main Capsule Operator, so make sure you have a working instance of Capsule before attempting to install it.
-Use the `capsule-proxy` only if you want Tenant Owners to list their own Cluster-Scope resources.
+Use the `capsule-proxy` only if you want Tenant Owners to list their Cluster-Scope resources.
 
 The `capsule-proxy` can be deployed in standalone mode, e.g. running as a pod bridging any Kubernetes client to the APIs server.
 Optionally, it can be deployed as a sidecar container in the backend of a dashboard.
@@ -72,22 +75,22 @@ Here how it looks like when exposed through an Ingress Controller:
 ## CLI flags
 
 - `capsule-configuration-name`: name of the `CapsuleConfiguration` resource which is containing the [Capsule configurations](/docs/general/references/#capsule-configuration) (default: `default`)
-- `capsule-user-group` (deprecated): old way to specify the user groups which request must be intercepted by the proxy
-- `ignored-user-group`: names of the groups which requests must be ignored and proxy-passed to the upstream server
+- `capsule-user-group` (deprecated): the old way to specify the user groups whose request must be intercepted by the proxy
+- `ignored-user-group`: names of the groups whose requests must be ignored and proxy-passed to the upstream server
 - `listening-port`: HTTP port the proxy listens to (default: `9001`)
 - `oidc-username-claim`: the OIDC field name used to identify the user (default: `preferred_username`), the proper value can be extracted from the Kubernetes API Server flags
-- `enable-ssl`: enable the bind on HTTPS for secure communication, allowing client-based certificate, also knows as mutual TLS (default: `true`)
+- `enable-ssl`: enable the bind on HTTPS for secure communication, allowing client-based certificate, also known as mutual TLS (default: `true`)
 - `ssl-cert-path`: path to the TLS certificate, then TLS mode is enabled (default: `/opt/capsule-proxy/tls.crt`)
 - `ssl-key-path`: path to the TLS certificate key, when TLS mode is enabled (default: `/opt/capsule-proxy/tls.key`)
 - `rolebindings-resync-period`: resync period for RoleBinding resources reflector, lower values can help if you're facing [flaky etcd connection](https://github.com/clastix/capsule-proxy/issues/174) (default: `10h`)
 
 ## User Authentication
 
-The `capsule-proxy` intercepts all the requests from the `kubectl` client directed to the APIs Server. Users using a TLS client based authentication with certificate and key are able to talks with APIs Server since it is able to forward client certificates to the Kubernetes APIs server.
+The `capsule-proxy` intercepts all the requests from the `kubectl` client directed to the APIs Server. Users using a TLS client-based authentication with a certificate and key can talk with the API Server since it can forward client certificates to the Kubernetes APIs server.
 
-It is possible to protect the `capsule-proxy` using a certificate provided by Let's Encrypt. Keep in mind that, in this way, the TLS termination will be executed by the Ingress Controller, meaning that the authentication based on client certificate will be withdrawn and not reversed to the upstream.
+It is possible to protect the `capsule-proxy` using a certificate provided by Let's Encrypt. Keep in mind that, in this way, the TLS termination will be executed by the Ingress Controller, meaning that the authentication based on the client certificate will be withdrawn and not reversed to the upstream.
 
-If your prerequisite is exposing `capsule-proxy` using an Ingress, you must rely on the token-based authentication, for example OIDC or Bearer tokens. Users providing tokens are always able to reach the APIs Server.
+If your prerequisite is exposing `capsule-proxy` using an Ingress, you must rely on the token-based authentication, for example, OIDC or Bearer tokens. Users providing tokens are always able to reach the APIs Server.
 
 ## Kubernetes dashboards integration
 
@@ -124,6 +127,8 @@ The proxy setting `kind` is an __enum__ accepting the supported resources:
 - `StorageClasses`
 - `IngressClasses`
 - `PriorityClasses`
+- `RuntimeClasses`
+- `PersistentVolumes`
 
 Each Resource kind can be granted with several verbs, such as:
 
@@ -131,6 +136,14 @@ Each Resource kind can be granted with several verbs, such as:
 - `Update`
 - `Delete`
 
+## Cluster-scoped resources selection strategy precedence
+
+Starting from [Capsule v0.2.0](https://github.com/clastix/capsule/releases/tag/v0.2.0), selection of cluster-scoped resources based on labels has been introduced.
+
+Due to the limitations of Kubernetes API Server which not support `OR` label selector, the Capsule core team decided to give precedence to the label selector over the exact and regex match.
+
+Capsule is going to deprecate in the upcoming feature the selection based on exact names and regex in order to approach entirely to the matching labels approach of Kubernetes itself.
+
 ### Namespaces
 
 As tenant owner `alice`, you can use `kubectl` to create some namespaces:
@@ -162,7 +175,7 @@ metadata:
 EOF
 
 namespace/solar-development unchanged
-# or, in case of non existing Namespace:
+# or, in case of non-existing Namespace:
 namespace/solar-development created
 ```
 
@@ -202,7 +215,7 @@ When issuing a `kubectl describe node`, some other endpoints are put in place:
 * `api/v1/pods?fieldSelector=spec.nodeName%3D{name}`
 * `/apis/coordination.k8s.io/v1/namespaces/kube-node-lease/leases/{name}`
 
-These are mandatory in order to retrieve the list of the running Pods on the required node, and providing info about the lease status of it.
+These are mandatory to retrieve the list of the running Pods on the required node and provide info about its lease status.
 
 ### Storage Classes
 
@@ -239,7 +252,7 @@ glusterfs            rook.io/glusterfs        Delete          WaitForFirstConsum
 zol                  zfs-on-linux/zfs         Delete          WaitForFirstConsumer   false                  54m
 ```
 
-The expected output using `capsule-proxy` is the retrieval of the `custom` Storage Class as well the other ones matching the regex `\w+fs`.
+The expected output using `capsule-proxy` is the retrieval of the `custom` Storage Class as well as the other ones matching the regex `\w+fs`.
 
 ```bash
 $ kubectl --context alice-oidc@mycluster get storageclasses
@@ -259,7 +272,6 @@ metadata:
     name: cephfs
   name: cephfs
 provisioner: cephfs
-
 ```
 
 ### Ingress Classes
@@ -286,7 +298,7 @@ spec:
         allowedRegex: "\\w+-lb"
 ```
 
-In the Kubernetes cluster we could have more Ingress Class resources, some of them forbidden and non-usable by the Tenant owner.
+In the Kubernetes cluster, we could have more Ingress Class resources, some of them forbidden and non-usable by the Tenant owner.
 
