chore(helm): bump app version 0.5.0 (#923)

Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com>

.github/workflows/check-actions.yml

@@ -16,7 +16,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       - name: Ensure SHA pinned actions
-        uses: zgosalvez/github-actions-ensure-sha-pinned-actions@b35f285b9bb7e80de0967367cee66d3b6d50ceca # v3.0.1
+        uses: zgosalvez/github-actions-ensure-sha-pinned-actions@b1b635d24259e8a047a6ce7d6501ea432aa7a830 # v3.0.2
         with:
           # slsa-github-generator requires using a semver tag for reusable workflows. 
           # See: https://github.com/slsa-framework/slsa-github-generator#referencing-slsa-builders-and-generators

.github/workflows/diff.yml

@@ -19,7 +19,7 @@ jobs:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
           fetch-depth: 0
-      - uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
+      - uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
         with:
           go-version: '1.20'
       - run: make installer

.github/workflows/docker-publish.yml

@@ -28,7 +28,7 @@ jobs:
         with:
           build-cache-key: publish-images
       - name: Run Trivy vulnerability (Repo)
-        uses: aquasecurity/trivy-action@2b6a709cf9c4025c5438138008beaddbb02086f0 # v0.14.0
+        uses: aquasecurity/trivy-action@22d2755f774d925b191a185b74e782a4b0638a41 # v0.15.0
         with:
           scan-type: 'fs'
           ignore-unfixed: true

.github/workflows/e2e.yml

@@ -43,7 +43,7 @@ jobs:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
           fetch-depth: 0
-      - uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
+      - uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
         with:
           go-version: '1.20'
       - run: make manifests

.github/workflows/releaser.yml

@@ -26,7 +26,7 @@ jobs:
         timeout-minutes: 5
         continue-on-error: true
       - uses: creekorful/goreportcard-action@1f35ced8cdac2cba28c9a2f2288a16aacfd507f9 # v1.0
-      - uses: anchore/sbom-action/download-syft@78fc58e266e87a38d4194b2137a3d4e9bcaf7ca1
+      - uses: anchore/sbom-action/download-syft@5ecf649a417b8ae17dc8383dc32d46c03f2312df
       - name: Install Cosign
         uses: sigstore/cosign-installer@1fc5bd396d372bee37d608f955b336615edf79c8 # v3.2.0
       - name: Run GoReleaser

Makefile

@@ -166,7 +166,8 @@ dev-setup:
 			{'op': 'replace', 'path': '/webhooks/5/clientConfig', 'value':{'url':\"$${WEBHOOK_URL}/pods\",'caBundle':\"$${CA_BUNDLE}\"}},\
 			{'op': 'replace', 'path': '/webhooks/6/clientConfig', 'value':{'url':\"$${WEBHOOK_URL}/persistentvolumeclaims\",'caBundle':\"$${CA_BUNDLE}\"}},\
 			{'op': 'replace', 'path': '/webhooks/7/clientConfig', 'value':{'url':\"$${WEBHOOK_URL}/services\",'caBundle':\"$${CA_BUNDLE}\"}},\
-			{'op': 'replace', 'path': '/webhooks/8/clientConfig', 'value':{'url':\"$${WEBHOOK_URL}/tenants\",'caBundle':\"$${CA_BUNDLE}\"}}\
+			{'op': 'replace', 'path': '/webhooks/8/clientConfig', 'value':{'url':\"$${WEBHOOK_URL}/tenantresource-objects\",'caBundle':\"$${CA_BUNDLE}\"}},\
+			{'op': 'replace', 'path': '/webhooks/9/clientConfig', 'value':{'url':\"$${WEBHOOK_URL}/tenants\",'caBundle':\"$${CA_BUNDLE}\"}}\
 		]" && \
 	kubectl patch crd tenants.capsule.clastix.io \
 		--type='json' -p="[\
@@ -241,7 +242,7 @@ apidocs-gen: ## Download crdoc locally if necessary.
 	$(call go-install-tool,$(APIDOCS_GEN),fybrik.io/crdoc@$(APIDOCS_GEN_VERSION))
 
 GINKGO         := $(shell pwd)/bin/ginkgo
-GINGKO_VERSION := v2.13.0
+GINGKO_VERSION := v2.13.2
 ginkgo: ## Download ginkgo locally if necessary.
 	$(call go-install-tool,$(GINKGO),github.com/onsi/ginkgo/v2/ginkgo@$(GINGKO_VERSION))
 

PROJECT

@@ -7,25 +7,6 @@ plugins:
 projectName: capsule
 repo: github.com/projectcapsule/capsule
 resources:
-- api:
-    crdVersion: v1
-  controller: true
-  domain: clastix.io
-  group: capsule
-  kind: Tenant
-  path: github.com/projectcapsule/capsule/api/v1alpha1
-  version: v1alpha1
-  webhooks:
-    conversion: true
-    webhookVersion: v1
-- api:
-    crdVersion: v1
-  controller: true
-  domain: clastix.io
-  group: capsule
-  kind: CapsuleConfiguration
-  path: github.com/projectcapsule/capsule/api/v1alpha1
-  version: v1alpha1
 - api:
     crdVersion: v1
   domain: clastix.io

api/v1alpha1/additional_metadata.go

@@ -1,9 +0,0 @@
-// Copyright 2020-2023 Project Capsule Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-package v1alpha1
-
-type AdditionalMetadata struct {
-	Labels      map[string]string `json:"additionalLabels,omitempty"`
-	Annotations map[string]string `json:"additionalAnnotations,omitempty"`
-}

api/v1alpha1/capsuleconfiguration_annotations.go

@@ -1,15 +0,0 @@
-// Copyright 2020-2023 Project Capsule Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-package v1alpha1
-
-const (
-	ForbiddenNodeLabelsAnnotation            = "capsule.clastix.io/forbidden-node-labels"
-	ForbiddenNodeLabelsRegexpAnnotation      = "capsule.clastix.io/forbidden-node-labels-regexp"
-	ForbiddenNodeAnnotationsAnnotation       = "capsule.clastix.io/forbidden-node-annotations"
-	ForbiddenNodeAnnotationsRegexpAnnotation = "capsule.clastix.io/forbidden-node-annotations-regexp"
-	TLSSecretNameAnnotation                  = "capsule.clastix.io/tls-secret-name"
-	MutatingWebhookConfigurationName         = "capsule.clastix.io/mutating-webhook-configuration-name"
-	ValidatingWebhookConfigurationName       = "capsule.clastix.io/validating-webhook-configuration-name"
-	EnableTLSConfigurationAnnotationName     = "capsule.clastix.io/enable-tls-configuration"
-)

api/v1alpha1/capsuleconfiguration_types.go

@@ -1,47 +0,0 @@
-// Copyright 2020-2023 Project Capsule Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-package v1alpha1
-
-import (
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-)
-
-// CapsuleConfigurationSpec defines the Capsule configuration.
-type CapsuleConfigurationSpec struct {
-	// Names of the groups for Capsule users.
-	// +kubebuilder:default={capsule.clastix.io}
-	UserGroups []string `json:"userGroups,omitempty"`
-	// Enforces the Tenant owner, during Namespace creation, to name it using the selected Tenant name as prefix,
-	// separated by a dash. This is useful to avoid Namespace name collision in a public CaaS environment.
-	// +kubebuilder:default=false
-	ForceTenantPrefix bool `json:"forceTenantPrefix,omitempty"`
-	// Disallow creation of namespaces, whose name matches this regexp
-	ProtectedNamespaceRegexpString string `json:"protectedNamespaceRegex,omitempty"`
-}
-
-// +kubebuilder:object:root=true
-// +kubebuilder:resource:scope=Cluster
-
-// CapsuleConfiguration is the Schema for the Capsule configuration API.
-type CapsuleConfiguration struct {
-	metav1.TypeMeta   `json:",inline"`
-	metav1.ObjectMeta `json:"metadata,omitempty"`
-
-	Spec CapsuleConfigurationSpec `json:"spec,omitempty"`
-}
-
-func (in *CapsuleConfiguration) Hub() {}
-
-// +kubebuilder:object:root=true
-
-// CapsuleConfigurationList contains a list of CapsuleConfiguration.
-type CapsuleConfigurationList struct {
-	metav1.TypeMeta `json:",inline"`
-	metav1.ListMeta `json:"metadata,omitempty"`
-	Items           []CapsuleConfiguration `json:"items"`
-}
-
-func init() {
-	SchemeBuilder.Register(&CapsuleConfiguration{}, &CapsuleConfigurationList{})
-}

api/v1alpha1/capsuleconfiguration_webhook.go

@@ -1,21 +0,0 @@
-// Copyright 2020-2023 Project Capsule Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-package v1alpha1
-
-import (
-	"os"
-
-	ctrl "sigs.k8s.io/controller-runtime"
-)
-
-func (in *CapsuleConfiguration) SetupWebhookWithManager(mgr ctrl.Manager) error {
-	certData, _ := os.ReadFile("/tmp/k8s-webhook-server/serving-certs/tls.crt")
-	if len(certData) == 0 {
-		return nil
-	}
-
-	return ctrl.NewWebhookManagedBy(mgr).
-		For(in).
-		Complete()
-}

api/v1alpha1/conversion_hub.go

@@ -1,583 +0,0 @@
-// Copyright 2020-2023 Project Capsule Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-package v1alpha1
-
-import (
-	"fmt"
-	"reflect"
-	"strconv"
-	"strings"
-
-	"github.com/pkg/errors"
-	"k8s.io/utils/pointer"
-	"sigs.k8s.io/controller-runtime/pkg/conversion"
-
-	capsulev1beta1 "github.com/projectcapsule/capsule/api/v1beta1"
-	"github.com/projectcapsule/capsule/pkg/api"
-)
-
-const (
-	resourceQuotaScopeAnnotation = "capsule.clastix.io/resource-quota-scope"
-
-	podAllowedImagePullPolicyAnnotation = "capsule.clastix.io/allowed-image-pull-policy"
-
-	podPriorityAllowedAnnotation      = "priorityclass.capsule.clastix.io/allowed"
-	podPriorityAllowedRegexAnnotation = "priorityclass.capsule.clastix.io/allowed-regex"
-
-	enableNodePortsAnnotation    = "capsule.clastix.io/enable-node-ports"
-	enableExternalNameAnnotation = "capsule.clastix.io/enable-external-name"
-	enableLoadBalancerAnnotation = "capsule.clastix.io/enable-loadbalancer-service"
-
-	ownerGroupsAnnotation         = "owners.capsule.clastix.io/group"
-	ownerUsersAnnotation          = "owners.capsule.clastix.io/user"
-	ownerServiceAccountAnnotation = "owners.capsule.clastix.io/serviceaccount"
-
-	enableNodeListingAnnotation           = "capsule.clastix.io/enable-node-listing"
-	enableNodeUpdateAnnotation            = "capsule.clastix.io/enable-node-update"
-	enableNodeDeletionAnnotation          = "capsule.clastix.io/enable-node-deletion"
-	enableStorageClassListingAnnotation   = "capsule.clastix.io/enable-storageclass-listing"
-	enableStorageClassUpdateAnnotation    = "capsule.clastix.io/enable-storageclass-update"
-	enableStorageClassDeletionAnnotation  = "capsule.clastix.io/enable-storageclass-deletion"
-	enableIngressClassListingAnnotation   = "capsule.clastix.io/enable-ingressclass-listing"
-	enableIngressClassUpdateAnnotation    = "capsule.clastix.io/enable-ingressclass-update"
-	enableIngressClassDeletionAnnotation  = "capsule.clastix.io/enable-ingressclass-deletion"
-	enablePriorityClassListingAnnotation  = "capsule.clastix.io/enable-priorityclass-listing"
-	enablePriorityClassUpdateAnnotation   = "capsule.clastix.io/enable-priorityclass-update"
-	enablePriorityClassDeletionAnnotation = "capsule.clastix.io/enable-priorityclass-deletion"
-
-	ingressHostnameCollisionScope = "ingress.capsule.clastix.io/hostname-collision-scope"
-)
-
-func (in *Tenant) convertV1Alpha1OwnerToV1Beta1() capsulev1beta1.OwnerListSpec {
-	serviceKindToAnnotationMap := map[capsulev1beta1.ProxyServiceKind][]string{
-		capsulev1beta1.NodesProxy:           {enableNodeListingAnnotation, enableNodeUpdateAnnotation, enableNodeDeletionAnnotation},
-		capsulev1beta1.StorageClassesProxy:  {enableStorageClassListingAnnotation, enableStorageClassUpdateAnnotation, enableStorageClassDeletionAnnotation},
-		capsulev1beta1.IngressClassesProxy:  {enableIngressClassListingAnnotation, enableIngressClassUpdateAnnotation, enableIngressClassDeletionAnnotation},
-		capsulev1beta1.PriorityClassesProxy: {enablePriorityClassListingAnnotation, enablePriorityClassUpdateAnnotation, enablePriorityClassDeletionAnnotation},
-	}
-	annotationToOperationMap := map[string]capsulev1beta1.ProxyOperation{
-		enableNodeListingAnnotation:           capsulev1beta1.ListOperation,
-		enableNodeUpdateAnnotation:            capsulev1beta1.UpdateOperation,
-		enableNodeDeletionAnnotation:          capsulev1beta1.DeleteOperation,
-		enableStorageClassListingAnnotation:   capsulev1beta1.ListOperation,
-		enableStorageClassUpdateAnnotation:    capsulev1beta1.UpdateOperation,
-		enableStorageClassDeletionAnnotation:  capsulev1beta1.DeleteOperation,
-		enableIngressClassListingAnnotation:   capsulev1beta1.ListOperation,
-		enableIngressClassUpdateAnnotation:    capsulev1beta1.UpdateOperation,
-		enableIngressClassDeletionAnnotation:  capsulev1beta1.DeleteOperation,
-		enablePriorityClassListingAnnotation:  capsulev1beta1.ListOperation,
-		enablePriorityClassUpdateAnnotation:   capsulev1beta1.UpdateOperation,
-		enablePriorityClassDeletionAnnotation: capsulev1beta1.DeleteOperation,
-	}
-	annotationToOwnerKindMap := map[string]capsulev1beta1.OwnerKind{
-		ownerUsersAnnotation:          capsulev1beta1.UserOwner,
-		ownerGroupsAnnotation:         capsulev1beta1.GroupOwner,
-		ownerServiceAccountAnnotation: capsulev1beta1.ServiceAccountOwner,
-	}
-
-	annotations := in.GetAnnotations()
-
-	operations := make(map[string]map[capsulev1beta1.ProxyServiceKind][]capsulev1beta1.ProxyOperation)
-
-	for serviceKind, operationAnnotations := range serviceKindToAnnotationMap {
-		for _, operationAnnotation := range operationAnnotations {
-			val, ok := annotations[operationAnnotation]
-			if ok {
-				for _, owner := range strings.Split(val, ",") {
-					if _, exists := operations[owner]; !exists {
-						operations[owner] = make(map[capsulev1beta1.ProxyServiceKind][]capsulev1beta1.ProxyOperation)
-					}
-
-					operations[owner][serviceKind] = append(operations[owner][serviceKind], annotationToOperationMap[operationAnnotation])
-				}
-			}
-		}
-	}
-
-	var owners capsulev1beta1.OwnerListSpec
-
-	getProxySettingsForOwner := func(ownerName string) (settings []capsulev1beta1.ProxySettings) {
-		ownerOperations, ok := operations[ownerName]
-		if ok {
-			for k, v := range ownerOperations {
-				settings = append(settings, capsulev1beta1.ProxySettings{
-					Kind:       k,
-					Operations: v,
-				})
-			}
-		}
-
-		return
-	}
-
-	owners = append(owners, capsulev1beta1.OwnerSpec{
-		Kind:            capsulev1beta1.OwnerKind(in.Spec.Owner.Kind),
-		Name:            in.Spec.Owner.Name,
-		ProxyOperations: getProxySettingsForOwner(in.Spec.Owner.Name),
-	})
-
-	for ownerAnnotation, ownerKind := range annotationToOwnerKindMap {
-		val, ok := annotations[ownerAnnotation]
-		if ok {
-			for _, owner := range strings.Split(val, ",") {
-				owners = append(owners, capsulev1beta1.OwnerSpec{
-					Kind:            ownerKind,
-					Name:            owner,
-					ProxyOperations: getProxySettingsForOwner(owner),
-				})
-			}
-		}
-	}
-
-	return owners
-}
-
-//nolint:gocognit,gocyclo,cyclop,maintidx
-func (in *Tenant) ConvertTo(dstRaw conversion.Hub) error {
-	dst, ok := dstRaw.(*capsulev1beta1.Tenant)
-	if !ok {
-		return fmt.Errorf("expected type *capsulev1beta1.Tenant, got %T", dst)
-	}
-
-	annotations := in.GetAnnotations()
-
-	// ObjectMeta
-	dst.ObjectMeta = in.ObjectMeta
-
-	// Spec
-	if in.Spec.NamespaceQuota != nil {
-		if dst.Spec.NamespaceOptions == nil {
-			dst.Spec.NamespaceOptions = &capsulev1beta1.NamespaceOptions{}
-		}
-
-		dst.Spec.NamespaceOptions.Quota = in.Spec.NamespaceQuota
-	}
-
-	dst.Spec.NodeSelector = in.Spec.NodeSelector
-
-	dst.Spec.Owners = in.convertV1Alpha1OwnerToV1Beta1()
-
-	if in.Spec.NamespacesMetadata != nil {
-		if dst.Spec.NamespaceOptions == nil {
-			dst.Spec.NamespaceOptions = &capsulev1beta1.NamespaceOptions{}
-		}
-
-		dst.Spec.NamespaceOptions.AdditionalMetadata = &api.AdditionalMetadataSpec{
-			Labels:      in.Spec.NamespacesMetadata.Labels,
-			Annotations: in.Spec.NamespacesMetadata.Annotations,
-		}
-	}
-
-	if in.Spec.ServicesMetadata != nil {
-		if dst.Spec.ServiceOptions == nil {
-			dst.Spec.ServiceOptions = &api.ServiceOptions{}
-		}
-
-		dst.Spec.ServiceOptions.AdditionalMetadata = &api.AdditionalMetadataSpec{
-			Labels:      in.Spec.ServicesMetadata.Labels,
-			Annotations: in.Spec.ServicesMetadata.Annotations,
-		}
-	}
-
-	if in.Spec.StorageClasses != nil {
-		dst.Spec.StorageClasses = in.Spec.StorageClasses
-	}
-
-	if v, annotationOk := in.Annotations[ingressHostnameCollisionScope]; annotationOk {
-		switch v {
-		case string(api.HostnameCollisionScopeCluster), string(api.HostnameCollisionScopeTenant), string(api.HostnameCollisionScopeNamespace):
-			dst.Spec.IngressOptions.HostnameCollisionScope = api.HostnameCollisionScope(v)
-		default:
-			dst.Spec.IngressOptions.HostnameCollisionScope = api.HostnameCollisionScopeDisabled
-		}
-	}
-
-	if in.Spec.IngressClasses != nil {
-		dst.Spec.IngressOptions.AllowedClasses = &api.AllowedListSpec{
-			Exact: in.Spec.IngressClasses.Exact,
-			Regex: in.Spec.IngressClasses.Regex,
-		}
-	}
-
-	if in.Spec.IngressHostnames != nil {
-		dst.Spec.IngressOptions.AllowedHostnames = &api.AllowedListSpec{
-			Exact: in.Spec.IngressHostnames.Exact,
-			Regex: in.Spec.IngressHostnames.Regex,
-		}
-	}
-
-	if in.Spec.ContainerRegistries != nil {
-		dst.Spec.ContainerRegistries = &api.AllowedListSpec{
-			Exact: in.Spec.ContainerRegistries.Exact,
-			Regex: in.Spec.ContainerRegistries.Regex,
-		}
-	}
-
-	if len(in.Spec.NetworkPolicies) > 0 {
-		dst.Spec.NetworkPolicies = api.NetworkPolicySpec{
-			Items: in.Spec.NetworkPolicies,
-		}
-	}
-
-	if len(in.Spec.LimitRanges) > 0 {
-		dst.Spec.LimitRanges = api.LimitRangesSpec{
-			Items: in.Spec.LimitRanges,
-		}
-	}
-
-	if len(in.Spec.ResourceQuota) > 0 {
-		dst.Spec.ResourceQuota = api.ResourceQuotaSpec{
-			Scope: func() api.ResourceQuotaScope {
-				if v, annotationOk := in.GetAnnotations()[resourceQuotaScopeAnnotation]; annotationOk {
-					switch v {
-					case string(api.ResourceQuotaScopeNamespace):
-						return api.ResourceQuotaScopeNamespace
-					case string(api.ResourceQuotaScopeTenant):
-						return api.ResourceQuotaScopeTenant
-					}
-				}
-
-				return api.ResourceQuotaScopeTenant
-			}(),
-			Items: in.Spec.ResourceQuota,
-		}
-	}
-
-	dst.Spec.AdditionalRoleBindings = in.Spec.AdditionalRoleBindings
-
-	if in.Spec.ExternalServiceIPs != nil {
-		if dst.Spec.ServiceOptions == nil {
-			dst.Spec.ServiceOptions = &api.ServiceOptions{}
-		}
-
-		dst.Spec.ServiceOptions.ExternalServiceIPs = in.Spec.ExternalServiceIPs
-	}
-
-	pullPolicies, ok := annotations[podAllowedImagePullPolicyAnnotation]
-	if ok {
-		for _, policy := range strings.Split(pullPolicies, ",") {
-			dst.Spec.ImagePullPolicies = append(dst.Spec.ImagePullPolicies, api.ImagePullPolicySpec(policy))
-		}
-	}
-
-	priorityClasses := api.AllowedListSpec{}
-
-	priorityClassAllowed, ok := annotations[podPriorityAllowedAnnotation]
-
-	if ok {
-		priorityClasses.Exact = strings.Split(priorityClassAllowed, ",")
-	}
-
-	priorityClassesRegexp, ok := annotations[podPriorityAllowedRegexAnnotation]
-
-	if ok {
-		priorityClasses.Regex = priorityClassesRegexp
-	}
-
-	if !reflect.ValueOf(priorityClasses).IsZero() {
-		dst.Spec.PriorityClasses = &priorityClasses
-	}
-
-	enableNodePorts, ok := annotations[enableNodePortsAnnotation]
-	if ok {
-		val, err := strconv.ParseBool(enableNodePorts)
-		if err != nil {
-			return errors.Wrap(err, fmt.Sprintf("unable to parse %s annotation on tenant %s", enableNodePortsAnnotation, in.GetName()))
-		}
-
-		if dst.Spec.ServiceOptions == nil {
-			dst.Spec.ServiceOptions = &api.ServiceOptions{}
-		}
-
-		if dst.Spec.ServiceOptions.AllowedServices == nil {
-			dst.Spec.ServiceOptions.AllowedServices = &api.AllowedServices{}
-		}
-
-		dst.Spec.ServiceOptions.AllowedServices.NodePort = pointer.Bool(val)
-	}
-
-	enableExternalName, ok := annotations[enableExternalNameAnnotation]
-	if ok {
-		val, err := strconv.ParseBool(enableExternalName)
-		if err != nil {
-			return errors.Wrap(err, fmt.Sprintf("unable to parse %s annotation on tenant %s", enableExternalNameAnnotation, in.GetName()))
-		}
-
-		if dst.Spec.ServiceOptions == nil {
-			dst.Spec.ServiceOptions = &api.ServiceOptions{}
-		}
-
-		if dst.Spec.ServiceOptions.AllowedServices == nil {
-			dst.Spec.ServiceOptions.AllowedServices = &api.AllowedServices{}
-		}
-
-		dst.Spec.ServiceOptions.AllowedServices.ExternalName = pointer.Bool(val)
-	}
-
-	loadBalancerService, ok := annotations[enableLoadBalancerAnnotation]
-	if ok {
-		val, err := strconv.ParseBool(loadBalancerService)
-		if err != nil {
-			return errors.Wrap(err, fmt.Sprintf("unable to parse %s annotation on tenant %s", enableLoadBalancerAnnotation, in.GetName()))
-		}
-
-		if dst.Spec.ServiceOptions == nil {
-			dst.Spec.ServiceOptions = &api.ServiceOptions{}
-		}
-
-		if dst.Spec.ServiceOptions.AllowedServices == nil {
-			dst.Spec.ServiceOptions.AllowedServices = &api.AllowedServices{}
-		}
-
-		dst.Spec.ServiceOptions.AllowedServices.LoadBalancer = pointer.Bool(val)
-	}
-	// Status
-	dst.Status = capsulev1beta1.TenantStatus{
-		Size:       in.Status.Size,
-		Namespaces: in.Status.Namespaces,
-	}
-	// Remove unneeded annotations
-	delete(dst.ObjectMeta.Annotations, podAllowedImagePullPolicyAnnotation)
-	delete(dst.ObjectMeta.Annotations, podPriorityAllowedAnnotation)
-	delete(dst.ObjectMeta.Annotations, podPriorityAllowedRegexAnnotation)
-	delete(dst.ObjectMeta.Annotations, enableNodePortsAnnotation)
-	delete(dst.ObjectMeta.Annotations, enableExternalNameAnnotation)
-	delete(dst.ObjectMeta.Annotations, enableLoadBalancerAnnotation)
-	delete(dst.ObjectMeta.Annotations, ownerGroupsAnnotation)
-	delete(dst.ObjectMeta.Annotations, ownerUsersAnnotation)
-	delete(dst.ObjectMeta.Annotations, ownerServiceAccountAnnotation)
-	delete(dst.ObjectMeta.Annotations, enableNodeListingAnnotation)
-	delete(dst.ObjectMeta.Annotations, enableNodeUpdateAnnotation)
-	delete(dst.ObjectMeta.Annotations, enableNodeDeletionAnnotation)
-	delete(dst.ObjectMeta.Annotations, enableStorageClassListingAnnotation)
-	delete(dst.ObjectMeta.Annotations, enableStorageClassUpdateAnnotation)
-	delete(dst.ObjectMeta.Annotations, enableStorageClassDeletionAnnotation)
-	delete(dst.ObjectMeta.Annotations, enableIngressClassListingAnnotation)
-	delete(dst.ObjectMeta.Annotations, enableIngressClassUpdateAnnotation)
-	delete(dst.ObjectMeta.Annotations, enableIngressClassDeletionAnnotation)
-	delete(dst.ObjectMeta.Annotations, enablePriorityClassListingAnnotation)
-	delete(dst.ObjectMeta.Annotations, enablePriorityClassUpdateAnnotation)
-	delete(dst.ObjectMeta.Annotations, enablePriorityClassDeletionAnnotation)
-	delete(dst.ObjectMeta.Annotations, resourceQuotaScopeAnnotation)
-	delete(dst.ObjectMeta.Annotations, ingressHostnameCollisionScope)
-
-	return nil
-}
-
-//nolint:gocognit,gocyclo,cyclop
-func (in *Tenant) convertV1Beta1OwnerToV1Alpha1(src *capsulev1beta1.Tenant) {
-	ownersAnnotations := map[string][]string{
-		ownerGroupsAnnotation:         nil,
-		ownerUsersAnnotation:          nil,
-		ownerServiceAccountAnnotation: nil,
-	}
-
-	proxyAnnotations := map[string][]string{
-		enableNodeListingAnnotation:          nil,
-		enableNodeUpdateAnnotation:           nil,
-		enableNodeDeletionAnnotation:         nil,
-		enableStorageClassListingAnnotation:  nil,
-		enableStorageClassUpdateAnnotation:   nil,
-		enableStorageClassDeletionAnnotation: nil,
-		enableIngressClassListingAnnotation:  nil,
-		enableIngressClassUpdateAnnotation:   nil,
-		enableIngressClassDeletionAnnotation: nil,
-	}
-
-	for i, owner := range src.Spec.Owners {
-		if i == 0 {
-			in.Spec.Owner = OwnerSpec{
-				Name: owner.Name,
-				Kind: Kind(owner.Kind),
-			}
-		} else {
-			switch owner.Kind {
-			case capsulev1beta1.UserOwner:
-				ownersAnnotations[ownerUsersAnnotation] = append(ownersAnnotations[ownerUsersAnnotation], owner.Name)
-			case capsulev1beta1.GroupOwner:
-				ownersAnnotations[ownerGroupsAnnotation] = append(ownersAnnotations[ownerGroupsAnnotation], owner.Name)
-			case capsulev1beta1.ServiceAccountOwner:
-				ownersAnnotations[ownerServiceAccountAnnotation] = append(ownersAnnotations[ownerServiceAccountAnnotation], owner.Name)
-			}
-		}
-
-		for _, setting := range owner.ProxyOperations {
-			switch setting.Kind {
-			case capsulev1beta1.NodesProxy:
-				for _, operation := range setting.Operations {
-					switch operation {
-					case capsulev1beta1.ListOperation:
-						proxyAnnotations[enableNodeListingAnnotation] = append(proxyAnnotations[enableNodeListingAnnotation], owner.Name)
-					case capsulev1beta1.UpdateOperation:
-						proxyAnnotations[enableNodeUpdateAnnotation] = append(proxyAnnotations[enableNodeUpdateAnnotation], owner.Name)
-					case capsulev1beta1.DeleteOperation:
-						proxyAnnotations[enableNodeDeletionAnnotation] = append(proxyAnnotations[enableNodeDeletionAnnotation], owner.Name)
-					}
-				}
-			case capsulev1beta1.PriorityClassesProxy:
-				for _, operation := range setting.Operations {
-					switch operation {
-					case capsulev1beta1.ListOperation:
-						proxyAnnotations[enablePriorityClassListingAnnotation] = append(proxyAnnotations[enablePriorityClassListingAnnotation], owner.Name)
-					case capsulev1beta1.UpdateOperation:
-						proxyAnnotations[enablePriorityClassUpdateAnnotation] = append(proxyAnnotations[enablePriorityClassUpdateAnnotation], owner.Name)
-					case capsulev1beta1.DeleteOperation:
-						proxyAnnotations[enablePriorityClassDeletionAnnotation] = append(proxyAnnotations[enablePriorityClassDeletionAnnotation], owner.Name)
-					}
-				}
-			case capsulev1beta1.StorageClassesProxy:
-				for _, operation := range setting.Operations {
-					switch operation {
-					case capsulev1beta1.ListOperation:
-						proxyAnnotations[enableStorageClassListingAnnotation] = append(proxyAnnotations[enableStorageClassListingAnnotation], owner.Name)
-					case capsulev1beta1.UpdateOperation:
-						proxyAnnotations[enableStorageClassUpdateAnnotation] = append(proxyAnnotations[enableStorageClassUpdateAnnotation], owner.Name)
-					case capsulev1beta1.DeleteOperation:
-						proxyAnnotations[enableStorageClassDeletionAnnotation] = append(proxyAnnotations[enableStorageClassDeletionAnnotation], owner.Name)
-					}
-				}
-			case capsulev1beta1.IngressClassesProxy:
-				for _, operation := range setting.Operations {
-					switch operation {
-					case capsulev1beta1.ListOperation:
-						proxyAnnotations[enableIngressClassListingAnnotation] = append(proxyAnnotations[enableIngressClassListingAnnotation], owner.Name)
-					case capsulev1beta1.UpdateOperation:
-						proxyAnnotations[enableIngressClassUpdateAnnotation] = append(proxyAnnotations[enableIngressClassUpdateAnnotation], owner.Name)
-					case capsulev1beta1.DeleteOperation:
-						proxyAnnotations[enableIngressClassDeletionAnnotation] = append(proxyAnnotations[enableIngressClassDeletionAnnotation], owner.Name)
-					}
-				}
-			}
-		}
-	}
-
-	for k, v := range ownersAnnotations {
-		if len(v) > 0 {
-			in.Annotations[k] = strings.Join(v, ",")
-		}
-	}
-
-	for k, v := range proxyAnnotations {
-		if len(v) > 0 {
-			in.Annotations[k] = strings.Join(v, ",")
-		}
-	}
-}
-
-//nolint:cyclop
-func (in *Tenant) ConvertFrom(srcRaw conversion.Hub) error {
-	src, ok := srcRaw.(*capsulev1beta1.Tenant)
-	if !ok {
-		return fmt.Errorf("expected *capsulev1beta1.Tenant, got %T", srcRaw)
-	}
-
-	// ObjectMeta
-	in.ObjectMeta = src.ObjectMeta
-
-	// Spec
-	if src.Spec.NamespaceOptions != nil && src.Spec.NamespaceOptions.Quota != nil {
-		in.Spec.NamespaceQuota = src.Spec.NamespaceOptions.Quota
-	}
-
-	in.Spec.NodeSelector = src.Spec.NodeSelector
-
-	if in.Annotations == nil {
-		in.Annotations = make(map[string]string)
-	}
-
-	in.convertV1Beta1OwnerToV1Alpha1(src)
-
-	if src.Spec.NamespaceOptions != nil && src.Spec.NamespaceOptions.AdditionalMetadata != nil {
-		in.Spec.NamespacesMetadata = &AdditionalMetadata{
-			Labels:      src.Spec.NamespaceOptions.AdditionalMetadata.Labels,
-			Annotations: src.Spec.NamespaceOptions.AdditionalMetadata.Annotations,
-		}
-	}
-
-	if src.Spec.ServiceOptions != nil && src.Spec.ServiceOptions.AdditionalMetadata != nil {
-		in.Spec.ServicesMetadata = &AdditionalMetadata{
-			Labels:      src.Spec.ServiceOptions.AdditionalMetadata.Labels,
-			Annotations: src.Spec.ServiceOptions.AdditionalMetadata.Annotations,
-		}
-	}
-
-	if src.Spec.StorageClasses != nil {
-		in.Spec.StorageClasses = src.Spec.StorageClasses
-	}
-
-	in.Annotations[ingressHostnameCollisionScope] = string(src.Spec.IngressOptions.HostnameCollisionScope)
-
-	if src.Spec.IngressOptions.AllowedClasses != nil {
-		in.Spec.IngressClasses = src.Spec.IngressOptions.AllowedClasses
-	}
-
-	if src.Spec.IngressOptions.AllowedHostnames != nil {
-		in.Spec.IngressHostnames = src.Spec.IngressOptions.AllowedHostnames
-	}
-
-	if src.Spec.ContainerRegistries != nil {
-		in.Spec.ContainerRegistries = src.Spec.ContainerRegistries
-	}
-
-	if len(src.Spec.NetworkPolicies.Items) > 0 {
-		in.Spec.NetworkPolicies = src.Spec.NetworkPolicies.Items
-	}
-
-	if len(src.Spec.LimitRanges.Items) > 0 {
-		in.Spec.LimitRanges = src.Spec.LimitRanges.Items
-	}
-
-	if len(src.Spec.ResourceQuota.Items) > 0 {
-		in.Annotations[resourceQuotaScopeAnnotation] = string(src.Spec.ResourceQuota.Scope)
-		in.Spec.ResourceQuota = src.Spec.ResourceQuota.Items
-	}
-
-	in.Spec.AdditionalRoleBindings = src.Spec.AdditionalRoleBindings
-
-	if src.Spec.ServiceOptions != nil && src.Spec.ServiceOptions.ExternalServiceIPs != nil {
-		in.Spec.ExternalServiceIPs = src.Spec.ServiceOptions.ExternalServiceIPs
-	}
-
-	if len(src.Spec.ImagePullPolicies) != 0 {
-		var pullPolicies []string
-
-		for _, policy := range src.Spec.ImagePullPolicies {
-			pullPolicies = append(pullPolicies, string(policy))
-		}
-
-		in.Annotations[podAllowedImagePullPolicyAnnotation] = strings.Join(pullPolicies, ",")
-	}
-
-	if src.Spec.PriorityClasses != nil {
-		if len(src.Spec.PriorityClasses.Exact) != 0 {
-			in.Annotations[podPriorityAllowedAnnotation] = strings.Join(src.Spec.PriorityClasses.Exact, ",")
-		}
-
-		if src.Spec.PriorityClasses.Regex != "" {
-			in.Annotations[podPriorityAllowedRegexAnnotation] = src.Spec.PriorityClasses.Regex
-		}
-	}
-
-	if src.Spec.ServiceOptions != nil && src.Spec.ServiceOptions.AllowedServices != nil {
-		if src.Spec.ServiceOptions.AllowedServices.NodePort != nil {
-			in.Annotations[enableNodePortsAnnotation] = strconv.FormatBool(*src.Spec.ServiceOptions.AllowedServices.NodePort)
-		}
-
-		if src.Spec.ServiceOptions.AllowedServices.ExternalName != nil {
-			in.Annotations[enableExternalNameAnnotation] = strconv.FormatBool(*src.Spec.ServiceOptions.AllowedServices.ExternalName)
-		}
-
-		if src.Spec.ServiceOptions.AllowedServices.LoadBalancer != nil {
-			in.Annotations[enableLoadBalancerAnnotation] = strconv.FormatBool(*src.Spec.ServiceOptions.AllowedServices.LoadBalancer)
-		}
-	}
-
-	// Status
-	in.Status = TenantStatus{
-		Size:       src.Status.Size,
-		Namespaces: src.Status.Namespaces,
-	}
-
-	return nil
-}

