[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/projectcapsule/capsule	v0.14.6 → v0.15.2

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

projectcapsule/capsule (github.com/projectcapsule/capsule)

v0.15.2

Compare Source

Changelog

✨ New Features

• caef51a: feat(helm): add openshift toggle (#​2238) (@​sandert-k8s)

🐛 Bug fixes

• 394a90a: fix: remove unecessary default bool pointers (#​2258) (@​oliverbaehler)

🛠 Dependency updates

• 362089e: fix(deps): update module github.com/prometheus/client_golang to v1.25.0 (#​2256) (@​renovate[bot])

Full Changelog: projectcapsule/capsule@v0.15.1...v0.15.2

Check out what's new in this release

Docker Images

• ghcr.io/projectcapsule/capsule:0.15.2
• ghcr.io/projectcapsule/capsule:latest

Helm Chart
View this release on Artifact Hub or use the OCI helm chart:

• ghcr.io/projectcapsule/charts/capsule:0.15.2

Review the Major Changes section first before upgrading to a new version

[!IMPORTANT]
Kubernetes compatibility

Note that the Capsule project offers support only for the latest minor version of Kubernetes.
Backwards compatibility with older versions of Kubernetes and OpenShift is offered by vendors.

Kubernetes version	Minimum required
v1.36	>= 1.36.0

Thanks to all the contributors! 🚀 🦄

v0.15.1

Compare Source

Changelog

✨ New Features

• b11b7d0: feat(e2e): speed up e2e tests (#​2251) (@​Svarrogh1337)
• 6d92444: feat: add listenersets default gateway mutation (#​2255) (@​oliverbaehler)

Full Changelog: projectcapsule/capsule@v0.15.0...v0.15.1

Check out what's new in this release

Docker Images

• ghcr.io/projectcapsule/capsule:0.15.1
• ghcr.io/projectcapsule/capsule:latest

Helm Chart
View this release on Artifact Hub or use the OCI helm chart:

• ghcr.io/projectcapsule/charts/capsule:0.15.1

Review the Major Changes section first before upgrading to a new version

[!IMPORTANT]
Kubernetes compatibility

Note that the Capsule project offers support only for the latest minor version of Kubernetes.
Backwards compatibility with older versions of Kubernetes and OpenShift is offered by vendors.

Kubernetes version	Minimum required
v1.36	>= 1.36.0

Thanks to all the contributors! 🚀 🦄

v0.15.0

Compare Source

Changelog

⚠️ Security

• GHSA-p8j8-x28r-3c9v Critical: Authorization bypass via namespaces/status and namespaces/finalize, whose ownership gate lives only in the mutating webhook, enabling system-namespace hijack. However these permissions are not provided to users by default. You are only affected if you provide users with these permissions. @​euriconicacio
• GHSA-4qv9-xv9f-w5xh High: DRA DeviceClass allow-list bypass: only first device request validated, enabling cross-tenant hardware access @​manus-use
• GHSA-wpv2-mpqq-vv52 Moderate: Forgeable projectcapsule.dev/managed-by skip label lets a tenant owner bypass all Capsule enforce rules (e.g. enforce.metadata) on namespaced and cluster-scoped objects @​IamwhatIamSY
• GHSA-jc72-9675-pcmv Moderate: Capsule: uncompiled serviceOptions forbidden deniedRegex panics the Service admission webhook (tenant DoS) @​manus-pi
• GHSA-793w-c9f9-m6f8 Moderate: Unvalidated Tenant class allowedRegex fields cause regexp.MustCompile panic and persistent tenant admission denial @​manus-pi

✨ New Features

• 9b658a9: feat(config): migrate config renovate.json (#​2239) (@​renovate[bot])
• 4c30567: feat(controller,api): Implement resource-permit functionality (#​1959) (@​bakito)
• e44a6d9: feat: add AGENTS.md file (#​2149) (@​oliverbaehler)
• 832937d: feat: add apply policies to g/tr (#​2161) (@​oliverbaehler)
• 0fd73eb: feat: add ingress cidr enforcement (#​2207) (@​oliverbaehler)
• a377a22: feat: add networkpolicy cidr enforcement (#​2203) (@​oliverbaehler)
• 7e63ac2: feat: add pdb enforcement (#​2196) (@​oliverbaehler)
• 50ff3fc: feat: add pullpolicy mutation (#​2192) (@​oliverbaehler)
• 5318490: feat: add read-only filesystem mutation (#​2191) (@​oliverbaehler)
• 958e904: feat: add rules nesting for workloads (#​2193) (@​oliverbaehler)
• 761e3db: feat: add scheduler mutation (#​2184) (@​oliverbaehler)
• b89bf7a: feat: add storage volumes rules (#​2205) (@​oliverbaehler)
• 1056d90: feat: add workload placement api (#​2174) (@​oliverbaehler)
• 06e0fb9: feat: add workload targets (#​2188) (@​oliverbaehler)
• dd100ba: feat: migrate openshift e2e from minc to microshift (#​2246) (@​sandert-k8s)
• e6d8d8e: feat: reconsider conditions api for rules (#​2176) (@​oliverbaehler)