 ```bash
 $ kubectl --context admin@mycluster get ingressclasses
@@ -385,23 +397,141 @@ globalDefault: false
 description: "Priority class for Tenants"
 ```
 
-### ProxySetting Use Case
-Consider a scenario, where a cluster admin creates a tenant and assign ownership of the tenant to a user, so called tenant owner. Afterwards, tenant owner would in turn like to provide access to their cluster-scoped resources to a set of users (e.g. non-owners or tenant users), groups and service accounts, who doesn't require tenant owner level permissions.
+### Runtime Classes
 
-Tenant Owner can provide access to following cluster-scoped resources to their tenant users, groups and service account by creating `ProxySetting` resource
+Allowed RuntimeClasses assigned to a Tenant Owner can be enforced as follows:
+
+```yaml
+apiVersion: capsule.clastix.io/v1beta2
+kind: Tenant
+metadata:
+  name: oil
+spec:
+  owners:
+  - kind: User
+    name: alice
+    proxySettings:
+    - kind: PriorityClasses
+      operations:
+      - List
+  runtimeClasses:
+    matchExpressions:
+      - key: capsule.clastix.io/qos
+        operator: Exists
+        values:
+          - bronze
+          - silver 
+```
+
+In the Kubernetes cluster we could have more RuntimeClasses resources, some of them forbidden and non-usable by the Tenant owner.
+
+```bash
+$ kubectl --context admin@mycluster get runtimeclasses.node.k8s.io --show-labels
+NAME      HANDLER           AGE   LABELS
+bronze    bronze            21h   capsule.clastix.io/qos=bronze
+default   myconfiguration   21h   <none>
+gold      gold              21h   capsule.clastix.io/qos=gold
+silver    silver            21h   capsule.clastix.io/qos=silver
+```
+
+The expected output using `capsule-proxy` is the retrieval of the `bronze` and `silver` ones.
+
+```bash
+$ kubectl --context alice-oidc@mycluster get runtimeclasses.node.k8s.io
+NAME     HANDLER   AGE
+bronze   bronze    21h
+silver   silver    21h
+```
+
+> `RuntimeClass` is one of the latest implementations in Capsule Proxy and is adhering to the new selection strategy based on labels selector, rather than exact match and regex ones.
+>
+> The latter ones are going to be deprecated in the upcoming releases of Capsule.
+
+### Persistent Volumes
+
+A Tenant can request persistent volumes through the `PersistentVolumeClaim` API, and get a volume from it.
+
+Starting from release v0.2.0, all the `PersistentVolumes` are labelled with the Capsule label that is used by the Capsule Proxy to allow the retrieval.
+
+```yaml
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  annotations:
+  finalizers:
+    - kubernetes.io/pv-protection
+  labels:
+    capsule.clastix.io/tenant: oil
+  name: data-01
+spec:
+  accessModes:
+    - ReadWriteOnce
+  capacity:
+    storage: 10Gi
+  hostPath:
+    path: /mnt/data
+    type: ""
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: manual
+  volumeMode: Filesystem
+```
+
+> Please, notice the label `capsule.clastix.io/tenant` matching the Tenant name.
+
+With that said, a multi-tenant cluster can be made of several volumes, each one for different tenants.
+
+```bash
+$ kubectl --context admin@mycluster get persistentvolumes --show-labels
+NAME      CAPACITY   ACCESS MODES   RECLAIM POLICY   STATUS      CLAIM   STORAGECLASS   REASON   AGE   LABELS
+data-01   10Gi       RWO            Retain           Available           manual                  17h   capsule.clastix.io/tenant=oil
+data-02   10Gi       RWO            Retain           Available           manual                  17h   capsule.clastix.io/tenant=gas
+
+```
+
+For the `oil` Tenant, Alice has the required permission to list Volumes.
+
+```yaml
+apiVersion: capsule.clastix.io/v1beta2
+kind: Tenant
+metadata:
+  name: oil
+spec:
+  owners:
+    - kind: User
+      name: alice
+      proxySettings:
+        - kind: PersistentVolumes
+          operations:
+            - List
+```
+
+The expected output using `capsule-proxy` is the retrieval of the PVs used currently, or in the past, by the PVCs in their Tenants.
+
+```bash
+$ kubectl --context alice-oidc@mycluster get persistentvolumes
+NAME      CAPACITY   ACCESS MODES   RECLAIM POLICY   STATUS      CLAIM   STORAGECLASS   REASON   AGE
+data-01   10Gi       RWO            Retain           Available           manual                  17h
+```
+
+### ProxySetting Use Case
+Consider a scenario, where a cluster admin creates a tenant and assigns ownership of the tenant to a user, the so-called tenant owner. Afterwards, tenant owner would in turn like to provide access to their cluster-scoped resources to a set of users (e.g. non-owners or tenant users), groups and service accounts, who doesn't require tenant-owner-level permissions.
+
+Tenant Owner can provide access to the following cluster-scoped resources to their tenant users, groups and service account by creating `ProxySetting` resource
 - `Nodes`
 - `StorageClasses`
 - `IngressClasses`
 - `PriorityClasses`
+- `RuntimeClasses`
+- `PersistentVolumes`
 
-Each Resource kind can be granted with following verbs, such as:
+Each Resource kind can be granted with the following verbs, such as:
 - `List`
 - `Update`
 - `Delete`
 
 These tenant users, groups and services accounts have less privileged access than tenant owners.
 
-As a Tenant Owner `alice`, you can create a `ProxySetting` resources to allow `bob` to list nodes, storage classes, ingress classes and priority classes
+As a Tenant Owner `alice`, you can create a `ProxySetting` resource to allow `bob` to list nodes, storage classes, ingress classes and priority classes
 ```yaml
 apiVersion: capsule.clastix.io/v1beta2
 kind: ProxySetting
@@ -439,7 +569,7 @@ $ kubectl auth can-i --context bob-oidc@mycluster get priorityclasses
 yes
 ```
 ## HTTP support
-Capsule proxy supports `https` and `http`, although the latter is not recommended, we understand that it can be useful for some use cases (i.e. development, working behind a TLS-terminated reverse proxy and so on). As the default behaviour is to work with `https`, we need to use the flag `--enable-ssl=false` if we really want to work under `http`.
+Capsule proxy supports `https` and `http`, although the latter is not recommended, we understand that it can be useful for some use cases (i.e. development, working behind a TLS-terminated reverse proxy and so on). As the default behaviour is to work with `https`, we need to use the flag `--enable-ssl=false` if we want to work under `http`.
 
 After having the `capsule-proxy` working under `http`, requests must provide authentication using an allowed Bearer Token.
 
@@ -456,16 +586,16 @@ $ curl -H "Authorization: Bearer $TOKEN" http://localhost:9001/api/v1/namespaces
 
 Starting from the v0.3.0 release, Capsule Proxy exposes Prometheus metrics available at `http://0.0.0.0:8080/metrics`.
 
-The offered metrics are related to the internal `controller-manager` code base, such as work-queue and REST client requests, and the Go runtime ones.
+The offered metrics are related to the internal `controller-manager` code base, such as work queue and REST client requests, and the Go runtime ones.
 
 Along with these, metrics `capsule_proxy_response_time_seconds` and `capsule_proxy_requests_total` have been introduced and are specific to the Capsule Proxy code-base and functionalities.
 
 `capsule_proxy_response_time_seconds` offers a bucket representation of the HTTP request duration.
-The available variables for this metrics are the following ones:
-- `path`: the HTTP path of each single request that Capsule Proxy passes to the upstream
+The available variables for these metrics are the following ones:
+- `path`: the HTTP path of every single request that Capsule Proxy passes to the upstream
 
 `capsule_proxy_requests_total` counts the global requests that Capsule Proxy is passing to the upstream with the following labels.
-- `path`: the HTTP path of each single request that Capsule Proxy passes to the upstream
+- `path`: the HTTP path of every single request that Capsule Proxy passes to the upstream
 - `status`: the HTTP status code of the request
 
 > Example output of the metrics:
@@ -493,6 +623,6 @@ The available variables for this metrics are the following ones:
 
 ## Contributing
 
-`capsule-proxy` is an open-source software released with Apache2 [license](https://github.com/clastix/capsule-proxy/blob/master/LICENSE).
+`capsule-proxy` is open-source software released with Apache2 [license](https://github.com/clastix/capsule-proxy/blob/master/LICENSE).
 
 Contributing guidelines are available [here](https://github.com/clastix/capsule-proxy/blob/master/CONTRIBUTING.md).

docs/content/general/tutorial.md

@@ -1308,6 +1308,12 @@ Kubernetes network policies control network traffic between namespaces and betwe
 
 To meet this requirement, Bill needs to define network policies that deny pods belonging to Alice's namespaces to access pods in namespaces belonging to other tenants, e.g. Bob's tenant `water`, or in system namespaces, e.g. `kube-system`.
 
+> Keep in mind, that because of how the NetworkPolicies API works, the users can still add a policy which contradicts what the Tenant has set, resulting in users being able to circumvent the initial limitation set by the tenant admin.
+>
+> Two options can be put in place to mitigate this potential privilege escalation:
+> 1. providing a restricted role rather than the default `admin` one
+> 2. using Calico's `GlobalNetworkPolicy`, or Cilium's `CiliumClusterwideNetworkPolicy` which are defined at the cluster-level, thus creating an order of packet filtering.
+
 Also, Bill can make sure pods belonging to a tenant namespace cannot access other network infrastructures like cluster nodes, load balancers, and virtual machines running other services.  
 
 Bill can set network policies in the tenant manifest, according to the requirements:

docs/content/guides/kubernetes-dashboard.md

@@ -0,0 +1,145 @@
+# Kubernetes Dashboard
+
+This guide describes how to integrate the [Kubernetes Dashboard](https://kubernetes.io/docs/tasks/access-application-cluster/web-ui-dashboard/) and [Capsule Proxy](https://capsule.clastix.io/docs/general/proxy/) with OIDC authorization.
+
+In this guide, we will use [Keycloak](https://www.keycloak.org) as the Identity Provider.
+
+![Kubernetes Dashboard](./assets/proxy-kubernetes-dashboard.png)
+
+## Configuring oauth2-proxy
+
+To enable the proxy authorization from the Kubernetes dashboard to Keycloak, we need to use an OAuth proxy.
+In this article, we will use [oauth2-proxy](https://oauth2-proxy.github.io/oauth2-proxy/) and install it as a pod in the Kubernetes Dashboard namespace.
+Alternatively, we can install `oauth2-proxy` in a different namespace or use it as a sidecar container in the Kubernetes Dashboard deployment.
+
+Prepare the values for oauth2-proxy:
+```bash
+cat > values-oauth2-proxy.yaml <<EOF
+config:
+  clientID: "${OIDC_CLIENT_ID}"
+  clientSecret: ${OIDC_CLIENT_SECRET}
+
+extraArgs:
+  provider: "keycloak-oidc"
+  redirect-url: "https://${DASHBOARD_URL}/oauth2/callback"
+  oidc-issuer-url: "https://${KEYCLOAK_URL}/auth/realms/${OIDC_CLIENT_ID}"
+  pass-access-token: true
+  set-authorization-header: true
+  pass-user-headers: true
+
+ingress:
+  enabled: true
+  path: "/oauth2"
+  hosts:
+    - ${DASHBOARD_URL}
+  tls:
+    - hosts:
+      - ${DASHBOARD_URL}
+EOF
+```
+
+> Values used for the config:
+> 
+> - **OIDC_CLIENT_ID**: the keycloak client ID (name) which user in Kubernetes API Server for authorization
+> - **OIDC_CLIENT_SECRET**: secret for the client (`OIDC_CLIENT_ID`). You can see it from the Keycloack UI -> Clients -> `OIDC_CLIENT_ID` -> Credentials
+> - **DASHBOARD_URL**: the Kubernetes Dashboard URL
+> - **KEYCLOAK_URL**: the Keycloak URL
+
+More information about the `keycloak-oidc` provider can be found on the [oauth2-proxy documentation](https://oauth2-proxy.github.io/oauth2-proxy/docs/configuration/oauth_provider/#keycloak-oidc-auth-provider).
+
+We're ready to install the `oauth2-proxy`:
+
+```bash
+helm repo add oauth2-proxy https://oauth2-proxy.github.io/manifests
+helm install oauth2-proxy oauth2-proxy/oauth2-proxy -n ${KUBERNETES_DASHBOARD_NAMESPACE} -f values-oauth2-proxy.yaml
+```
+
+## Configuring Keycloak
+
+The Kubernetes cluster must be configured with a valid OIDC provider: for our guide, we're giving for granted that Keycloak is used, if you need more info please follow the [OIDC Authentication](/docs/guides/oidc-auth) section.
+
+In a such scenario, you should have in the `kube-apiserver.yaml` manifest the following content:
+```yaml
+spec:
+  containers:
+  - command:
+    - kube-apiserver
+    ...
+    - --oidc-issuer-url=https://${OIDC_ISSUER}
+    - --oidc-ca-file=/etc/kubernetes/oidc/ca.crt
+    - --oidc-client-id=${OIDC_CLIENT_ID}
+    - --oidc-username-claim=preferred_username
+    - --oidc-groups-claim=groups
+    - --oidc-username-prefix=-
+```
+
+Where `${OIDC_CLIENT_ID}` refers to the client ID that all tokens must be issued.
+
+For this client we need:
+1. Check `Valid Redirect URIs`: in the `oauth2-proxy` configuration we set `redirect-url: "https://${DASHBOARD_URL}/oauth2/callback"`, it needs to add this path to the `Valid Redirect URIs`
+2. Create a mapper with Mapper Type 'Group Membership' and Token Claim Name 'groups'.
+3. Create a mapper with Mapper Type 'Audience' and Included Client Audience and Included Custom Audience set to your client name(OIDC_CLIENT_ID).
+
+## Configuring Kubernetes Dashboard
+
+If your Capsule Proxy uses HTTPS and the CA certificate is not the Kubernetes CA, you need to add a secret with the CA for the Capsule Proxy URL.
+```bash
+cat > ca.crt<< EOF
+-----BEGIN CERTIFICATE-----
+...
+...
+...
+-----END CERTIFICATE-----
+EOF
+
+kubectl create secret generic certificate --from-file=ca.crt=ca.crt -n ${KUBERNETES_DASHBOARD_NAMESPACE}
+```
+
+Prepare the values for the Kubernetes Dashboard:
+```bash
+cat > values-kubernetes-dashboard.yaml <<EOF
+extraVolumes:
+  - name: token-ca
+    projected:
+      sources:
+        - serviceAccountToken:
+            expirationSeconds: 86400
+            path: token
+        - secret:
+            name: certificate
+            items:
+              - key: ca.crt
+                path: ca.crt
+extraVolumeMounts:
+  - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
+    name: token-ca
+
+ingress:
+  enabled: true
+  annotations:
+    nginx.ingress.kubernetes.io/auth-signin: https://${DASHBOARD_URL}/oauth2/start?rd=$escaped_request_uri
+    nginx.ingress.kubernetes.io/auth-url: https://${DASHBOARD_URL}/oauth2/auth
+    nginx.ingress.kubernetes.io/auth-response-headers: "authorization"
+  hosts:
+    - ${DASHBOARD_URL}
+  tls:
+    - hosts:
+      - ${DASHBOARD_URL}
+
+extraEnv:
+  - name: KUBERNETES_SERVICE_HOST
+    value: '${CAPSULE_PROXY_URL}'
+  - name: KUBERNETES_SERVICE_PORT
+    value: '${CAPSULE_PROXY_PORT}'
+EOF
+```
+
+To add the Certificate Authority for the Capsule Proxy URL, we use the volume `token-ca` to mount the `ca.crt` file.
+Additionally, we set the environment variables `KUBERNETES_SERVICE_HOST` and `KUBERNETES_SERVICE_PORT` to route requests to the Capsule Proxy.
+
+Now you can install the Kubernetes Dashboard:
+
+```bash
+helm repo add kubernetes-dashboard https://kubernetes.github.io/dashboard/
+helm install kubernetes-dashboard kubernetes-dashboard/kubernetes-dashboard -n ${KUBERNETES_DASHBOARD_NAMESPACE} -f values-kubernetes-dashboard.yaml
+```

docs/content/guides/upgrading.md

@@ -3,7 +3,8 @@
 List of Tenant API changes:
 
 - [Capsule v0.1.0](https://github.com/clastix/capsule/releases/tag/v0.1.0) bump to `v1beta1` from `v1alpha1`.
-- [Capsule v0.2.0](https://github.com/clastix/capsule/releases/tag/v0.1.0) bump to `v1beta2` from `v1beta1`, deprecating `v1alpha1`.
+- [Capsule v0.2.0](https://github.com/clastix/capsule/releases/tag/v0.2.0) bump to `v1beta2` from `v1beta1`, deprecating `v1alpha1`.
+- [Capsule v0.3.0](https://github.com/clastix/capsule/releases/tag/v0.3.0) missing enums required by [Capsule Proxy](https://github.com/clastix/capsule-proxy).
 
 This document aims to provide support and a guide on how to perform a clean upgrade to the latest API version in order to avoid service disruption and data loss.
 
@@ -14,6 +15,55 @@ As an installation method, Helm is given for granted, YMMV using the `kustomize`
 We strongly suggest performing a full backup of your Kubernetes cluster, such as storage and etcd.
 Use your favourite tool according to your needs.
 
+# Upgrading from v0.2.x to v0.3.x
+
+A minor bump has been requested due to some missing enums in the Tenant resource.
+
+## Scale down the Capsule controller
+
+Using the `kubectl` or Helm, scale down the Capsule controller manager: this is required to avoid the old Capsule version from processing objects that aren't yet installed as a CRD.
+
+```
+helm upgrade -n capsule-system capsule --set "replicaCount=0" 
+```
+
+## Patch the Tenant custom resource definition
+
+Unfortunately, Helm doesn't manage the lifecycle of Custom Resource Definitions, additional details can be found [here](https://github.com/helm/community/blob/f9e06c16d89ccea1bea77c01a6a96ae3b309f823/architecture/crds.md).
+
+This process must be executed manually as follows:
+
+```
+kubectl apply -f https://raw.githubusercontent.com/clastix/capsule/v0.3.0/charts/capsule/crds/tenant-crd.yaml
+```
+
+## Update your Capsule Helm chart
+
+Ensure to update the Capsule repository to fetch the latest changes.
+
+```
+helm repo update
+```
+
+The latest Chart must be used, at the current time, >=0.4.0 is expected for Capsule >=v0.3.0, you can fetch the full list of available charts with the following command.
+
+```
+helm search repo -l clastix/capsule
+```
+
+Since the Tenant custom resource definition has been patched with new fields, we can install back Capsule using the provided Helm chart.
+
+```
+helm upgrade --install capsule clastix/capsule -n capsule-system --create-namespace --version 0.4.0
+```
+
+This will start the Operator with the latest changes, and perform the required sync operations like:
+
+1. Ensuring the CA is still valid
+2. Ensuring a TLS certificate is valid for the local webhook server
+3. If not using the cert-manager integration, patching the Validating and Mutating Webhook Configuration resources with the Capsule CA
+4. If not using the cert-manager integration, patching the Capsule's Custom Resource Definitions conversion webhook fields with the Capsule CA
+
 # Upgrading from v0.1.3 to v0.2.x
 
 ## Scale down the Capsule controller
@@ -40,7 +90,7 @@ The deletion of the `CapsuleConfiguration` resource is required, along with the
 