api/v1alpha1/conversion_hub_test.go

@@ -1,393 +0,0 @@
-// Copyright 2020-2023 Project Capsule Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-package v1alpha1
-
-import (
-	"sort"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	corev1 "k8s.io/api/core/v1"
-	networkingv1 "k8s.io/api/networking/v1"
-	rbacv1 "k8s.io/api/rbac/v1"
-	"k8s.io/apimachinery/pkg/api/resource"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/utils/pointer"
-
-	capsulev1beta1 "github.com/projectcapsule/capsule/api/v1beta1"
-	"github.com/projectcapsule/capsule/pkg/api"
-)
-
-//nolint:maintidx
-func generateTenantsSpecs() (Tenant, capsulev1beta1.Tenant) {
-	var namespaceQuota int32 = 5
-
-	nodeSelector := map[string]string{
-		"foo": "bar",
-	}
-	v1alpha1AdditionalMetadataSpec := &AdditionalMetadata{
-		Labels: map[string]string{
-			"foo": "bar",
-		},
-		Annotations: map[string]string{
-			"foo": "bar",
-		},
-	}
-	v1alpha1AllowedListSpec := &api.AllowedListSpec{
-		Exact: []string{"foo", "bar"},
-		Regex: "^foo*",
-	}
-	v1beta1AdditionalMetadataSpec := &api.AdditionalMetadataSpec{
-		Labels: map[string]string{
-			"foo": "bar",
-		},
-		Annotations: map[string]string{
-			"foo": "bar",
-		},
-	}
-	v1beta1NamespaceOptions := &capsulev1beta1.NamespaceOptions{
-		Quota:              &namespaceQuota,
-		AdditionalMetadata: v1beta1AdditionalMetadataSpec,
-	}
-	v1beta1ServiceOptions := &api.ServiceOptions{
-		AdditionalMetadata: v1beta1AdditionalMetadataSpec,
-		AllowedServices: &api.AllowedServices{
-			NodePort:     pointer.Bool(false),
-			ExternalName: pointer.Bool(false),
-			LoadBalancer: pointer.Bool(false),
-		},
-		ExternalServiceIPs: &api.ExternalServiceIPsSpec{
-			Allowed: []api.AllowedIP{"192.168.0.1"},
-		},
-	}
-	v1beta2AllowedListSpec := &api.SelectorAllowedListSpec{
-		AllowedListSpec: api.AllowedListSpec{
-			Exact: []string{"foo", "bar"},
-			Regex: "^foo*",
-		},
-	}
-	networkPolicies := []networkingv1.NetworkPolicySpec{
-		{
-			Ingress: []networkingv1.NetworkPolicyIngressRule{
-				{
-					From: []networkingv1.NetworkPolicyPeer{
-						{
-							NamespaceSelector: &metav1.LabelSelector{
-								MatchLabels: map[string]string{
-									"foo": "tenant-resources",
-								},
-							},
-						},
-						{
-							PodSelector: &metav1.LabelSelector{},
-						},
-						{
-							IPBlock: &networkingv1.IPBlock{
-								CIDR: "192.168.0.0/12",
-							},
-						},
-					},
-				},
-			},
-		},
-	}
-	limitRanges := []corev1.LimitRangeSpec{
-		{
-			Limits: []corev1.LimitRangeItem{
-				{
-					Type: corev1.LimitTypePod,
-					Min: map[corev1.ResourceName]resource.Quantity{
-						corev1.ResourceCPU:    resource.MustParse("50m"),
-						corev1.ResourceMemory: resource.MustParse("5Mi"),
-					},
-					Max: map[corev1.ResourceName]resource.Quantity{
-						corev1.ResourceCPU:    resource.MustParse("1"),
-						corev1.ResourceMemory: resource.MustParse("1Gi"),
-					},
-				},
-			},
-		},
-	}
-	resourceQuotas := []corev1.ResourceQuotaSpec{
-		{
-			Hard: map[corev1.ResourceName]resource.Quantity{
-				corev1.ResourceLimitsCPU:      resource.MustParse("8"),
-				corev1.ResourceLimitsMemory:   resource.MustParse("16Gi"),
-				corev1.ResourceRequestsCPU:    resource.MustParse("8"),
-				corev1.ResourceRequestsMemory: resource.MustParse("16Gi"),
-			},
-			Scopes: []corev1.ResourceQuotaScope{
-				corev1.ResourceQuotaScopeNotTerminating,
-			},
-		},
-	}
-
-	v1beta1Tnt := capsulev1beta1.Tenant{
-		TypeMeta: metav1.TypeMeta{},
-		ObjectMeta: metav1.ObjectMeta{
-			Name: "alice",
-			Labels: map[string]string{
-				"foo": "bar",
-			},
-			Annotations: map[string]string{
-				"foo": "bar",
-			},
-		},
-		Spec: capsulev1beta1.TenantSpec{
-			Owners: capsulev1beta1.OwnerListSpec{
-				{
-					Kind: "User",
-					Name: "alice",
-					ProxyOperations: []capsulev1beta1.ProxySettings{
-						{
-							Kind:       "IngressClasses",
-							Operations: []capsulev1beta1.ProxyOperation{"List", "Update", "Delete"},
-						},
-						{
-							Kind:       "Nodes",
-							Operations: []capsulev1beta1.ProxyOperation{"Update", "Delete"},
-						},
-						{
-							Kind:       "StorageClasses",
-							Operations: []capsulev1beta1.ProxyOperation{"Update", "Delete"},
-						},
-					},
-				},
-				{
-					Kind: "User",
-					Name: "bob",
-					ProxyOperations: []capsulev1beta1.ProxySettings{
-						{
-							Kind:       "IngressClasses",
-							Operations: []capsulev1beta1.ProxyOperation{"Update"},
-						},
-						{
-							Kind:       "StorageClasses",
-							Operations: []capsulev1beta1.ProxyOperation{"List"},
-						},
-					},
-				},
-				{
-					Kind: "User",
-					Name: "jack",
-					ProxyOperations: []capsulev1beta1.ProxySettings{
-						{
-							Kind:       "IngressClasses",
-							Operations: []capsulev1beta1.ProxyOperation{"Delete"},
-						},
-						{
-							Kind:       "Nodes",
-							Operations: []capsulev1beta1.ProxyOperation{"Delete"},
-						},
-						{
-							Kind:       "StorageClasses",
-							Operations: []capsulev1beta1.ProxyOperation{"List"},
-						},
-						{
-							Kind:       "PriorityClasses",
-							Operations: []capsulev1beta1.ProxyOperation{"List"},
-						},
-					},
-				},
-				{
-					Kind: "Group",
-					Name: "owner-foo",
-					ProxyOperations: []capsulev1beta1.ProxySettings{
-						{
-							Kind:       "IngressClasses",
-							Operations: []capsulev1beta1.ProxyOperation{"List"},
-						},
-					},
-				},
-				{
-					Kind: "Group",
-					Name: "owner-bar",
-					ProxyOperations: []capsulev1beta1.ProxySettings{
-						{
-							Kind:       "IngressClasses",
-							Operations: []capsulev1beta1.ProxyOperation{"List"},
-						},
-						{
-							Kind:       "StorageClasses",
-							Operations: []capsulev1beta1.ProxyOperation{"Delete"},
-						},
-					},
-				},
-				{
-					Kind: "ServiceAccount",
-					Name: "system:serviceaccount:oil-production:default",
-					ProxyOperations: []capsulev1beta1.ProxySettings{
-						{
-							Kind:       "Nodes",
-							Operations: []capsulev1beta1.ProxyOperation{"Update"},
-						},
-					},
-				},
-				{
-					Kind: "ServiceAccount",
-					Name: "system:serviceaccount:gas-production:gas",
-					ProxyOperations: []capsulev1beta1.ProxySettings{
-						{
-							Kind:       "StorageClasses",
-							Operations: []capsulev1beta1.ProxyOperation{"Update"},
-						},
-					},
-				},
-			},
-			NamespaceOptions: v1beta1NamespaceOptions,
-			ServiceOptions:   v1beta1ServiceOptions,
-			StorageClasses:   &v1beta2AllowedListSpec.AllowedListSpec,
-			IngressOptions: capsulev1beta1.IngressOptions{
-				HostnameCollisionScope: api.HostnameCollisionScopeDisabled,
-				AllowedClasses:         &v1beta2AllowedListSpec.AllowedListSpec,
-				AllowedHostnames:       &v1beta2AllowedListSpec.AllowedListSpec,
-			},
-			ContainerRegistries: &v1beta2AllowedListSpec.AllowedListSpec,
-			NodeSelector:        nodeSelector,
-			NetworkPolicies: api.NetworkPolicySpec{
-				Items: networkPolicies,
-			},
-			LimitRanges: api.LimitRangesSpec{
-				Items: limitRanges,
-			},
-			ResourceQuota: api.ResourceQuotaSpec{
-				Scope: api.ResourceQuotaScopeNamespace,
-				Items: resourceQuotas,
-			},
-			AdditionalRoleBindings: []api.AdditionalRoleBindingsSpec{
-				{
-					ClusterRoleName: "crds-rolebinding",
-					Subjects: []rbacv1.Subject{
-						{
-							Kind:     "Group",
-							APIGroup: rbacv1.GroupName,
-							Name:     "system:authenticated",
-						},
-					},
-				},
-			},
-			ImagePullPolicies: []api.ImagePullPolicySpec{"Always", "IfNotPresent"},
-			PriorityClasses: &api.AllowedListSpec{
-				Exact: []string{"default"},
-				Regex: "^tier-.*$",
-			},
-		},
-		Status: capsulev1beta1.TenantStatus{
-			Size:       1,
-			Namespaces: []string{"foo", "bar"},
-		},
-	}
-
-	v1alpha1Tnt := Tenant{
-		TypeMeta: metav1.TypeMeta{},
-		ObjectMeta: metav1.ObjectMeta{
-			Name: "alice",
-			Labels: map[string]string{
-				"foo": "bar",
-			},
-			Annotations: map[string]string{
-				"foo":                                "bar",
-				podAllowedImagePullPolicyAnnotation:  "Always,IfNotPresent",
-				enableExternalNameAnnotation:         "false",
-				enableNodePortsAnnotation:            "false",
-				enableLoadBalancerAnnotation:         "false",
-				podPriorityAllowedAnnotation:         "default",
-				podPriorityAllowedRegexAnnotation:    "^tier-.*$",
-				ownerGroupsAnnotation:                "owner-foo,owner-bar",
-				ownerUsersAnnotation:                 "bob,jack",
-				ownerServiceAccountAnnotation:        "system:serviceaccount:oil-production:default,system:serviceaccount:gas-production:gas",
-				enableNodeUpdateAnnotation:           "alice,system:serviceaccount:oil-production:default",
-				enableNodeDeletionAnnotation:         "alice,jack",
-				enableStorageClassListingAnnotation:  "bob,jack",
-				enableStorageClassUpdateAnnotation:   "alice,system:serviceaccount:gas-production:gas",
-				enableStorageClassDeletionAnnotation: "alice,owner-bar",
-				enableIngressClassListingAnnotation:  "alice,owner-foo,owner-bar",
-				enableIngressClassUpdateAnnotation:   "alice,bob",
-				enableIngressClassDeletionAnnotation: "alice,jack",
-				enablePriorityClassListingAnnotation: "jack",
-				resourceQuotaScopeAnnotation:         "Namespace",
-				ingressHostnameCollisionScope:        "Disabled",
-			},
-		},
-		Spec: TenantSpec{
-			Owner: OwnerSpec{
-				Name: "alice",
-				Kind: "User",
-			},
-			NamespaceQuota:      &namespaceQuota,
-			NamespacesMetadata:  v1alpha1AdditionalMetadataSpec,
-			ServicesMetadata:    v1alpha1AdditionalMetadataSpec,
-			StorageClasses:      v1alpha1AllowedListSpec,
-			IngressClasses:      v1alpha1AllowedListSpec,
-			IngressHostnames:    v1alpha1AllowedListSpec,
-			ContainerRegistries: v1alpha1AllowedListSpec,
-			NodeSelector:        nodeSelector,
-			NetworkPolicies:     networkPolicies,
-			LimitRanges:         limitRanges,
-			ResourceQuota:       resourceQuotas,
-			AdditionalRoleBindings: []api.AdditionalRoleBindingsSpec{
-				{
-					ClusterRoleName: "crds-rolebinding",
-					Subjects: []rbacv1.Subject{
-						{
-							Kind:     "Group",
-							APIGroup: rbacv1.GroupName,
-							Name:     "system:authenticated",
-						},
-					},
-				},
-			},
-			ExternalServiceIPs: &api.ExternalServiceIPsSpec{
-				Allowed: []api.AllowedIP{"192.168.0.1"},
-			},
-		},
-		Status: TenantStatus{
-			Size:       1,
-			Namespaces: []string{"foo", "bar"},
-		},
-	}
-
-	return v1alpha1Tnt, v1beta1Tnt
-}
-
-func TestConversionHub_ConvertTo(t *testing.T) {
-	v1beta1ConvertedTnt := capsulev1beta1.Tenant{}
-
-	v1alpha1Tnt, v1beta1tnt := generateTenantsSpecs()
-	err := v1alpha1Tnt.ConvertTo(&v1beta1ConvertedTnt)
-
-	if assert.NoError(t, err) {
-		sort.Slice(v1beta1tnt.Spec.Owners, func(i, j int) bool {
-			return v1beta1tnt.Spec.Owners[i].Name < v1beta1tnt.Spec.Owners[j].Name
-		})
-		sort.Slice(v1beta1ConvertedTnt.Spec.Owners, func(i, j int) bool {
-			return v1beta1ConvertedTnt.Spec.Owners[i].Name < v1beta1ConvertedTnt.Spec.Owners[j].Name
-		})
-
-		for _, owner := range v1beta1tnt.Spec.Owners {
-			sort.Slice(owner.ProxyOperations, func(i, j int) bool {
-				return owner.ProxyOperations[i].Kind < owner.ProxyOperations[j].Kind
-			})
-		}
-
-		for _, owner := range v1beta1ConvertedTnt.Spec.Owners {
-			sort.Slice(owner.ProxyOperations, func(i, j int) bool {
-				return owner.ProxyOperations[i].Kind < owner.ProxyOperations[j].Kind
-			})
-		}
-
-		assert.Equal(t, v1beta1tnt, v1beta1ConvertedTnt)
-	}
-}
-
-func TestConversionHub_ConvertFrom(t *testing.T) {
-	v1alpha1ConvertedTnt := Tenant{}
-
-	v1alpha1Tnt, v1beta1tnt := generateTenantsSpecs()
-
-	err := v1alpha1ConvertedTnt.ConvertFrom(&v1beta1tnt)
-	if assert.NoError(t, err) {
-		assert.EqualValues(t, v1alpha1Tnt, v1alpha1ConvertedTnt)
-	}
-}

api/v1alpha1/groupversion_info.go

@@ -1,23 +0,0 @@
-// Copyright 2020-2023 Project Capsule Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-// Package v1alpha1 contains API Schema definitions for the capsule.clastix.io v1alpha1 API group
-// +kubebuilder:object:generate=true
-// +groupName=capsule.clastix.io
-package v1alpha1
-
-import (
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"sigs.k8s.io/controller-runtime/pkg/scheme"
-)
-
-var (
-	// GroupVersion is group version used to register these objects.
-	GroupVersion = schema.GroupVersion{Group: "capsule.clastix.io", Version: "v1alpha1"}
-
-	// SchemeBuilder is used to add go types to the GroupVersionKind scheme.
-	SchemeBuilder = &scheme.Builder{GroupVersion: GroupVersion}
-
-	// AddToScheme adds the types in this group-version to the given scheme.
-	AddToScheme = SchemeBuilder.AddToScheme
-)

api/v1alpha1/owner.go

@@ -1,17 +0,0 @@
-// Copyright 2020-2023 Project Capsule Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-package v1alpha1
-
-// OwnerSpec defines tenant owner name and kind.
-type OwnerSpec struct {
-	Name string `json:"name"`
-	Kind Kind   `json:"kind"`
-}
-
-// +kubebuilder:validation:Enum=User;Group
-type Kind string
-
-func (k Kind) String() string {
-	return string(k)
-}

api/v1alpha1/tenant_func.go

@@ -1,34 +0,0 @@
-// Copyright 2020-2023 Project Capsule Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-package v1alpha1
-
-import (
-	"sort"
-
-	corev1 "k8s.io/api/core/v1"
-)
-
-func (in *Tenant) IsFull() bool {
-	// we don't have limits on assigned Namespaces
-	if in.Spec.NamespaceQuota == nil {
-		return false
-	}
-
-	return len(in.Status.Namespaces) >= int(*in.Spec.NamespaceQuota)
-}
-
-func (in *Tenant) AssignNamespaces(namespaces []corev1.Namespace) {
-	var l []string
-
-	for _, ns := range namespaces {
-		if ns.Status.Phase == corev1.NamespaceActive {
-			l = append(l, ns.GetName())
-		}
-	}
-
-	sort.Strings(l)
-
-	in.Status.Namespaces = l
-	in.Status.Size = uint(len(l))
-}

api/v1alpha1/tenant_types.go

@@ -1,71 +0,0 @@
-// Copyright 2020-2023 Project Capsule Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-package v1alpha1
-
-import (
-	corev1 "k8s.io/api/core/v1"
-	networkingv1 "k8s.io/api/networking/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-
-	"github.com/projectcapsule/capsule/pkg/api"
-)
-
-// TenantSpec defines the desired state of Tenant.
-type TenantSpec struct {
-	Owner OwnerSpec `json:"owner"`
-
-	// +kubebuilder:validation:Minimum=1
-	NamespaceQuota         *int32                           `json:"namespaceQuota,omitempty"`
-	NamespacesMetadata     *AdditionalMetadata              `json:"namespacesMetadata,omitempty"`
-	ServicesMetadata       *AdditionalMetadata              `json:"servicesMetadata,omitempty"`
-	StorageClasses         *api.AllowedListSpec             `json:"storageClasses,omitempty"`
-	IngressClasses         *api.AllowedListSpec             `json:"ingressClasses,omitempty"`
-	IngressHostnames       *api.AllowedListSpec             `json:"ingressHostnames,omitempty"`
-	ContainerRegistries    *api.AllowedListSpec             `json:"containerRegistries,omitempty"`
-	NodeSelector           map[string]string                `json:"nodeSelector,omitempty"`
-	NetworkPolicies        []networkingv1.NetworkPolicySpec `json:"networkPolicies,omitempty"`
-	LimitRanges            []corev1.LimitRangeSpec          `json:"limitRanges,omitempty"`
-	ResourceQuota          []corev1.ResourceQuotaSpec       `json:"resourceQuotas,omitempty"`
-	AdditionalRoleBindings []api.AdditionalRoleBindingsSpec `json:"additionalRoleBindings,omitempty"`
-	ExternalServiceIPs     *api.ExternalServiceIPsSpec      `json:"externalServiceIPs,omitempty"`
-}
-
-// TenantStatus defines the observed state of Tenant.
-type TenantStatus struct {
-	Size       uint     `json:"size"`
-	Namespaces []string `json:"namespaces,omitempty"`
-}
-
-// +kubebuilder:object:root=true
-// +kubebuilder:subresource:status
-// +kubebuilder:resource:scope=Cluster,shortName=tnt
-// +kubebuilder:printcolumn:name="Namespace quota",type="integer",JSONPath=".spec.namespaceQuota",description="The max amount of Namespaces can be created"
-// +kubebuilder:printcolumn:name="Namespace count",type="integer",JSONPath=".status.size",description="The total amount of Namespaces in use"
-// +kubebuilder:printcolumn:name="Owner name",type="string",JSONPath=".spec.owner.name",description="The assigned Tenant owner"
-// +kubebuilder:printcolumn:name="Owner kind",type="string",JSONPath=".spec.owner.kind",description="The assigned Tenant owner kind"
-// +kubebuilder:printcolumn:name="Node selector",type="string",JSONPath=".spec.nodeSelector",description="Node Selector applied to Pods"
-// +kubebuilder:printcolumn:name="Age",type="date",JSONPath=".metadata.creationTimestamp",description="Age"
-// +kubebuilder:deprecatedversion:warning="This version is going to be dropped in the upcoming version of Capsule; please, migrate to v1beta2 version."
-
-// Tenant is the Schema for the tenants API.
-type Tenant struct {
-	metav1.TypeMeta   `json:",inline"`
-	metav1.ObjectMeta `json:"metadata,omitempty"`
-
-	Spec   TenantSpec   `json:"spec,omitempty"`
-	Status TenantStatus `json:"status,omitempty"`
-}
-
-// +kubebuilder:object:root=true
-
-// TenantList contains a list of Tenant.
-type TenantList struct {
-	metav1.TypeMeta `json:",inline"`
-	metav1.ListMeta `json:"metadata,omitempty"`
-	Items           []Tenant `json:"items"`
-}
-
-func init() {
-	SchemeBuilder.Register(&Tenant{}, &TenantList{})
-}

api/v1alpha1/tenant_webhook.go

@@ -1,21 +0,0 @@
-// Copyright 2020-2023 Project Capsule Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-package v1alpha1
-
-import (
-	"os"
-
-	ctrl "sigs.k8s.io/controller-runtime"
-)
-
-func (in *Tenant) SetupWebhookWithManager(mgr ctrl.Manager) error {
-	certData, _ := os.ReadFile("/tmp/k8s-webhook-server/serving-certs/tls.crt")
-	if len(certData) == 0 {
-		return nil
-	}
-
-	return ctrl.NewWebhookManagedBy(mgr).
-		For(in).
-		Complete()
-}

api/v1alpha1/zz_generated.deepcopy.go

@@ -1,308 +0,0 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
-// Copyright 2020-2023 Project Capsule Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-// Code generated by controller-gen. DO NOT EDIT.
-
-package v1alpha1
-
-import (
-	"github.com/projectcapsule/capsule/pkg/api"
-	corev1 "k8s.io/api/core/v1"
-	"k8s.io/api/networking/v1"
-	runtime "k8s.io/apimachinery/pkg/runtime"
-)
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *AdditionalMetadata) DeepCopyInto(out *AdditionalMetadata) {
-	*out = *in
-	if in.Labels != nil {
-		in, out := &in.Labels, &out.Labels
-		*out = make(map[string]string, len(*in))
-		for key, val := range *in {
-			(*out)[key] = val
-		}
-	}
-	if in.Annotations != nil {
-		in, out := &in.Annotations, &out.Annotations
-		*out = make(map[string]string, len(*in))
-		for key, val := range *in {
-			(*out)[key] = val
-		}
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AdditionalMetadata.
-func (in *AdditionalMetadata) DeepCopy() *AdditionalMetadata {
-	if in == nil {
-		return nil
-	}
-	out := new(AdditionalMetadata)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *CapsuleConfiguration) DeepCopyInto(out *CapsuleConfiguration) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
-	in.Spec.DeepCopyInto(&out.Spec)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CapsuleConfiguration.
-func (in *CapsuleConfiguration) DeepCopy() *CapsuleConfiguration {
-	if in == nil {
-		return nil
-	}
-	out := new(CapsuleConfiguration)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *CapsuleConfiguration) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *CapsuleConfigurationList) DeepCopyInto(out *CapsuleConfigurationList) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ListMeta.DeepCopyInto(&out.ListMeta)
-	if in.Items != nil {
-		in, out := &in.Items, &out.Items
-		*out = make([]CapsuleConfiguration, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CapsuleConfigurationList.
-func (in *CapsuleConfigurationList) DeepCopy() *CapsuleConfigurationList {
-	if in == nil {
-		return nil
-	}
-	out := new(CapsuleConfigurationList)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *CapsuleConfigurationList) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *CapsuleConfigurationSpec) DeepCopyInto(out *CapsuleConfigurationSpec) {
-	*out = *in
-	if in.UserGroups != nil {
-		in, out := &in.UserGroups, &out.UserGroups
-		*out = make([]string, len(*in))
-		copy(*out, *in)
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CapsuleConfigurationSpec.
-func (in *CapsuleConfigurationSpec) DeepCopy() *CapsuleConfigurationSpec {
-	if in == nil {
-		return nil
-	}
-	out := new(CapsuleConfigurationSpec)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *OwnerSpec) DeepCopyInto(out *OwnerSpec) {
-	*out = *in
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new OwnerSpec.
-func (in *OwnerSpec) DeepCopy() *OwnerSpec {
-	if in == nil {
-		return nil
-	}
-	out := new(OwnerSpec)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Tenant) DeepCopyInto(out *Tenant) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
-	in.Spec.DeepCopyInto(&out.Spec)
-	in.Status.DeepCopyInto(&out.Status)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Tenant.
-func (in *Tenant) DeepCopy() *Tenant {
-	if in == nil {
-		return nil
-	}
-	out := new(Tenant)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *Tenant) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *TenantList) DeepCopyInto(out *TenantList) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ListMeta.DeepCopyInto(&out.ListMeta)
-	if in.Items != nil {
-		in, out := &in.Items, &out.Items
-		*out = make([]Tenant, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TenantList.
-func (in *TenantList) DeepCopy() *TenantList {
-	if in == nil {
-		return nil
-	}
-	out := new(TenantList)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *TenantList) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *TenantSpec) DeepCopyInto(out *TenantSpec) {
-	*out = *in
-	out.Owner = in.Owner
-	if in.NamespaceQuota != nil {
-		in, out := &in.NamespaceQuota, &out.NamespaceQuota
-		*out = new(int32)
-		**out = **in
-	}
-	if in.NamespacesMetadata != nil {
-		in, out := &in.NamespacesMetadata, &out.NamespacesMetadata
-		*out = new(AdditionalMetadata)
-		(*in).DeepCopyInto(*out)
-	}
-	if in.ServicesMetadata != nil {
-		in, out := &in.ServicesMetadata, &out.ServicesMetadata
-		*out = new(AdditionalMetadata)
-		(*in).DeepCopyInto(*out)
-	}
-	if in.StorageClasses != nil {
-		in, out := &in.StorageClasses, &out.StorageClasses
-		*out = new(api.AllowedListSpec)
-		(*in).DeepCopyInto(*out)
-	}
-	if in.IngressClasses != nil {
-		in, out := &in.IngressClasses, &out.IngressClasses
-		*out = new(api.AllowedListSpec)
-		(*in).DeepCopyInto(*out)
-	}
-	if in.IngressHostnames != nil {
-		in, out := &in.IngressHostnames, &out.IngressHostnames
-		*out = new(api.AllowedListSpec)
-		(*in).DeepCopyInto(*out)
-	}
-	if in.ContainerRegistries != nil {
-		in, out := &in.ContainerRegistries, &out.ContainerRegistries
-		*out = new(api.AllowedListSpec)
-		(*in).DeepCopyInto(*out)
-	}
-	if in.NodeSelector != nil {
-		in, out := &in.NodeSelector, &out.NodeSelector
-		*out = make(map[string]string, len(*in))
-		for key, val := range *in {
-			(*out)[key] = val
-		}
-	}
-	if in.NetworkPolicies != nil {
-		in, out := &in.NetworkPolicies, &out.NetworkPolicies
-		*out = make([]v1.NetworkPolicySpec, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
-	if in.LimitRanges != nil {
-		in, out := &in.LimitRanges, &out.LimitRanges
-		*out = make([]corev1.LimitRangeSpec, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
-	if in.ResourceQuota != nil {
-		in, out := &in.ResourceQuota, &out.ResourceQuota
-		*out = make([]corev1.ResourceQuotaSpec, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
-	if in.AdditionalRoleBindings != nil {
-		in, out := &in.AdditionalRoleBindings, &out.AdditionalRoleBindings
-		*out = make([]api.AdditionalRoleBindingsSpec, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
-	if in.ExternalServiceIPs != nil {
-		in, out := &in.ExternalServiceIPs, &out.ExternalServiceIPs
-		*out = new(api.ExternalServiceIPsSpec)
-		(*in).DeepCopyInto(*out)
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TenantSpec.
-func (in *TenantSpec) DeepCopy() *TenantSpec {
-	if in == nil {
-		return nil
-	}
-	out := new(TenantSpec)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *TenantStatus) DeepCopyInto(out *TenantStatus) {
-	*out = *in
-	if in.Namespaces != nil {
-		in, out := &in.Namespaces, &out.Namespaces
-		*out = make([]string, len(*in))
-		copy(*out, *in)
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TenantStatus.
-func (in *TenantStatus) DeepCopy() *TenantStatus {
-	if in == nil {
-		return nil
-	}
-	out := new(TenantStatus)
-	in.DeepCopyInto(out)
-	return out
-}

