What's New ✨

Events 📅

Security 🔒

• Advisory GHSA-pvhj-cqh2-rpq8 - High - Tenant Owners could grant themselves cross-tenant and cluster-scoped read access through clusterResources in a namespaced ProxySetting. Affects Capsule Proxy <= 0.14.1.
• (Enterprise): Projectcapsule is now providing their releases on an immutable OCI registry, which allows users to verify the integrity of the images and provides a more secure way to distribute the images. Which is not possible on GHCR due to the fact that GHCR does not support immutability of images.
• [OpenShift] Added documentation showing how to prevent CapsuleUsers from modifying OpenShift-managed namespace labels and annotations, including openshift.io/run-level, to help prevent SecurityContextConstraints bypasses. Read More

Breaking Changes ⚠️

• Proxy: A namespaced ProxySetting can no longer grant clusterResources. Move existing grants to a GlobalProxySettings, which requires the ProxyClusterScoped feature gate.

Features ✨

• Capsule: Resource policies for TenantResource and GlobalTenantResource add conditional application and control over resource adoption, protection, and cleanup.

• Capsule: The rules API now offers more ways to configure and enforce namespace profiles:

  • Workload Placement Mutation: Configure schedulers, node selectors, tolerations, affinity, and topology spread constraints on new Pods with merge or replace actions.
  • Workload User Namespace Mutation: Request separate user namespaces for new Pods with security.hostUsers: false.
  • Workload Read-only Root Filesystem Mutation: Set security.readOnlyRootFilesystem for selected regular, init, and newly added ephemeral containers.
  • Workload Seccomp Mutation: Default or replace Pod-level seccomp profiles, including node-local profile paths.
  • Workload AppArmor Mutation: Default or replace Pod-level AppArmor profiles, including named profiles loaded on nodes.
  • Mutation Conditions: Apply individual mutation entries conditionally with CEL expressions that inspect the resource and admission request.
  • Workload Placement Enforcement: Control which schedulers, node selectors, tolerations, affinity rules, and topology spread constraints workloads may use.
  • Workload Type Enforcement: Allow, deny, or audit selected workload kinds, such as blocking DaemonSets in application namespaces.
  • Pod Disruption Budget Enforcement: Require room for voluntary evictions, prevent overlapping PDBs, and control unhealthy Pod eviction. Checks cover PDB and workload changes, including controller scaling.
  • Workload Seccomp Enforcement: Restrict effective seccomp profile types and local profile paths across selected Pods and containers.
  • Workload AppArmor Enforcement: Restrict effective AppArmor profiles, including container overrides and named profiles loaded on nodes.
  • NetworkPolicy Ingress and Egress CIDR Enforcement: Allow, deny, or audit IPv4 and IPv6 ingress and egress CIDR grants in selected namespaces, accounting for overlapping ranges and ipBlock.except.
  • Enforcement Conditions: Apply an enforcement block only to resources and admission requests that match your CEL conditions.
  • Additional PersistentVolume Access: Authorize restore handoffs and other explicit PVC bindings to PVs without a Tenant label, using namespace profiles, read-only label selectors, audiences, and CEL conditions on the referenced volume. Existing Tenant ownership labels remain authoritative.

Documentation 📚

We have added new documentation for a better experience. See the following topics:

• Best Practices for Tenants
• Best Practices for Networking
• Best Practices for Workloads

Ecosystem 🌐

Dedicated Addons joining the capsule ecosystem

• Change Windows: Change Windows helps organizations plan routine IT maintenance with fewer surprises and less manual coordination. It gives teams advance notice and can prevent conflicting changes while planned work is underway. It can also pause development environments overnight and bring them back in the morning, helping control infrastructure costs. These routines run automatically on your Kubernetes platform, so teams can spend less time coordinating maintenance and more time delivering services.

• Resource Permits: Resource Permits helps platform teams offer services without handling every request manually or handing out broad administrator access. Teams request a predefined service, reviewers decide whether to approve it, and Kubernetes tracks the resources and their lifecycle. Requests can be made through the Kubernetes API, the kubectl plugin, or Headlamp.

Newly added documentation to integrate Capsule with other applications:

• Opensearch
• External Secrets Operator
• Headlamp Plugin

Roadmap 🗺️

In the upcoming releases we are planning to work on the following features:

• Capsule: Porting more Properties to the Namespace Rule Approach.
• Capsule: Adding triggers for Global/TenantResources.
• Capsule: Adding healthChecks for Global/TenantResources.
• Capsule: Adding Generic Implementation for Global/TenantResources.
• Website: Improving the documentation with more examples and use-cases.