 ```
 kubectl delete capsuleconfiguration default
-kubectl apply -f https://raw.githubusercontent.com/clastix/capsule/v0.2.1/config/crd/bases/capsuleconfiguration-crd.yaml
+kubectl apply -f https://raw.githubusercontent.com/clastix/capsule/v0.2.1/charts/capsule/crds/capsuleconfiguration-crd.yaml
 ```
 
 During the Helm upgrade, a new `CapsuleConfiguration` will be created: please, refer to the Helm Chart values to pick up your desired settings.
@@ -52,9 +102,9 @@ Unfortunately, Helm doesn't manage the lifecycle of Custom Resource Definitions,
 This process must be executed manually as follows:
 
 ```
-kubectl apply -f https://raw.githubusercontent.com/clastix/capsule/v0.2.1/config/crd/bases/globaltenantresources-crd.yaml
-kubectl apply -f https://raw.githubusercontent.com/clastix/capsule/v0.2.1/config/crd/bases/tenant-crd.yaml
-kubectl apply -f https://raw.githubusercontent.com/clastix/capsule/v0.2.1/config/crd/bases/tenantresources-crd.yaml
+kubectl apply -f https://raw.githubusercontent.com/clastix/capsule/v0.2.1/charts/capsule/crds/globaltenantresources-crd.yaml
+kubectl apply -f https://raw.githubusercontent.com/clastix/capsule/v0.2.1/charts/capsule/crds/tenant-crd.yaml
+kubectl apply -f https://raw.githubusercontent.com/clastix/capsule/v0.2.1/charts/capsule/crds/tenantresources-crd.yaml
 ```
 
 > We're giving for granted that Capsule is installed in the `capsule-system` Namespace.
@@ -142,7 +192,7 @@ Unfortunately, Helm doesn't manage the lifecycle of Custom Resource Definitions,
 This process must be executed manually as follows:
 