api/v1beta2/capsuleconfiguration_convertion_hub.go

@@ -1,142 +0,0 @@
-// Copyright 2020-2023 Project Capsule Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-package v1beta2
-
-import (
-	"fmt"
-	"strconv"
-	"strings"
-
-	"sigs.k8s.io/controller-runtime/pkg/conversion"
-
-	capsulev1alpha1 "github.com/projectcapsule/capsule/api/v1alpha1"
-)
-
-func (in *CapsuleConfiguration) ConvertTo(raw conversion.Hub) error {
-	dst, ok := raw.(*capsulev1alpha1.CapsuleConfiguration)
-	if !ok {
-		return fmt.Errorf("expected type *capsulev1alpha1.CapsuleConfiguration, got %T", dst)
-	}
-
-	dst.ObjectMeta = in.ObjectMeta
-	dst.Spec.ProtectedNamespaceRegexpString = in.Spec.ProtectedNamespaceRegexpString
-	dst.Spec.UserGroups = in.Spec.UserGroups
-	dst.Spec.ProtectedNamespaceRegexpString = in.Spec.ProtectedNamespaceRegexpString
-
-	annotations := dst.GetAnnotations()
-	if annotations == nil {
-		annotations = make(map[string]string)
-	}
-
-	if in.Spec.NodeMetadata != nil {
-		if len(in.Spec.NodeMetadata.ForbiddenLabels.Exact) > 0 {
-			annotations[capsulev1alpha1.ForbiddenNodeLabelsAnnotation] = strings.Join(in.Spec.NodeMetadata.ForbiddenLabels.Exact, ",")
-		}
-
-		if len(in.Spec.NodeMetadata.ForbiddenLabels.Regex) > 0 {
-			annotations[capsulev1alpha1.ForbiddenNodeLabelsRegexpAnnotation] = in.Spec.NodeMetadata.ForbiddenLabels.Regex
-		}
-
-		if len(in.Spec.NodeMetadata.ForbiddenAnnotations.Exact) > 0 {
-			annotations[capsulev1alpha1.ForbiddenNodeAnnotationsAnnotation] = strings.Join(in.Spec.NodeMetadata.ForbiddenAnnotations.Exact, ",")
-		}
-
-		if len(in.Spec.NodeMetadata.ForbiddenAnnotations.Regex) > 0 {
-			annotations[capsulev1alpha1.ForbiddenNodeAnnotationsRegexpAnnotation] = in.Spec.NodeMetadata.ForbiddenAnnotations.Regex
-		}
-	}
-
-	annotations[capsulev1alpha1.EnableTLSConfigurationAnnotationName] = fmt.Sprintf("%t", in.Spec.EnableTLSReconciler)
-	annotations[capsulev1alpha1.TLSSecretNameAnnotation] = in.Spec.CapsuleResources.TLSSecretName
-	annotations[capsulev1alpha1.MutatingWebhookConfigurationName] = in.Spec.CapsuleResources.MutatingWebhookConfigurationName
-	annotations[capsulev1alpha1.ValidatingWebhookConfigurationName] = in.Spec.CapsuleResources.ValidatingWebhookConfigurationName
-
-	dst.SetAnnotations(annotations)
-
-	return nil
-}
-
-func (in *CapsuleConfiguration) ConvertFrom(raw conversion.Hub) error {
-	src, ok := raw.(*capsulev1alpha1.CapsuleConfiguration)
-	if !ok {
-		return fmt.Errorf("expected type *capsulev1alpha1.CapsuleConfiguration, got %T", src)
-	}
-
-	in.ObjectMeta = src.ObjectMeta
-	in.Spec.ProtectedNamespaceRegexpString = src.Spec.ProtectedNamespaceRegexpString
-	in.Spec.UserGroups = src.Spec.UserGroups
-	in.Spec.ProtectedNamespaceRegexpString = src.Spec.ProtectedNamespaceRegexpString
-
-	annotations := src.GetAnnotations()
-
-	if value, found := annotations[capsulev1alpha1.ForbiddenNodeLabelsAnnotation]; found {
-		if in.Spec.NodeMetadata == nil {
-			in.Spec.NodeMetadata = &NodeMetadata{}
-		}
-
-		in.Spec.NodeMetadata.ForbiddenLabels.Exact = strings.Split(value, ",")
-
-		delete(annotations, capsulev1alpha1.ForbiddenNodeLabelsAnnotation)
-	}
-
-	if value, found := annotations[capsulev1alpha1.ForbiddenNodeLabelsRegexpAnnotation]; found {
-		if in.Spec.NodeMetadata == nil {
-			in.Spec.NodeMetadata = &NodeMetadata{}
-		}
-
-		in.Spec.NodeMetadata.ForbiddenLabels.Regex = value
-
-		delete(annotations, capsulev1alpha1.ForbiddenNodeLabelsRegexpAnnotation)
-	}
-
-	if value, found := annotations[capsulev1alpha1.ForbiddenNodeAnnotationsAnnotation]; found {
-		if in.Spec.NodeMetadata == nil {
-			in.Spec.NodeMetadata = &NodeMetadata{}
-		}
-
-		in.Spec.NodeMetadata.ForbiddenAnnotations.Exact = strings.Split(value, ",")
-
-		delete(annotations, capsulev1alpha1.ForbiddenNodeAnnotationsAnnotation)
-	}
-
-	if value, found := annotations[capsulev1alpha1.ForbiddenNodeAnnotationsRegexpAnnotation]; found {
-		if in.Spec.NodeMetadata == nil {
-			in.Spec.NodeMetadata = &NodeMetadata{}
-		}
-
-		in.Spec.NodeMetadata.ForbiddenAnnotations.Regex = value
-
-		delete(annotations, capsulev1alpha1.ForbiddenNodeAnnotationsRegexpAnnotation)
-	}
-
-	if value, found := annotations[capsulev1alpha1.EnableTLSConfigurationAnnotationName]; found {
-		v, _ := strconv.ParseBool(value)
-
-		in.Spec.EnableTLSReconciler = v
-
-		delete(annotations, capsulev1alpha1.EnableTLSConfigurationAnnotationName)
-	}
-
-	if value, found := annotations[capsulev1alpha1.TLSSecretNameAnnotation]; found {
-		in.Spec.CapsuleResources.TLSSecretName = value
-
-		delete(annotations, capsulev1alpha1.TLSSecretNameAnnotation)
-	}
-
-	if value, found := annotations[capsulev1alpha1.MutatingWebhookConfigurationName]; found {
-		in.Spec.CapsuleResources.MutatingWebhookConfigurationName = value
-
-		delete(annotations, capsulev1alpha1.MutatingWebhookConfigurationName)
-	}
-
-	if value, found := annotations[capsulev1alpha1.ValidatingWebhookConfigurationName]; found {
-		in.Spec.CapsuleResources.ValidatingWebhookConfigurationName = value
-
-		delete(annotations, capsulev1alpha1.ValidatingWebhookConfigurationName)
-	}
-
-	in.SetAnnotations(annotations)
-
-	return nil
-}

api/v1beta2/owner.go

@@ -48,6 +48,7 @@ const (
 	PriorityClassesProxy   ProxyServiceKind = "PriorityClasses"
 	RuntimeClassesProxy    ProxyServiceKind = "RuntimeClasses"
 	PersistentVolumesProxy ProxyServiceKind = "PersistentVolumes"
+	TenantProxy            ProxyServiceKind = "Tenant"
 
 	ListOperation   ProxyOperation = "List"
 	UpdateOperation ProxyOperation = "Update"

api/v1beta2/tenant_annotations.go

@@ -7,21 +7,25 @@ import (
 	"crypto/md5" //#nosec
 	"encoding/hex"
 	"fmt"
+	"strings"
 )
 
 const (
 	// Annotation name part must be no more than 63 characters.
 	maxAnnotationLength = 63
+
+	HardCapsuleQuotaAnnotation = "quota.capsule.clastix.io/hard-"
+	UsedCapsuleQuotaAnnotation = "quota.capsule.clastix.io/used-"
 )
 
 func createAnnotation(format string, resource fmt.Stringer) (string, error) {
-	suffix := resource.String()
+	resourceStr := strings.ReplaceAll(resource.String(), "/", "_")
 
-	hash := md5.Sum([]byte(resource.String())) //#nosec
+	hash := md5.Sum([]byte(resourceStr)) //#nosec
 
 	hashed := hex.EncodeToString(hash[:])
 	capsuleHashed := format + hashed
-	capsuleAnnotation := format + suffix
+	capsuleAnnotation := format + resourceStr
 
 	switch {
 	case len(capsuleAnnotation) <= maxAnnotationLength:
@@ -36,9 +40,9 @@ func createAnnotation(format string, resource fmt.Stringer) (string, error) {
 }
 
 func UsedQuotaFor(resource fmt.Stringer) (string, error) {
-	return createAnnotation("quota.capsule.clastix.io/used-", resource)
+	return createAnnotation(UsedCapsuleQuotaAnnotation, resource)
 }
 
 func HardQuotaFor(resource fmt.Stringer) (string, error) {
-	return createAnnotation("quota.capsule.clastix.io/hard-", resource)
+	return createAnnotation(HardCapsuleQuotaAnnotation, resource)
 }

api/v1beta2/tenant_types.go

@@ -17,6 +17,8 @@ type TenantSpec struct {
 	NamespaceOptions *NamespaceOptions `json:"namespaceOptions,omitempty"`
 	// Specifies options for the Service, such as additional metadata or block of certain type of Services. Optional.
 	ServiceOptions *api.ServiceOptions `json:"serviceOptions,omitempty"`
+	// Specifies options for the Pods deployed in the Tenant namespaces, such as additional metadata.
+	PodOptions *api.PodOptions `json:"podOptions,omitempty"`
 	// Specifies the allowed StorageClasses assigned to the Tenant.
 	// Capsule assures that all PersistentVolumeClaim resources created in the Tenant can use only one of the allowed StorageClasses.
 	// A default value can be specified, and all the PersistentVolumeClaim resources created will inherit the declared class.

api/v1beta2/zz_generated.deepcopy.go

@@ -716,6 +716,11 @@ func (in *TenantSpec) DeepCopyInto(out *TenantSpec) {
 		*out = new(api.ServiceOptions)
 		(*in).DeepCopyInto(*out)
 	}
+	if in.PodOptions != nil {
+		in, out := &in.PodOptions, &out.PodOptions
+		*out = new(api.PodOptions)
+		(*in).DeepCopyInto(*out)
+	}
 	if in.StorageClasses != nil {
 		in, out := &in.StorageClasses, &out.StorageClasses
 		*out = new(api.DefaultAllowedListSpec)

charts/capsule/Chart.yaml

@@ -19,10 +19,10 @@ name: capsule
 sources:
 - https://github.com/projectcapsule/capsule
 # The version is overwritten by the release workflow.
-version: 0.5.2
+version: 0.6.0
 # This is the version number of the application being deployed.
 # This version number should be incremented each time you make changes to the application.
-appVersion: 0.4.1
+appVersion: 0.5.0
 annotations:
   artifacthub.io/operator: "true"
   artifacthub.io/prerelease: "false"

charts/capsule/README.md

@@ -114,6 +114,9 @@ Here the values you can override:
 | manager.options.logLevel | string | `"4"` | Set the log verbosity of the capsule with a value from 1 to 10 |
 | manager.options.nodeMetadata | object | `{"forbiddenAnnotations":{"denied":[],"deniedRegex":""},"forbiddenLabels":{"denied":[],"deniedRegex":""}}` | Allows to set the forbidden metadata for the worker nodes that could be patched by a Tenant |
 | manager.options.protectedNamespaceRegex | string | `""` | If specified, disallows creation of namespaces matching the passed regexp |
+| manager.rbac.create | bool | `true` | Specifies whether RBAC resources should be created. |
+| manager.rbac.existingClusterRoles | list | `[]` | Specifies further cluster roles to be added to the Capsule manager service account. |
+| manager.rbac.existingRoles | list | `[]` | Specifies further cluster roles to be added to the Capsule manager service account. |
 | manager.readinessProbe | object | `{"httpGet":{"path":"/readyz","port":10080}}` | Configure the readiness probe using Deployment probe spec |
 | manager.resources.limits.cpu | string | `"200m"` |  |
 | manager.resources.limits.memory | string | `"128Mi"` |  |

charts/capsule/ci/test-values.yaml

@@ -1,5 +1,12 @@
 fullnameOverride: capsule
 manager:
+    # Manager RBAC
+  rbac:
+    create: true
+    existingClusterRoles:
+    - "view"
+    existingRoles:
+    - "some-role"
   resources:
     limits:
       cpu: 500m

charts/capsule/crds/capsuleconfiguration-crd.yaml

@@ -16,7 +16,6 @@ spec:
           namespace: capsule-system
           path: /convert
       conversionReviewVersions:
-        - v1alpha1
         - v1beta1
         - v1beta2
   group: capsule.clastix.io
@@ -27,40 +26,6 @@ spec:
     singular: capsuleconfiguration
   scope: Cluster
   versions:
-    - name: v1alpha1
-      schema:
-        openAPIV3Schema:
-          description: CapsuleConfiguration is the Schema for the Capsule configuration API.
-          properties:
-            apiVersion:
-              description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
-              type: string
-            kind:
-              description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
-              type: string
-            metadata:
-              type: object
-            spec:
-              description: CapsuleConfigurationSpec defines the Capsule configuration.
-              properties:
-                forceTenantPrefix:
-                  default: false
-                  description: Enforces the Tenant owner, during Namespace creation, to name it using the selected Tenant name as prefix, separated by a dash. This is useful to avoid Namespace name collision in a public CaaS environment.
-                  type: boolean
-                protectedNamespaceRegex:
-                  description: Disallow creation of namespaces, whose name matches this regexp
-                  type: string
-                userGroups:
-                  default:
-                    - capsule.clastix.io
-                  description: Names of the groups for Capsule users.
-                  items:
-                    type: string
-                  type: array
-              type: object
-          type: object
-      served: true
-      storage: false
     - name: v1beta2
       schema:
         openAPIV3Schema:

charts/capsule/crds/tenant-crd.yaml

@@ -15,7 +15,6 @@ spec:
           namespace: capsule-system
           path: /convert
       conversionReviewVersions:
-        - v1alpha1
         - v1beta1
         - v1beta2
   group: capsule.clastix.io
@@ -28,859 +27,6 @@ spec:
     singular: tenant
   scope: Cluster
   versions:
-    - additionalPrinterColumns:
-        - description: The max amount of Namespaces can be created
-          jsonPath: .spec.namespaceQuota
-          name: Namespace quota
-          type: integer
-        - description: The total amount of Namespaces in use
-          jsonPath: .status.size
-          name: Namespace count
-          type: integer
-        - description: The assigned Tenant owner
-          jsonPath: .spec.owner.name
-          name: Owner name
-          type: string
-        - description: The assigned Tenant owner kind
-          jsonPath: .spec.owner.kind
-          name: Owner kind
-          type: string
-        - description: Node Selector applied to Pods
-          jsonPath: .spec.nodeSelector
-          name: Node selector
-          type: string
-        - description: Age
-          jsonPath: .metadata.creationTimestamp
-          name: Age
-          type: date
-      deprecated: true
-      deprecationWarning: This version is going to be dropped in the upcoming version
-        of Capsule; please, migrate to v1beta2 version.
-      name: v1alpha1
-      schema:
-        openAPIV3Schema:
-          description: Tenant is the Schema for the tenants API.
-          properties:
-            apiVersion:
-              description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
-              type: string
-            kind:
-              description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
-              type: string
-            metadata:
-              type: object
-            spec:
-              description: TenantSpec defines the desired state of Tenant.
-              properties:
-                additionalRoleBindings:
-                  description: Specifies additional RoleBindings assigned to the Tenant. Capsule will ensure that all namespaces in the Tenant always contain the RoleBinding for the given ClusterRole. Optional.
-                  items:
-                    properties:
-                      clusterRoleName:
-                        type: string
-                      subjects:
-                        description: kubebuilder:validation:Minimum=1
-                        items:
-                          description: Subject contains a reference to the object or user identities a role binding applies to.  This can either hold a direct API object reference, or a value for non-objects such as user and group names.
-                          properties:
-                            apiGroup:
-                              description: APIGroup holds the API group of the referenced subject. Defaults to "" for ServiceAccount subjects. Defaults to "rbac.authorization.k8s.io" for User and Group subjects.
-                              type: string
-                            kind:
-                              description: Kind of object being referenced. Values defined by this API group are "User", "Group", and "ServiceAccount". If the Authorizer does not recognized the kind value, the Authorizer should report an error.
-                              type: string
-                            name:
-                              description: Name of the object being referenced.
-                              type: string
-                            namespace:
-                              description: Namespace of the referenced object.  If the object kind is non-namespace, such as "User" or "Group", and this value is not empty the Authorizer should report an error.
-                              type: string
-                          required:
-                            - kind
-                            - name
-                          type: object
-                          x-kubernetes-map-type: atomic
-                        type: array
-                    required:
-                      - clusterRoleName
-                      - subjects
-                    type: object
-                  type: array
-                containerRegistries:
-                  description: Specifies the trusted Image Registries assigned to the Tenant. Capsule assures that all Pods resources created in the Tenant can use only one of the allowed trusted registries. Optional.
-                  properties:
-                    allowed:
-                      items:
-                        type: string
-                      type: array
-                    allowedRegex:
-                      type: string
-                  type: object
-                cordoned:
-                  description: Toggling the Tenant resources cordoning, when enable resources cannot be deleted.
-                  type: boolean
-                imagePullPolicies:
-                  description: Specify the allowed values for the imagePullPolicies option in Pod resources. Capsule assures that all Pod resources created in the Tenant can use only one of the allowed policy. Optional.
-                  items:
-                    enum:
-                      - Always
-                      - Never
-                      - IfNotPresent
-                    type: string
-                  type: array
-                ingressOptions:
-                  description: Specifies options for the Ingress resources, such as allowed hostnames and IngressClass. Optional.
-                  properties:
-                    allowWildcardHostnames:
-                      description: Toggles the ability for Ingress resources created in a Tenant to have a hostname wildcard.
-                      type: boolean
-                    allowedClasses:
-                      description: Specifies the allowed IngressClasses assigned to the Tenant. Capsule assures that all Ingress resources created in the Tenant can use only one of the allowed IngressClasses. A default value can be specified, and all the Ingress resources created will inherit the declared class. Optional.
-                      properties:
-                        allowed:
-                          items:
-                            type: string
-                          type: array
-                        allowedRegex:
-                          type: string
-                        default:
-                          type: string
-                        matchExpressions:
-                          description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                          items:
-                            description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.
-                            properties:
-                              key:
-                                description: key is the label key that the selector applies to.
-                                type: string
-                              operator:
-                                description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
-                                type: string
-                              values:
-                                description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
-                                items:
-                                  type: string
-                                type: array
-                            required:
-                              - key
-                              - operator
-                            type: object
-                          type: array
-                        matchLabels:
-                          additionalProperties:
-                            type: string
-                          description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
-                          type: object
-                      type: object
-                      x-kubernetes-map-type: atomic
-                    allowedHostnames:
-                      description: Specifies the allowed hostnames in Ingresses for the given Tenant. Capsule assures that all Ingress resources created in the Tenant can use only one of the allowed hostnames. Optional.
-                      properties:
-                        allowed:
-                          items:
-                            type: string
-                          type: array
-                        allowedRegex:
-                          type: string
-                      type: object
-                    hostnameCollisionScope:
-                      default: Disabled
-                      description: "Defines the scope of hostname collision check performed when Tenant Owners create Ingress with allowed hostnames. \n - Cluster: disallow the creation of an Ingress if the pair hostname and path is already used across the Namespaces managed by Capsule. \n - Tenant: disallow the creation of an Ingress if the pair hostname and path is already used across the Namespaces of the Tenant. \n - Namespace: disallow the creation of an Ingress if the pair hostname and path is already used in the Ingress Namespace. \n Optional."
-                      enum:
-                        - Cluster
-                        - Tenant
-                        - Namespace
-                        - Disabled
-                      type: string
-                  type: object
-                limitRanges:
-                  description: Specifies the resource min/max usage restrictions to the Tenant. The assigned values are inherited by any namespace created in the Tenant. Optional.
-                  properties:
-                    items:
-                      items:
-                        description: LimitRangeSpec defines a min/max usage limit for resources that match on kind.
-                        properties:
-                          limits:
-                            description: Limits is the list of LimitRangeItem objects that are enforced.
-                            items:
-                              description: LimitRangeItem defines a min/max usage limit for any resource that matches on kind.
-                              properties:
-                                default:
-                                  additionalProperties:
-                                    anyOf:
-                                      - type: integer
-                                      - type: string
-                                    pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                                    x-kubernetes-int-or-string: true
-                                  description: Default resource requirement limit value by resource name if resource limit is omitted.
-                                  type: object
-                                defaultRequest:
-                                  additionalProperties:
-                                    anyOf:
-                                      - type: integer
-                                      - type: string
-                                    pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                                    x-kubernetes-int-or-string: true
-                                  description: DefaultRequest is the default resource requirement request value by resource name if resource request is omitted.
-                                  type: object
-                                max:
-                                  additionalProperties:
-                                    anyOf:
-                                      - type: integer
-                                      - type: string
-                                    pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                                    x-kubernetes-int-or-string: true
-                                  description: Max usage constraints on this kind by resource name.
-                                  type: object
-                                maxLimitRequestRatio:
-                                  additionalProperties:
-                                    anyOf:
-                                      - type: integer
-                                      - type: string
-                                    pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                                    x-kubernetes-int-or-string: true
-                                  description: MaxLimitRequestRatio if specified, the named resource must have a request and limit that are both non-zero where limit divided by request is less than or equal to the enumerated value; this represents the max burst for the named resource.
-                                  type: object
-                                min:
-                                  additionalProperties:
-                                    anyOf:
-                                      - type: integer
-                                      - type: string
-                                    pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                                    x-kubernetes-int-or-string: true
-                                  description: Min usage constraints on this kind by resource name.
-                                  type: object
-                                type:
-                                  description: Type of resource that this limit applies to.
-                                  type: string
-                              required:
-                                - type
-                              type: object
-                            type: array
-                        required:
-                          - limits
-                        type: object
-                      type: array
-                  type: object
-                namespaceOptions:
-                  description: Specifies options for the Namespaces, such as additional metadata or maximum number of namespaces allowed for that Tenant. Once the namespace quota assigned to the Tenant has been reached, the Tenant owner cannot create further namespaces. Optional.
-                  properties:
-                    additionalMetadata:
-                      description: Specifies additional labels and annotations the Capsule operator places on any Namespace resource in the Tenant. Optional.
-                      properties:
-                        annotations:
-                          additionalProperties:
-                            type: string
-                          type: object
-                        labels:
-                          additionalProperties:
-                            type: string
-                          type: object
-                      type: object
-                    forbiddenAnnotations:
-                      description: Define the annotations that a Tenant Owner cannot set for their Namespace resources.
-                      properties:
-                        denied:
-                          items:
-                            type: string
-                          type: array
-                        deniedRegex:
-                          type: string
-                      type: object
-                    forbiddenLabels:
-                      description: Define the labels that a Tenant Owner cannot set for their Namespace resources.
-                      properties:
-                        denied:
-                          items:
-                            type: string
-                          type: array
-                        deniedRegex:
-                          type: string
-                      type: object
-                    quota:
-                      description: Specifies the maximum number of namespaces allowed for that Tenant. Once the namespace quota assigned to the Tenant has been reached, the Tenant owner cannot create further namespaces. Optional.
-                      format: int32
-                      minimum: 1
-                      type: integer
-                  type: object
-                networkPolicies:
-                  description: Specifies the NetworkPolicies assigned to the Tenant. The assigned NetworkPolicies are inherited by any namespace created in the Tenant. Optional.
-                  properties:
-                    items:
-                      items:
-                        description: NetworkPolicySpec provides the specification of a NetworkPolicy
-                        properties:
-                          egress:
-                            description: egress is a list of egress rules to be applied to the selected pods. Outgoing traffic is allowed if there are no NetworkPolicies selecting the pod (and cluster policy otherwise allows the traffic), OR if the traffic matches at least one egress rule across all of the NetworkPolicy objects whose podSelector matches the pod. If this field is empty then this NetworkPolicy limits all outgoing traffic (and serves solely to ensure that the pods it selects are isolated by default). This field is beta-level in 1.8
-                            items:
-                              description: NetworkPolicyEgressRule describes a particular set of traffic that is allowed out of pods matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and to. This type is beta-level in 1.8
-                              properties:
-                                ports:
-                                  description: ports is a list of destination ports for outgoing traffic. Each item in this list is combined using a logical OR. If this field is empty or missing, this rule matches all ports (traffic not restricted by port). If this field is present and contains at least one item, then this rule allows traffic only if the traffic matches at least one port in the list.
-                                  items:
-                                    description: NetworkPolicyPort describes a port to allow traffic on
-                                    properties:
-                                      endPort:
-                                        description: endPort indicates that the range of ports from port to endPort if set, inclusive, should be allowed by the policy. This field cannot be defined if the port field is not defined or if the port field is defined as a named (string) port. The endPort must be equal or greater than port.
-                                        format: int32
-                                        type: integer
-                                      port:
-                                        anyOf:
-                                          - type: integer
-                                          - type: string
-                                        description: port represents the port on the given protocol. This can either be a numerical or named port on a pod. If this field is not provided, this matches all port names and numbers. If present, only traffic on the specified protocol AND port will be matched.
-                                        x-kubernetes-int-or-string: true
-                                      protocol:
-                                        default: TCP
-                                        description: protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. If not specified, this field defaults to TCP.
-                                        type: string
-                                    type: object
-                                  type: array
-                                to:
-                                  description: to is a list of destinations for outgoing traffic of pods selected for this rule. Items in this list are combined using a logical OR operation. If this field is empty or missing, this rule matches all destinations (traffic not restricted by destination). If this field is present and contains at least one item, this rule allows traffic only if the traffic matches at least one item in the to list.
-                                  items:
-                                    description: NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of fields are allowed
-                                    properties:
-                                      ipBlock:
-                                        description: ipBlock defines policy on a particular IPBlock. If this field is set then neither of the other fields can be.
-                                        properties:
-                                          cidr:
-                                            description: cidr is a string representing the IPBlock Valid examples are "192.168.1.0/24" or "2001:db8::/64"
-                                            type: string
-                                          except:
-                                            description: except is a slice of CIDRs that should not be included within an IPBlock Valid examples are "192.168.1.0/24" or "2001:db8::/64" Except values will be rejected if they are outside the cidr range
-                                            items:
-                                              type: string
-                                            type: array
-                                        required:
-                                          - cidr
-                                        type: object
-                                      namespaceSelector:
-                                        description: "namespaceSelector selects namespaces using cluster-scoped labels. This field follows standard label selector semantics; if present but empty, it selects all namespaces. \n If podSelector is also set, then the NetworkPolicyPeer as a whole selects the pods matching podSelector in the namespaces selected by namespaceSelector. Otherwise it selects all pods in the namespaces selected by namespaceSelector."
-                                        properties:
-                                          matchExpressions:
-                                            description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                            items:
-                                              description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.
-                                              properties:
-                                                key:
-                                                  description: key is the label key that the selector applies to.
-                                                  type: string
-                                                operator:
-                                                  description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                  type: string
-                                                values:
-                                                  description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
-                                                  items:
-                                                    type: string
-                                                  type: array
-                                              required:
-                                                - key
-                                                - operator
-                                              type: object
-                                            type: array
-                                          matchLabels:
-                                            additionalProperties:
-                                              type: string
-                                            description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                            type: object
-                                        type: object
-                                        x-kubernetes-map-type: atomic
-                                      podSelector:
-                                        description: "podSelector is a label selector which selects pods. This field follows standard label selector semantics; if present but empty, it selects all pods. \n If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects the pods matching podSelector in the Namespaces selected by NamespaceSelector. Otherwise it selects the pods matching podSelector in the policy's own namespace."
-                                        properties:
-                                          matchExpressions:
-                                            description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                            items:
-                                              description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.
-                                              properties:
-                                                key:
-                                                  description: key is the label key that the selector applies to.
-                                                  type: string
-                                                operator:
-                                                  description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                  type: string
-                                                values:
-                                                  description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
-                                                  items:
-                                                    type: string
-                                                  type: array
-                                              required:
-                                                - key
-                                                - operator
-                                              type: object
-                                            type: array
-                                          matchLabels:
-                                            additionalProperties:
-                                              type: string
-                                            description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                            type: object
-                                        type: object
-                                        x-kubernetes-map-type: atomic
-                                    type: object
-                                  type: array
-                              type: object
-                            type: array
-                          ingress:
-                            description: ingress is a list of ingress rules to be applied to the selected pods. Traffic is allowed to a pod if there are no NetworkPolicies selecting the pod (and cluster policy otherwise allows the traffic), OR if the traffic source is the pod's local node, OR if the traffic matches at least one ingress rule across all of the NetworkPolicy objects whose podSelector matches the pod. If this field is empty then this NetworkPolicy does not allow any traffic (and serves solely to ensure that the pods it selects are isolated by default)
-                            items:
-                              description: NetworkPolicyIngressRule describes a particular set of traffic that is allowed to the pods matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and from.
-                              properties:
-                                from:
-                                  description: from is a list of sources which should be able to access the pods selected for this rule. Items in this list are combined using a logical OR operation. If this field is empty or missing, this rule matches all sources (traffic not restricted by source). If this field is present and contains at least one item, this rule allows traffic only if the traffic matches at least one item in the from list.
-                                  items:
-                                    description: NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of fields are allowed
-                                    properties:
-                                      ipBlock:
-                                        description: ipBlock defines policy on a particular IPBlock. If this field is set then neither of the other fields can be.
-                                        properties:
-                                          cidr:
-                                            description: cidr is a string representing the IPBlock Valid examples are "192.168.1.0/24" or "2001:db8::/64"
-                                            type: string
-                                          except:
-                                            description: except is a slice of CIDRs that should not be included within an IPBlock Valid examples are "192.168.1.0/24" or "2001:db8::/64" Except values will be rejected if they are outside the cidr range
-                                            items:
-                                              type: string
-                                            type: array
-                                        required:
-                                          - cidr
-                                        type: object
-                                      namespaceSelector:
-                                        description: "namespaceSelector selects namespaces using cluster-scoped labels. This field follows standard label selector semantics; if present but empty, it selects all namespaces. \n If podSelector is also set, then the NetworkPolicyPeer as a whole selects the pods matching podSelector in the namespaces selected by namespaceSelector. Otherwise it selects all pods in the namespaces selected by namespaceSelector."
-                                        properties:
-                                          matchExpressions:
-                                            description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                            items:
-                                              description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.
-                                              properties:
-                                                key:
-                                                  description: key is the label key that the selector applies to.
-                                                  type: string
-                                                operator:
-                                                  description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                  type: string
-                                                values:
-                                                  description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
-                                                  items:
-                                                    type: string
-                                                  type: array
-                                              required:
-                                                - key
-                                                - operator
-                                              type: object
-                                            type: array
-                                          matchLabels:
-                                            additionalProperties:
-                                              type: string
-                                            description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                            type: object
-                                        type: object
-                                        x-kubernetes-map-type: atomic
-                                      podSelector:
-                                        description: "podSelector is a label selector which selects pods. This field follows standard label selector semantics; if present but empty, it selects all pods. \n If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects the pods matching podSelector in the Namespaces selected by NamespaceSelector. Otherwise it selects the pods matching podSelector in the policy's own namespace."
-                                        properties:
-                                          matchExpressions:
-                                            description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                            items:
-                                              description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.
-                                              properties:
-                                                key:
-                                                  description: key is the label key that the selector applies to.
-                                                  type: string
-                                                operator:
-                                                  description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
-                                                  type: string
-                                                values:
-                                                  description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
-                                                  items:
-                                                    type: string
-                                                  type: array
-                                              required:
-                                                - key
-                                                - operator
-                                              type: object
-                                            type: array
-                                          matchLabels:
-                                            additionalProperties:
-                                              type: string
-                                            description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                            type: object
-                                        type: object
-                                        x-kubernetes-map-type: atomic
-                                    type: object
-                                  type: array
-                                ports:
-                                  description: ports is a list of ports which should be made accessible on the pods selected for this rule. Each item in this list is combined using a logical OR. If this field is empty or missing, this rule matches all ports (traffic not restricted by port). If this field is present and contains at least one item, then this rule allows traffic only if the traffic matches at least one port in the list.
-                                  items:
-                                    description: NetworkPolicyPort describes a port to allow traffic on
-                                    properties:
-                                      endPort:
-                                        description: endPort indicates that the range of ports from port to endPort if set, inclusive, should be allowed by the policy. This field cannot be defined if the port field is not defined or if the port field is defined as a named (string) port. The endPort must be equal or greater than port.
-                                        format: int32
-                                        type: integer
-                                      port:
-                                        anyOf:
-                                          - type: integer
-                                          - type: string
-                                        description: port represents the port on the given protocol. This can either be a numerical or named port on a pod. If this field is not provided, this matches all port names and numbers. If present, only traffic on the specified protocol AND port will be matched.
-                                        x-kubernetes-int-or-string: true
-                                      protocol:
-                                        default: TCP
-                                        description: protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. If not specified, this field defaults to TCP.
-                                        type: string
-                                    type: object
-                                  type: array
-                              type: object
-                            type: array
-                          podSelector:
-                            description: podSelector selects the pods to which this NetworkPolicy object applies. The array of ingress rules is applied to any pods selected by this field. Multiple network policies can select the same set of pods. In this case, the ingress rules for each are combined additively. This field is NOT optional and follows standard label selector semantics. An empty podSelector matches all pods in this namespace.
-                            properties:
-                              matchExpressions:
-                                description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                items:
-                                  description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.
-                                  properties:
-                                    key:
-                                      description: key is the label key that the selector applies to.
-                                      type: string
-                                    operator:
-                                      description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
-                                      type: string
-                                    values:
-                                      description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
-                                      items:
-                                        type: string
-                                      type: array
-                                  required:
-                                    - key
-                                    - operator
-                                  type: object
-                                type: array
-                              matchLabels:
-                                additionalProperties:
-                                  type: string
-                                description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                type: object
-                            type: object
-                            x-kubernetes-map-type: atomic
-                          policyTypes:
-                            description: policyTypes is a list of rule types that the NetworkPolicy relates to. Valid options are ["Ingress"], ["Egress"], or ["Ingress", "Egress"]. If this field is not specified, it will default based on the existence of ingress or egress rules; policies that contain an egress section are assumed to affect egress, and all policies (whether or not they contain an ingress section) are assumed to affect ingress. If you want to write an egress-only policy, you must explicitly specify policyTypes [ "Egress" ]. Likewise, if you want to write a policy that specifies that no egress is allowed, you must specify a policyTypes value that include "Egress" (since such a policy would not include an egress section and would otherwise default to just [ "Ingress" ]). This field is beta-level in 1.8
-                            items:
-                              description: PolicyType string describes the NetworkPolicy type This type is beta-level in 1.8
-                              type: string
-                            type: array
-                        required:
-                          - podSelector
-                        type: object
-                      type: array
-                  type: object
-                nodeSelector:
-                  additionalProperties:
-                    type: string
-                  description: Specifies the label to control the placement of pods on a given pool of worker nodes. All namespaces created within the Tenant will have the node selector annotation. This annotation tells the Kubernetes scheduler to place pods on the nodes having the selector label. Optional.
-                  type: object
-                owners:
-                  description: Specifies the owners of the Tenant. Mandatory.
-                  items:
-                    properties:
-                      clusterRoles:
-                        default:
-                          - admin
-                          - capsule-namespace-deleter
-                        description: Defines additional cluster-roles for the specific Owner.
-                        items:
-                          type: string
-                        type: array
-                      kind:
-                        description: Kind of tenant owner. Possible values are "User", "Group", and "ServiceAccount"
-                        enum:
-                          - User
-                          - Group
-                          - ServiceAccount
-                        type: string
-                      name:
-                        description: Name of tenant owner.
-                        type: string
-                      proxySettings:
-                        description: Proxy settings for tenant owner.
-                        items:
-                          properties:
-                            kind:
-                              enum:
-                                - Nodes
-                                - StorageClasses
-                                - IngressClasses
-                                - PriorityClasses
-                                - RuntimeClasses
-                                - PersistentVolumes
-                              type: string
-                            operations:
-                              items:
-                                enum:
-                                  - List
-                                  - Update
-                                  - Delete
-                                type: string
-                              type: array
-                          required:
-                            - kind
-                            - operations
-                          type: object
-                        type: array
-                    required:
-                      - kind
-                      - name
-                    type: object
-                  type: array
-                preventDeletion:
-                  description: Prevent accidental deletion of the Tenant. When enabled, the deletion request will be declined.
-                  type: boolean
-                priorityClasses:
-                  description: Specifies the allowed priorityClasses assigned to the Tenant. Capsule assures that all Pods resources created in the Tenant can use only one of the allowed PriorityClasses. A default value can be specified, and all the Pod resources created will inherit the declared class. Optional.
-                  properties:
-                    allowed:
-                      items:
-                        type: string
-                      type: array
-                    allowedRegex:
-                      type: string
-                    default:
-                      type: string
-                    matchExpressions:
-                      description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                      items:
-                        description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.
-                        properties:
-                          key:
-                            description: key is the label key that the selector applies to.
-                            type: string
-                          operator:
-                            description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
-                            type: string
-                          values:
-                            description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
-                            items:
-                              type: string
-                            type: array
-                        required:
-                          - key
-                          - operator
-                        type: object
-                      type: array
-                    matchLabels:
-                      additionalProperties:
-                        type: string
-                      description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
-                      type: object
-                  type: object
-                  x-kubernetes-map-type: atomic
-                resourceQuotas:
-                  description: Specifies a list of ResourceQuota resources assigned to the Tenant. The assigned values are inherited by any namespace created in the Tenant. The Capsule operator aggregates ResourceQuota at Tenant level, so that the hard quota is never crossed for the given Tenant. This permits the Tenant owner to consume resources in the Tenant regardless of the namespace. Optional.
-                  properties:
-                    items:
-                      items:
-                        description: ResourceQuotaSpec defines the desired hard limits to enforce for Quota.
-                        properties:
-                          hard:
-                            additionalProperties:
-                              anyOf:
-                                - type: integer
-                                - type: string
-                              pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                              x-kubernetes-int-or-string: true
-                            description: 'hard is the set of desired hard limits for each named resource. More info: https://kubernetes.io/docs/concepts/policy/resource-quotas/'
-                            type: object
-                          scopeSelector:
-                            description: scopeSelector is also a collection of filters like scopes that must match each object tracked by a quota but expressed using ScopeSelectorOperator in combination with possible values. For a resource to match, both scopes AND scopeSelector (if specified in spec), must be matched.
-                            properties:
-                              matchExpressions:
-                                description: A list of scope selector requirements by scope of the resources.
-                                items:
-                                  description: A scoped-resource selector requirement is a selector that contains values, a scope name, and an operator that relates the scope name and values.
-                                  properties:
-                                    operator:
-                                      description: Represents a scope's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist.
-                                      type: string
-                                    scopeName:
-                                      description: The name of the scope that the selector applies to.
-                                      type: string
-                                    values:
-                                      description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
-                                      items:
-                                        type: string
-                                      type: array
-                                  required:
-                                    - operator
-                                    - scopeName
-                                  type: object
-                                type: array
-                            type: object
-                            x-kubernetes-map-type: atomic
-                          scopes:
-                            description: A collection of filters that must match each object tracked by a quota. If not specified, the quota matches all objects.
-                            items:
-                              description: A ResourceQuotaScope defines a filter that must match each object tracked by a quota
-                              type: string
-                            type: array
-                        type: object
-                      type: array
-                    scope:
-                      default: Tenant
-                      description: Define if the Resource Budget should compute resource across all Namespaces in the Tenant or individually per cluster. Default is Tenant
-                      enum:
-                        - Tenant
-                        - Namespace
-                      type: string
-                  type: object
-                runtimeClasses:
-                  description: Specifies the allowed RuntimeClasses assigned to the Tenant. Capsule assures that all Pods resources created in the Tenant can use only one of the allowed RuntimeClasses. Optional.
-                  properties:
-                    allowed:
-                      items:
-                        type: string
-                      type: array
-                    allowedRegex:
-                      type: string
-                    matchExpressions:
-                      description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                      items:
-                        description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.
-                        properties:
-                          key:
-                            description: key is the label key that the selector applies to.
-                            type: string
-                          operator:
-                            description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
-                            type: string
-                          values:
-                            description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
-                            items:
-                              type: string
-                            type: array
-                        required:
-                          - key
-                          - operator
-                        type: object
-                      type: array
-                    matchLabels:
-                      additionalProperties:
-                        type: string
-                      description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
-                      type: object
-                  type: object
-                  x-kubernetes-map-type: atomic
-                serviceOptions:
-                  description: Specifies options for the Service, such as additional metadata or block of certain type of Services. Optional.
-                  properties:
-                    additionalMetadata:
-                      description: Specifies additional labels and annotations the Capsule operator places on any Service resource in the Tenant. Optional.
-                      properties:
-                        annotations:
-                          additionalProperties:
-                            type: string
-                          type: object
-                        labels:
-                          additionalProperties:
-                            type: string
-                          type: object
-                      type: object
-                    allowedServices:
-                      description: Block or deny certain type of Services. Optional.
-                      properties:
-                        externalName:
-                          default: true
-                          description: Specifies if ExternalName service type resources are allowed for the Tenant. Default is true. Optional.
-                          type: boolean
-                        loadBalancer:
-                          default: true
-                          description: Specifies if LoadBalancer service type resources are allowed for the Tenant. Default is true. Optional.
-                          type: boolean
-                        nodePort:
-                          default: true
-                          description: Specifies if NodePort service type resources are allowed for the Tenant. Default is true. Optional.
-                          type: boolean
-                      type: object
-                    externalIPs:
-                      description: Specifies the external IPs that can be used in Services with type ClusterIP. An empty list means no IPs are allowed. Optional.
-                      properties:
-                        allowed:
-                          items:
-                            pattern: ^([0-9]{1,3}.){3}[0-9]{1,3}(/([0-9]|[1-2][0-9]|3[0-2]))?$
-                            type: string
-                          type: array
-                      required:
-                        - allowed
-                      type: object
-                  type: object
-                storageClasses:
-                  description: Specifies the allowed StorageClasses assigned to the Tenant. Capsule assures that all PersistentVolumeClaim resources created in the Tenant can use only one of the allowed StorageClasses. A default value can be specified, and all the PersistentVolumeClaim resources created will inherit the declared class. Optional.
-                  properties:
-                    allowed:
-                      items:
-                        type: string
-                      type: array
-                    allowedRegex:
-                      type: string
-                    default:
-                      type: string
-                    matchExpressions:
-                      description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                      items:
-                        description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.
-                        properties:
-                          key:
-                            description: key is the label key that the selector applies to.
-                            type: string
-                          operator:
-                            description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
-                            type: string
-                          values:
-                            description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
-                            items:
-                              type: string
-                            type: array
-                        required:
-                          - key
-                          - operator
-                        type: object
-                      type: array
-                    matchLabels:
-                      additionalProperties:
-                        type: string
-                      description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
-                      type: object
-                  type: object
-                  x-kubernetes-map-type: atomic
-              required:
-                - owners
-              type: object
-            status:
-              description: Returns the observed state of the Tenant.
-              properties:
-                namespaces:
-                  description: List of namespaces assigned to the Tenant.
-                  items:
-                    type: string
-                  type: array
-                size:
-                  description: How many namespaces are assigned to the Tenant.
-                  type: integer
-                state:
-                  default: Active
-                  description: The operational state of the Tenant. Possible values are "Active", "Cordoned".
-                  enum:
-                    - Cordoned
-                    - Active
-                  type: string
-              required:
-                - size
-                - state
-              type: object
-          type: object
-      served: true
-      storage: false
-      subresources:
-        status: {}
     - additionalPrinterColumns:
         - description: The actual state of the Tenant
           jsonPath: .status.state
@@ -1737,6 +883,22 @@ spec:
                       - name
                     type: object
                   type: array
+                podOptions:
+                  description: Specifies options for the Pod, such as additional metadata. Optional.
+                  properties:
+                    additionalMetadata:
+                      description: Specifies additional labels and annotations the Capsule operator places on any Service resource in the Tenant. Optional.
+                      properties:
+                        annotations:
+                          additionalProperties:
+                            type: string
+                          type: object
+                        labels:
+                          additionalProperties:
+                            type: string
+                          type: object
+                      type: object
+                  type: object
                 priorityClasses:
                   description: Specifies the allowed priorityClasses assigned to the
                     Tenant. Capsule assures that all Pods resources created in the Tenant
@@ -2869,6 +2031,22 @@ spec:
                       - name
                     type: object
                   type: array
+                podOptions:
+                  description: Specifies options for the Pod, such as additional metadata. Optional.
+                  properties:
+                    additionalMetadata:
+                      description: Specifies additional labels and annotations the Capsule operator places on any Service resource in the Tenant. Optional.
+                      properties:
+                        annotations:
+                          additionalProperties:
+                            type: string
+                          type: object
+                        labels:
+                          additionalProperties:
+                            type: string
+                          type: object
+                      type: object
+                  type: object
                 preventDeletion:
                   description: Prevent accidental deletion of the Tenant. When enabled,
                     the deletion request will be declined.
@@ -3085,6 +2263,28 @@ spec:
                             type: string
                           type: object
                       type: object
+                    forbiddenAnnotations:
+                      description: Define the annotations that a Tenant Owner cannot
+                        set for their Service resources.
+                      properties:
+                        denied:
+                          items:
+                            type: string
+                          type: array
+                        deniedRegex:
+                          type: string
+                      type: object
+                    forbiddenLabels:
+                      description: Define the labels that a Tenant Owner cannot set
+                        for their Service resources.
+                      properties:
+                        denied:
+                          items:
+                            type: string
+                          type: array
+                        deniedRegex:
+                          type: string
+                      type: object
                     allowedServices:
                       description: Block or deny certain type of Services. Optional.
                       properties:

charts/capsule/templates/rbac.yaml

@@ -1,61 +1,4 @@
-kind: ClusterRole
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: {{ include "capsule.fullname" . }}-proxy-role
-  labels:
-    {{- include "capsule.labels" . | nindent 4 }}
-  {{- with .Values.customAnnotations }}
-  annotations:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-rules:
-- apiGroups:
-  - authentication.k8s.io
-  resources:
-  - tokenreviews
-  verbs:
-  - create
-- apiGroups:
-  - authorization.k8s.io
-  resources:
-  - subjectaccessreviews
-  verbs:
-  - create
----
-kind: ClusterRole
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: {{ include "capsule.fullname" . }}-metrics-reader
-  labels:
-    {{- include "capsule.labels" . | nindent 4 }}
-  {{- with .Values.customAnnotations }}
-  annotations:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-rules:
-- nonResourceURLs:
-  - /metrics
-  verbs:
-  - get
----
-kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: {{ include "capsule.fullname" . }}-proxy-rolebinding
-  labels:
-    {{- include "capsule.labels" . | nindent 4 }}
-  {{- with .Values.customAnnotations }}
-  annotations:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: {{ include "capsule.fullname" . }}-proxy-role
-subjects:
-- kind: ServiceAccount
-  name: {{ include "capsule.serviceAccountName" . }}
-  namespace: {{ .Release.Namespace }}
+{{- if $.Values.manager.rbac.create }}
 ---
 kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
@@ -74,4 +17,47 @@ roleRef:
 subjects:
 - kind: ServiceAccount
   name: {{ include "capsule.serviceAccountName" . }}
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ .Release.Namespace }}
+{{- end }}
+{{- range $_, $cr := $.Values.manager.rbac.existingClusterRoles }}
+---
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ include "capsule.fullname" $ }}-{{ $cr }}
+  labels:
+    {{- include "capsule.labels" $ | nindent 4 }}
+  {{- with $.Values.customAnnotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ $cr }}
+subjects:
+- kind: ServiceAccount
+  name: {{ include "capsule.serviceAccountName" $ }}
+  namespace: {{ $.Release.Namespace }}
+{{- end }}
+{{- range $_, $nr := $.Values.manager.rbac.existingRoles }}
+---
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ include "capsule.fullname" $ }}-{{ $nr }}
+  labels:
+    {{- include "capsule.labels" $ | nindent 4 }}
+  {{- with $.Values.customAnnotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ $nr }}
+subjects:
+- kind: ServiceAccount
+  name: {{ include "capsule.serviceAccountName" $ }}
+  namespace: {{ $.Release.Namespace }}
+{{- end }}

charts/capsule/values.yaml

@@ -14,6 +14,17 @@ tls:
 # Manager Options
 manager:
 
+  # Manager RBAC
+  rbac:
+    # -- Specifies whether RBAC resources should be created.
+    create: true
+    # -- Specifies further cluster roles to be added to the Capsule manager service account.
+    existingClusterRoles: []
+    # - cluster-admin
+    # -- Specifies further cluster roles to be added to the Capsule manager service account.
+    existingRoles: []
+    # - namespace-admin
+
   # -- Set the controller deployment mode as `Deployment` or `DaemonSet`.
   kind: Deployment
 

config/crd/bases/capsule.clastix.io_capsuleconfigurations.yaml

@@ -15,49 +15,6 @@ spec:
     singular: capsuleconfiguration
   scope: Cluster
   versions:
-  - name: v1alpha1
-    schema:
-      openAPIV3Schema:
-        description: CapsuleConfiguration is the Schema for the Capsule configuration
-          API.
-        properties:
-          apiVersion:
-            description: 'APIVersion defines the versioned schema of this representation
-              of an object. Servers should convert recognized schemas to the latest
-              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
-            type: string
-          kind:
-            description: 'Kind is a string value representing the REST resource this
-              object represents. Servers may infer this from the endpoint the client
-              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
-            type: string
-          metadata:
-            type: object
-          spec:
-            description: CapsuleConfigurationSpec defines the Capsule configuration.
-            properties:
-              forceTenantPrefix:
-                default: false
-                description: Enforces the Tenant owner, during Namespace creation,
-                  to name it using the selected Tenant name as prefix, separated by
-                  a dash. This is useful to avoid Namespace name collision in a public
-                  CaaS environment.
-                type: boolean
-              protectedNamespaceRegex:
-                description: Disallow creation of namespaces, whose name matches this
-                  regexp
-                type: string
-              userGroups:
-                default:
-                - capsule.clastix.io
-                description: Names of the groups for Capsule users.
-                items:
-                  type: string
-                type: array
-            type: object
-        type: object
-    served: true
-    storage: false
   - name: v1beta2
     schema:
       openAPIV3Schema:

config/crd/bases/capsule.clastix.io_tenants.yaml

@@ -17,860 +17,6 @@ spec:
     singular: tenant
   scope: Cluster
   versions:
-  - additionalPrinterColumns:
-    - description: The max amount of Namespaces can be created
-      jsonPath: .spec.namespaceQuota
-      name: Namespace quota
-      type: integer
-    - description: The total amount of Namespaces in use
-      jsonPath: .status.size
-      name: Namespace count
-      type: integer
-    - description: The assigned Tenant owner
-      jsonPath: .spec.owner.name
-      name: Owner name
-      type: string
-    - description: The assigned Tenant owner kind
-      jsonPath: .spec.owner.kind
-      name: Owner kind
-      type: string
-    - description: Node Selector applied to Pods
-      jsonPath: .spec.nodeSelector
-      name: Node selector
-      type: string
-    - description: Age
-      jsonPath: .metadata.creationTimestamp
-      name: Age
-      type: date
-    deprecated: true
-    deprecationWarning: This version is going to be dropped in the upcoming version
-      of Capsule; please, migrate to v1beta2 version.
-    name: v1alpha1
-    schema:
-      openAPIV3Schema:
-        description: Tenant is the Schema for the tenants API.
-        properties:
-          apiVersion:
-            description: 'APIVersion defines the versioned schema of this representation
-              of an object. Servers should convert recognized schemas to the latest
-              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
-            type: string
-          kind:
-            description: 'Kind is a string value representing the REST resource this
-              object represents. Servers may infer this from the endpoint the client
-              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
-            type: string
-          metadata:
-            type: object
-          spec:
-            description: TenantSpec defines the desired state of Tenant.
-            properties:
-              additionalRoleBindings:
-                items:
-                  properties:
-                    clusterRoleName:
-                      type: string
-                    subjects:
-                      description: kubebuilder:validation:Minimum=1
-                      items:
-                        description: Subject contains a reference to the object or
-                          user identities a role binding applies to.  This can either
-                          hold a direct API object reference, or a value for non-objects
-                          such as user and group names.
-                        properties:
-                          apiGroup:
-                            description: APIGroup holds the API group of the referenced
-                              subject. Defaults to "" for ServiceAccount subjects.
-                              Defaults to "rbac.authorization.k8s.io" for User and
-                              Group subjects.
-                            type: string
-                          kind:
-                            description: Kind of object being referenced. Values defined
-                              by this API group are "User", "Group", and "ServiceAccount".
-                              If the Authorizer does not recognized the kind value,
-                              the Authorizer should report an error.
-                            type: string
-                          name:
-                            description: Name of the object being referenced.
-                            type: string
-                          namespace:
-                            description: Namespace of the referenced object.  If the
-                              object kind is non-namespace, such as "User" or "Group",
-                              and this value is not empty the Authorizer should report
-                              an error.
-                            type: string
-                        required:
-                        - kind
-                        - name
-                        type: object
-                        x-kubernetes-map-type: atomic
-                      type: array
-                  required:
-                  - clusterRoleName
-                  - subjects
-                  type: object
-                type: array
-              containerRegistries:
-                properties:
-                  allowed:
-                    items:
-                      type: string
-                    type: array
-                  allowedRegex:
-                    type: string
-                type: object
-              externalServiceIPs:
-                properties:
-                  allowed:
-                    items:
-                      pattern: ^([0-9]{1,3}.){3}[0-9]{1,3}(/([0-9]|[1-2][0-9]|3[0-2]))?$
-                      type: string
-                    type: array
-                required:
-                - allowed
-                type: object
-              ingressClasses:
-                properties:
-                  allowed:
-                    items:
-                      type: string
-                    type: array
-                  allowedRegex:
-                    type: string
-                type: object
-              ingressHostnames:
-                properties:
-                  allowed:
-                    items:
-                      type: string
-                    type: array
-                  allowedRegex:
-                    type: string
-                type: object
-              limitRanges:
-                items:
-                  description: LimitRangeSpec defines a min/max usage limit for resources
-                    that match on kind.
-                  properties:
-                    limits:
-                      description: Limits is the list of LimitRangeItem objects that
-                        are enforced.
-                      items:
-                        description: LimitRangeItem defines a min/max usage limit
-                          for any resource that matches on kind.
-                        properties:
-                          default:
-                            additionalProperties:
-                              anyOf:
-                              - type: integer
-                              - type: string
-                              pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                              x-kubernetes-int-or-string: true
-                            description: Default resource requirement limit value
-                              by resource name if resource limit is omitted.
-                            type: object
-                          defaultRequest:
-                            additionalProperties:
-                              anyOf:
-                              - type: integer
-                              - type: string
-                              pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                              x-kubernetes-int-or-string: true
-                            description: DefaultRequest is the default resource requirement
-                              request value by resource name if resource request is
-                              omitted.
-                            type: object
-                          max:
-                            additionalProperties:
-                              anyOf:
-                              - type: integer
-                              - type: string
-                              pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                              x-kubernetes-int-or-string: true
-                            description: Max usage constraints on this kind by resource
-                              name.
-                            type: object
-                          maxLimitRequestRatio:
-                            additionalProperties:
-                              anyOf:
-                              - type: integer
-                              - type: string
-                              pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                              x-kubernetes-int-or-string: true
-                            description: MaxLimitRequestRatio if specified, the named
-                              resource must have a request and limit that are both
-                              non-zero where limit divided by request is less than
-                              or equal to the enumerated value; this represents the
-                              max burst for the named resource.
-                            type: object
-                          min:
-                            additionalProperties:
-                              anyOf:
-                              - type: integer
-                              - type: string
-                              pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                              x-kubernetes-int-or-string: true
-                            description: Min usage constraints on this kind by resource
-                              name.
-                            type: object
-                          type:
-                            description: Type of resource that this limit applies
-                              to.
-                            type: string
-                        required:
-                        - type
-                        type: object
-                      type: array
-                  required:
-                  - limits
-                  type: object
-                type: array
-              namespaceQuota:
-                format: int32
-                minimum: 1
-                type: integer
-              namespacesMetadata:
-                properties:
-                  additionalAnnotations:
-                    additionalProperties:
-                      type: string
-                    type: object
-                  additionalLabels:
-                    additionalProperties:
-                      type: string
-                    type: object
-                type: object
-              networkPolicies:
-                items:
-                  description: NetworkPolicySpec provides the specification of a NetworkPolicy
-                  properties:
-                    egress:
-                      description: egress is a list of egress rules to be applied
-                        to the selected pods. Outgoing traffic is allowed if there
-                        are no NetworkPolicies selecting the pod (and cluster policy
-                        otherwise allows the traffic), OR if the traffic matches at
-                        least one egress rule across all of the NetworkPolicy objects
-                        whose podSelector matches the pod. If this field is empty
-                        then this NetworkPolicy limits all outgoing traffic (and serves
-                        solely to ensure that the pods it selects are isolated by
-                        default). This field is beta-level in 1.8
-                      items:
-                        description: NetworkPolicyEgressRule describes a particular
-                          set of traffic that is allowed out of pods matched by a
-                          NetworkPolicySpec's podSelector. The traffic must match
-                          both ports and to. This type is beta-level in 1.8
-                        properties:
-                          ports:
-                            description: ports is a list of destination ports for
-                              outgoing traffic. Each item in this list is combined
-                              using a logical OR. If this field is empty or missing,
-                              this rule matches all ports (traffic not restricted
-                              by port). If this field is present and contains at least
-                              one item, then this rule allows traffic only if the
-                              traffic matches at least one port in the list.
-                            items:
-                              description: NetworkPolicyPort describes a port to allow
-                                traffic on
-                              properties:
-                                endPort:
-                                  description: endPort indicates that the range of
-                                    ports from port to endPort if set, inclusive,
-                                    should be allowed by the policy. This field cannot
-                                    be defined if the port field is not defined or
-                                    if the port field is defined as a named (string)
-                                    port. The endPort must be equal or greater than
-                                    port.
-                                  format: int32
-                                  type: integer
-                                port:
-                                  anyOf:
-                                  - type: integer
-                                  - type: string
-                                  description: port represents the port on the given
-                                    protocol. This can either be a numerical or named
-                                    port on a pod. If this field is not provided,
-                                    this matches all port names and numbers. If present,
-                                    only traffic on the specified protocol AND port
-                                    will be matched.
-                                  x-kubernetes-int-or-string: true
-                                protocol:
-                                  default: TCP
-                                  description: protocol represents the protocol (TCP,
-                                    UDP, or SCTP) which traffic must match. If not
-                                    specified, this field defaults to TCP.
-                                  type: string
-                              type: object
-                            type: array
-                          to:
-                            description: to is a list of destinations for outgoing
-                              traffic of pods selected for this rule. Items in this
-                              list are combined using a logical OR operation. If this
-                              field is empty or missing, this rule matches all destinations
-                              (traffic not restricted by destination). If this field
-                              is present and contains at least one item, this rule
-                              allows traffic only if the traffic matches at least
-                              one item in the to list.
-                            items:
-                              description: NetworkPolicyPeer describes a peer to allow
-                                traffic to/from. Only certain combinations of fields
-                                are allowed
-                              properties:
-                                ipBlock:
-                                  description: ipBlock defines policy on a particular
-                                    IPBlock. If this field is set then neither of
-                                    the other fields can be.
-                                  properties:
-                                    cidr:
-                                      description: cidr is a string representing the
-                                        IPBlock Valid examples are "192.168.1.0/24"
-                                        or "2001:db8::/64"
-                                      type: string
-                                    except:
-                                      description: except is a slice of CIDRs that
-                                        should not be included within an IPBlock Valid
-                                        examples are "192.168.1.0/24" or "2001:db8::/64"
-                                        Except values will be rejected if they are
-                                        outside the cidr range
-                                      items:
-                                        type: string
-                                      type: array
-                                  required:
-                                  - cidr
-                                  type: object
-                                namespaceSelector:
-                                  description: "namespaceSelector selects namespaces
-                                    using cluster-scoped labels. This field follows
-                                    standard label selector semantics; if present
-                                    but empty, it selects all namespaces. \n If podSelector
-                                    is also set, then the NetworkPolicyPeer as a whole
-                                    selects the pods matching podSelector in the namespaces
-                                    selected by namespaceSelector. Otherwise it selects
-                                    all pods in the namespaces selected by namespaceSelector."
-                                  properties:
-                                    matchExpressions:
-                                      description: matchExpressions is a list of label
-                                        selector requirements. The requirements are
-                                        ANDed.
-                                      items:
-                                        description: A label selector requirement
-                                          is a selector that contains values, a key,
-                                          and an operator that relates the key and
-                                          values.
-                                        properties:
-                                          key:
-                                            description: key is the label key that
-                                              the selector applies to.
-                                            type: string
-                                          operator:
-                                            description: operator represents a key's
-                                              relationship to a set of values. Valid
-                                              operators are In, NotIn, Exists and
-                                              DoesNotExist.
-                                            type: string
-                                          values:
-                                            description: values is an array of string
-                                              values. If the operator is In or NotIn,
-                                              the values array must be non-empty.
-                                              If the operator is Exists or DoesNotExist,
-                                              the values array must be empty. This
-                                              array is replaced during a strategic
-                                              merge patch.
-                                            items:
-                                              type: string
-                                            type: array
-                                        required:
-                                        - key
-                                        - operator
-                                        type: object
-                                      type: array
-                                    matchLabels:
-                                      additionalProperties:
-                                        type: string
-                                      description: matchLabels is a map of {key,value}
-                                        pairs. A single {key,value} in the matchLabels
-                                        map is equivalent to an element of matchExpressions,
-                                        whose key field is "key", the operator is
-                                        "In", and the values array contains only "value".
-                                        The requirements are ANDed.
-                                      type: object
-                                  type: object
-                                  x-kubernetes-map-type: atomic
-                                podSelector:
-                                  description: "podSelector is a label selector which
-                                    selects pods. This field follows standard label
-                                    selector semantics; if present but empty, it selects
-                                    all pods. \n If namespaceSelector is also set,
-                                    then the NetworkPolicyPeer as a whole selects
-                                    the pods matching podSelector in the Namespaces
-                                    selected by NamespaceSelector. Otherwise it selects
-                                    the pods matching podSelector in the policy's
-                                    own namespace."
-                                  properties:
-                                    matchExpressions:
-                                      description: matchExpressions is a list of label
-                                        selector requirements. The requirements are
-                                        ANDed.
-                                      items:
-                                        description: A label selector requirement
-                                          is a selector that contains values, a key,
-                                          and an operator that relates the key and
-                                          values.
-                                        properties:
-                                          key:
-                                            description: key is the label key that
-                                              the selector applies to.
-                                            type: string
-                                          operator:
-                                            description: operator represents a key's
-                                              relationship to a set of values. Valid
-                                              operators are In, NotIn, Exists and
-                                              DoesNotExist.
-                                            type: string
-                                          values:
-                                            description: values is an array of string
-                                              values. If the operator is In or NotIn,
-                                              the values array must be non-empty.
-                                              If the operator is Exists or DoesNotExist,
-                                              the values array must be empty. This
-                                              array is replaced during a strategic
-                                              merge patch.
-                                            items:
-                                              type: string
-                                            type: array
-                                        required:
-                                        - key
-                                        - operator
-                                        type: object
-                                      type: array
-                                    matchLabels:
-                                      additionalProperties:
-                                        type: string
-                                      description: matchLabels is a map of {key,value}
-                                        pairs. A single {key,value} in the matchLabels
-                                        map is equivalent to an element of matchExpressions,
-                                        whose key field is "key", the operator is
-                                        "In", and the values array contains only "value".
-                                        The requirements are ANDed.
-                                      type: object
-                                  type: object
-                                  x-kubernetes-map-type: atomic
-                              type: object
-                            type: array
-                        type: object
-                      type: array
-                    ingress:
-                      description: ingress is a list of ingress rules to be applied
-                        to the selected pods. Traffic is allowed to a pod if there
-                        are no NetworkPolicies selecting the pod (and cluster policy
-                        otherwise allows the traffic), OR if the traffic source is
-                        the pod's local node, OR if the traffic matches at least one
-                        ingress rule across all of the NetworkPolicy objects whose
-                        podSelector matches the pod. If this field is empty then this
-                        NetworkPolicy does not allow any traffic (and serves solely
-                        to ensure that the pods it selects are isolated by default)
-                      items:
-                        description: NetworkPolicyIngressRule describes a particular
-                          set of traffic that is allowed to the pods matched by a
-                          NetworkPolicySpec's podSelector. The traffic must match
-                          both ports and from.
-                        properties:
-                          from:
-                            description: from is a list of sources which should be
-                              able to access the pods selected for this rule. Items
-                              in this list are combined using a logical OR operation.
-                              If this field is empty or missing, this rule matches
-                              all sources (traffic not restricted by source). If this
-                              field is present and contains at least one item, this
-                              rule allows traffic only if the traffic matches at least
-                              one item in the from list.
-                            items:
-                              description: NetworkPolicyPeer describes a peer to allow
-                                traffic to/from. Only certain combinations of fields
-                                are allowed
-                              properties:
-                                ipBlock:
-                                  description: ipBlock defines policy on a particular
-                                    IPBlock. If this field is set then neither of
-                                    the other fields can be.
-                                  properties:
-                                    cidr:
-                                      description: cidr is a string representing the
-                                        IPBlock Valid examples are "192.168.1.0/24"
-                                        or "2001:db8::/64"
-                                      type: string
-                                    except:
-                                      description: except is a slice of CIDRs that
-                                        should not be included within an IPBlock Valid
-                                        examples are "192.168.1.0/24" or "2001:db8::/64"
-                                        Except values will be rejected if they are
-                                        outside the cidr range
-                                      items:
-                                        type: string
-                                      type: array
-                                  required:
-                                  - cidr
-                                  type: object
-                                namespaceSelector:
-                                  description: "namespaceSelector selects namespaces
-                                    using cluster-scoped labels. This field follows
-                                    standard label selector semantics; if present
-                                    but empty, it selects all namespaces. \n If podSelector
-                                    is also set, then the NetworkPolicyPeer as a whole
-                                    selects the pods matching podSelector in the namespaces
-                                    selected by namespaceSelector. Otherwise it selects
-                                    all pods in the namespaces selected by namespaceSelector."
-                                  properties:
-                                    matchExpressions:
-                                      description: matchExpressions is a list of label
-                                        selector requirements. The requirements are
-                                        ANDed.
-                                      items:
-                                        description: A label selector requirement
-                                          is a selector that contains values, a key,
-                                          and an operator that relates the key and
-                                          values.
-                                        properties:
-                                          key:
-                                            description: key is the label key that
-                                              the selector applies to.
-                                            type: string
-                                          operator:
-                                            description: operator represents a key's
-                                              relationship to a set of values. Valid
-                                              operators are In, NotIn, Exists and
-                                              DoesNotExist.
-                                            type: string
-                                          values:
-                                            description: values is an array of string
-                                              values. If the operator is In or NotIn,
-                                              the values array must be non-empty.
-                                              If the operator is Exists or DoesNotExist,
-                                              the values array must be empty. This
-                                              array is replaced during a strategic
-                                              merge patch.
-                                            items:
-                                              type: string
-                                            type: array
-                                        required:
-                                        - key
-                                        - operator
-                                        type: object
-                                      type: array
-                                    matchLabels:
-                                      additionalProperties:
-                                        type: string
-                                      description: matchLabels is a map of {key,value}
-                                        pairs. A single {key,value} in the matchLabels
-                                        map is equivalent to an element of matchExpressions,
-                                        whose key field is "key", the operator is
-                                        "In", and the values array contains only "value".
-                                        The requirements are ANDed.
-                                      type: object
-                                  type: object
-                                  x-kubernetes-map-type: atomic
-                                podSelector:
-                                  description: "podSelector is a label selector which
-                                    selects pods. This field follows standard label
-                                    selector semantics; if present but empty, it selects
-                                    all pods. \n If namespaceSelector is also set,
-                                    then the NetworkPolicyPeer as a whole selects
-                                    the pods matching podSelector in the Namespaces
-                                    selected by NamespaceSelector. Otherwise it selects
-                                    the pods matching podSelector in the policy's
-                                    own namespace."
-                                  properties:
-                                    matchExpressions:
-                                      description: matchExpressions is a list of label
-                                        selector requirements. The requirements are
-                                        ANDed.
-                                      items:
-                                        description: A label selector requirement
-                                          is a selector that contains values, a key,
-                                          and an operator that relates the key and
-                                          values.
-                                        properties:
-                                          key:
-                                            description: key is the label key that
-                                              the selector applies to.
-                                            type: string
-                                          operator:
-                                            description: operator represents a key's
-                                              relationship to a set of values. Valid
-                                              operators are In, NotIn, Exists and
-                                              DoesNotExist.
-                                            type: string
-                                          values:
-                                            description: values is an array of string
-                                              values. If the operator is In or NotIn,
-                                              the values array must be non-empty.
-                                              If the operator is Exists or DoesNotExist,
-                                              the values array must be empty. This
-                                              array is replaced during a strategic
-                                              merge patch.
-                                            items:
-                                              type: string
-                                            type: array
-                                        required:
-                                        - key
-                                        - operator
-                                        type: object
-                                      type: array
-                                    matchLabels:
-                                      additionalProperties:
-                                        type: string
-                                      description: matchLabels is a map of {key,value}
-                                        pairs. A single {key,value} in the matchLabels
-                                        map is equivalent to an element of matchExpressions,
-                                        whose key field is "key", the operator is
-                                        "In", and the values array contains only "value".
-                                        The requirements are ANDed.
-                                      type: object
-                                  type: object
-                                  x-kubernetes-map-type: atomic
-                              type: object
-                            type: array
-                          ports:
-                            description: ports is a list of ports which should be
-                              made accessible on the pods selected for this rule.
-                              Each item in this list is combined using a logical OR.
-                              If this field is empty or missing, this rule matches
-                              all ports (traffic not restricted by port). If this
-                              field is present and contains at least one item, then
-                              this rule allows traffic only if the traffic matches
-                              at least one port in the list.
-                            items:
-                              description: NetworkPolicyPort describes a port to allow
-                                traffic on
-                              properties:
-                                endPort:
-                                  description: endPort indicates that the range of
-                                    ports from port to endPort if set, inclusive,
-                                    should be allowed by the policy. This field cannot
-                                    be defined if the port field is not defined or
-                                    if the port field is defined as a named (string)
-                                    port. The endPort must be equal or greater than
-                                    port.
-                                  format: int32
-                                  type: integer
-                                port:
-                                  anyOf:
-                                  - type: integer
-                                  - type: string
-                                  description: port represents the port on the given
-                                    protocol. This can either be a numerical or named
-                                    port on a pod. If this field is not provided,
-                                    this matches all port names and numbers. If present,
-                                    only traffic on the specified protocol AND port
-                                    will be matched.
-                                  x-kubernetes-int-or-string: true
-                                protocol:
-                                  default: TCP
-                                  description: protocol represents the protocol (TCP,
-                                    UDP, or SCTP) which traffic must match. If not
-                                    specified, this field defaults to TCP.
-                                  type: string
-                              type: object
-                            type: array
-                        type: object
-                      type: array
-                    podSelector:
-                      description: podSelector selects the pods to which this NetworkPolicy
-                        object applies. The array of ingress rules is applied to any
-                        pods selected by this field. Multiple network policies can
-                        select the same set of pods. In this case, the ingress rules
-                        for each are combined additively. This field is NOT optional
-                        and follows standard label selector semantics. An empty podSelector
-                        matches all pods in this namespace.
-                      properties:
-                        matchExpressions:
-                          description: matchExpressions is a list of label selector
-                            requirements. The requirements are ANDed.
-                          items:
-                            description: A label selector requirement is a selector
-                              that contains values, a key, and an operator that relates
-                              the key and values.
-                            properties:
-                              key:
-                                description: key is the label key that the selector
-                                  applies to.
-                                type: string
-                              operator:
-                                description: operator represents a key's relationship
-                                  to a set of values. Valid operators are In, NotIn,
-                                  Exists and DoesNotExist.
-                                type: string
-                              values:
-                                description: values is an array of string values.
-                                  If the operator is In or NotIn, the values array
-                                  must be non-empty. If the operator is Exists or
-                                  DoesNotExist, the values array must be empty. This
-                                  array is replaced during a strategic merge patch.
-                                items:
-                                  type: string
-                                type: array
-                            required:
-                            - key
-                            - operator
-                            type: object
-                          type: array
-                        matchLabels:
-                          additionalProperties:
-                            type: string
-                          description: matchLabels is a map of {key,value} pairs.
-                            A single {key,value} in the matchLabels map is equivalent
-                            to an element of matchExpressions, whose key field is
-                            "key", the operator is "In", and the values array contains
-                            only "value". The requirements are ANDed.
-                          type: object
-                      type: object
-                      x-kubernetes-map-type: atomic
-                    policyTypes:
-                      description: policyTypes is a list of rule types that the NetworkPolicy
-                        relates to. Valid options are ["Ingress"], ["Egress"], or
-                        ["Ingress", "Egress"]. If this field is not specified, it
-                        will default based on the existence of ingress or egress rules;
-                        policies that contain an egress section are assumed to affect
-                        egress, and all policies (whether or not they contain an ingress
-                        section) are assumed to affect ingress. If you want to write
-                        an egress-only policy, you must explicitly specify policyTypes
-                        [ "Egress" ]. Likewise, if you want to write a policy that
-                        specifies that no egress is allowed, you must specify a policyTypes
-                        value that include "Egress" (since such a policy would not
-                        include an egress section and would otherwise default to just
-                        [ "Ingress" ]). This field is beta-level in 1.8
-                      items:
-                        description: PolicyType string describes the NetworkPolicy
-                          type This type is beta-level in 1.8
-                        type: string
-                      type: array
-                  required:
-                  - podSelector
-                  type: object
-                type: array
-              nodeSelector:
-                additionalProperties:
-                  type: string
-                type: object
-              owner:
-                description: OwnerSpec defines tenant owner name and kind.
-                properties:
-                  kind:
-                    enum:
-                    - User
-                    - Group
-                    type: string
-                  name:
-                    type: string
-                required:
-                - kind
-                - name
-                type: object
-              resourceQuotas:
-                items:
-                  description: ResourceQuotaSpec defines the desired hard limits to
-                    enforce for Quota.
-                  properties:
-                    hard:
-                      additionalProperties:
-                        anyOf:
-                        - type: integer
-                        - type: string
-                        pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                        x-kubernetes-int-or-string: true
-                      description: 'hard is the set of desired hard limits for each
-                        named resource. More info: https://kubernetes.io/docs/concepts/policy/resource-quotas/'
-                      type: object
-                    scopeSelector:
-                      description: scopeSelector is also a collection of filters like
-                        scopes that must match each object tracked by a quota but
-                        expressed using ScopeSelectorOperator in combination with
-                        possible values. For a resource to match, both scopes AND
-                        scopeSelector (if specified in spec), must be matched.
-                      properties:
-                        matchExpressions:
-                          description: A list of scope selector requirements by scope
-                            of the resources.
-                          items:
-                            description: A scoped-resource selector requirement is
-                              a selector that contains values, a scope name, and an
-                              operator that relates the scope name and values.
-                            properties:
-                              operator:
-                                description: Represents a scope's relationship to
-                                  a set of values. Valid operators are In, NotIn,
-                                  Exists, DoesNotExist.
-                                type: string
-                              scopeName:
-                                description: The name of the scope that the selector
-                                  applies to.
-                                type: string
-                              values:
-                                description: An array of string values. If the operator
-                                  is In or NotIn, the values array must be non-empty.
-                                  If the operator is Exists or DoesNotExist, the values
-                                  array must be empty. This array is replaced during
-                                  a strategic merge patch.
-                                items:
-                                  type: string
-                                type: array
-                            required:
-                            - operator
-                            - scopeName
-                            type: object
-                          type: array
-                      type: object
-                      x-kubernetes-map-type: atomic
-                    scopes:
-                      description: A collection of filters that must match each object
-                        tracked by a quota. If not specified, the quota matches all
-                        objects.
-                      items:
-                        description: A ResourceQuotaScope defines a filter that must
-                          match each object tracked by a quota
-                        type: string
-                      type: array
-                  type: object
-                type: array
-              servicesMetadata:
-                properties:
-                  additionalAnnotations:
-                    additionalProperties:
-                      type: string
-                    type: object
-                  additionalLabels:
-                    additionalProperties:
-                      type: string
-                    type: object
-                type: object
-              storageClasses:
-                properties:
-                  allowed:
-                    items:
-                      type: string
-                    type: array
-                  allowedRegex:
-                    type: string
-                type: object
-            required:
-            - owner
-            type: object
-          status:
-            description: TenantStatus defines the observed state of Tenant.
-            properties:
-              namespaces:
-                items:
-                  type: string
-                type: array
-              size:
-                type: integer
-            required:
-            - size
-            type: object
-        type: object
-    served: true
-    storage: false
-    subresources:
-      status: {}
   - additionalPrinterColumns:
     - description: The actual state of the Tenant
       jsonPath: .status.state
@@ -1873,6 +1019,28 @@ spec:
                     required:
                     - allowed
                     type: object
+                  forbiddenAnnotations:
+                    description: Define the annotations that a Tenant Owner cannot
+                      set for their Service resources.
+                    properties:
+                      denied:
+                        items:
+                          type: string
+                        type: array
+                      deniedRegex:
+                        type: string
+                    type: object
+                  forbiddenLabels:
+                    description: Define the labels that a Tenant Owner cannot set
+                      for their Service resources.
+                    properties:
+                      denied:
+                        items:
+                          type: string
+                        type: array
+                      deniedRegex:
+                        type: string
+                    type: object
                 type: object
               storageClasses:
                 description: Specifies the allowed StorageClasses assigned to the
@@ -2859,6 +2027,24 @@ spec:
                   - name
                   type: object
                 type: array
+              podOptions:
+                description: Specifies options for the Pods deployed in the Tenant
+                  namespaces, such as additional metadata.
+                properties:
+                  additionalMetadata:
+                    description: Specifies additional labels and annotations the Capsule
+                      operator places on any Pod resource in the Tenant. Optional.
+                    properties:
+                      annotations:
+                        additionalProperties:
+                          type: string
+                        type: object
+                      labels:
+                        additionalProperties:
+                          type: string
+                        type: object
+                    type: object
+                type: object
               preventDeletion:
                 description: Prevent accidental deletion of the Tenant. When enabled,
                   the deletion request will be declined.
@@ -3107,6 +2293,28 @@ spec:
                     required:
                     - allowed
                     type: object
+                  forbiddenAnnotations:
+                    description: Define the annotations that a Tenant Owner cannot
+                      set for their Service resources.
+                    properties:
+                      denied:
+                        items:
+                          type: string
+                        type: array
+                      deniedRegex:
+                        type: string
+                    type: object
+                  forbiddenLabels:
+                    description: Define the labels that a Tenant Owner cannot set
+                      for their Service resources.
+                    properties:
+                      denied:
+                        items:
+                          type: string
+                        type: array
+                      deniedRegex:
+                        type: string
+                    type: object
                 type: object
               storageClasses:
                 description: Specifies the allowed StorageClasses assigned to the

config/crd/patches/webhook_in_capsuleconfiguration.yaml

@@ -13,6 +13,5 @@ spec:
           name: webhook-service
           path: /convert
       conversionReviewVersions:
-        - v1alpha1
         - v1beta1
         - v1beta2

config/crd/patches/webhook_in_tenants.yaml

@@ -13,6 +13,5 @@ spec:
           name: webhook-service
           path: /convert
       conversionReviewVersions:
-        - v1alpha1
         - v1beta1
         - v1beta2