🐛 Bug fixes

• aabc409: fix(api): match mixed-case allowed list entries (#​2165) (@​tikket1)
• fa0efd9: fix(chart): use configured kubectl entrypoints in hooks (#​2202) (@​winrarr)
• ca80b25: fix: avoid nil panics for dra inspection (#​2164) (@​oliverbaehler)
• 853bd41: fix: avoid pvc selector mutations on update (#​2204) (@​oliverbaehler)
• b98f74f: fix: coordinate legacy quota recounts with admission reservations (#​2250) (@​oliverbaehler)
• e391826: fix: correct readme badge urls (#​2243) (@​bakito)
• 0718f97: fix: dedicated namespace clean up controller (#​2171) (@​oliverbaehler)
• 05bc718: fix: disallow orphan namespaces on tenant deletion (#​2197) (@​oliverbaehler)
• 9f69543: fix: do not emit events on dry-run operations (#​2210) (@​oliverbaehler)
• 3428a26: fix: handle ns subersources actions and disallow metadata bypasses (#​2166) (@​bakito)
• 061a9c1: fix: prioritize rbac repliciation speed for tenant reconciler (#​2245) (@​oliverbaehler)
• 0cdfcd4: fix: reduce memory footprint for collectors (#​2146) (@​oliverbaehler)
• 2a8f08b: fix: require controller identity for rule skips (@​oliverbaehler)
• 411472b: fix: validate Service forbidden metadata regexes (#​2178) (@​oliverbaehler)
• e2b7ce8: fix: validate tenant regular expression on admission (#​2169) (@​bakito)

🛠 Dependency updates

• fff51ce: fix(deps): update k8s.io/utils digest to cf1189d (#​1867) (@​renovate[bot])
• b7fd369: fix(deps): update module filippo.io/age to v1.3.2 (#​2136) (@​renovate[bot])
• 89fdac6: fix(deps): update module github.com/go-sprout/sprout to v1.1.1 (#​2122) (@​renovate[bot])
• 727b4d4: fix(deps): update module github.com/go-sprout/sprout to v1.1.2 (#​2185) (@​renovate[bot])
• 2485fbc: fix(deps): update module github.com/prometheus/client_model to v0.6.3 (#​2140) (@​renovate[bot])
• aa9b481: fix(deps): update module github.com/xhit/go-str2duration/v2 to v2.2.0 (#​2173) (@​renovate[bot])
• 4831931: fix(deps): update module golang.org/x/sync to v0.24.0 (#​2213) (@​renovate[bot])

📖 Documentation updates

• afaf980: docs: add gemara assesement structure (#​2214) (@​oliverbaehler)

🚀 Build process updates

• ff814d6: ci: add osps baseline workflows (#​2226) (@​oliverbaehler)
• 6e0708a: ci: correct formating for osps baseline publishing (#​2236) (@​oliverbaehler)
• 631ed36: ci: correct formating for osps baseline publishing (#​2237) (@​oliverbaehler)

Full Changelog: projectcapsule/capsule@v0.14.6...v0.15.0

Check out what's new in this release

Docker Images

• ghcr.io/projectcapsule/capsule:0.15.0
• ghcr.io/projectcapsule/capsule:latest

Helm Chart
View this release on Artifact Hub or use the OCI helm chart:

• ghcr.io/projectcapsule/charts/capsule:0.15.0

Review the Major Changes section first before upgrading to a new version

[!IMPORTANT]
Kubernetes compatibility

Note that the Capsule project offers support only for the latest minor version of Kubernetes.
Backwards compatibility with older versions of Kubernetes and OpenShift is offered by vendors.

Kubernetes version	Minimum required
v1.36	>= 1.36.0

Thanks to all the contributors! 🚀 🦄

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.