 ```
-kubectl apply -f https://raw.githubusercontent.com/clastix/capsule/v0.1.0/config/crd/bases/capsule.clastix.io_tenants.yaml
+kubectl apply -f https://raw.githubusercontent.com/clastix/capsule/v0.1.0/charts/capsule/crds/tenant-crd.yaml
 ```
 
 > Please note the Capsule version in the said URL, your mileage may vary according to the desired upgrading version.

docs/gridsome.server.js

@@ -66,6 +66,10 @@ module.exports = function (api) {
               label: 'Monitoring Capsule',
               path: '/docs/guides/monitoring'
             },
+            {
+              label: 'Kubernetes Dashboard',
+              path: '/docs/guides/kubernetes-dashboard'
+            },
             {
               label: 'Backup & Restore with Velero',
               path: '/docs/guides/velero'

docs/package-lock.json

@@ -2591,9 +2591,9 @@
       },
       "dependencies": {
         "semver": {
-          "version": "5.7.1",
-          "resolved": "https://registry.npmjs.org/semver/-/semver-5.7.1.tgz",
-          "integrity": "sha512-sauaDf/PZdVgrLTNYHRtpXa1iRiKcaebiKQ1BJdpQlWH2lCvexQdX55snPFyK7QzpudqbCI0qXFfOasHdyNDGQ=="
+          "version": "5.7.2",
+          "resolved": "https://registry.npmjs.org/semver/-/semver-5.7.2.tgz",
+          "integrity": "sha512-cBznnQ9KjJqU67B52RMC65CMarK2600WFnbkcaiwWq3xy/5haFJlshgnpjovMVJ+Hff49d8GEn0b87C5pDQ10g=="
         }
       }
     },
@@ -3827,9 +3827,9 @@
       },
       "dependencies": {
         "semver": {
-          "version": "5.7.1",
-          "resolved": "https://registry.npmjs.org/semver/-/semver-5.7.1.tgz",
-          "integrity": "sha512-sauaDf/PZdVgrLTNYHRtpXa1iRiKcaebiKQ1BJdpQlWH2lCvexQdX55snPFyK7QzpudqbCI0qXFfOasHdyNDGQ=="
+          "version": "5.7.2",
+          "resolved": "https://registry.npmjs.org/semver/-/semver-5.7.2.tgz",
+          "integrity": "sha512-cBznnQ9KjJqU67B52RMC65CMarK2600WFnbkcaiwWq3xy/5haFJlshgnpjovMVJ+Hff49d8GEn0b87C5pDQ10g=="
         }
       }
     },
@@ -5611,9 +5611,9 @@
           }
         },
         "semver": {
-          "version": "5.7.1",
-          "resolved": "https://registry.npmjs.org/semver/-/semver-5.7.1.tgz",
-          "integrity": "sha512-sauaDf/PZdVgrLTNYHRtpXa1iRiKcaebiKQ1BJdpQlWH2lCvexQdX55snPFyK7QzpudqbCI0qXFfOasHdyNDGQ=="
+          "version": "5.7.2",
+          "resolved": "https://registry.npmjs.org/semver/-/semver-5.7.2.tgz",
+          "integrity": "sha512-cBznnQ9KjJqU67B52RMC65CMarK2600WFnbkcaiwWq3xy/5haFJlshgnpjovMVJ+Hff49d8GEn0b87C5pDQ10g=="
         }
       }
     },
@@ -6352,9 +6352,9 @@
           }
         },
         "semver": {
-          "version": "5.7.1",
-          "resolved": "https://registry.npmjs.org/semver/-/semver-5.7.1.tgz",
-          "integrity": "sha512-sauaDf/PZdVgrLTNYHRtpXa1iRiKcaebiKQ1BJdpQlWH2lCvexQdX55snPFyK7QzpudqbCI0qXFfOasHdyNDGQ=="
+          "version": "5.7.2",
+          "resolved": "https://registry.npmjs.org/semver/-/semver-5.7.2.tgz",
+          "integrity": "sha512-cBznnQ9KjJqU67B52RMC65CMarK2600WFnbkcaiwWq3xy/5haFJlshgnpjovMVJ+Hff49d8GEn0b87C5pDQ10g=="
         }
       }
     },
@@ -7799,9 +7799,9 @@
       "integrity": "sha512-qsda+H8jTaUaN/x5vzW2rzc+8Rw4TAQ/4KjB46IwK5VH+IlVeeeje/EoZRpiXvIqjFgK84QffqPztGI3VBLG1A=="
     },
     "lilconfig": {
-      "version": "2.0.6",
-      "resolved": "https://registry.npmjs.org/lilconfig/-/lilconfig-2.0.6.tgz",
-      "integrity": "sha512-9JROoBW7pobfsx+Sq2JsASvCo6Pfo6WWoUW79HuB1BCoBXD4PLWJPqDF6fNj67pqBYTbAHkE57M1kS/+L1neOg==",
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/lilconfig/-/lilconfig-2.1.0.tgz",
+      "integrity": "sha512-utWOt/GHzuUxnLKxB6dk81RoOeoNeHgbrXiuGk4yyF5qlRz+iIVWu56E2fqGHFrXz0QNUhLB/8nKqvRH66JKGQ==",
       "dev": true
     },
     "lines-and-columns": {
@@ -8443,9 +8443,9 @@
       },
       "dependencies": {
         "semver": {
-          "version": "5.7.1",
-          "resolved": "https://registry.npmjs.org/semver/-/semver-5.7.1.tgz",
-          "integrity": "sha512-sauaDf/PZdVgrLTNYHRtpXa1iRiKcaebiKQ1BJdpQlWH2lCvexQdX55snPFyK7QzpudqbCI0qXFfOasHdyNDGQ=="
+          "version": "5.7.2",
+          "resolved": "https://registry.npmjs.org/semver/-/semver-5.7.2.tgz",
+          "integrity": "sha512-cBznnQ9KjJqU67B52RMC65CMarK2600WFnbkcaiwWq3xy/5haFJlshgnpjovMVJ+Hff49d8GEn0b87C5pDQ10g=="
         }
       }
     },
@@ -8532,9 +8532,9 @@
       },
       "dependencies": {
         "semver": {
-          "version": "5.7.1",
-          "resolved": "https://registry.npmjs.org/semver/-/semver-5.7.1.tgz",
-          "integrity": "sha512-sauaDf/PZdVgrLTNYHRtpXa1iRiKcaebiKQ1BJdpQlWH2lCvexQdX55snPFyK7QzpudqbCI0qXFfOasHdyNDGQ=="
+          "version": "5.7.2",
+          "resolved": "https://registry.npmjs.org/semver/-/semver-5.7.2.tgz",
+          "integrity": "sha512-cBznnQ9KjJqU67B52RMC65CMarK2600WFnbkcaiwWq3xy/5haFJlshgnpjovMVJ+Hff49d8GEn0b87C5pDQ10g=="
         }
       }
     },
@@ -10918,9 +10918,9 @@
           "dev": true
         },
         "nanoid": {
-          "version": "3.3.4",
-          "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.4.tgz",
-          "integrity": "sha512-MqBkQh/OHTS2egovRtLk45wEyNXwF+cokD+1YPf9u5VfJiRdAiRwB2froX5Co9Rh20xs4siNPm8naNotSD6RBw==",
+          "version": "3.3.6",
+          "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.6.tgz",
+          "integrity": "sha512-BGcqMMJuToF7i1rt+2PWSNVnWIkGCU78jBG3RxO/bZlnZPK2Cmi2QaffxGO/2RvWi9sL+FAiRiXMgsyxQ1DIDA==",
           "dev": true
         },
         "picocolors": {
@@ -10930,12 +10930,12 @@
           "dev": true
         },
         "postcss": {
-          "version": "8.4.19",
-          "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.4.19.tgz",
-          "integrity": "sha512-h+pbPsyhlYj6N2ozBmHhHrs9DzGmbaarbLvWipMRO7RLS+v4onj26MPFXA5OBYFxyqYhUJK456SwDcY9H2/zsA==",
+          "version": "8.4.25",
+          "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.4.25.tgz",
+          "integrity": "sha512-7taJ/8t2av0Z+sQEvNzCkpDynl0tX3uJMCODi6nT3PfASC7dYCWV9aQ+uiCf+KBD4SEFcu+GvJdGdwzQ6OSjCw==",
           "dev": true,
           "requires": {
-            "nanoid": "^3.3.4",
+            "nanoid": "^3.3.6",
             "picocolors": "^1.0.0",
             "source-map-js": "^1.0.2"
           }
@@ -11839,9 +11839,9 @@
           }
         },
         "semver": {
-          "version": "7.3.5",
-          "resolved": "https://registry.npmjs.org/semver/-/semver-7.3.5.tgz",
-          "integrity": "sha512-PoeGJYh8HK4BTO/a9Tf6ZG3veo/A7ZVsYrSA6J8ny9nb3B1VrpkuN+z9OE5wfE5p6H4LchYZsegiQgbJD94ZFQ==",
+          "version": "7.5.4",
+          "resolved": "https://registry.npmjs.org/semver/-/semver-7.5.4.tgz",
+          "integrity": "sha512-1bCSESV6Pv+i21Hvpxp3Dx+pSD8lIPt8uVjRrxAUt/nbswYc+tK6Y2btiULjd4+fnq15PX+nqQDC7Oft7WkwcA==",
           "dev": true,
           "requires": {
             "lru-cache": "^6.0.0"
@@ -11898,9 +11898,9 @@
       }
     },
     "semver": {
-      "version": "6.3.0",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.0.tgz",
-      "integrity": "sha512-b39TBaTSfV6yBrapU89p5fKekE2m/NwnDocOVruQFS1/veMgdzuPcnOM34M6CwxW8jH/lxEa5rBoDeUwu5HHTw=="
+      "version": "6.3.1",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz",
+      "integrity": "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA=="
     },
     "semver-diff": {
       "version": "3.1.1",
@@ -11924,9 +11924,9 @@
       },
       "dependencies": {
         "semver": {
-          "version": "5.7.1",
-          "resolved": "https://registry.npmjs.org/semver/-/semver-5.7.1.tgz",
-          "integrity": "sha512-sauaDf/PZdVgrLTNYHRtpXa1iRiKcaebiKQ1BJdpQlWH2lCvexQdX55snPFyK7QzpudqbCI0qXFfOasHdyNDGQ=="
+          "version": "5.7.2",
+          "resolved": "https://registry.npmjs.org/semver/-/semver-5.7.2.tgz",
+          "integrity": "sha512-cBznnQ9KjJqU67B52RMC65CMarK2600WFnbkcaiwWq3xy/5haFJlshgnpjovMVJ+Hff49d8GEn0b87C5pDQ10g=="
         }
       }
     },
@@ -12003,9 +12003,9 @@
           }
         },
         "semver": {
-          "version": "7.3.5",
-          "resolved": "https://registry.npmjs.org/semver/-/semver-7.3.5.tgz",
-          "integrity": "sha512-PoeGJYh8HK4BTO/a9Tf6ZG3veo/A7ZVsYrSA6J8ny9nb3B1VrpkuN+z9OE5wfE5p6H4LchYZsegiQgbJD94ZFQ==",
+          "version": "7.5.4",