config/install.yaml

@@ -21,7 +21,6 @@ spec:
           namespace: capsule-system
           path: /convert
       conversionReviewVersions:
-      - v1alpha1
       - v1beta1
       - v1beta2
   group: capsule.clastix.io
@@ -32,40 +31,6 @@ spec:
     singular: capsuleconfiguration
   scope: Cluster
   versions:
-  - name: v1alpha1
-    schema:
-      openAPIV3Schema:
-        description: CapsuleConfiguration is the Schema for the Capsule configuration API.
-        properties:
-          apiVersion:
-            description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
-            type: string
-          kind:
-            description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
-            type: string
-          metadata:
-            type: object
-          spec:
-            description: CapsuleConfigurationSpec defines the Capsule configuration.
-            properties:
-              forceTenantPrefix:
-                default: false
-                description: Enforces the Tenant owner, during Namespace creation, to name it using the selected Tenant name as prefix, separated by a dash. This is useful to avoid Namespace name collision in a public CaaS environment.
-                type: boolean
-              protectedNamespaceRegex:
-                description: Disallow creation of namespaces, whose name matches this regexp
-                type: string
-              userGroups:
-                default:
-                - capsule.clastix.io
-                description: Names of the groups for Capsule users.
-                items:
-                  type: string
-                type: array
-            type: object
-        type: object
-    served: true
-    storage: false
   - name: v1beta2
     schema:
       openAPIV3Schema:
@@ -579,7 +544,6 @@ spec:
           namespace: capsule-system
           path: /convert
       conversionReviewVersions:
-      - v1alpha1
       - v1beta1
       - v1beta2
   group: capsule.clastix.io
@@ -592,571 +556,6 @@ spec:
     singular: tenant
   scope: Cluster
   versions:
-  - additionalPrinterColumns:
-    - description: The max amount of Namespaces can be created
-      jsonPath: .spec.namespaceQuota
-      name: Namespace quota
-      type: integer
-    - description: The total amount of Namespaces in use
-      jsonPath: .status.size
-      name: Namespace count
-      type: integer
-    - description: The assigned Tenant owner
-      jsonPath: .spec.owner.name
-      name: Owner name
-      type: string
-    - description: The assigned Tenant owner kind
-      jsonPath: .spec.owner.kind
-      name: Owner kind
-      type: string
-    - description: Node Selector applied to Pods
-      jsonPath: .spec.nodeSelector
-      name: Node selector
-      type: string
-    - description: Age
-      jsonPath: .metadata.creationTimestamp
-      name: Age
-      type: date
-    deprecated: true
-    deprecationWarning: This version is going to be dropped in the upcoming version of Capsule; please, migrate to v1beta2 version.
-    name: v1alpha1
-    schema:
-      openAPIV3Schema:
-        description: Tenant is the Schema for the tenants API.
-        properties:
-          apiVersion:
-            description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
-            type: string
-          kind:
-            description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
-            type: string
-          metadata:
-            type: object
-          spec:
-            description: TenantSpec defines the desired state of Tenant.
-            properties:
-              additionalRoleBindings:
-                items:
-                  properties:
-                    clusterRoleName:
-                      type: string
-                    subjects:
-                      description: kubebuilder:validation:Minimum=1
-                      items:
-                        description: Subject contains a reference to the object or user identities a role binding applies to.  This can either hold a direct API object reference, or a value for non-objects such as user and group names.
-                        properties:
-                          apiGroup:
-                            description: APIGroup holds the API group of the referenced subject. Defaults to "" for ServiceAccount subjects. Defaults to "rbac.authorization.k8s.io" for User and Group subjects.
-                            type: string
-                          kind:
-                            description: Kind of object being referenced. Values defined by this API group are "User", "Group", and "ServiceAccount". If the Authorizer does not recognized the kind value, the Authorizer should report an error.
-                            type: string
-                          name:
-                            description: Name of the object being referenced.
-                            type: string
-                          namespace:
-                            description: Namespace of the referenced object.  If the object kind is non-namespace, such as "User" or "Group", and this value is not empty the Authorizer should report an error.
-                            type: string
-                        required:
-                        - kind
-                        - name
-                        type: object
-                        x-kubernetes-map-type: atomic
-                      type: array
-                  required:
-                  - clusterRoleName
-                  - subjects
-                  type: object
-                type: array
-              containerRegistries:
-                properties:
-                  allowed:
-                    items:
-                      type: string
-                    type: array
-                  allowedRegex:
-                    type: string
-                type: object
-              externalServiceIPs:
-                properties:
-                  allowed:
-                    items:
-                      pattern: ^([0-9]{1,3}.){3}[0-9]{1,3}(/([0-9]|[1-2][0-9]|3[0-2]))?$
-                      type: string
-                    type: array
-                required:
-                - allowed
-                type: object
-              ingressClasses:
-                properties:
-                  allowed:
-                    items:
-                      type: string
-                    type: array
-                  allowedRegex:
-                    type: string
-                type: object
-              ingressHostnames:
-                properties:
-                  allowed:
-                    items:
-                      type: string
-                    type: array
-                  allowedRegex:
-                    type: string
-                type: object
-              limitRanges:
-                items:
-                  description: LimitRangeSpec defines a min/max usage limit for resources that match on kind.
-                  properties:
-                    limits:
-                      description: Limits is the list of LimitRangeItem objects that are enforced.
-                      items:
-                        description: LimitRangeItem defines a min/max usage limit for any resource that matches on kind.
-                        properties:
-                          default:
-                            additionalProperties:
-                              anyOf:
-                              - type: integer
-                              - type: string
-                              pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                              x-kubernetes-int-or-string: true
-                            description: Default resource requirement limit value by resource name if resource limit is omitted.
-                            type: object
-                          defaultRequest:
-                            additionalProperties:
-                              anyOf:
-                              - type: integer
-                              - type: string
-                              pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                              x-kubernetes-int-or-string: true
-                            description: DefaultRequest is the default resource requirement request value by resource name if resource request is omitted.
-                            type: object
-                          max:
-                            additionalProperties:
-                              anyOf:
-                              - type: integer
-                              - type: string
-                              pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                              x-kubernetes-int-or-string: true
-                            description: Max usage constraints on this kind by resource name.
-                            type: object
-                          maxLimitRequestRatio:
-                            additionalProperties:
-                              anyOf:
-                              - type: integer
-                              - type: string
-                              pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                              x-kubernetes-int-or-string: true
-                            description: MaxLimitRequestRatio if specified, the named resource must have a request and limit that are both non-zero where limit divided by request is less than or equal to the enumerated value; this represents the max burst for the named resource.
-                            type: object
-                          min:
-                            additionalProperties:
-                              anyOf:
-                              - type: integer
-                              - type: string
-                              pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                              x-kubernetes-int-or-string: true
-                            description: Min usage constraints on this kind by resource name.
-                            type: object
-                          type:
-                            description: Type of resource that this limit applies to.
-                            type: string
-                        required:
-                        - type
-                        type: object
-                      type: array
-                  required:
-                  - limits
-                  type: object
-                type: array
-              namespaceQuota:
-                format: int32
-                minimum: 1
-                type: integer
-              namespacesMetadata:
-                properties:
-                  additionalAnnotations:
-                    additionalProperties:
-                      type: string
-                    type: object
-                  additionalLabels:
-                    additionalProperties:
-                      type: string
-                    type: object
-                type: object
-              networkPolicies:
-                items:
-                  description: NetworkPolicySpec provides the specification of a NetworkPolicy
-                  properties:
-                    egress:
-                      description: egress is a list of egress rules to be applied to the selected pods. Outgoing traffic is allowed if there are no NetworkPolicies selecting the pod (and cluster policy otherwise allows the traffic), OR if the traffic matches at least one egress rule across all of the NetworkPolicy objects whose podSelector matches the pod. If this field is empty then this NetworkPolicy limits all outgoing traffic (and serves solely to ensure that the pods it selects are isolated by default). This field is beta-level in 1.8
-                      items:
-                        description: NetworkPolicyEgressRule describes a particular set of traffic that is allowed out of pods matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and to. This type is beta-level in 1.8
-                        properties:
-                          ports:
-                            description: ports is a list of destination ports for outgoing traffic. Each item in this list is combined using a logical OR. If this field is empty or missing, this rule matches all ports (traffic not restricted by port). If this field is present and contains at least one item, then this rule allows traffic only if the traffic matches at least one port in the list.
-                            items:
-                              description: NetworkPolicyPort describes a port to allow traffic on
-                              properties:
-                                endPort:
-                                  description: endPort indicates that the range of ports from port to endPort if set, inclusive, should be allowed by the policy. This field cannot be defined if the port field is not defined or if the port field is defined as a named (string) port. The endPort must be equal or greater than port.
-                                  format: int32
-                                  type: integer
-                                port:
-                                  anyOf:
-                                  - type: integer
-                                  - type: string
-                                  description: port represents the port on the given protocol. This can either be a numerical or named port on a pod. If this field is not provided, this matches all port names and numbers. If present, only traffic on the specified protocol AND port will be matched.
-                                  x-kubernetes-int-or-string: true
-                                protocol:
-                                  default: TCP
-                                  description: protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. If not specified, this field defaults to TCP.
-                                  type: string
-                              type: object
-                            type: array
-                          to:
-                            description: to is a list of destinations for outgoing traffic of pods selected for this rule. Items in this list are combined using a logical OR operation. If this field is empty or missing, this rule matches all destinations (traffic not restricted by destination). If this field is present and contains at least one item, this rule allows traffic only if the traffic matches at least one item in the to list.
-                            items:
-                              description: NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of fields are allowed
-                              properties:
-                                ipBlock:
-                                  description: ipBlock defines policy on a particular IPBlock. If this field is set then neither of the other fields can be.
-                                  properties:
-                                    cidr:
-                                      description: cidr is a string representing the IPBlock Valid examples are "192.168.1.0/24" or "2001:db8::/64"
-                                      type: string
-                                    except:
-                                      description: except is a slice of CIDRs that should not be included within an IPBlock Valid examples are "192.168.1.0/24" or "2001:db8::/64" Except values will be rejected if they are outside the cidr range
-                                      items:
-                                        type: string
-                                      type: array
-                                  required:
-                                  - cidr
-                                  type: object
-                                namespaceSelector:
-                                  description: "namespaceSelector selects namespaces using cluster-scoped labels. This field follows standard label selector semantics; if present but empty, it selects all namespaces. \n If podSelector is also set, then the NetworkPolicyPeer as a whole selects the pods matching podSelector in the namespaces selected by namespaceSelector. Otherwise it selects all pods in the namespaces selected by namespaceSelector."
-                                  properties:
-                                    matchExpressions:
-                                      description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                      items:
-                                        description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.
-                                        properties:
-                                          key:
-                                            description: key is the label key that the selector applies to.
-                                            type: string
-                                          operator:
-                                            description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
-                                            type: string
-                                          values:
-                                            description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
-                                            items:
-                                              type: string
-                                            type: array
-                                        required:
-                                        - key
-                                        - operator
-                                        type: object
-                                      type: array
-                                    matchLabels:
-                                      additionalProperties:
-                                        type: string
-                                      description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                      type: object
-                                  type: object
-                                  x-kubernetes-map-type: atomic
-                                podSelector:
-                                  description: "podSelector is a label selector which selects pods. This field follows standard label selector semantics; if present but empty, it selects all pods. \n If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects the pods matching podSelector in the Namespaces selected by NamespaceSelector. Otherwise it selects the pods matching podSelector in the policy's own namespace."
-                                  properties:
-                                    matchExpressions:
-                                      description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                      items:
-                                        description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.
-                                        properties:
-                                          key:
-                                            description: key is the label key that the selector applies to.
-                                            type: string
-                                          operator:
-                                            description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
-                                            type: string
-                                          values:
-                                            description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
-                                            items:
-                                              type: string
-                                            type: array
-                                        required:
-                                        - key
-                                        - operator
-                                        type: object
-                                      type: array
-                                    matchLabels:
-                                      additionalProperties:
-                                        type: string
-                                      description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                      type: object
-                                  type: object
-                                  x-kubernetes-map-type: atomic
-                              type: object
-                            type: array
-                        type: object
-                      type: array
-                    ingress:
-                      description: ingress is a list of ingress rules to be applied to the selected pods. Traffic is allowed to a pod if there are no NetworkPolicies selecting the pod (and cluster policy otherwise allows the traffic), OR if the traffic source is the pod's local node, OR if the traffic matches at least one ingress rule across all of the NetworkPolicy objects whose podSelector matches the pod. If this field is empty then this NetworkPolicy does not allow any traffic (and serves solely to ensure that the pods it selects are isolated by default)
-                      items:
-                        description: NetworkPolicyIngressRule describes a particular set of traffic that is allowed to the pods matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and from.
-                        properties:
-                          from:
-                            description: from is a list of sources which should be able to access the pods selected for this rule. Items in this list are combined using a logical OR operation. If this field is empty or missing, this rule matches all sources (traffic not restricted by source). If this field is present and contains at least one item, this rule allows traffic only if the traffic matches at least one item in the from list.
-                            items:
-                              description: NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of fields are allowed
-                              properties:
-                                ipBlock:
-                                  description: ipBlock defines policy on a particular IPBlock. If this field is set then neither of the other fields can be.
-                                  properties:
-                                    cidr:
-                                      description: cidr is a string representing the IPBlock Valid examples are "192.168.1.0/24" or "2001:db8::/64"
-                                      type: string
-                                    except:
-                                      description: except is a slice of CIDRs that should not be included within an IPBlock Valid examples are "192.168.1.0/24" or "2001:db8::/64" Except values will be rejected if they are outside the cidr range
-                                      items:
-                                        type: string
-                                      type: array
-                                  required:
-                                  - cidr
-                                  type: object
-                                namespaceSelector:
-                                  description: "namespaceSelector selects namespaces using cluster-scoped labels. This field follows standard label selector semantics; if present but empty, it selects all namespaces. \n If podSelector is also set, then the NetworkPolicyPeer as a whole selects the pods matching podSelector in the namespaces selected by namespaceSelector. Otherwise it selects all pods in the namespaces selected by namespaceSelector."
-                                  properties:
-                                    matchExpressions:
-                                      description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                      items:
-                                        description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.
-                                        properties:
-                                          key:
-                                            description: key is the label key that the selector applies to.
-                                            type: string
-                                          operator:
-                                            description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
-                                            type: string
-                                          values:
-                                            description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
-                                            items:
-                                              type: string
-                                            type: array
-                                        required:
-                                        - key
-                                        - operator
-                                        type: object
-                                      type: array
-                                    matchLabels:
-                                      additionalProperties:
-                                        type: string
-                                      description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                      type: object
-                                  type: object
-                                  x-kubernetes-map-type: atomic
-                                podSelector:
-                                  description: "podSelector is a label selector which selects pods. This field follows standard label selector semantics; if present but empty, it selects all pods. \n If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects the pods matching podSelector in the Namespaces selected by NamespaceSelector. Otherwise it selects the pods matching podSelector in the policy's own namespace."
-                                  properties:
-                                    matchExpressions:
-                                      description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                                      items:
-                                        description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.
-                                        properties:
-                                          key:
-                                            description: key is the label key that the selector applies to.
-                                            type: string
-                                          operator:
-                                            description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
-                                            type: string
-                                          values:
-                                            description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
-                                            items:
-                                              type: string
-                                            type: array
-                                        required:
-                                        - key
-                                        - operator
-                                        type: object
-                                      type: array
-                                    matchLabels:
-                                      additionalProperties:
-                                        type: string
-                                      description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
-                                      type: object
-                                  type: object
-                                  x-kubernetes-map-type: atomic
-                              type: object
-                            type: array
-                          ports:
-                            description: ports is a list of ports which should be made accessible on the pods selected for this rule. Each item in this list is combined using a logical OR. If this field is empty or missing, this rule matches all ports (traffic not restricted by port). If this field is present and contains at least one item, then this rule allows traffic only if the traffic matches at least one port in the list.
-                            items:
-                              description: NetworkPolicyPort describes a port to allow traffic on
-                              properties:
-                                endPort:
-                                  description: endPort indicates that the range of ports from port to endPort if set, inclusive, should be allowed by the policy. This field cannot be defined if the port field is not defined or if the port field is defined as a named (string) port. The endPort must be equal or greater than port.
-                                  format: int32
-                                  type: integer
-                                port:
-                                  anyOf:
-                                  - type: integer
-                                  - type: string
-                                  description: port represents the port on the given protocol. This can either be a numerical or named port on a pod. If this field is not provided, this matches all port names and numbers. If present, only traffic on the specified protocol AND port will be matched.
-                                  x-kubernetes-int-or-string: true
-                                protocol:
-                                  default: TCP
-                                  description: protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. If not specified, this field defaults to TCP.
-                                  type: string
-                              type: object
-                            type: array
-                        type: object
-                      type: array
-                    podSelector:
-                      description: podSelector selects the pods to which this NetworkPolicy object applies. The array of ingress rules is applied to any pods selected by this field. Multiple network policies can select the same set of pods. In this case, the ingress rules for each are combined additively. This field is NOT optional and follows standard label selector semantics. An empty podSelector matches all pods in this namespace.
-                      properties:
-                        matchExpressions:
-                          description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
-                          items:
-                            description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.
-                            properties:
-                              key:
-                                description: key is the label key that the selector applies to.
-                                type: string
-                              operator:
-                                description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
-                                type: string
-                              values:
-                                description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
-                                items:
-                                  type: string
-                                type: array
-                            required:
-                            - key
-                            - operator
-                            type: object
-                          type: array
-                        matchLabels:
-                          additionalProperties:
-                            type: string
-                          description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
-                          type: object
-                      type: object
-                      x-kubernetes-map-type: atomic
-                    policyTypes:
-                      description: policyTypes is a list of rule types that the NetworkPolicy relates to. Valid options are ["Ingress"], ["Egress"], or ["Ingress", "Egress"]. If this field is not specified, it will default based on the existence of ingress or egress rules; policies that contain an egress section are assumed to affect egress, and all policies (whether or not they contain an ingress section) are assumed to affect ingress. If you want to write an egress-only policy, you must explicitly specify policyTypes [ "Egress" ]. Likewise, if you want to write a policy that specifies that no egress is allowed, you must specify a policyTypes value that include "Egress" (since such a policy would not include an egress section and would otherwise default to just [ "Ingress" ]). This field is beta-level in 1.8
-                      items:
-                        description: PolicyType string describes the NetworkPolicy type This type is beta-level in 1.8
-                        type: string
-                      type: array
-                  required:
-                  - podSelector
-                  type: object
-                type: array
-              nodeSelector:
-                additionalProperties:
-                  type: string
-                type: object
-              owner:
-                description: OwnerSpec defines tenant owner name and kind.
-                properties:
-                  kind:
-                    enum:
-                    - User
-                    - Group
-                    type: string
-                  name:
-                    type: string
-                required:
-                - kind
-                - name
-                type: object
-              resourceQuotas:
-                items:
-                  description: ResourceQuotaSpec defines the desired hard limits to enforce for Quota.
-                  properties:
-                    hard:
-                      additionalProperties:
-                        anyOf:
-                        - type: integer
-                        - type: string
-                        pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                        x-kubernetes-int-or-string: true
-                      description: 'hard is the set of desired hard limits for each named resource. More info: https://kubernetes.io/docs/concepts/policy/resource-quotas/'
-                      type: object
-                    scopeSelector:
-                      description: scopeSelector is also a collection of filters like scopes that must match each object tracked by a quota but expressed using ScopeSelectorOperator in combination with possible values. For a resource to match, both scopes AND scopeSelector (if specified in spec), must be matched.
-                      properties:
-                        matchExpressions:
-                          description: A list of scope selector requirements by scope of the resources.
-                          items:
-                            description: A scoped-resource selector requirement is a selector that contains values, a scope name, and an operator that relates the scope name and values.
-                            properties:
-                              operator:
-                                description: Represents a scope's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist.
-                                type: string
-                              scopeName:
-                                description: The name of the scope that the selector applies to.
-                                type: string
-                              values:
-                                description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
-                                items:
-                                  type: string
-                                type: array
-                            required:
-                            - operator
-                            - scopeName
-                            type: object
-                          type: array
-                      type: object
-                      x-kubernetes-map-type: atomic
-                    scopes:
-                      description: A collection of filters that must match each object tracked by a quota. If not specified, the quota matches all objects.
-                      items:
-                        description: A ResourceQuotaScope defines a filter that must match each object tracked by a quota
-                        type: string
-                      type: array
-                  type: object
-                type: array
-              servicesMetadata:
-                properties:
-                  additionalAnnotations:
-                    additionalProperties:
-                      type: string
-                    type: object
-                  additionalLabels:
-                    additionalProperties:
-                      type: string
-                    type: object
-                type: object
-              storageClasses:
-                properties:
-                  allowed:
-                    items:
-                      type: string
-                    type: array
-                  allowedRegex:
-                    type: string
-                type: object
-            required:
-            - owner
-            type: object
-          status:
-            description: TenantStatus defines the observed state of Tenant.
-            properties:
-              namespaces:
-                items:
-                  type: string
-                type: array
-              size:
-                type: integer
-            required:
-            - size
-            type: object
-        type: object
-    served: true
-    storage: false
-    subresources:
-      status: {}
   - additionalPrinterColumns:
     - description: The actual state of the Tenant
       jsonPath: .status.state
@@ -1799,6 +1198,26 @@ spec:
                     required:
                     - allowed
                     type: object
+                  forbiddenAnnotations:
+                    description: Define the annotations that a Tenant Owner cannot set for their Service resources.
+                    properties:
+                      denied:
+                        items:
+                          type: string
+                        type: array
+                      deniedRegex:
+                        type: string
+                    type: object
+                  forbiddenLabels:
+                    description: Define the labels that a Tenant Owner cannot set for their Service resources.
+                    properties:
+                      denied:
+                        items:
+                          type: string
+                        type: array
+                      deniedRegex:
+                        type: string
+                    type: object
                 type: object
               storageClasses:
                 description: Specifies the allowed StorageClasses assigned to the Tenant. Capsule assures that all PersistentVolumeClaim resources created in the Tenant can use only one of the allowed StorageClasses. Optional.
@@ -2437,6 +1856,22 @@ spec:
                   - name
                   type: object
                 type: array
+              podOptions:
+                description: Specifies options for the Pods deployed in the Tenant namespaces, such as additional metadata.
+                properties:
+                  additionalMetadata:
+                    description: Specifies additional labels and annotations the Capsule operator places on any Pod resource in the Tenant. Optional.
+                    properties:
+                      annotations:
+                        additionalProperties:
+                          type: string
+                        type: object
+                      labels:
+                        additionalProperties:
+                          type: string
+                        type: object
+                    type: object
+                type: object
               preventDeletion:
                 description: Prevent accidental deletion of the Tenant. When enabled, the deletion request will be declined.
                 type: boolean
@@ -2616,6 +2051,26 @@ spec:
                     required:
                     - allowed
                     type: object
+                  forbiddenAnnotations:
+                    description: Define the annotations that a Tenant Owner cannot set for their Service resources.
+                    properties:
+                      denied:
+                        items:
+                          type: string
+                        type: array
+                      deniedRegex:
+                        type: string
+                    type: object
+                  forbiddenLabels:
+                    description: Define the labels that a Tenant Owner cannot set for their Service resources.
+                    properties:
+                      denied:
+                        items:
+                          type: string
+                        type: array
+                      deniedRegex:
+                        type: string
+                    type: object
                 type: object
               storageClasses:
                 description: Specifies the allowed StorageClasses assigned to the Tenant. Capsule assures that all PersistentVolumeClaim resources created in the Tenant can use only one of the allowed StorageClasses. A default value can be specified, and all the PersistentVolumeClaim resources created will inherit the declared class. Optional.

config/samples/capsule_v1alpha1_capsuleconfiguration.yaml

@@ -1,9 +0,0 @@
----
-apiVersion: capsule.clastix.io/v1alpha1
-kind: CapsuleConfiguration
-metadata:
-  name: default
-spec:
-  userGroups: ["capsule.clastix.io"]
-  forceTenantPrefix: false
-  protectedNamespaceRegex: ""

config/samples/capsule_v1alpha1_tenant.yaml

@@ -1,101 +0,0 @@
----
-apiVersion: capsule.clastix.io/v1alpha1
-kind: Tenant
-metadata:
-  name: oil
-spec:
-  ingressHostnames:
-    allowed:
-      - my.oil.acmecorp.com
-      - my.gas.acmecorp.com
-    allowedRegex: "^.*acmecorp.com$"
-  ingressClasses:
-    allowed:
-      - default
-    allowedRegex: ""
-  limitRanges:
-    -
-      limits:
-        -
-          max:
-            cpu: "1"
-            memory: 1Gi
-          min:
-            cpu: 50m
-            memory: 5Mi
-          type: Pod
-        -
-          default:
-            cpu: 200m
-            memory: 100Mi
-          defaultRequest:
-            cpu: 100m
-            memory: 10Mi
-          max:
-            cpu: "1"
-            memory: 1Gi
-          min:
-            cpu: 50m
-            memory: 5Mi
-          type: Container
-        -
-          max:
-            storage: 10Gi
-          min:
-            storage: 1Gi
-          type: PersistentVolumeClaim
-  namespaceQuota: 3
-  networkPolicies:
-    -
-      egress:
-        -
-          to:
-            -
-              ipBlock:
-                cidr: 0.0.0.0/0
-                except:
-                  - 192.168.0.0/12
-      ingress:
-        -
-          from:
-            -
-              namespaceSelector:
-                matchLabels:
-                  capsule.clastix.io/tenant: oil
-            -
-              podSelector: {}
-            -
-              ipBlock:
-                cidr: 192.168.0.0/12
-      podSelector: {}
-      policyTypes:
-        - Ingress
-        - Egress
-  nodeSelector:
-    kubernetes.io/os: linux
-  owner:
-    kind: User
-    name: alice
-  resourceQuotas:
-    -
-      hard:
-        limits.cpu: "8"
-        limits.memory: 16Gi
-        requests.cpu: "8"
-        requests.memory: 16Gi
-      scopes:
-        - NotTerminating
-    -
-      hard:
-        pods: "10"
-    -
-      hard:
-        requests.storage: 100Gi
-  storageClasses:
-    allowed:
-      - default
-    allowedRegex: ""
-  containerRegistries:
-    allowed:
-      - docker.io
-    allowedRegex: ""

config/samples/kustomization.yaml

@@ -1,5 +1,3 @@
 ## This file is auto-generated, do not modify ##
 resources:
-- capsule_v1alpha1_capsuleconfiguration.yaml
-- capsule_v1alpha1_tenant.yaml
 - capsule_v1beta1_tenant.yaml

controllers/pod/errors.go

@@ -0,0 +1,30 @@
+// Copyright 2020-2023 Project Capsule Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package pod
+
+import "fmt"
+
+type NonTenantObjectError struct {
+	objectName string
+}
+
+func NewNonTenantObject(objectName string) error {
+	return &NonTenantObjectError{objectName: objectName}
+}
+
+func (n NonTenantObjectError) Error() string {
+	return fmt.Sprintf("Skipping labels sync for %s as it doesn't belong to tenant", n.objectName)
+}
+
+type NoPodMetadataError struct {
+	objectName string
+}
+
+func NewNoPodMetadata(objectName string) error {
+	return &NoPodMetadataError{objectName: objectName}
+}
+
+func (n NoPodMetadataError) Error() string {
+	return fmt.Sprintf("Skipping labels sync for %s because no AdditionalLabels or AdditionalAnnotations presents in Tenant spec", n.objectName)
+}

controllers/pod/metadata.go

@@ -0,0 +1,130 @@
+// Copyright 2020-2023 Project Capsule Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package pod
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/pkg/errors"
+	corev1 "k8s.io/api/core/v1"
+	apierr "k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/fields"
+	"k8s.io/apimachinery/pkg/types"
+	ctrl "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/builder"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
+	"sigs.k8s.io/controller-runtime/pkg/log"
+	"sigs.k8s.io/controller-runtime/pkg/predicate"
+	"sigs.k8s.io/controller-runtime/pkg/reconcile"
+
+	capsulev1beta2 "github.com/projectcapsule/capsule/api/v1beta2"
+	"github.com/projectcapsule/capsule/pkg/utils"
+)
+
+type MetadataReconciler struct {
+	Client client.Client
+}
+
+func (m *MetadataReconciler) Reconcile(ctx context.Context, request ctrl.Request) (ctrl.Result, error) {
+	var pod corev1.Pod
+
+	logger := log.FromContext(ctx)
+
+	tenant, err := m.getTenant(ctx, request.NamespacedName, m.Client)
+	if err != nil {
+		noTenantObjError := &NonTenantObjectError{}
+		noPodMetaError := &NoPodMetadataError{}
+
+		if errors.As(err, &noTenantObjError) || errors.As(err, &noPodMetaError) {
+			return reconcile.Result{}, nil
+		}
+
+		logger.Error(err, fmt.Sprintf("Cannot get tenant corev1.Pod %s/%s", request.Namespace, request.Name))
+
+		return reconcile.Result{}, err
+	}
+
+	err = m.Client.Get(ctx, request.NamespacedName, &pod)
+	if err != nil {
+		if apierr.IsNotFound(err) {
+			return reconcile.Result{}, nil
+		}
+
+		return reconcile.Result{}, err
+	}
+
+	_, err = controllerutil.CreateOrUpdate(ctx, m.Client, &pod, func() (err error) {
+		pod.SetLabels(m.sync(pod.GetLabels(), tenant.Spec.PodOptions.AdditionalMetadata.Labels))
+		pod.SetAnnotations(m.sync(pod.GetAnnotations(), tenant.Spec.PodOptions.AdditionalMetadata.Annotations))
+
+		return nil
+	})
+
+	return reconcile.Result{}, err
+}
+
+func (m *MetadataReconciler) getTenant(ctx context.Context, namespacedName types.NamespacedName, client client.Client) (*capsulev1beta2.Tenant, error) {
+	ns := &corev1.Namespace{}
+	tenant := &capsulev1beta2.Tenant{}
+
+	if err := client.Get(ctx, types.NamespacedName{Name: namespacedName.Namespace}, ns); err != nil {
+		return nil, err
+	}
+
+	capsuleLabel, _ := utils.GetTypeLabel(&capsulev1beta2.Tenant{})
+	if _, ok := ns.GetLabels()[capsuleLabel]; !ok {
+		return nil, NewNonTenantObject(namespacedName.Name)
+	}
+
+	if err := client.Get(ctx, types.NamespacedName{Name: ns.Labels[capsuleLabel]}, tenant); err != nil {
+		return nil, err
+	}
+
+	if tenant.Spec.PodOptions == nil || tenant.Spec.PodOptions.AdditionalMetadata == nil {
+		return nil, NewNoPodMetadata(namespacedName.Name)
+	}
+
+	return tenant, nil
+}
+
+func (m *MetadataReconciler) sync(available map[string]string, tenantSpec map[string]string) map[string]string {
+	if tenantSpec != nil {
+		if available == nil {
+			return tenantSpec
+		}
+
+		for key, value := range tenantSpec {
+			if available[key] != value {
+				available[key] = value
+			}
+		}
+	}
+
+	return available
+}
+
+func (m *MetadataReconciler) forOptionPerInstanceName(ctx context.Context) builder.ForOption {
+	return builder.WithPredicates(predicate.NewPredicateFuncs(func(object client.Object) bool {
+		return m.isNamespaceInTenant(ctx, object.GetNamespace())
+	}))
+}
+
+func (m *MetadataReconciler) isNamespaceInTenant(ctx context.Context, namespace string) bool {
+	tl := &capsulev1beta2.TenantList{}
+	if err := m.Client.List(ctx, tl, client.MatchingFieldsSelector{
+		Selector: fields.OneTermEqualSelector(".status.namespaces", namespace),
+	}); err != nil {
+		return false
+	}
+
+	return len(tl.Items) > 0
+}
+
+func (m *MetadataReconciler) SetupWithManager(ctx context.Context, mgr ctrl.Manager) error {
+	return ctrl.NewControllerManagedBy(mgr).
+		For(&corev1.Pod{}, m.forOptionPerInstanceName(ctx)).
+		Complete(m)
+}

controllers/resources/processor.go

@@ -124,6 +124,7 @@ func (r *Processor) HandleSection(ctx context.Context, tnt capsulev1beta2.Tenant
 
 	objLabels[Label] = fmt.Sprintf("%d", resourceIndex)
 	objLabels[tenantLabel] = tnt.GetName()
+
 	// processed will contain the sets of resources replicated, both for the raw and the Namespaced ones:
 	// these are required to perform a final pruning once the replication has been occurred.
 	processed := sets.NewString()
@@ -265,8 +266,22 @@ func (r *Processor) createOrUpdate(ctx context.Context, obj *unstructured.Unstru
 		rv := actual.GetResourceVersion()
 
 		actual.SetUnstructuredContent(desired.Object)
-		actual.SetLabels(labels)
-		actual.SetAnnotations(annotations)
+		combinedLabels := obj.GetLabels()
+		if combinedLabels == nil {
+			combinedLabels = make(map[string]string)
+		}
+		for key, value := range labels {
+			combinedLabels[key] = value
+		}
+		actual.SetLabels(combinedLabels)
+		combinedAnnotations := obj.GetAnnotations()
+		if combinedAnnotations == nil {
+			combinedAnnotations = make(map[string]string)
+		}
+		for key, value := range annotations {
+			combinedAnnotations[key] = value
+		}
+		actual.SetAnnotations(combinedAnnotations)
 		actual.SetResourceVersion(rv)
 		actual.SetUID(UID)
 

controllers/tenant/manager.go

@@ -60,6 +60,13 @@ func (r Manager) Reconcile(ctx context.Context, request ctrl.Request) (result ct
 
 		return
 	}
+	// Ensuring Metadata
+	if err = r.ensureMetadata(ctx, instance); err != nil {
+		r.Log.Error(err, "Cannot ensure metadata")
+
+		return
+	}
+
 	// Ensuring ResourceQuota
 	r.Log.Info("Ensuring limit resources count is updated")
 

controllers/tenant/metadata.go

@@ -0,0 +1,23 @@
+// Copyright 2020-2023 Project Capsule Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package tenant
+
+import (
+	"context"
+
+	capsulev1beta2 "github.com/projectcapsule/capsule/api/v1beta2"
+	capsuleapi "github.com/projectcapsule/capsule/pkg/api"
+)
+
+// Sets a label on the Tenant object with it's name.
+func (r *Manager) ensureMetadata(ctx context.Context, tnt *capsulev1beta2.Tenant) (err error) {
+	// Assign Labels
+	if tnt.Labels == nil {
+		tnt.Labels = make(map[string]string)
+	}
+
+	tnt.Labels[capsuleapi.TenantNameLabel] = tnt.Name
+
+	return r.Client.Update(ctx, tnt)
+}

controllers/tenant/namespaces.go

@@ -57,8 +57,8 @@ func (r *Manager) syncNamespaceMetadata(ctx context.Context, namespace string, t
 		res, conflictErr = controllerutil.CreateOrUpdate(ctx, r.Client, ns, func() error {
 			annotations := make(map[string]string)
 			labels := map[string]string{
-				"name":       namespace,
-				capsuleLabel: tnt.GetName(),
+				"kubernetes.io/metadata.name": namespace,
+				capsuleLabel:                  tnt.GetName(),
 			}
 
 			if tnt.Spec.NamespaceOptions != nil && tnt.Spec.NamespaceOptions.AdditionalMetadata != nil {

controllers/tenant/resourcequotas.go

@@ -7,6 +7,7 @@ import (
 	"context"
 	"fmt"
 	"strconv"
+	"strings"
 
 	"golang.org/x/sync/errgroup"
 	corev1 "k8s.io/api/core/v1"
@@ -15,6 +16,7 @@ import (
 	"k8s.io/apimachinery/pkg/labels"
 	"k8s.io/apimachinery/pkg/selection"
 	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/apimachinery/pkg/util/sets"
 	"k8s.io/client-go/util/retry"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
@@ -52,9 +54,12 @@ func (r *Manager) syncResourceQuotas(ctx context.Context, tenant *capsulev1beta2
 		group := new(errgroup.Group)
 
 		for i, q := range tenant.Spec.ResourceQuota.Items {
-			index := i
+			index, resourceQuota := i, q
 
-			resourceQuota := q
+			toKeep := sets.New[corev1.ResourceName]()
+			for k := range resourceQuota.Hard {
+				toKeep.Insert(k)
+			}
 
 			group.Go(func() (scopeErr error) {
 				// Calculating the Resource Budget at Tenant scope just if this is put in place.
@@ -120,9 +125,15 @@ func (r *Manager) syncResourceQuotas(ctx context.Context, tenant *capsulev1beta2
 								list.Items[item].Spec.Hard = map[corev1.ResourceName]resource.Quantity{}
 							}
 							list.Items[item].Spec.Hard[name] = resourceQuota.Hard[name]
+
+							for k := range list.Items[item].Spec.Hard {
+								if !toKeep.Has(k) {
+									delete(list.Items[item].Spec.Hard, k)
+								}
+							}
 						}
 					}
-					if scopeErr = r.resourceQuotasUpdate(ctx, name, quantity, resourceQuota.Hard[name], list.Items...); scopeErr != nil {
+					if scopeErr = r.resourceQuotasUpdate(ctx, name, quantity, toKeep, resourceQuota.Hard[name], list.Items...); scopeErr != nil {
 						r.Log.Error(scopeErr, "cannot proceed with outer ResourceQuota")
 
 						return
@@ -217,9 +228,21 @@ func (r *Manager) syncResourceQuota(ctx context.Context, tenant *capsulev1beta2.
 // Serial ResourceQuota processing is expensive: using Go routines we can speed it up.
 // In case of multiple errors these are logged properly, returning a generic error since we have to repush back the
 // reconciliation loop.
-func (r *Manager) resourceQuotasUpdate(ctx context.Context, resourceName corev1.ResourceName, actual, limit resource.Quantity, list ...corev1.ResourceQuota) (err error) {
+func (r *Manager) resourceQuotasUpdate(ctx context.Context, resourceName corev1.ResourceName, actual resource.Quantity, toKeep sets.Set[corev1.ResourceName], limit resource.Quantity, list ...corev1.ResourceQuota) (err error) {
 	group := new(errgroup.Group)
 
+	annotationsToKeep := sets.New[string]()
+
+	for _, item := range toKeep.UnsortedList() {
+		if v, vErr := capsulev1beta2.UsedQuotaFor(item); vErr == nil {
+			annotationsToKeep.Insert(v)
+		}
+
+		if v, vErr := capsulev1beta2.HardQuotaFor(item); vErr == nil {
+			annotationsToKeep.Insert(v)
+		}
+	}
+
 	for _, item := range list {
 		rq := item
 
@@ -236,6 +259,16 @@ func (r *Manager) resourceQuotasUpdate(ctx context.Context, resourceName corev1.
 					if found.Annotations == nil {
 						found.Annotations = make(map[string]string)
 					}
+					// Pruning the Capsule quota annotations:
+					// if the ResourceQuota is updated by removing some objects,
+					// we could still have left-overs which could be misleading.
+					// This will not lead to a reconciliation loop since the whole code is idempotent.
+					for k := range found.Annotations {
+						if (strings.HasPrefix(k, capsulev1beta2.HardCapsuleQuotaAnnotation) || strings.HasPrefix(k, capsulev1beta2.UsedCapsuleQuotaAnnotation)) && !annotationsToKeep.Has(k) {
+							delete(found.Annotations, k)
+						}
+					}
+
 					found.Labels = rq.Labels
 					if actualKey, keyErr := capsulev1beta2.UsedQuotaFor(resourceName); keyErr == nil {
 						found.Annotations[actualKey] = actual.String()

controllers/tenant/resourcequotas_quota.go

@@ -110,7 +110,17 @@ func (r *Manager) syncCustomResourceQuotaUsages(ctx context.Context, tenant *cap
 					usedMap[key] = 0
 				}
 