+          "resolved": "https://registry.npmjs.org/semver/-/semver-7.5.4.tgz",
+          "integrity": "sha512-1bCSESV6Pv+i21Hvpxp3Dx+pSD8lIPt8uVjRrxAUt/nbswYc+tK6Y2btiULjd4+fnq15PX+nqQDC7Oft7WkwcA==",
           "requires": {
             "lru-cache": "^6.0.0"
           }

docs/yarn.lock

@@ -8764,9 +8764,9 @@ semver-truncate@^1.1.2:
     semver "^5.3.0"
 
 "semver@2 || 3 || 4 || 5", semver@^5.3.0, semver@^5.4.1, semver@^5.5.0, semver@^5.6.0:
-  version "5.7.1"
-  resolved "https://registry.yarnpkg.com/semver/-/semver-5.7.1.tgz#a954f931aeba508d307bbf069eff0c01c96116f7"
-  integrity sha512-sauaDf/PZdVgrLTNYHRtpXa1iRiKcaebiKQ1BJdpQlWH2lCvexQdX55snPFyK7QzpudqbCI0qXFfOasHdyNDGQ==
+  version "5.7.2"
+  resolved "https://registry.yarnpkg.com/semver/-/semver-5.7.2.tgz#48d55db737c3287cd4835e17fa13feace1c41ef8"
+  integrity sha512-cBznnQ9KjJqU67B52RMC65CMarK2600WFnbkcaiwWq3xy/5haFJlshgnpjovMVJ+Hff49d8GEn0b87C5pDQ10g==
 
 semver@7.0.0:
   version "7.0.0"
@@ -8774,14 +8774,14 @@ semver@7.0.0:
   integrity sha512-+GB6zVA9LWh6zovYQLALHwv5rb2PHGlJi3lfiqIHxR0uuwCgefcOJc59v9fv1w8GbStwxuuqqAjI9NMAOOgq1A==
 
 semver@^6.0.0, semver@^6.1.0, semver@^6.1.1, semver@^6.1.2, semver@^6.2.0, semver@^6.3.0:
-  version "6.3.0"
-  resolved "https://registry.yarnpkg.com/semver/-/semver-6.3.0.tgz#ee0a64c8af5e8ceea67687b133761e1becbd1d3d"
-  integrity sha512-b39TBaTSfV6yBrapU89p5fKekE2m/NwnDocOVruQFS1/veMgdzuPcnOM34M6CwxW8jH/lxEa5rBoDeUwu5HHTw==
+  version "6.3.1"
+  resolved "https://registry.yarnpkg.com/semver/-/semver-6.3.1.tgz#556d2ef8689146e46dcea4bfdd095f3434dffcb4"
+  integrity sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==
 
 semver@^7.3.2:
-  version "7.3.5"
-  resolved "https://registry.yarnpkg.com/semver/-/semver-7.3.5.tgz#0b621c879348d8998e4b0e4be94b3f12e6018ef7"
-  integrity sha512-PoeGJYh8HK4BTO/a9Tf6ZG3veo/A7ZVsYrSA6J8ny9nb3B1VrpkuN+z9OE5wfE5p6H4LchYZsegiQgbJD94ZFQ==
+  version "7.5.4"
+  resolved "https://registry.yarnpkg.com/semver/-/semver-7.5.4.tgz#483986ec4ed38e1c6c48c34894a9182dbff68a6e"
+  integrity sha512-1bCSESV6Pv+i21Hvpxp3Dx+pSD8lIPt8uVjRrxAUt/nbswYc+tK6Y2btiULjd4+fnq15PX+nqQDC7Oft7WkwcA==
   dependencies:
     lru-cache "^6.0.0"
 

e2e/additional_role_bindings_test.go

@@ -9,7 +9,7 @@ import (
 	"context"
 	"fmt"
 
-	. "github.com/onsi/ginkgo"
+	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
 	rbacv1 "k8s.io/api/rbac/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"

e2e/allowed_external_ips_test.go

@@ -8,7 +8,7 @@ package e2e
 import (
 	"context"
 
-	. "github.com/onsi/ginkgo"
+	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"

e2e/container_registry_test.go

@@ -9,7 +9,7 @@ import (
 	"context"
 	"encoding/json"
 
-	. "github.com/onsi/ginkgo"
+	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"

e2e/custom_capsule_group_test.go

@@ -8,7 +8,7 @@ package e2e
 import (
 	"context"
 
-	. "github.com/onsi/ginkgo"
+	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 

e2e/custom_resource_quota_test.go

@@ -9,7 +9,7 @@ import (
 	"context"
 	"fmt"
 
-	. "github.com/onsi/ginkgo"
+	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
 	v1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"

e2e/disable_externalname_test.go

@@ -8,7 +8,7 @@ package e2e
 import (
 	"context"
 
-	. "github.com/onsi/ginkgo"
+	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -33,7 +33,7 @@ var _ = Describe("creating an ExternalName service when it is disabled for Tenan
 			},
 			ServiceOptions: &api.ServiceOptions{
 				AllowedServices: &api.AllowedServices{
-					ExternalName: pointer.BoolPtr(false),
+					ExternalName: pointer.Bool(false),
 				},
 			},
 		},

e2e/disable_ingress_wildcard_test.go

@@ -7,19 +7,18 @@ package e2e
 
 import (
 	"context"
-	"errors"
 	"fmt"
 
-	. "github.com/onsi/ginkgo"
+	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
 	extensionsv1beta1 "k8s.io/api/extensions/v1beta1"
 	networkingv1 "k8s.io/api/networking/v1"
 	networkingv1beta1 "k8s.io/api/networking/v1beta1"
-	"k8s.io/apimachinery/pkg/api/meta"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/util/intstr"
 
 	capsulev1beta2 "github.com/clastix/capsule/api/v1beta2"
+	"github.com/clastix/capsule/pkg/utils"
 )
 
 var _ = Describe("creating an Ingress with a wildcard when it is denied for the Tenant", func() {
@@ -54,8 +53,7 @@ var _ = Describe("creating an Ingress with a wildcard when it is denied for the
 
 	It("should fail creating an extensions/v1beta1 Ingress with a wildcard hostname", func() {
 		if err := k8sClient.List(context.Background(), &extensionsv1beta1.IngressList{}); err != nil {
-			missingAPIError := &meta.NoKindMatchError{}
-			if errors.As(err, &missingAPIError) {
+			if utils.IsUnsupportedAPI(err) {
 				Skip(fmt.Sprintf("Running test due to unsupported API kind: %s", err.Error()))
 			}
 		}
@@ -135,8 +133,7 @@ var _ = Describe("creating an Ingress with a wildcard when it is denied for the
 
 	It("should fail creating an networking.k8s.io/v1beta1 Ingress with a wildcard hostname", func() {
 		if err := k8sClient.List(context.Background(), &networkingv1beta1.IngressList{}); err != nil {
-			missingAPIError := &meta.NoKindMatchError{}
-			if errors.As(err, &missingAPIError) {
+			if utils.IsUnsupportedAPI(err) {
 				Skip(fmt.Sprintf("Running test due to unsupported API kind: %s", err.Error()))
 			}
 		}
@@ -216,8 +213,7 @@ var _ = Describe("creating an Ingress with a wildcard when it is denied for the
 
 	It("should fail creating an networking.k8s.io/v1 Ingress with a wildcard hostname", func() {
 		if err := k8sClient.List(context.Background(), &networkingv1.IngressList{}); err != nil {
-			missingAPIError := &meta.NoKindMatchError{}
-			if errors.As(err, &missingAPIError) {
+			if utils.IsUnsupportedAPI(err) {
 				Skip(fmt.Sprintf("Running test due to unsupported API kind: %s", err.Error()))
 			}
 		}

e2e/disable_loadbalancer_test.go

@@ -8,7 +8,7 @@ package e2e
 import (
 	"context"
 
-	. "github.com/onsi/ginkgo"
+	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -33,7 +33,7 @@ var _ = Describe("creating a LoadBalancer service when it is disabled for Tenant
 			},
 			ServiceOptions: &api.ServiceOptions{
 				AllowedServices: &api.AllowedServices{
-					LoadBalancer: pointer.BoolPtr(false),
+					LoadBalancer: pointer.Bool(false),
 				},
 			},
 		},

e2e/disable_node_ports_test.go

@@ -8,7 +8,7 @@ package e2e
 import (
 	"context"
 
-	. "github.com/onsi/ginkgo"
+	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -33,7 +33,7 @@ var _ = Describe("creating a nodePort service when it is disabled for Tenant", f
 			},
 			ServiceOptions: &api.ServiceOptions{
 				AllowedServices: &api.AllowedServices{
-					NodePort: pointer.BoolPtr(false),
+					NodePort: pointer.Bool(false),
 				},
 			},
 		},

e2e/dynamic_tenant_owner_clusterroles_test.go

@@ -9,7 +9,7 @@ package e2e
 import (
 	"context"
 
-	. "github.com/onsi/ginkgo"
+	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 

e2e/enable_loadbalancer_test.go

@@ -8,7 +8,7 @@ package e2e
 import (
 	"context"
 
-	. "github.com/onsi/ginkgo"
+	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -33,7 +33,7 @@ var _ = Describe("creating a LoadBalancer service when it is enabled for Tenant"
 			},
 			ServiceOptions: &api.ServiceOptions{
 				AllowedServices: &api.AllowedServices{
-					LoadBalancer: pointer.BoolPtr(true),
+					LoadBalancer: pointer.Bool(true),
 				},
 			},
 		},

e2e/enable_node_ports_test.go

@@ -8,7 +8,7 @@ package e2e
 import (
 	"context"
 
-	. "github.com/onsi/ginkgo"
+	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"

e2e/forbidden_annotations_regex_test.go

@@ -8,7 +8,7 @@ package e2e
 import (
 	"context"
 
-	. "github.com/onsi/ginkgo"
+	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 
@@ -91,7 +91,7 @@ var _ = Describe("creating a tenant with various forbidden regexes", func() {
 
 			EventuallyCreation(func() error {
 				tnt.SetResourceVersion("")
-				
+
 				tnt.Spec.NamespaceOptions = &capsulev1beta2.NamespaceOptions{
 					ForbiddenAnnotations: api.ForbiddenListSpec{
 						Regex: annotationValue,

e2e/force_tenant_prefix_test.go

@@ -8,7 +8,7 @@ package e2e
 import (
 	"context"
 
-	. "github.com/onsi/ginkgo"
+	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 

e2e/globaltenantresource_test.go

@@ -10,7 +10,7 @@ import (
 	"fmt"
 	"time"
 
-	. "github.com/onsi/ginkgo"
+	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"

e2e/imagepullpolicy_multiple_test.go

@@ -8,7 +8,7 @@ package e2e
 import (
 	"context"
 
-	. "github.com/onsi/ginkgo"
+	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"

e2e/imagepullpolicy_single_test.go

@@ -8,7 +8,7 @@ package e2e
 import (
 	"context"
 
-	. "github.com/onsi/ginkgo"
+	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"

e2e/ingress_class_extensions_test.go

@@ -7,19 +7,18 @@ package e2e
 
 import (
 	"context"
-	"errors"
 	"fmt"
 
-	. "github.com/onsi/ginkgo"
+	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
 	extensionsv1beta1 "k8s.io/api/extensions/v1beta1"
-	"k8s.io/apimachinery/pkg/api/meta"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/util/intstr"
 	"k8s.io/utils/pointer"
 
 	capsulev1beta2 "github.com/clastix/capsule/api/v1beta2"
 	"github.com/clastix/capsule/pkg/api"
+	"github.com/clastix/capsule/pkg/utils"
 )
 
 var _ = Describe("when Tenant handles Ingress classes with extensions/v1beta1", func() {
@@ -72,8 +71,7 @@ var _ = Describe("when Tenant handles Ingress classes with extensions/v1beta1",
 
 		By("non-specifying at all", func() {
 			if err := k8sClient.List(context.Background(), &extensionsv1beta1.IngressList{}); err != nil {
-				missingAPIError := &meta.NoKindMatchError{}
-				if errors.As(err, &missingAPIError) {
+				if utils.IsUnsupportedAPI(err) {
 					Skip(fmt.Sprintf("Running test due to unsupported API kind: %s", err.Error()))
 				}
 			}
@@ -96,8 +94,7 @@ var _ = Describe("when Tenant handles Ingress classes with extensions/v1beta1",
 		})
 		By("defining as deprecated annotation", func() {
 			if err := k8sClient.List(context.Background(), &extensionsv1beta1.IngressList{}); err != nil {
-				missingAPIError := &meta.NoKindMatchError{}
-				if errors.As(err, &missingAPIError) {
+				if utils.IsUnsupportedAPI(err) {
 					Skip(fmt.Sprintf("Running test due to unsupported API kind: %s", err.Error()))
 				}
 			}
@@ -123,8 +120,7 @@ var _ = Describe("when Tenant handles Ingress classes with extensions/v1beta1",
 		})
 		By("using the ingressClassName", func() {
 			if err := k8sClient.List(context.Background(), &extensionsv1beta1.IngressList{}); err != nil {
-				missingAPIError := &meta.NoKindMatchError{}
-				if errors.As(err, &missingAPIError) {
+				if utils.IsUnsupportedAPI(err) {
 					Skip(fmt.Sprintf("Running test due to unsupported API kind: %s", err.Error()))
 				}
 			}
@@ -135,7 +131,7 @@ var _ = Describe("when Tenant handles Ingress classes with extensions/v1beta1",
 						Name: "denied-ingress",
 					},
 					Spec: extensionsv1beta1.IngressSpec{
-						IngressClassName: pointer.StringPtr("the-worst-ingress-available"),
+						IngressClassName: pointer.String("the-worst-ingress-available"),
 						Backend: &extensionsv1beta1.IngressBackend{
 							ServiceName: "foo",
 							ServicePort: intstr.FromInt(8080),
@@ -158,8 +154,7 @@ var _ = Describe("when Tenant handles Ingress classes with extensions/v1beta1",
 		for _, c := range tnt.Spec.IngressOptions.AllowedClasses.Exact {
 			Eventually(func() (err error) {
 				if err := k8sClient.List(context.Background(), &extensionsv1beta1.IngressList{}); err != nil {
-					missingAPIError := &meta.NoKindMatchError{}
-					if errors.As(err, &missingAPIError) {
+					if utils.IsUnsupportedAPI(err) {
 						Skip(fmt.Sprintf("Running test due to unsupported API kind: %s", err.Error()))
 					}
 				}
@@ -186,8 +181,7 @@ var _ = Describe("when Tenant handles Ingress classes with extensions/v1beta1",
 
 	It("should allow enabled class using the ingressClassName field", func() {
 		if err := k8sClient.List(context.Background(), &extensionsv1beta1.IngressList{}); err != nil {
-			missingAPIError := &meta.NoKindMatchError{}
-			if errors.As(err, &missingAPIError) {
+			if utils.IsUnsupportedAPI(err) {
 				Skip(fmt.Sprintf("Running test due to unsupported API kind: %s", err.Error()))
 			}
 		}
@@ -232,8 +226,7 @@ var _ = Describe("when Tenant handles Ingress classes with extensions/v1beta1",
 
 		Eventually(func() (err error) {
 			if err := k8sClient.List(context.Background(), &extensionsv1beta1.IngressList{}); err != nil {
-				missingAPIError := &meta.NoKindMatchError{}
-				if errors.As(err, &missingAPIError) {
+				if utils.IsUnsupportedAPI(err) {
 					Skip(fmt.Sprintf("Running test due to unsupported API kind: %s", err.Error()))
 				}
 			}
@@ -267,8 +260,7 @@ var _ = Describe("when Tenant handles Ingress classes with extensions/v1beta1",
 
 		Eventually(func() (err error) {
 			if err := k8sClient.List(context.Background(), &extensionsv1beta1.IngressList{}); err != nil {
-				missingAPIError := &meta.NoKindMatchError{}
-				if errors.As(err, &missingAPIError) {
+				if utils.IsUnsupportedAPI(err) {
 					Skip(fmt.Sprintf("Running test due to unsupported API kind: %s", err.Error()))
 				}
 			}

e2e/ingress_class_networking_test.go

@@ -7,15 +7,13 @@ package e2e
 
 import (
 	"context"
-	"errors"
 	"fmt"
 	"strconv"
 	"strings"
 
-	. "github.com/onsi/ginkgo"
+	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
 	networkingv1 "k8s.io/api/networking/v1"
-	"k8s.io/apimachinery/pkg/api/meta"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/labels"
 	"k8s.io/apimachinery/pkg/selection"
@@ -25,6 +23,7 @@ import (
 
 	capsulev1beta2 "github.com/clastix/capsule/api/v1beta2"
 	"github.com/clastix/capsule/pkg/api"
+	"github.com/clastix/capsule/pkg/utils"
 )
 
 var _ = Describe("when Tenant handles Ingress classes with networking.k8s.io/v1", func() {
@@ -158,8 +157,7 @@ var _ = Describe("when Tenant handles Ingress classes with networking.k8s.io/v1"
 
 	It("should block a non allowed class", func() {
 		if err := k8sClient.List(context.Background(), &networkingv1.IngressList{}); err != nil {
-			missingAPIError := &meta.NoKindMatchError{}
-			if errors.As(err, &missingAPIError) {
+			if utils.IsUnsupportedAPI(err) {
 				Skip(fmt.Sprintf("Running test due to unsupported API kind: %s", err.Error()))
 			}
 		}
@@ -222,7 +220,7 @@ var _ = Describe("when Tenant handles Ingress classes with networking.k8s.io/v1"
 						Name: "denied-ingress",
 					},
 					Spec: networkingv1.IngressSpec{
-						IngressClassName: pointer.StringPtr("the-worst-ingress-available"),
+						IngressClassName: pointer.String("the-worst-ingress-available"),
 						DefaultBackend: &networkingv1.IngressBackend{
 							Service: &networkingv1.IngressServiceBackend{
 								Name: "foo",
@@ -241,8 +239,7 @@ var _ = Describe("when Tenant handles Ingress classes with networking.k8s.io/v1"
 
 	It("should allow enabled class using the deprecated annotation for networking.k8s.io/v1", func() {
 		if err := k8sClient.List(context.Background(), &networkingv1.IngressList{}); err != nil {
-			missingAPIError := &meta.NoKindMatchError{}
-			if errors.As(err, &missingAPIError) {
+			if utils.IsUnsupportedAPI(err) {
 				Skip(fmt.Sprintf("Running test due to unsupported API kind: %s", err.Error()))
 			}
 		}
@@ -281,8 +278,7 @@ var _ = Describe("when Tenant handles Ingress classes with networking.k8s.io/v1"
 
 	It("should allow enabled class using the ingressClassName field", func() {
 		if err := k8sClient.List(context.Background(), &networkingv1.IngressList{}); err != nil {
-			missingAPIError := &meta.NoKindMatchError{}
-			if errors.As(err, &missingAPIError) {
+			if utils.IsUnsupportedAPI(err) {
 				Skip(fmt.Sprintf("Running test due to unsupported API kind: %s", err.Error()))
 			}
 		}
@@ -319,8 +315,7 @@ var _ = Describe("when Tenant handles Ingress classes with networking.k8s.io/v1"
 
 	It("should allow enabled Ingress by regex using the deprecated annotation", func() {
 		if err := k8sClient.List(context.Background(), &networkingv1.IngressList{}); err != nil {
-			missingAPIError := &meta.NoKindMatchError{}
-			if errors.As(err, &missingAPIError) {
+			if utils.IsUnsupportedAPI(err) {
 				Skip(fmt.Sprintf("Running test due to unsupported API kind: %s", err.Error()))
 			}
 		}
@@ -358,8 +353,7 @@ var _ = Describe("when Tenant handles Ingress classes with networking.k8s.io/v1"
 
 	It("should allow enabled Ingress by regex using the ingressClassName field", func() {