-				usedMap[key] += len(list.Items)
+				var used int
+
+				for _, k := range list.Items {
+					if k.GetDeletionTimestamp() != nil {
+						continue
+					}
+
+					used++
+				}
+
+				usedMap[key] += used
 			}
 
 			return

controllers/tls/manager.go

@@ -239,7 +239,7 @@ func (r *Reconciler) updateTenantCustomResourceDefinition(ctx context.Context, n
 						},
 						CABundle: caBundle,
 					},
-					ConversionReviewVersions: []string{"v1alpha1", "v1beta1", "v1beta2"},
+					ConversionReviewVersions: []string{"v1beta1", "v1beta2"},
 				},
 			}
 

e2e/globaltenantresource_test.go

@@ -249,7 +249,7 @@ var _ = Describe("Creating a GlobalTenantResource object", func() {
 
 			gtr.Spec.Resources[0].NamespaceSelector = &metav1.LabelSelector{
 				MatchLabels: map[string]string{
-					"name": "solar-three",
+					"kubernetes.io/metadata.name": "solar-three",
 				},
 			}
 

e2e/pod_metadata_test.go

@@ -0,0 +1,115 @@
+//go:build e2e
+
+// Copyright 2020-2021 Clastix Labs
+// SPDX-License-Identifier: Apache-2.0
+
+package e2e
+
+import (
+	"context"
+	"fmt"
+	. "github.com/onsi/ginkgo/v2"
+	. "github.com/onsi/gomega"
+	capsulev1beta2 "github.com/projectcapsule/capsule/api/v1beta2"
+	"github.com/projectcapsule/capsule/pkg/api"
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
+)
+
+var _ = Describe("adding metadata to Pod objects", func() {
+	tnt := &capsulev1beta2.Tenant{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: "pod-metadata",
+		},
+		Spec: capsulev1beta2.TenantSpec{
+			Owners: capsulev1beta2.OwnerListSpec{
+				{
+					Name: "gatsby",
+					Kind: "User",
+				},
+			},
+			PodOptions: &api.PodOptions{
+				AdditionalMetadata: &api.AdditionalMetadataSpec{
+					Labels: map[string]string{
+						"k8s.io/custom-label":     "foo",
+						"clastix.io/custom-label": "bar",
+					},
+					Annotations: map[string]string{
+						"k8s.io/custom-annotation":     "bizz",
+						"clastix.io/custom-annotation": "buzz",
+					},
+				},
+			},
+		},
+	}
+
+	JustBeforeEach(func() {
+		EventuallyCreation(func() error {
+
+			tnt.ResourceVersion = ""
+			return k8sClient.Create(context.TODO(), tnt)
+		}).Should(Succeed())
+	})
+
+	JustAfterEach(func() {
+		Expect(k8sClient.Delete(context.TODO(), tnt)).Should(Succeed())
+	})
+
+	It("should apply them to Pod", func() {
+		ns := NewNamespace("")
+		NamespaceCreation(ns, tnt.Spec.Owners[0], defaultTimeoutInterval).Should(Succeed())
+		fmt.Sprint("namespace created")
+		//TenantNamespaceList(tnt, defaultTimeoutInterval).Should(ContainElement(ns.GetName()))
+		fmt.Sprint("tenant contains list namespace")
+		pod := &corev1.Pod{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:      "pod-metadata",
+				Namespace: ns.GetName(),
+			},
+			Spec: corev1.PodSpec{
+				Containers: []corev1.Container{
+					{
+						Name:            "container",
+						Image:           "quay.io/google-containers/pause-amd64:3.0",
+						ImagePullPolicy: "IfNotPresent",
+					},
+				},
+				RestartPolicy: "Always",
+			},
+		}
+
+		EventuallyCreation(func() (err error) {
+			_, err = ownerClient(tnt.Spec.Owners[0]).CoreV1().Pods(ns.GetName()).Create(context.Background(), pod, metav1.CreateOptions{})
+
+			return
+		}).Should(Succeed())
+
+		By("checking additional labels", func() {
+			Eventually(func() (ok bool) {
+				Expect(k8sClient.Get(context.TODO(), types.NamespacedName{Name: pod.GetName(), Namespace: ns.GetName()}, pod)).Should(Succeed())
+				for k, v := range tnt.Spec.PodOptions.AdditionalMetadata.Labels {
+					ok, _ = HaveKeyWithValue(k, v).Match(pod.GetLabels())
+					if !ok {
+						return false
+					}
+				}
+				return true
+			}, defaultTimeoutInterval, defaultPollInterval).Should(BeTrue())
+		})
+
+		By("checking additional annotations", func() {
+			Eventually(func() (ok bool) {
+				Expect(k8sClient.Get(context.TODO(), types.NamespacedName{Name: pod.GetName(), Namespace: ns.GetName()}, pod)).Should(Succeed())
+				for k, v := range tnt.Spec.PodOptions.AdditionalMetadata.Annotations {
+					ok, _ = HaveKeyWithValue(k, v).Match(pod.GetAnnotations())
+					if !ok {
+						return false
+					}
+				}
+				return true
+			}, defaultTimeoutInterval, defaultPollInterval).Should(BeTrue())
+		})
+	})
+
+})

e2e/service_forbidden_metadata_test.go

@@ -0,0 +1,229 @@
+//go:build e2e
+
+// Copyright 2020-2023 Project Capsule Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package e2e
+
+import (
+	"context"
+	"time"
+
+	. "github.com/onsi/ginkgo/v2"
+	. "github.com/onsi/gomega"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
+
+	capsulev1beta2 "github.com/projectcapsule/capsule/api/v1beta2"
+	"github.com/projectcapsule/capsule/pkg/api"
+)
+
+var _ = Describe("creating a Service with user-specified labels and annotations", func() {
+	tnt := &capsulev1beta2.Tenant{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: "tenant-user-metadata-forbidden",
+		},
+		Spec: capsulev1beta2.TenantSpec{
+			ServiceOptions: &api.ServiceOptions{
+				ForbiddenLabels: api.ForbiddenListSpec{
+					Exact: []string{"foo", "bar"},
+					Regex: "^gatsby-.*$",
+				},
+				ForbiddenAnnotations: api.ForbiddenListSpec{
+					Exact: []string{"foo", "bar"},
+					Regex: "^gatsby-.*$",
+				},
+			},
+			Owners: capsulev1beta2.OwnerListSpec{
+				{
+					Name: "gatsby",
+					Kind: "User",
+				},
+			},
+		},
+	}
+
+	JustBeforeEach(func() {
+		EventuallyCreation(func() error {
+			tnt.ResourceVersion = ""
+			return k8sClient.Create(context.TODO(), tnt)
+		}).Should(Succeed())
+	})
+	JustAfterEach(func() {
+		Expect(k8sClient.Delete(context.TODO(), tnt)).Should(Succeed())
+	})
+
+	It("should allow", func() {
+		By("specifying non-forbidden labels", func() {
+			ns := NewNamespace("")
+			NamespaceCreation(ns, tnt.Spec.Owners[0], defaultTimeoutInterval).Should(Succeed())
+			TenantNamespaceList(tnt, defaultTimeoutInterval).Should(ContainElement(ns.GetName()))
+
+			svc := NewService(types.NamespacedName{
+				Namespace: ns.GetName(),
+				Name:      "non-forbidden-labels",
+			})
+			svc.SetLabels(map[string]string{"bim": "baz"})
+			ServiceCreation(svc, tnt.Spec.Owners[0], defaultTimeoutInterval).Should(Succeed())
+		})
+		By("specifying non-forbidden annotations", func() {
+			ns := NewNamespace("")
+			NamespaceCreation(ns, tnt.Spec.Owners[0], defaultTimeoutInterval).Should(Succeed())
+			TenantNamespaceList(tnt, defaultTimeoutInterval).Should(ContainElement(ns.GetName()))
+
+			svc := NewService(types.NamespacedName{
+				Namespace: ns.GetName(),
+				Name:      "non-forbidden-annotations",
+			})
+			svc.SetAnnotations(map[string]string{"bim": "baz"})
+			ServiceCreation(svc, tnt.Spec.Owners[0], defaultTimeoutInterval).Should(Succeed())
+		})
+	})
+
+	It("should fail when creating a Service", func() {
+		By("specifying forbidden labels using exact match", func() {
+			ns := NewNamespace("")
+			NamespaceCreation(ns, tnt.Spec.Owners[0], defaultTimeoutInterval).Should(Succeed())
+			TenantNamespaceList(tnt, defaultTimeoutInterval).Should(ContainElement(ns.GetName()))
+
+			svc := NewService(types.NamespacedName{
+				Namespace: ns.GetName(),
+				Name:      "forbidden-labels-exact",
+			})
+			svc.SetLabels(map[string]string{"foo": "bar"})
+			ServiceCreation(svc, tnt.Spec.Owners[0], defaultTimeoutInterval).ShouldNot(Succeed())
+		})
+		By("specifying forbidden labels using regex match", func() {
+			ns := NewNamespace("")
+			NamespaceCreation(ns, tnt.Spec.Owners[0], defaultTimeoutInterval).Should(Succeed())
+			TenantNamespaceList(tnt, defaultTimeoutInterval).Should(ContainElement(ns.GetName()))
+
+			svc := NewService(types.NamespacedName{
+				Namespace: ns.GetName(),
+				Name:      "forbidden-labels-regex",
+			})
+			svc.SetLabels(map[string]string{"gatsby-foo": "bar"})
+			ServiceCreation(svc, tnt.Spec.Owners[0], defaultTimeoutInterval).ShouldNot(Succeed())
+		})
+		By("specifying forbidden annotations using exact match", func() {
+			ns := NewNamespace("")
+			NamespaceCreation(ns, tnt.Spec.Owners[0], defaultTimeoutInterval).Should(Succeed())
+			TenantNamespaceList(tnt, defaultTimeoutInterval).Should(ContainElement(ns.GetName()))
+
+			svc := NewService(types.NamespacedName{
+				Namespace: ns.GetName(),
+				Name:      "forbidden-annotations-exact",
+			})
+			svc.SetAnnotations(map[string]string{"foo": "bar"})
+			ServiceCreation(svc, tnt.Spec.Owners[0], defaultTimeoutInterval).ShouldNot(Succeed())
+		})
+		By("specifying forbidden annotations using regex match", func() {
+			ns := NewNamespace("")
+			NamespaceCreation(ns, tnt.Spec.Owners[0], defaultTimeoutInterval).Should(Succeed())
+			TenantNamespaceList(tnt, defaultTimeoutInterval).Should(ContainElement(ns.GetName()))
+
+			svc := NewService(types.NamespacedName{
+				Namespace: ns.GetName(),
+				Name:      "forbidden-annotations-regex",
+			})
+			svc.SetAnnotations(map[string]string{"gatsby-foo": "bar"})
+			ServiceCreation(svc, tnt.Spec.Owners[0], defaultTimeoutInterval).ShouldNot(Succeed())
+		})
+	})
+
+	It("should fail when updating a Service", func() {
+		cs := ownerClient(tnt.Spec.Owners[0])
+
+		By("specifying forbidden labels using exact match", func() {
+			ns := NewNamespace("")
+			NamespaceCreation(ns, tnt.Spec.Owners[0], defaultTimeoutInterval).Should(Succeed())
+			TenantNamespaceList(tnt, defaultTimeoutInterval).Should(ContainElement(ns.GetName()))
+
+			svc := NewService(types.NamespacedName{
+				Namespace: ns.GetName(),
+				Name:      "forbidden-labels-exact-match",
+			})
+			ServiceCreation(svc, tnt.Spec.Owners[0], defaultTimeoutInterval).Should(Succeed())
+			Consistently(func() error {
+				svc, err := cs.CoreV1().Services(svc.Namespace).Get(context.Background(), svc.GetName(), metav1.GetOptions{})
+				if err != nil {
+					return nil
+				}
+				svc.SetLabels(map[string]string{"foo": "bar"})
+
+				_, err = cs.CoreV1().Services(svc.Namespace).Update(context.Background(), svc, metav1.UpdateOptions{})
+
+				return err
+			}, 10*time.Second, time.Second).ShouldNot(Succeed())
+		})
+		By("specifying forbidden labels using regex match", func() {
+			ns := NewNamespace("")
+			NamespaceCreation(ns, tnt.Spec.Owners[0], defaultTimeoutInterval).Should(Succeed())
+			TenantNamespaceList(tnt, defaultTimeoutInterval).Should(ContainElement(ns.GetName()))
+
+			svc := NewService(types.NamespacedName{
+				Namespace: ns.GetName(),
+				Name:      "forbidden-labels-regex-match",
+			})
+			ServiceCreation(svc, tnt.Spec.Owners[0], defaultTimeoutInterval).Should(Succeed())
+			Consistently(func() error {
+				svc, err := cs.CoreV1().Services(svc.Namespace).Get(context.Background(), svc.GetName(), metav1.GetOptions{})
+				if err != nil {
+					return nil
+				}
+
+				svc.SetLabels(map[string]string{"gatsby-foo": "bar"})
+
+				_, err = cs.CoreV1().Services(svc.Namespace).Update(context.Background(), svc, metav1.UpdateOptions{})
+
+				return err
+			}, 3*time.Second, time.Second).ShouldNot(Succeed())
+		})
+		By("specifying forbidden annotations using exact match", func() {
+			ns := NewNamespace("")
+			NamespaceCreation(ns, tnt.Spec.Owners[0], defaultTimeoutInterval).Should(Succeed())
+			TenantNamespaceList(tnt, defaultTimeoutInterval).Should(ContainElement(ns.GetName()))
+
+			svc := NewService(types.NamespacedName{
+				Namespace: ns.GetName(),
+				Name:      "forbidden-annotations-exact-match",
+			})
+			ServiceCreation(svc, tnt.Spec.Owners[0], defaultTimeoutInterval).Should(Succeed())
+			Consistently(func() error {
+				svc, err := cs.CoreV1().Services(svc.Namespace).Get(context.Background(), svc.GetName(), metav1.GetOptions{})
+				if err != nil {
+					return nil
+				}
+
+				svc.SetAnnotations(map[string]string{"foo": "bar"})
+
+				_, err = cs.CoreV1().Services(svc.Namespace).Update(context.Background(), svc, metav1.UpdateOptions{})
+
+				return err
+			}, 10*time.Second, time.Second).ShouldNot(Succeed())
+		})
+		By("specifying forbidden annotations using regex match", func() {
+			ns := NewNamespace("")
+			NamespaceCreation(ns, tnt.Spec.Owners[0], defaultTimeoutInterval).Should(Succeed())
+			TenantNamespaceList(tnt, defaultTimeoutInterval).Should(ContainElement(ns.GetName()))
+
+			svc := NewService(types.NamespacedName{
+				Namespace: ns.GetName(),
+				Name:      "forbidden-annotations-regex-match",
+			})
+			ServiceCreation(svc, tnt.Spec.Owners[0], defaultTimeoutInterval).Should(Succeed())
+			Consistently(func() error {
+				svc, err := cs.CoreV1().Services(svc.Namespace).Get(context.Background(), svc.GetName(), metav1.GetOptions{})
+				if err != nil {
+					return nil
+				}
+
+				svc.SetAnnotations(map[string]string{"gatsby-foo": "bar"})
+
+				_, err = cs.CoreV1().Services(svc.Namespace).Update(context.Background(), svc, metav1.UpdateOptions{})
+
+				return err
+			}, 10*time.Second, time.Second).ShouldNot(Succeed())
+		})
+	})
+})

e2e/suite_client_test.go

@@ -0,0 +1,63 @@
+//go:build e2e
+
+// Copyright 2020-2023 Project Capsule Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package e2e
+
+import (
+	"context"
+	"time"
+
+	"sigs.k8s.io/controller-runtime/pkg/client"
+)
+
+type e2eClient struct {
+	client.Client
+}
+
+func (e *e2eClient) sleep() {
+	time.Sleep(250 * time.Millisecond)
+}
+
+func (e *e2eClient) Get(ctx context.Context, key client.ObjectKey, obj client.Object, opts ...client.GetOption) error {
+	defer e.sleep()
+
+	return e.Client.Get(ctx, key, obj, opts...)
+}
+
+func (e *e2eClient) List(ctx context.Context, list client.ObjectList, opts ...client.ListOption) error {
+	defer e.sleep()
+
+	return e.Client.List(ctx, list, opts...)
+}
+
+func (e *e2eClient) Create(ctx context.Context, obj client.Object, opts ...client.CreateOption) error {
+	defer e.sleep()
+
+	return e.Client.Create(ctx, obj, opts...)
+}
+
+func (e *e2eClient) Delete(ctx context.Context, obj client.Object, opts ...client.DeleteOption) error {
+	defer e.sleep()
+
+	return e.Client.Delete(ctx, obj, opts...)
+}
+
+func (e *e2eClient) Update(ctx context.Context, obj client.Object, opts ...client.UpdateOption) error {
+	defer e.sleep()
+
+	return e.Client.Update(ctx, obj, opts...)
+}
+
+func (e *e2eClient) Patch(ctx context.Context, obj client.Object, patch client.Patch, opts ...client.PatchOption) error {
+	defer e.sleep()
+
+	return e.Client.Patch(ctx, obj, patch, opts...)
+}
+
+func (e *e2eClient) DeleteAllOf(ctx context.Context, obj client.Object, opts ...client.DeleteAllOfOption) error {
+	defer e.sleep()
+
+	return e.Client.DeleteAllOf(ctx, obj, opts...)
+}

e2e/suite_test.go

@@ -13,6 +13,7 @@ import (
 	"k8s.io/client-go/kubernetes"
 	"k8s.io/client-go/kubernetes/scheme"
 	"k8s.io/client-go/rest"
+	"k8s.io/utils/pointer"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/client/config"
 	"sigs.k8s.io/controller-runtime/pkg/envtest"
@@ -42,9 +43,7 @@ var _ = BeforeSuite(func() {
 
 	By("bootstrapping test environment")
 	testEnv = &envtest.Environment{
-		UseExistingCluster: func(v bool) *bool {
-			return &v
-		}(true),
+		UseExistingCluster: pointer.Bool(true),
 	}
 
 	var err error
@@ -54,9 +53,11 @@ var _ = BeforeSuite(func() {
 
 	Expect(capsulev1beta2.AddToScheme(scheme.Scheme)).NotTo(HaveOccurred())
 
-	k8sClient, err = client.New(cfg, client.Options{Scheme: scheme.Scheme})
+	ctrlClient, err := client.New(cfg, client.Options{Scheme: scheme.Scheme})
 	Expect(err).ToNot(HaveOccurred())
-	Expect(k8sClient).ToNot(BeNil())
+	Expect(ctrlClient).ToNot(BeNil())
+
+	k8sClient = &e2eClient{Client: ctrlClient}
 })
 
 var _ = AfterSuite(func() {
@@ -71,5 +72,6 @@ func ownerClient(owner capsulev1beta2.OwnerSpec) (cs kubernetes.Interface) {
 	c.Impersonate.UserName = owner.Name
 	cs, err = kubernetes.NewForConfig(c)
 	Expect(err).ToNot(HaveOccurred())
-	return
+
+	return cs
 }

e2e/tenant_metadata.go

@@ -0,0 +1,67 @@
+//go:build e2e
+
+// Copyright 2020-2023 Project Capsule Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package e2e
+
+import (
+	"context"
+
+	. "github.com/onsi/ginkgo/v2"
+	. "github.com/onsi/gomega"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
+
+	capsulev1beta2 "github.com/projectcapsule/capsule/api/v1beta2"
+)
+
+func getLabels(tnt capsulev1beta2.Tenant) (map[string]string, error) {
+	current := &capsulev1beta2.Tenant{}
+	err := k8sClient.Get(context.TODO(), types.NamespacedName{Name: tnt.GetName()}, current)
+	if err != nil {
+		return nil, err
+	}
+	return current.GetLabels(), nil
+}
+
+var _ = Describe("adding metadata to a Tenant", func() {
+	tnt := &capsulev1beta2.Tenant{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: "tenant-metadata",
+			Labels: map[string]string{
+				"custom-label": "test",
+			},
+		},
+		Spec: capsulev1beta2.TenantSpec{
+			Owners: capsulev1beta2.OwnerListSpec{
+				{
+					Name: "jim",
+					Kind: "User",
+				},
+			},
+		},
+	}
+	JustBeforeEach(func() {
+		EventuallyCreation(func() error {
+			return k8sClient.Create(context.TODO(), tnt)
+		}).Should(Succeed())
+	})
+
+	JustAfterEach(func() {
+		Expect(k8sClient.Delete(context.TODO(), tnt)).Should(Succeed())
+	})
+
+	It("Should ensure label metadata", func() {
+		By("Default labels", func() {
+			currentlabels, _ := getLabels(*tnt)
+			Expect(currentlabels["kubernetes.io/metadata.name"]).To(Equal("tenant-metadata"))
+			Expect(currentlabels["custom-label"]).To(Equal("test"))
+		})
+		By("Disallow name overwritte", func() {
+			tnt.Labels["kubernetes.io/metadata.name"] = "evil"
+			Expect(k8sClient.Update(context.TODO(), tnt)).ShouldNot(Succeed())
+		})
+
+	})
+})

e2e/tenantresource_test.go

@@ -63,6 +63,13 @@ var _ = Describe("Creating a TenantResource object", func() {
 		Type: corev1.SecretTypeOpaque,
 	}
 
+	testLabels := map[string]string{
+		"labels.energy.io": "namespaced",
+	}
+	testAnnotations := map[string]string{
+		"annotations.energy.io": "namespaced",
+	}
+
 	tr := &capsulev1beta2.TenantResource{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      "replicate-energies",
@@ -101,7 +108,9 @@ var _ = Describe("Creating a TenantResource object", func() {
 										APIVersion: "v1",
 									},
 									ObjectMeta: metav1.ObjectMeta{
-										Name: "raw-secret-1",
+										Name:        "raw-secret-1",
+										Labels:      testLabels,
+										Annotations: testAnnotations,
 									},
 									Type: corev1.SecretTypeOpaque,
 									Data: map[string][]byte{
@@ -119,7 +128,9 @@ var _ = Describe("Creating a TenantResource object", func() {
 										APIVersion: "v1",
 									},
 									ObjectMeta: metav1.ObjectMeta{
-										Name: "raw-secret-2",
+										Name:        "raw-secret-2",
+										Labels:      testLabels,
+										Annotations: testAnnotations,
 									},
 									Type: corev1.SecretTypeOpaque,
 									Data: map[string][]byte{
@@ -137,7 +148,9 @@ var _ = Describe("Creating a TenantResource object", func() {
 										APIVersion: "v1",
 									},
 									ObjectMeta: metav1.ObjectMeta{
-										Name: "raw-secret-3",
+										Name:        "raw-secret-3",
+										Labels:      testLabels,
+										Annotations: testAnnotations,
 									},
 									Type: corev1.SecretTypeOpaque,
 									Data: map[string][]byte{
@@ -249,7 +262,7 @@ var _ = Describe("Creating a TenantResource object", func() {
 
 			tr.Spec.Resources[0].NamespaceSelector = &metav1.LabelSelector{
 				MatchLabels: map[string]string{
-					"name": "solar-three",
+					"kubernetes.io/metadata.name": "solar-three",
 				},
 			}
 
@@ -288,11 +301,18 @@ var _ = Describe("Creating a TenantResource object", func() {
 					_, err := HaveKeyWithValue(k, v).Match(secret.GetLabels())
 					Expect(err).ToNot(HaveOccurred())
 				}
-
+				for k, v := range testLabels {
+					_, err := HaveKeyWithValue(k, v).Match(secret.GetLabels())
+					Expect(err).ToNot(HaveOccurred())
+				}
 				for k, v := range tr.Spec.Resources[0].AdditionalMetadata.Annotations {
 					_, err := HaveKeyWithValue(k, v).Match(secret.GetAnnotations())
 					Expect(err).ToNot(HaveOccurred())
 				}
+				for k, v := range testAnnotations {
+					_, err := HaveKeyWithValue(k, v).Match(secret.GetAnnotations())
+					Expect(err).ToNot(HaveOccurred())
+				}
 			}
 		})
 

e2e/utils_test.go

@@ -31,6 +31,28 @@ const (
 	defaultPollInterval    = time.Second
 )
 
+func NewService(svc types.NamespacedName) *corev1.Service {
+	return &corev1.Service{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      svc.Name,
+			Namespace: svc.Namespace,
+		},
+		Spec: corev1.ServiceSpec{
+			Ports: []corev1.ServicePort{
+				{Port: int32(80)},
+			},
+		},
+	}
+}
+
+func ServiceCreation(svc *corev1.Service, owner capsulev1beta2.OwnerSpec, timeout time.Duration) AsyncAssertion {
+	cs := ownerClient(owner)
+	return Eventually(func() (err error) {
+		_, err = cs.CoreV1().Services(svc.Namespace).Create(context.TODO(), svc, metav1.CreateOptions{})
+		return
+	}, timeout, defaultPollInterval)
+}
+
 func NewNamespace(name string) *corev1.Namespace {
 	if len(name) == 0 {
 		name = rand.String(10)
@@ -77,8 +99,6 @@ func ModifyCapsuleConfigurationOpts(fn func(configuration *capsulev1beta2.Capsul
 	fn(config)
 
 	Expect(k8sClient.Update(context.Background(), config)).ToNot(HaveOccurred())
-
-	time.Sleep(1 * time.Second)
 }
 
 func CheckForOwnerRoleBindings(ns *corev1.Namespace, owner capsulev1beta2.OwnerSpec, roles map[string]bool) func() error {

go.mod

@@ -5,20 +5,21 @@ go 1.20
 require (
 	github.com/go-logr/logr v1.3.0
 	github.com/hashicorp/go-multierror v1.1.1
-	github.com/onsi/ginkgo/v2 v2.13.0
+	github.com/onsi/ginkgo/v2 v2.13.2
 	github.com/onsi/gomega v1.30.0
 	github.com/pkg/errors v0.9.1
 	github.com/spf13/pflag v1.0.5
 	github.com/stretchr/testify v1.8.4
 	github.com/valyala/fasttemplate v1.2.2
+	go.uber.org/automaxprocs v1.5.3
 	go.uber.org/zap v1.26.0
 	golang.org/x/sync v0.5.0
-	k8s.io/api v0.28.3
-	k8s.io/apiextensions-apiserver v0.28.3
-	k8s.io/apimachinery v0.28.3
-	k8s.io/client-go v0.28.3
+	k8s.io/api v0.28.4
+	k8s.io/apiextensions-apiserver v0.28.4
+	k8s.io/apimachinery v0.28.4
+	k8s.io/client-go v0.28.4
 	k8s.io/utils v0.0.0-20230406110748-d93618cff8a2
-	sigs.k8s.io/cluster-api v1.6.0-beta.1
+	sigs.k8s.io/cluster-api v1.6.0
 	sigs.k8s.io/controller-runtime v0.16.3
 )
 
@@ -59,22 +60,23 @@ require (
 	github.com/prometheus/common v0.44.0 // indirect
 	github.com/prometheus/procfs v0.11.1 // indirect
 	github.com/valyala/bytebufferpool v1.0.0 // indirect
+	go.uber.org/goleak v1.3.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	golang.org/x/exp v0.0.0-20230905200255-921286631fa9 // indirect
-	golang.org/x/net v0.17.0 // indirect
-	golang.org/x/oauth2 v0.13.0 // indirect
-	golang.org/x/sys v0.13.0 // indirect
-	golang.org/x/term v0.13.0 // indirect
-	golang.org/x/text v0.13.0 // indirect
+	golang.org/x/net v0.18.0 // indirect
+	golang.org/x/oauth2 v0.14.0 // indirect
+	golang.org/x/sys v0.14.0 // indirect
+	golang.org/x/term v0.14.0 // indirect
+	golang.org/x/text v0.14.0 // indirect
 	golang.org/x/time v0.3.0 // indirect
-	golang.org/x/tools v0.13.0 // indirect
+	golang.org/x/tools v0.14.0 // indirect
 	gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
 	google.golang.org/appengine v1.6.7 // indirect
 	google.golang.org/protobuf v1.31.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	k8s.io/component-base v0.28.3 // indirect
+	k8s.io/component-base v0.28.4 // indirect
 	k8s.io/klog/v2 v2.100.1 // indirect
 	k8s.io/kube-openapi v0.0.0-20230717233707-2695361300d9 // indirect
 	sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect

go.sum

@@ -102,8 +102,8 @@ github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9G
 github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
-github.com/onsi/ginkgo/v2 v2.13.0 h1:0jY9lJquiL8fcf3M4LAXN5aMlS/b2BV86HFFPCPMgE4=
-github.com/onsi/ginkgo/v2 v2.13.0/go.mod h1:TE309ZR8s5FsKKpuB1YAQYBzCaAfUgatB/xlT/ETL/o=
+github.com/onsi/ginkgo/v2 v2.13.2 h1:Bi2gGVkfn6gQcjNjZJVO8Gf0FHzMPf2phUei9tejVMs=
+github.com/onsi/ginkgo/v2 v2.13.2/go.mod h1:XStQ8QcGwLyF4HdfcZB8SFOS/MWCgDuXMSBe6zrvLgM=
 github.com/onsi/gomega v1.30.0 h1:hvMK7xYz4D3HapigLTeGdId/NcfQx1VHMJc60ew99+8=
 github.com/onsi/gomega v1.30.0/go.mod h1:9sxs+SwGrKI0+PWe4Fxa9tFQQBG5xSsSbMXOI8PPpoQ=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
@@ -112,6 +112,7 @@ github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/prashantv/gostub v1.1.0 h1:BTyx3RfQjRHnUWaGF9oQos79AlQ5k8WNktv7VGvVH4g=
 github.com/prometheus/client_golang v1.17.0 h1:rl2sfwZMtSthVU752MqfjQozy7blglC+1SOtjMAMh+Q=
 github.com/prometheus/client_golang v1.17.0/go.mod h1:VeL+gMmOAxkS2IqfCq0ZmHSL+LjWfWDUmp1mBz9JgUY=
 github.com/prometheus/client_model v0.4.1-0.20230718164431-9a2bf3000d16 h1:v7DLqVdK4VrYkVD5diGdl4sxJurKJEMnODWRJlxV9oM=
@@ -145,8 +146,11 @@ github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9de
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.3.5/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
 go.uber.org/atomic v1.7.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc=
+go.uber.org/automaxprocs v1.5.3 h1:kWazyxZUrS3Gs4qUpbwo5kEIMGe/DAvi5Z4tl2NW4j8=
+go.uber.org/automaxprocs v1.5.3/go.mod h1:eRbA25aqJrxAbsLO0xy5jVwPt7FQnRgjW+efnwa1WM0=
 go.uber.org/goleak v1.1.11/go.mod h1:cwTWslyiVhfpKIDGSZEM2HlOvcqm+tG4zioyIeLoqMQ=
-go.uber.org/goleak v1.2.1 h1:NBol2c7O1ZokfZ0LEU9K6Whx/KnwvepVetCUhtKja4A=
+go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
+go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
 go.uber.org/multierr v1.6.0/go.mod h1:cdWPpRnG4AhwMwsgIHip0KRBQjJy5kYEpYjJxpXp9iU=
 go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
 go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
@@ -156,14 +160,14 @@ go.uber.org/zap v1.26.0/go.mod h1:dtElttAiwGvoJ/vj4IwHBS/gXsEu/pZ50mUIRWuG0so=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.14.0 h1:wBqGXzWJW6m1XrIKlAH0Hs1JJ7+9KBwnIO8v66Q9cHc=
+golang.org/x/crypto v0.15.0 h1:frVn1TEaCEaZcn3Tmd7Y2b5KKPaZ+I32Q2OA3kYp5TA=
 golang.org/x/exp v0.0.0-20230905200255-921286631fa9 h1:GoHiUyI/Tp2nVkLI2mCxVkOjsbSXD66ic0XW0js0R9g=
 golang.org/x/exp v0.0.0-20230905200255-921286631fa9/go.mod h1:S2oDrQGGwySpoQPVqRShND87VCbxmc6bL1Yd2oYrm6k=
 golang.org/x/lint v0.0.0-20190930215403-16217165b5de/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.12.0 h1:rmsUpXtvNzj340zd98LZ4KntptpfRHwpFOHG188oHXc=
+golang.org/x/mod v0.13.0 h1:I/DsJXRlw/8l/0c24sM9yb0T4z9liZTduXvdAWYiysY=
 golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
@@ -171,10 +175,10 @@ golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLL
 golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM=
-golang.org/x/net v0.17.0 h1:pVaXccu2ozPjCXewfr1S7xza/zcXTity9cCdXQYSjIM=
-golang.org/x/net v0.17.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE=
-golang.org/x/oauth2 v0.13.0 h1:jDDenyj+WgFtmV3zYVoi8aE2BwtXFLWOA67ZfNWftiY=
-golang.org/x/oauth2 v0.13.0/go.mod h1:/JMhi4ZRXAf4HG9LiNmxvk+45+96RUlVThiH8FzNBn0=
+golang.org/x/net v0.18.0 h1:mIYleuAkSbHh0tCv7RvjL3F6ZVbLjq4+R7zbOn3Kokg=
+golang.org/x/net v0.18.0/go.mod h1:/czyP5RqHAH4odGYxBJ1qz0+CE5WZ+2j1YgoEo8F2jQ=
+golang.org/x/oauth2 v0.14.0 h1:P0Vrf/2538nmC0H+pEQ3MNFRRnVR7RlqyVw+bvm26z0=
+golang.org/x/oauth2 v0.14.0/go.mod h1:lAtNWgaWfL4cm7j2OV8TxGi9Qb7ECORx8DktCY74OwM=
 golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -190,16 +194,16 @@ golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20210330210617-4fbd30eecc44/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220908164124-27713097b956/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.13.0 h1:Af8nKPmuFypiUBjVoU9V20FiaFXOcuZI21p0ycVYYGE=
-golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.14.0 h1:Vz7Qs629MkJkGyHxUlRHizWJRG2j8fbQKjELVSNhy7Q=
+golang.org/x/sys v0.14.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
-golang.org/x/term v0.13.0 h1:bb+I9cTfFazGW51MZqBVmZy7+JEJMouUHTUSKVQLBek=
-golang.org/x/term v0.13.0/go.mod h1:LTmsnFJwVN6bCy1rVCoS+qHT1HhALEFxKncY3WNNh4U=
+golang.org/x/term v0.14.0 h1:LGK9IlZ8T9jvdy6cTdfKUCltatMFOehAQo9SRC46UQ8=
+golang.org/x/term v0.14.0/go.mod h1:TySc+nGkYR6qt8km8wUhuFRTVSMIX3XPR58y2lC8vww=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.13.0 h1:ablQoSUd0tRdKxZewP80B+BaqeKJuVhuRxj/dkrun3k=
-golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
+golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ=
+golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/time v0.3.0 h1:rg5rLMjNzMS1RkNLzCG38eapWhnYLFYXDXj2gOlr8j4=
 golang.org/x/time v0.3.0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
@@ -208,8 +212,8 @@ golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtn
 golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.1.5/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
-golang.org/x/tools v0.13.0 h1:Iey4qkscZuv0VvIt8E0neZjtPVQFSc870HQ448QgEmQ=
-golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
+golang.org/x/tools v0.14.0 h1:jvNa2pY0M4r62jkRQ6RwEZZyPcymeL9XZMLBbV7U2nc=
+golang.org/x/tools v0.14.0/go.mod h1:uYBEerGOWcJyEORxN+Ek8+TT266gXkNlHdJBwexUsBg=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -238,26 +242,26 @@ gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C
 gopkg.in/yaml.v3 v3.0.0/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-k8s.io/api v0.28.3 h1:Gj1HtbSdB4P08C8rs9AR94MfSGpRhJgsS+GF9V26xMM=
-k8s.io/api v0.28.3/go.mod h1:MRCV/jr1dW87/qJnZ57U5Pak65LGmQVkKTzf3AtKFHc=
-k8s.io/apiextensions-apiserver v0.28.3 h1:Od7DEnhXHnHPZG+W9I97/fSQkVpVPQx2diy+2EtmY08=
-k8s.io/apiextensions-apiserver v0.28.3/go.mod h1:NE1XJZ4On0hS11aWWJUTNkmVB03j9LM7gJSisbRt8Lc=
-k8s.io/apimachinery v0.28.3 h1:B1wYx8txOaCQG0HmYF6nbpU8dg6HvA06x5tEffvOe7A=
-k8s.io/apimachinery v0.28.3/go.mod h1:uQTKmIqs+rAYaq+DFaoD2X7pcjLOqbQX2AOiO0nIpb8=
-k8s.io/apiserver v0.28.3 h1:8Ov47O1cMyeDzTXz0rwcfIIGAP/dP7L8rWbEljRcg5w=
-k8s.io/client-go v0.28.3 h1:2OqNb72ZuTZPKCl+4gTKvqao0AMOl9f3o2ijbAj3LI4=
-k8s.io/client-go v0.28.3/go.mod h1:LTykbBp9gsA7SwqirlCXBWtK0guzfhpoW4qSm7i9dxo=
-k8s.io/cluster-bootstrap v0.28.3 h1:hGK3mJsmVGGvRJ61nyQcYNR9g/IYax75TbJcylTmZts=
-k8s.io/component-base v0.28.3 h1:rDy68eHKxq/80RiMb2Ld/tbH8uAE75JdCqJyi6lXMzI=
-k8s.io/component-base v0.28.3/go.mod h1:fDJ6vpVNSk6cRo5wmDa6eKIG7UlIQkaFmZN2fYgIUD8=
+k8s.io/api v0.28.4 h1:8ZBrLjwosLl/NYgv1P7EQLqoO8MGQApnbgH8tu3BMzY=
+k8s.io/api v0.28.4/go.mod h1:axWTGrY88s/5YE+JSt4uUi6NMM+gur1en2REMR7IRj0=
+k8s.io/apiextensions-apiserver v0.28.4 h1:AZpKY/7wQ8n+ZYDtNHbAJBb+N4AXXJvyZx6ww6yAJvU=
+k8s.io/apiextensions-apiserver v0.28.4/go.mod h1:pgQIZ1U8eJSMQcENew/0ShUTlePcSGFq6dxSxf2mwPM=
+k8s.io/apimachinery v0.28.4 h1:zOSJe1mc+GxuMnFzD4Z/U1wst50X28ZNsn5bhgIIao8=
+k8s.io/apimachinery v0.28.4/go.mod h1:wI37ncBvfAoswfq626yPTe6Bz1c22L7uaJ8dho83mgg=
+k8s.io/apiserver v0.28.4 h1:BJXlaQbAU/RXYX2lRz+E1oPe3G3TKlozMMCZWu5GMgg=
+k8s.io/client-go v0.28.4 h1:Np5ocjlZcTrkyRJ3+T3PkXDpe4UpatQxj85+xjaD2wY=
+k8s.io/client-go v0.28.4/go.mod h1:0VDZFpgoZfelyP5Wqu0/r/TRYcLYuJ2U1KEeoaPa1N4=
+k8s.io/cluster-bootstrap v0.28.4 h1:4MKNy1Qd9QY7pl47rSMGIORF+tm3CUaqC1M8U9bjn4Q=
+k8s.io/component-base v0.28.4 h1:c/iQLWPdUgI90O+T9TeECg8o7N3YJTiuz2sKxILYcYo=
+k8s.io/component-base v0.28.4/go.mod h1:m9hR0uvqXDybiGL2nf/3Lf0MerAfQXzkfWhUY58JUbU=
 k8s.io/klog/v2 v2.100.1 h1:7WCHKK6K8fNhTqfBhISHQ97KrnJNFZMcQvKp7gP/tmg=
 k8s.io/klog/v2 v2.100.1/go.mod h1:y1WjHnz7Dj687irZUWR/WLkLc5N1YHtjLdmgWjndZn0=
 k8s.io/kube-openapi v0.0.0-20230717233707-2695361300d9 h1:LyMgNKD2P8Wn1iAwQU5OhxCKlKJy0sHc+PcDwFB24dQ=
 k8s.io/kube-openapi v0.0.0-20230717233707-2695361300d9/go.mod h1:wZK2AVp1uHCp4VamDVgBP2COHZjqD1T68Rf0CM3YjSM=
 k8s.io/utils v0.0.0-20230406110748-d93618cff8a2 h1:qY1Ad8PODbnymg2pRbkyMT/ylpTrCM8P2RJ0yroCyIk=
 k8s.io/utils v0.0.0-20230406110748-d93618cff8a2/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
-sigs.k8s.io/cluster-api v1.6.0-beta.1 h1:8834scDzJLijFxtgxcLq+HWfS2fVrauEayysmMSwiS4=
-sigs.k8s.io/cluster-api v1.6.0-beta.1/go.mod h1:W209QjUpxNfjpa3KCMcMw4zScECS36cOcJoykM4KaWQ=
+sigs.k8s.io/cluster-api v1.6.0 h1:2bhVSnUbtWI8taCjd9lGiHExsRUpKf7Z1fXqi/IwYx4=
+sigs.k8s.io/cluster-api v1.6.0/go.mod h1:LB7u/WxiWj4/bbpHNOa1oQ8nq0MQ5iYlD0pGfRSBGLI=
 sigs.k8s.io/controller-runtime v0.16.3 h1:2TuvuokmfXvDUamSx1SuAOO3eTyye+47mJCigwG62c4=
 sigs.k8s.io/controller-runtime v0.16.3/go.mod h1:j7bialYoSn142nv9sCOJmQgDXQXxnroFU4VnX/brVJ0=
 sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd h1:EDPBXCAspyGV4jQlpZSudPeMmr1bNJefnuqLsRAsHZo=

main.go

@@ -10,6 +10,7 @@ import (
 	goRuntime "runtime"
 
 	flag "github.com/spf13/pflag"
+	_ "go.uber.org/automaxprocs"
 	"go.uber.org/zap/zapcore"
 	corev1 "k8s.io/api/core/v1"
 	apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
@@ -27,10 +28,10 @@ import (
 	metricsserver "sigs.k8s.io/controller-runtime/pkg/metrics/server"
 	ctrlwebhook "sigs.k8s.io/controller-runtime/pkg/webhook"
 
-	capsulev1alpha1 "github.com/projectcapsule/capsule/api/v1alpha1"
 	capsulev1beta1 "github.com/projectcapsule/capsule/api/v1beta1"
 	capsulev1beta2 "github.com/projectcapsule/capsule/api/v1beta2"
 	configcontroller "github.com/projectcapsule/capsule/controllers/config"
+	podlabelscontroller "github.com/projectcapsule/capsule/controllers/pod"
 	"github.com/projectcapsule/capsule/controllers/pv"
 	rbaccontroller "github.com/projectcapsule/capsule/controllers/rbac"
 	"github.com/projectcapsule/capsule/controllers/resources"
@@ -63,7 +64,6 @@ var (
 func init() {
 	utilruntime.Must(clientgoscheme.AddToScheme(scheme))
 
-	utilruntime.Must(capsulev1alpha1.AddToScheme(scheme))
 	utilruntime.Must(capsulev1beta1.AddToScheme(scheme))
 	utilruntime.Must(capsulev1beta2.AddToScheme(scheme))
 	utilruntime.Must(apiextensionsv1.AddToScheme(scheme))
@@ -77,7 +77,7 @@ func printVersion() {
 	setupLog.Info(fmt.Sprintf("Go OS/Arch: %s/%s", goRuntime.GOOS, goRuntime.GOARCH))
 }
 
-//nolint:maintidx,cyclop
+//nolint:maintidx
 func main() {
 	var enableLeaderElection, version bool
 
@@ -199,16 +199,6 @@ func main() {
 		os.Exit(1)
 	}
 
-	if err = (&capsulev1alpha1.Tenant{}).SetupWebhookWithManager(manager); err != nil {
-		setupLog.Error(err, "unable to create conversion webhook", "webhook", "capsulev1alpha1.Tenant")
-		os.Exit(1)
-	}
-
-	if err = (&capsulev1alpha1.CapsuleConfiguration{}).SetupWebhookWithManager(manager); err != nil {
-		setupLog.Error(err, "unable to create conversion webhook", "webhook", "capsulev1alpha1.CapsuleConfiguration")
-		os.Exit(1)
-	}
-
 	if err = (&capsulev1beta1.Tenant{}).SetupWebhookWithManager(manager); err != nil {
 		setupLog.Error(err, "unable to create conversion webhook", "webhook", "capsulev1beta1.Tenant")
 		os.Exit(1)
@@ -236,7 +226,7 @@ func main() {
 		route.Service(service.Handler()),
 		route.TenantResourceObjects(utils.InCapsuleGroups(cfg, tntresource.WriteOpsHandler())),
 		route.NetworkPolicy(utils.InCapsuleGroups(cfg, networkpolicy.Handler())),
-		route.Tenant(tenant.NameHandler(), tenant.RoleBindingRegexHandler(), tenant.IngressClassRegexHandler(), tenant.StorageClassRegexHandler(), tenant.ContainerRegistryRegexHandler(), tenant.HostnameRegexHandler(), tenant.FreezedEmitter(), tenant.ServiceAccountNameHandler(), tenant.ForbiddenAnnotationsRegexHandler(), tenant.ProtectedHandler()),
+		route.Tenant(tenant.NameHandler(), tenant.RoleBindingRegexHandler(), tenant.IngressClassRegexHandler(), tenant.StorageClassRegexHandler(), tenant.ContainerRegistryRegexHandler(), tenant.HostnameRegexHandler(), tenant.FreezedEmitter(), tenant.ServiceAccountNameHandler(), tenant.ForbiddenAnnotationsRegexHandler(), tenant.ProtectedHandler(), tenant.MetaHandler()),
 		route.OwnerReference(utils.InCapsuleGroups(cfg, ownerreference.Handler(cfg))),
 		route.Cordoning(tenant.CordoningHandler(cfg), tenant.ResourceCounterHandler(manager.GetClient())),
 		route.Node(utils.InCapsuleGroups(cfg, node.UserMetadataHandler(cfg, kubeVersion))),
@@ -291,6 +281,11 @@ func main() {
 		setupLog.Error(err, "unable to create controller", "controller", "EndpointSliceLabels")
 	}
 
+	if err = (&podlabelscontroller.MetadataReconciler{Client: manager.GetClient()}).SetupWithManager(ctx, manager); err != nil {
+		setupLog.Error(err, "unable to create controller", "controller", "PodLabels")
+		os.Exit(1)
+	}
+
 	if err = (&pv.Controller{}).SetupWithManager(manager); err != nil {
 		setupLog.Error(err, "unable to create controller", "controller", "PersistentVolume")
 		os.Exit(1)

pkg/api/forbidden_list.go

@@ -4,13 +4,21 @@
 package api
 
 import (
+	"fmt"
+	"reflect"
 	"regexp"
 	"sort"
 	"strings"
 )
 
-// +kubebuilder:object:generate=true
+const (
+	// ForbiddenLabelReason used as reason string to deny forbidden labels.
+	ForbiddenLabelReason = "ForbiddenLabel"
+	// ForbiddenAnnotationReason used as reason string to deny forbidden annotations.
+	ForbiddenAnnotationReason = "ForbiddenAnnotation"
+)
 
+// +kubebuilder:object:generate=true
 type ForbiddenListSpec struct {
 	Exact []string `json:"denied,omitempty"`
 	Regex string   `json:"deniedRegex,omitempty"`
@@ -37,3 +45,57 @@ func (in ForbiddenListSpec) RegexMatch(value string) (ok bool) {
 
 	return
 }
+
+type ForbiddenError struct {
+	key  string
+	spec ForbiddenListSpec
+}
+
+func NewForbiddenError(key string, forbiddenSpec ForbiddenListSpec) error {
+	return &ForbiddenError{
+		key:  key,
+		spec: forbiddenSpec,
+	}
+}
+
+//nolint:predeclared
+func (f *ForbiddenError) appendForbiddenError() (append string) {
+	append += "Forbidden are "
+	if len(f.spec.Exact) > 0 {
+		append += fmt.Sprintf("one of the following (%s)", strings.Join(f.spec.Exact, ", "))
+		if len(f.spec.Regex) > 0 {
+			append += " or "
+		}
+	}
+
+	if len(f.spec.Regex) > 0 {
+		append += fmt.Sprintf("matching the regex %s", f.spec.Regex)
+	}
+
+	return
+}
+
+func (f ForbiddenError) Error() string {
+	return fmt.Sprintf("%s is forbidden for the current Tenant. %s", f.key, f.appendForbiddenError())
+}
+
+func ValidateForbidden(metadata map[string]string, forbiddenList ForbiddenListSpec) error {
+	if reflect.DeepEqual(ForbiddenListSpec{}, forbiddenList) {
+		return nil
+	}
+
+	for key := range metadata {
+		var forbidden, matched bool
+		forbidden = forbiddenList.ExactMatch(key)
+		matched = forbiddenList.RegexMatch(key)
+
+		if forbidden || matched {
+			return NewForbiddenError(
+				key,
+				forbiddenList,
+			)
+		}
+	}
+
+	return nil
+}

pkg/api/forbidden_list_test.go

@@ -72,3 +72,50 @@ func TestForbiddenListSpec_RegexMatch(t *testing.T) {
 		}
 	}
 }
+
+func TestValidateForbidden(t *testing.T) {
+	type tc struct {
+		Keys          map[string]string
+		ForbiddenSpec ForbiddenListSpec
+		HasError      bool
+	}
+
+	for _, tc := range []tc{
+		{
+			Keys: map[string]string{"foobar": "", "thesecondkey": "", "anotherkey": ""},
+			ForbiddenSpec: ForbiddenListSpec{
+				Exact: []string{"foobar", "somelabelkey1"},
+			},
+			HasError: true,
+		},
+		{
+			Keys: map[string]string{"foobar": ""},
+			ForbiddenSpec: ForbiddenListSpec{
+				Exact: []string{"foobar.io", "somelabelkey1", "test-exact"},
+			},
+			HasError: false,
+		},
+		{
+			Keys: map[string]string{"foobar": "", "barbaz": ""},
+			ForbiddenSpec: ForbiddenListSpec{
+				Regex: "foo.*",
+			},
+			HasError: true,
+		},
+		{
+			Keys: map[string]string{"foobar": "", "another-annotation-key": ""},
+			ForbiddenSpec: ForbiddenListSpec{
+				Regex: "foo1111",
+			},
+			HasError: false,
+		},
+	} {
+		if tc.HasError {
+			assert.Error(t, ValidateForbidden(tc.Keys, tc.ForbiddenSpec))
+		}
+
+		if !tc.HasError {
+			assert.NoError(t, ValidateForbidden(tc.Keys, tc.ForbiddenSpec))
+		}
+	}
+}

pkg/api/metadata_const.go

@@ -0,0 +1,8 @@
+// Copyright 2020-2023 Project Capsule Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package api
+
+const (
+	TenantNameLabel = "kubernetes.io/metadata.name"
+)

pkg/api/pod_options.go

@@ -0,0 +1,11 @@
+// Copyright 2020-2023 Project Capsule Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package api
+
+// +kubebuilder:object:generate=true
+
+type PodOptions struct {
+	// Specifies additional labels and annotations the Capsule operator places on any Pod resource in the Tenant. Optional.
+	AdditionalMetadata *AdditionalMetadataSpec `json:"additionalMetadata,omitempty"`
+}

pkg/api/service_options.go

@@ -12,4 +12,8 @@ type ServiceOptions struct {
 	AllowedServices *AllowedServices `json:"allowedServices,omitempty"`
 	// Specifies the external IPs that can be used in Services with type ClusterIP. An empty list means no IPs are allowed. Optional.
 	ExternalServiceIPs *ExternalServiceIPsSpec `json:"externalIPs,omitempty"`
+	// Define the labels that a Tenant Owner cannot set for their Service resources.
+	ForbiddenLabels ForbiddenListSpec `json:"forbiddenLabels,omitempty"`
+	// Define the annotations that a Tenant Owner cannot set for their Service resources.
+	ForbiddenAnnotations ForbiddenListSpec `json:"forbiddenAnnotations,omitempty"`
 }

pkg/api/zz_generated.deepcopy.go

@@ -213,6 +213,26 @@ func (in *NetworkPolicySpec) DeepCopy() *NetworkPolicySpec {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PodOptions) DeepCopyInto(out *PodOptions) {
+	*out = *in
+	if in.AdditionalMetadata != nil {
+		in, out := &in.AdditionalMetadata, &out.AdditionalMetadata
+		*out = new(AdditionalMetadataSpec)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PodOptions.
+func (in *PodOptions) DeepCopy() *PodOptions {
+	if in == nil {
+		return nil
+	}
+	out := new(PodOptions)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *ResourceQuotaSpec) DeepCopyInto(out *ResourceQuotaSpec) {
 	*out = *in
@@ -270,6 +290,8 @@ func (in *ServiceOptions) DeepCopyInto(out *ServiceOptions) {
 		*out = new(ExternalServiceIPsSpec)
 		(*in).DeepCopyInto(*out)
 	}
+	in.ForbiddenLabels.DeepCopyInto(&out.ForbiddenLabels)
+	in.ForbiddenAnnotations.DeepCopyInto(&out.ForbiddenAnnotations)
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ServiceOptions.

pkg/utils/tenant_labels.go

@@ -11,14 +11,13 @@ import (
 	rbacv1 "k8s.io/api/rbac/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 
-	"github.com/projectcapsule/capsule/api/v1alpha1"
 	"github.com/projectcapsule/capsule/api/v1beta1"
 	"github.com/projectcapsule/capsule/api/v1beta2"
 )
 
 func GetTypeLabel(t runtime.Object) (label string, err error) {
 	switch v := t.(type) {
-	case *v1alpha1.Tenant, *v1beta1.Tenant, *v1beta2.Tenant:
+	case *v1beta1.Tenant, *v1beta2.Tenant:
 		return "capsule.clastix.io/tenant", nil
 	case *corev1.LimitRange:
 		return "capsule.clastix.io/limit-range", nil

pkg/webhook/namespace/errors.go

@@ -3,30 +3,6 @@
 
 package namespace
 
-import (
-	"fmt"
-	"strings"
-
-	capsuleapi "github.com/projectcapsule/capsule/pkg/api"
-)
-
-//nolint:predeclared
-func appendForbiddenError(spec *capsuleapi.ForbiddenListSpec) (append string) {
-	append += "Forbidden are "
-	if len(spec.Exact) > 0 {
-		append += fmt.Sprintf("one of the following (%s)", strings.Join(spec.Exact, ", "))
-		if len(spec.Regex) > 0 {
-			append += " or "
-		}
-	}
-
-	if len(spec.Regex) > 0 {
-		append += fmt.Sprintf("matching the regex %s", spec.Regex)
-	}
-
-	return
-}
-
 type namespaceQuotaExceededError struct{}
 
 func NewNamespaceQuotaExceededError() error {
@@ -36,35 +12,3 @@ func NewNamespaceQuotaExceededError() error {
 func (namespaceQuotaExceededError) Error() string {
 	return "Cannot exceed Namespace quota: please, reach out to the system administrators"
 }
-
-type namespaceLabelForbiddenError struct {
-	label string
-	spec  *capsuleapi.ForbiddenListSpec
-}
-
-func NewNamespaceLabelForbiddenError(label string, forbiddenSpec *capsuleapi.ForbiddenListSpec) error {
-	return &namespaceLabelForbiddenError{
-		label: label,
-		spec:  forbiddenSpec,
-	}
-}
-
-func (f namespaceLabelForbiddenError) Error() string {
-	return fmt.Sprintf("Label %s is forbidden for namespaces in the current Tenant. %s", f.label, appendForbiddenError(f.spec))
-}
-
-type namespaceAnnotationForbiddenError struct {
-	annotation string
-	spec       *capsuleapi.ForbiddenListSpec
-}
-
-func NewNamespaceAnnotationForbiddenError(annotation string, forbiddenSpec *capsuleapi.ForbiddenListSpec) error {
-	return &namespaceAnnotationForbiddenError{
-		annotation: annotation,
-		spec:       forbiddenSpec,
-	}
-}
-
-func (f namespaceAnnotationForbiddenError) Error() string {
-	return fmt.Sprintf("Annotation %s is forbidden for namespaces in the current Tenant. %s", f.annotation, appendForbiddenError(f.spec))
-}

pkg/webhook/namespace/user_metadata.go

@@ -5,8 +5,8 @@ package namespace
 
 import (
 	"context"
-	"fmt"
 
+	"github.com/pkg/errors"
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/types"
 	"k8s.io/client-go/tools/record"
@@ -14,6 +14,7 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
 
 	capsulev1beta2 "github.com/projectcapsule/capsule/api/v1beta2"
+	"github.com/projectcapsule/capsule/pkg/api"
 	capsulewebhook "github.com/projectcapsule/capsule/pkg/webhook"
 	"github.com/projectcapsule/capsule/pkg/webhook/utils"
 )
@@ -24,48 +25,6 @@ func UserMetadataHandler() capsulewebhook.Handler {
 	return &userMetadataHandler{}
 }
 
-func (r *userMetadataHandler) validateUserMetadata(tnt *capsulev1beta2.Tenant, recorder record.EventRecorder, labels map[string]string, annotations map[string]string) *admission.Response {
-	if tnt.Spec.NamespaceOptions != nil {
-		forbiddenLabels := tnt.Spec.NamespaceOptions.ForbiddenLabels
-
-		for label := range labels {
-			var forbidden, matched bool
-			forbidden = forbiddenLabels.ExactMatch(label)
-			matched = forbiddenLabels.RegexMatch(label)
-
-			if forbidden || matched {
-				recorder.Eventf(tnt, corev1.EventTypeWarning, "ForbiddenNamespaceLabel", fmt.Sprintf("Label %s is forbidden for a namespaces of the current Tenant ", label))
-
-				response := admission.Denied(NewNamespaceLabelForbiddenError(label, &forbiddenLabels).Error())
-
-				return &response
-			}
-		}
-	}
-
-	if tnt.Spec.NamespaceOptions == nil {
-		return nil
-	}
-
-	forbiddenAnnotations := tnt.Spec.NamespaceOptions.ForbiddenLabels
-
-	for annotation := range annotations {
-		var forbidden, matched bool
-		forbidden = forbiddenAnnotations.ExactMatch(annotation)
-		matched = forbiddenAnnotations.RegexMatch(annotation)
-
-		if forbidden || matched {
-			recorder.Eventf(tnt, corev1.EventTypeWarning, "ForbiddenNamespaceAnnotation", fmt.Sprintf("Annotation %s is forbidden for a namespaces of the current Tenant ", annotation))
-
-			response := admission.Denied(NewNamespaceAnnotationForbiddenError(annotation, &forbiddenAnnotations).Error())
-
-			return &response
-		}
-	}
-
-	return nil
-}
-
 func (r *userMetadataHandler) OnCreate(client client.Client, decoder *admission.Decoder, recorder record.EventRecorder) capsulewebhook.Func {
 	return func(ctx context.Context, req admission.Request) *admission.Response {
 		ns := &corev1.Namespace{}
@@ -81,10 +40,27 @@ func (r *userMetadataHandler) OnCreate(client client.Client, decoder *admission.
 			}
 		}
 
-		labels := ns.GetLabels()
-		annotations := ns.GetAnnotations()
+		if tnt.Spec.NamespaceOptions != nil {
+			err := api.ValidateForbidden(ns.ObjectMeta.Annotations, tnt.Spec.NamespaceOptions.ForbiddenAnnotations)
+			if err != nil {
+				err = errors.Wrap(err, "namespace annotations validation failed")
+				recorder.Eventf(tnt, corev1.EventTypeWarning, api.ForbiddenAnnotationReason, err.Error())
+				response := admission.Denied(err.Error())
 
-		return r.validateUserMetadata(tnt, recorder, labels, annotations)
+				return &response
+			}
+
+			err = api.ValidateForbidden(ns.ObjectMeta.Labels, tnt.Spec.NamespaceOptions.ForbiddenLabels)
+			if err != nil {
+				err = errors.Wrap(err, "namespace labels validation failed")
+				recorder.Eventf(tnt, corev1.EventTypeWarning, api.ForbiddenLabelReason, err.Error())
+				response := admission.Denied(err.Error())
+
+				return &response
+			}
+		}
+
+		return nil
 	}
 }
 
@@ -173,6 +149,26 @@ func (r *userMetadataHandler) OnUpdate(client client.Client, decoder *admission.
 			delete(annotations, key)
 		}
 
-		return r.validateUserMetadata(tnt, recorder, labels, annotations)
+		if tnt.Spec.NamespaceOptions != nil {
+			err := api.ValidateForbidden(annotations, tnt.Spec.NamespaceOptions.ForbiddenAnnotations)
+			if err != nil {
+				err = errors.Wrap(err, "namespace annotations validation failed")
+				recorder.Eventf(tnt, corev1.EventTypeWarning, api.ForbiddenAnnotationReason, err.Error())
+				response := admission.Denied(err.Error())
+
+				return &response
+			}
+
+			err = api.ValidateForbidden(labels, tnt.Spec.NamespaceOptions.ForbiddenLabels)
+			if err != nil {
+				err = errors.Wrap(err, "namespace labels validation failed")
+				recorder.Eventf(tnt, corev1.EventTypeWarning, api.ForbiddenLabelReason, err.Error())
+				response := admission.Denied(err.Error())
+
+				return &response
+			}
+		}
+
+		return nil
 	}
 }

pkg/webhook/service/validating.go

@@ -8,6 +8,7 @@ import (
 	"net"
 	"strings"
 
+	"github.com/pkg/errors"
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/fields"
 	"k8s.io/client-go/tools/record"
@@ -15,6 +16,7 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
 
 	capsulev1beta2 "github.com/projectcapsule/capsule/api/v1beta2"
+	"github.com/projectcapsule/capsule/pkg/api"
 	capsulewebhook "github.com/projectcapsule/capsule/pkg/webhook"
 	"github.com/projectcapsule/capsule/pkg/webhook/utils"
 )
@@ -68,6 +70,26 @@ func (r *handler) handleService(ctx context.Context, clt client.Client, decoder
 		return &response
 	}
 
+	if tnt.Spec.ServiceOptions != nil {
+		err := api.ValidateForbidden(svc.Annotations, tnt.Spec.ServiceOptions.ForbiddenAnnotations)
+		if err != nil {
+			err = errors.Wrap(err, "service annotations validation failed")
+			recorder.Eventf(&tnt, corev1.EventTypeWarning, api.ForbiddenAnnotationReason, err.Error())
+			response := admission.Denied(err.Error())
+
+			return &response
+		}
+
+		err = api.ValidateForbidden(svc.Labels, tnt.Spec.ServiceOptions.ForbiddenLabels)
+		if err != nil {
+			err = errors.Wrap(err, "service labels validation failed")
+			recorder.Eventf(&tnt, corev1.EventTypeWarning, api.ForbiddenLabelReason, err.Error())
+			response := admission.Denied(err.Error())
+
+			return &response
+		}
+	}
+
 	if svc.Spec.ExternalIPs == nil || (tnt.Spec.ServiceOptions == nil || tnt.Spec.ServiceOptions.ExternalServiceIPs == nil) {
 		return nil
 	}

pkg/webhook/tenant/metadata.go

@@ -0,0 +1,57 @@
+// Copyright 2020-2023 Project Capsule Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package tenant
+
+import (
+	"context"
+	"fmt"
+
+	"k8s.io/client-go/tools/record"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
+
+	capsulev1beta2 "github.com/projectcapsule/capsule/api/v1beta2"
+	capsuleapi "github.com/projectcapsule/capsule/pkg/api"
+	capsulewebhook "github.com/projectcapsule/capsule/pkg/webhook"
+	"github.com/projectcapsule/capsule/pkg/webhook/utils"
+)
+
+type metaHandler struct{}
+
+func MetaHandler() capsulewebhook.Handler {
+	return &metaHandler{}
+}
+
+func (h *metaHandler) OnCreate(_ client.Client, decoder *admission.Decoder, _ record.EventRecorder) capsulewebhook.Func {
+	return func(ctx context.Context, req admission.Request) *admission.Response {
+		return nil
+	}
+}
+
+func (h *metaHandler) OnDelete(client.Client, *admission.Decoder, record.EventRecorder) capsulewebhook.Func {
+	return func(context.Context, admission.Request) *admission.Response {
+		return nil
+	}
+}
+
+func (h *metaHandler) OnUpdate(_ client.Client, decoder *admission.Decoder, _ record.EventRecorder) capsulewebhook.Func {
+	return func(ctx context.Context, req admission.Request) *admission.Response {
+		tenant := &capsulev1beta2.Tenant{}
+		if err := decoder.Decode(req, tenant); err != nil {
+			return utils.ErroredResponse(err)
+		}
+
+		if tenant.Labels != nil {
+			if tenant.Labels[capsuleapi.TenantNameLabel] != "" {
+				if tenant.Labels[capsuleapi.TenantNameLabel] != tenant.Name {
+					response := admission.Denied(fmt.Sprintf("tenant label '%s' is immutable", capsuleapi.TenantNameLabel))
+
+					return &response
+				}
+			}
+		}
+
+		return nil
+	}
+}