 		if err := k8sClient.List(context.Background(), &networkingv1.IngressList{}); err != nil {
-			missingAPIError := &meta.NoKindMatchError{}
-			if errors.As(err, &missingAPIError) {
+			if utils.IsUnsupportedAPI(err) {
 				Skip(fmt.Sprintf("Running test due to unsupported API kind: %s", err.Error()))
 			}
 		}
@@ -395,8 +389,7 @@ var _ = Describe("when Tenant handles Ingress classes with networking.k8s.io/v1"
 
 	It("should allow enabled Ingress by selector using the deprecated annotation", func() {
 		if err := k8sClient.List(context.Background(), &networkingv1.IngressList{}); err != nil {
-			missingAPIError := &meta.NoKindMatchError{}
-			if errors.As(err, &missingAPIError) {
+			if utils.IsUnsupportedAPI(err) {
 				Skip(fmt.Sprintf("Running test due to unsupported API kind: %s", err.Error()))
 			}
 		}
@@ -451,8 +444,7 @@ var _ = Describe("when Tenant handles Ingress classes with networking.k8s.io/v1"
 
 	It("should allow enabled Ingress by selector using the ingressClassName field", func() {
 		if err := k8sClient.List(context.Background(), &networkingv1.IngressList{}); err != nil {
-			missingAPIError := &meta.NoKindMatchError{}
-			if errors.As(err, &missingAPIError) {
+			if utils.IsUnsupportedAPI(err) {
 				Skip(fmt.Sprintf("Running test due to unsupported API kind: %s", err.Error()))
 			}
 		}
@@ -535,8 +527,7 @@ var _ = Describe("when Tenant handles Ingress classes with networking.k8s.io/v1"
 
 	It("should mutate to default tenant IngressClass (class exists)", func() {
 		if err := k8sClient.List(context.Background(), &networkingv1.IngressList{}); err != nil {
-			missingAPIError := &meta.NoKindMatchError{}
-			if errors.As(err, &missingAPIError) {
+			if utils.IsUnsupportedAPI(err) {
 				Skip(fmt.Sprintf("Running test due to unsupported API kind: %s", err.Error()))
 			}
 		}
@@ -575,8 +566,7 @@ var _ = Describe("when Tenant handles Ingress classes with networking.k8s.io/v1"
 
 	It("shoult mutate to default tenant IngressClass although the cluster global one is not allowed", func() {
 		if err := k8sClient.List(context.Background(), &networkingv1.IngressList{}); err != nil {
-			missingAPIError := &meta.NoKindMatchError{}
-			if errors.As(err, &missingAPIError) {
+			if utils.IsUnsupportedAPI(err) {
 				Skip(fmt.Sprintf("Running test due to unsupported API kind: %s", err.Error()))
 			}
 		}
@@ -622,8 +612,7 @@ var _ = Describe("when Tenant handles Ingress classes with networking.k8s.io/v1"
 
 	It("should mutate to default tenant IngressClass although the cluster global one is allowed", func() {
 		if err := k8sClient.List(context.Background(), &networkingv1.IngressList{}); err != nil {
-			missingAPIError := &meta.NoKindMatchError{}
-			if errors.As(err, &missingAPIError) {
+			if utils.IsUnsupportedAPI(err) {
 				Skip(fmt.Sprintf("Running test due to unsupported API kind: %s", err.Error()))
 			}
 		}

e2e/ingress_hostnames_collision_cluster_scope_test.go

@@ -7,19 +7,18 @@ package e2e
 
 import (
 	"context"
-	"errors"
 	"fmt"
 
-	. "github.com/onsi/ginkgo"
+	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
 	extensionsv1beta1 "k8s.io/api/extensions/v1beta1"
 	networkingv1 "k8s.io/api/networking/v1"
-	"k8s.io/apimachinery/pkg/api/meta"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/util/intstr"
 
 	capsulev1beta2 "github.com/clastix/capsule/api/v1beta2"
 	"github.com/clastix/capsule/pkg/api"
+	"github.com/clastix/capsule/pkg/utils"
 )
 
 var _ = Describe("when handling Cluster scoped Ingress hostnames collision", func() {
@@ -156,8 +155,7 @@ var _ = Describe("when handling Cluster scoped Ingress hostnames collision", fun
 
 		By("testing networking.k8s.io", func() {
 			if err := k8sClient.List(context.Background(), &networkingv1.IngressList{}); err != nil {
-				missingAPIError := &meta.NoKindMatchError{}
-				if errors.As(err, &missingAPIError) {
+				if utils.IsUnsupportedAPI(err) {
 					Skip(fmt.Sprintf("Running test due to unsupported API kind: %s", err.Error()))
 				}
 			}
@@ -191,8 +189,7 @@ var _ = Describe("when handling Cluster scoped Ingress hostnames collision", fun
 
 		By("testing extensions", func() {
 			if err := k8sClient.List(context.Background(), &extensionsv1beta1.IngressList{}); err != nil {
-				missingAPIError := &meta.NoKindMatchError{}
-				if errors.As(err, &missingAPIError) {
+				if utils.IsUnsupportedAPI(err) {
 					Skip(fmt.Sprintf("Running test due to unsupported API kind: %s", err.Error()))
 				}
 			}

e2e/ingress_hostnames_collision_disabled_test.go

@@ -7,19 +7,18 @@ package e2e
 
 import (
 	"context"
-	"errors"
 	"fmt"
 
-	. "github.com/onsi/ginkgo"
+	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
 	extensionsv1beta1 "k8s.io/api/extensions/v1beta1"
 	networkingv1 "k8s.io/api/networking/v1"
-	"k8s.io/apimachinery/pkg/api/meta"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/util/intstr"
 
 	capsulev1beta2 "github.com/clastix/capsule/api/v1beta2"
 	"github.com/clastix/capsule/pkg/api"
+	"github.com/clastix/capsule/pkg/utils"
 )
 
 var _ = Describe("when disabling Ingress hostnames collision", func() {
@@ -130,8 +129,7 @@ var _ = Describe("when disabling Ingress hostnames collision", func() {
 
 		By("testing networking.k8s.io", func() {
 			if err := k8sClient.List(context.Background(), &networkingv1.IngressList{}); err != nil {
-				missingAPIError := &meta.NoKindMatchError{}
-				if errors.As(err, &missingAPIError) {
+				if utils.IsUnsupportedAPI(err) {
 					Skip(fmt.Sprintf("Running test due to unsupported API kind: %s", err.Error()))
 				}
 			}
@@ -171,8 +169,7 @@ var _ = Describe("when disabling Ingress hostnames collision", func() {
 
 		By("testing extensions", func() {
 			if err := k8sClient.List(context.Background(), &extensionsv1beta1.IngressList{}); err != nil {
-				missingAPIError := &meta.NoKindMatchError{}
-				if errors.As(err, &missingAPIError) {
+				if utils.IsUnsupportedAPI(err) {
 					Skip(fmt.Sprintf("Running test due to unsupported API kind: %s", err.Error()))
 				}
 			}

e2e/ingress_hostnames_collision_namespace_scope_test.go

@@ -7,19 +7,18 @@ package e2e
 
 import (
 	"context"
-	"errors"
 	"fmt"
 
-	. "github.com/onsi/ginkgo"
+	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
 	extensionsv1beta1 "k8s.io/api/extensions/v1beta1"
 	networkingv1 "k8s.io/api/networking/v1"
-	"k8s.io/apimachinery/pkg/api/meta"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/util/intstr"
 
 	capsulev1beta2 "github.com/clastix/capsule/api/v1beta2"
 	"github.com/clastix/capsule/pkg/api"
+	"github.com/clastix/capsule/pkg/utils"
 )
 
 var _ = Describe("when handling Namespace scoped Ingress hostnames collision", func() {
@@ -130,8 +129,7 @@ var _ = Describe("when handling Namespace scoped Ingress hostnames collision", f
 
 		By("testing networking.k8s.io", func() {
 			if err := k8sClient.List(context.Background(), &networkingv1.IngressList{}); err != nil {
-				missingAPIError := &meta.NoKindMatchError{}
-				if errors.As(err, &missingAPIError) {
+				if utils.IsUnsupportedAPI(err) {
 					Skip(fmt.Sprintf("Running test due to unsupported API kind: %s", err.Error()))
 				}
 			}
@@ -172,8 +170,7 @@ var _ = Describe("when handling Namespace scoped Ingress hostnames collision", f
 
 		By("testing extensions", func() {
 			if err := k8sClient.List(context.Background(), &extensionsv1beta1.IngressList{}); err != nil {
-				missingAPIError := &meta.NoKindMatchError{}
-				if errors.As(err, &missingAPIError) {
+				if utils.IsUnsupportedAPI(err) {
 					Skip(fmt.Sprintf("Running test due to unsupported API kind: %s", err.Error()))
 				}
 			}

e2e/ingress_hostnames_collision_tenant_scope_test.go

@@ -7,19 +7,18 @@ package e2e
 
 import (
 	"context"
-	"errors"
 	"fmt"
 
-	. "github.com/onsi/ginkgo"
+	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
 	extensionsv1beta1 "k8s.io/api/extensions/v1beta1"
 	networkingv1 "k8s.io/api/networking/v1"
-	"k8s.io/apimachinery/pkg/api/meta"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/util/intstr"
 
 	capsulev1beta2 "github.com/clastix/capsule/api/v1beta2"
 	"github.com/clastix/capsule/pkg/api"
+	"github.com/clastix/capsule/pkg/utils"
 )
 
 var _ = Describe("when handling Tenant scoped Ingress hostnames collision", func() {
@@ -133,8 +132,7 @@ var _ = Describe("when handling Tenant scoped Ingress hostnames collision", func
 
 		By("testing networking.k8s.io", func() {
 			if err := k8sClient.List(context.Background(), &networkingv1.IngressList{}); err != nil {
-				missingAPIError := &meta.NoKindMatchError{}
-				if errors.As(err, &missingAPIError) {
+				if utils.IsUnsupportedAPI(err) {
 					Skip(fmt.Sprintf("Running test due to unsupported API kind: %s", err.Error()))
 				}
 			}
@@ -168,8 +166,7 @@ var _ = Describe("when handling Tenant scoped Ingress hostnames collision", func
 
 		By("testing extensions", func() {
 			if err := k8sClient.List(context.Background(), &extensionsv1beta1.IngressList{}); err != nil {
-				missingAPIError := &meta.NoKindMatchError{}
-				if errors.As(err, &missingAPIError) {
+				if utils.IsUnsupportedAPI(err) {
 					Skip(fmt.Sprintf("Running test due to unsupported API kind: %s", err.Error()))
 				}
 			}

e2e/ingress_hostnames_test.go

@@ -7,19 +7,18 @@ package e2e
 
 import (
 	"context"
-	"errors"
 	"fmt"
 
-	. "github.com/onsi/ginkgo"
+	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
 	extensionsv1beta1 "k8s.io/api/extensions/v1beta1"
 	networkingv1 "k8s.io/api/networking/v1"
-	"k8s.io/apimachinery/pkg/api/meta"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/util/intstr"
 
 	capsulev1beta2 "github.com/clastix/capsule/api/v1beta2"
 	"github.com/clastix/capsule/pkg/api"
+	"github.com/clastix/capsule/pkg/utils"
 )
 
 var _ = Describe("when Tenant handles Ingress hostnames", func() {
@@ -129,8 +128,7 @@ var _ = Describe("when Tenant handles Ingress hostnames", func() {
 
 		By("testing networking.k8s.io", func() {
 			if err := k8sClient.List(context.Background(), &networkingv1.IngressList{}); err != nil {
-				missingAPIError := &meta.NoKindMatchError{}
-				if errors.As(err, &missingAPIError) {
+				if utils.IsUnsupportedAPI(err) {
 					Skip(fmt.Sprintf("Running test due to unsupported API kind: %s", err.Error()))
 				}
 			}
@@ -152,8 +150,7 @@ var _ = Describe("when Tenant handles Ingress hostnames", func() {
 
 		By("testing extensions", func() {
 			if err := k8sClient.List(context.Background(), &extensionsv1beta1.IngressList{}); err != nil {
-				missingAPIError := &meta.NoKindMatchError{}
-				if errors.As(err, &missingAPIError) {
+				if utils.IsUnsupportedAPI(err) {
 					Skip(fmt.Sprintf("Running test due to unsupported API kind: %s", err.Error()))
 				}
 			}
@@ -175,8 +172,7 @@ var _ = Describe("when Tenant handles Ingress hostnames", func() {
 
 		By("testing networking.k8s.io", func() {
 			if err := k8sClient.List(context.Background(), &networkingv1.IngressList{}); err != nil {
-				missingAPIError := &meta.NoKindMatchError{}
-				if errors.As(err, &missingAPIError) {
+				if utils.IsUnsupportedAPI(err) {
 					Skip(fmt.Sprintf("Running test due to unsupported API kind: %s", err.Error()))
 				}
 			}
@@ -200,8 +196,7 @@ var _ = Describe("when Tenant handles Ingress hostnames", func() {
 
 		By("testing extensions", func() {
 			if err := k8sClient.List(context.Background(), &extensionsv1beta1.IngressList{}); err != nil {
-				missingAPIError := &meta.NoKindMatchError{}
-				if errors.As(err, &missingAPIError) {
+				if utils.IsUnsupportedAPI(err) {
 					Skip(fmt.Sprintf("Running test due to unsupported API kind: %s", err.Error()))
 				}
 			}
@@ -225,8 +220,7 @@ var _ = Describe("when Tenant handles Ingress hostnames", func() {
 
 		By("testing networking.k8s.io", func() {
 			if err := k8sClient.List(context.Background(), &networkingv1.IngressList{}); err != nil {
-				missingAPIError := &meta.NoKindMatchError{}
-				if errors.As(err, &missingAPIError) {
+				if utils.IsUnsupportedAPI(err) {
 					Skip(fmt.Sprintf("Running test due to unsupported API kind: %s", err.Error()))
 				}
 			}
@@ -250,8 +244,7 @@ var _ = Describe("when Tenant handles Ingress hostnames", func() {
 
 		By("testing extensions", func() {
 			if err := k8sClient.List(context.Background(), &extensionsv1beta1.IngressList{}); err != nil {
-				missingAPIError := &meta.NoKindMatchError{}
-				if errors.As(err, &missingAPIError) {
+				if utils.IsUnsupportedAPI(err) {
 					Skip(fmt.Sprintf("Running test due to unsupported API kind: %s", err.Error()))
 				}
 			}

e2e/missing_tenant_test.go

@@ -8,7 +8,7 @@ package e2e
 import (
 	"context"
 
-	. "github.com/onsi/ginkgo"
+	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 

e2e/namespace_additional_metadata_test.go

@@ -8,7 +8,7 @@ package e2e
 import (
 	"context"
 
-	. "github.com/onsi/ginkgo"
+	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/types"

e2e/namespace_capsule_label_test.go

@@ -8,7 +8,7 @@ package e2e
 import (
 	"context"
 
-	. "github.com/onsi/ginkgo"
+	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
 	v1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"

e2e/namespace_user_metadata_test.go

@@ -9,7 +9,7 @@ import (
 	"context"
 	"time"
 
-	. "github.com/onsi/ginkgo"
+	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
 	rbacv1 "k8s.io/api/rbac/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"

e2e/new_namespace_test.go

@@ -8,7 +8,7 @@ package e2e
 import (
 	"context"
 
-	. "github.com/onsi/ginkgo"
+	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 

e2e/node_user_metadata_test.go

@@ -9,7 +9,7 @@ import (
 	"context"
 	"fmt"
 
-	. "github.com/onsi/ginkgo"
+	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
 	corev1 "k8s.io/api/core/v1"
 	rbacv1 "k8s.io/api/rbac/v1"

e2e/overquota_namespace_test.go

@@ -8,7 +8,7 @@ package e2e
 import (
 	"context"
 
-	. "github.com/onsi/ginkgo"
+	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/utils/pointer"
@@ -29,7 +29,7 @@ var _ = Describe("creating a Namespace in over-quota of three", func() {
 				},
 			},
 			NamespaceOptions: &capsulev1beta2.NamespaceOptions{
-				Quota: pointer.Int32Ptr(3),
+				Quota: pointer.Int32(3),
 			},
 		},
 	}

e2e/owner_webhooks_test.go

@@ -9,7 +9,7 @@ import (
 	"context"
 	"fmt"
 
-	. "github.com/onsi/ginkgo"
+	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
 	corev1 "k8s.io/api/core/v1"
 	networkingv1 "k8s.io/api/networking/v1"

e2e/pod_priority_class_test.go

@@ -10,7 +10,7 @@ import (
 	"strconv"
 	"strings"
 
-	. "github.com/onsi/ginkgo"
+	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
 	corev1 "k8s.io/api/core/v1"
 	schedulingv1 "k8s.io/api/scheduling/v1"

e2e/pod_runtime_class_test.go

@@ -10,7 +10,7 @@ import (
 	"strconv"
 	"strings"
 
-	. "github.com/onsi/ginkgo"
+	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
 	corev1 "k8s.io/api/core/v1"
 	nodev1 "k8s.io/api/node/v1"

e2e/preventing_pv_cross_tenant_mount_test.go

@@ -8,7 +8,7 @@ package e2e
 import (
 	"context"
 
-	. "github.com/onsi/ginkgo"
+	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/api/resource"

e2e/protected_namespace_regex_test.go

@@ -8,7 +8,7 @@ package e2e
 import (
 	"context"
 
-	. "github.com/onsi/ginkgo"
+	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 

e2e/resource_quota_exceeded_test.go

@@ -8,9 +8,10 @@ package e2e
 import (
 	"context"
 	"fmt"
+
 	"github.com/clastix/capsule/pkg/api"
 
-	. "github.com/onsi/ginkgo"
+	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
@@ -134,7 +135,7 @@ var _ = Describe("exceeding a Tenant resource quota", func() {
 						Name: "my-pause",
 					},
 					Spec: appsv1.DeploymentSpec{
-						Replicas: pointer.Int32Ptr(5),
+						Replicas: pointer.Int32(5),
 						Selector: &metav1.LabelSelector{
 							MatchLabels: map[string]string{
 								"app": "pause",

e2e/sa_prevent_privilege_escalation_test.go

@@ -10,7 +10,7 @@ import (
 	"fmt"
 	"time"
 
-	. "github.com/onsi/ginkgo"
+	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
 	rbacv1 "k8s.io/api/rbac/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"

e2e/selecting_non_owned_tenant_test.go

@@ -7,9 +7,10 @@ package e2e
 
 import (
 	"context"
+
 	"github.com/clastix/capsule/pkg/utils"
 
-	. "github.com/onsi/ginkgo"
+	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"

e2e/selecting_tenant_fail_test.go

@@ -8,7 +8,7 @@ package e2e
 import (
 	"context"
 
-	. "github.com/onsi/ginkgo"
+	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"