Changelog

✨ New Features

• 96f0806: feat(chart): bind default owner clusterroles in strict rbac mode (#2088) (@Svarrogh1337)
• bdcdcef: feat: add globalresourcequota api (#2068) (@oliverbaehler)
• 957288b: feat: bump supported kubernetes version to 1.36 (#2072) (@oliverbaehler)
• fed61d2: feat: replicating resources upon namespace creation (#2080) (@prometherion)
• 65a4e19: feat: requests and limit policies (#2095) (@oliverbaehler)

🐛 Bug fixes

• bddb976: fix(helm): fix manager.rbac.strict being no-op (#2084) (@Svarrogh1337)
• 5944210: fix: allowing replication of cluster scoped objects via gtr (#2090) (@prometherion)
• 305cabd: fix: consistently reconcile quotas from rules (#2083) (@oliverbaehler)
• 93fafdc: fix: do not mutate on update and bound pvcs (#2073) (@oliverbaehler)
• fbda18f: fix: missing leader election namespace when running out-of-cluster (#2079) (@prometherion)
• 62d8d62: fix: revert pv labeling to dircet api reads (#2085) (@oliverbaehler)

🛠 Dependency updates

• 1b633d6: fix(deps): update module github.com/go-logr/logr to v1.4.4 (#2065) (@renovate[bot])
• 4f0a4c9: fix(deps): update module github.com/google/cel-go to v0.30.0 (#2061) (@renovate[bot])
• 06b2f63: fix(deps): update module github.com/prometheus/client_golang to v1.24.1 (#2064) (@renovate[bot])
• a0154a9: fix(deps): update module go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp to v0.69.0 (#2010) (@renovate[bot])
• 7c9b989: fix(deps): update module google.golang.org/grpc to v1.82.1 (#2060) (@renovate[bot])
• bd197b8: fix(deps): update module google.golang.org/grpc to v1.83.0 (#2078) (@renovate[bot])
• 8d111c7: fix(deps): update module sigs.k8s.io/cluster-api to v1.13.4 (#2056) (@renovate[bot])
• d924534: fix(deps): update module sigs.k8s.io/gateway-api to v1.6.1 (#2027) (@renovate[bot])

🛡️ Security updates

• 06187e5: sec: use default serviceaccount for tenantresources by default (#2029) (@oliverbaehler)

Full Changelog: v0.13.11...v0.14.0

Check out what's new in this release

Docker Images

• ghcr.io/projectcapsule/capsule:0.14.0
• ghcr.io/projectcapsule/capsule:latest

Helm Chart
View this release on Artifact Hub or use the OCI helm chart:

• ghcr.io/projectcapsule/charts/capsule:0.14.0

Review the Major Changes section first before upgrading to a new version

Thanks to all the contributors! 🚀 🦄

v0.14.0 Latest

Latest

Compare

Choose a tag to compare

Changelog

✨ New Features

• 2252c53: feat(performance): removed duplicate client calls from all admission paths (#2054) (@oliverbaehler)

🐛 Bug fixes

• 613b43a: fix: correct tenant ownerships resolution with deduplicaiton (#2059) (@oliverbaehler)

Full Changelog: v0.13.10...v0.13.11

Check out what's new in this release

Docker Images

• ghcr.io/projectcapsule/capsule:0.13.11
• ghcr.io/projectcapsule/capsule:latest

Helm Chart
View this release on Artifact Hub or use the OCI helm chart:

• ghcr.io/projectcapsule/charts/capsule:0.13.11

Review the Major Changes section first before upgrading to a new version

Thanks to all the contributors! 🚀 🦄

v0.13.11

Compare

Choose a tag to compare

Changelog

✨ New Features

• f1b760a: feat(rules): improve metadata enforcement and add ingress rules (#2050) (@oliverbaehler)
• e8ac32d: feat: add administrator capabilities (#2049) (@oliverbaehler)
• c17e4fa: feat: add leader-election tuning (#2008) (@oliverbaehler)
• 30e4f9d: feat: add managed-by labels to emitted events (#2028) (@oliverbaehler)
• 9ee5468: feat: add rolebindings to rules api (#2032) (@oliverbaehler)
• 99e0522: feat: implement performance optimizations (#2045) (@oliverbaehler)

🐛 Bug fixes

• 388d9f3: fix(webhook): fix hostname validation logic (#2015) (@boettluSICKAG)
• abff646: fix: Enforce namespace metadata validation for capsule users only (#2042) (@tom-stockwell)
• 15a848d: fix: allow administrator operations on tenant namespaces (#2037) (@oliverbaehler)

🛠 Dependency updates

• f5bfb72: fix(deps): update module google.golang.org/grpc to v1.82.0 (#2033) (@renovate[bot])
• 509516e: fix(deps): update module k8s.io/klog/v2 to v2.140.0 (#2016) (@renovate[bot])
• a14db27: fix(deps): update opentelemetry-go monorepo to v1.44.0 (#2011) (@renovate[bot])

🚀 Build process updates

• 1fadf5f: ci: add fossa project.team name (#2046) (@Svarrogh1337)
• 16bc219: ci: add fossa project.team name (#2047) (@Svarrogh1337)

Full Changelog: v0.13.9...v0.13.10

Check out what's new in this release

Docker Images

• ghcr.io/projectcapsule/capsule:0.13.10
• ghcr.io/projectcapsule/capsule:latest

Helm Chart
View this release on Artifact Hub or use the OCI helm chart:

• ghcr.io/projectcapsule/charts/capsule:0.13.10

Review the Major Changes section first before upgrading to a new version

Thanks to all the contributors! 🚀 🦄

v0.13.10

Compare

Choose a tag to compare

Changelog

🐛 Bug fixes

• 8d52116: fix: add cache timeout for rbac controller (#2006) (@oliverbaehler)

Full Changelog: v0.13.8...v0.13.9

Check out what's new in this release

Docker Images

• ghcr.io/projectcapsule/capsule:0.13.9
• ghcr.io/projectcapsule/capsule:latest

Helm Chart
View this release on Artifact Hub or use the OCI helm chart:

• ghcr.io/projectcapsule/charts/capsule:0.13.9

Review the Major Changes section first before upgrading to a new version

Thanks to all the contributors! 🚀 🦄

v0.13.9

Compare

Choose a tag to compare

⚠️ Security

• GHSA-jr6p-8pjj-mfx6 Moderate: Incomplete fix of CVE-2026-22872: TenantResource RawItems and Generators still allow cluster-scoped resource creation (cross-tenant privilege escalation) - Without impersonation
• GHSA-68cj-mvg9-rgm2 Moderate: CapsuleConfiguration NodeMetadata regex fields lack webhook validation, allowing MustCompile panic on all Node admission requests

Changelog

✨ New Features

• 8e1cc91: feat(globalcustomquota): add support for not-equals field selector (#1997) (@sandert-k8s)
• 77d1810: feat(chart): add built-in prometheusrules (#1990) (@oliverbaehler)
• 77d1810: feat: add metadata enforcement (#1990) (@oliverbaehler) Read More
• 0c22ce8: feat: define interface for event recorder (#1985) (@bakito)
• 6a762e7: feat: add improve webhook validation for regex properties (#1995) (@oliverbaehler)
• 6a762e7: feat: add metric recorder for all objects with conditions (#1995) (@oliverbaehler)

🐛 Bug fixes

• 4b07463: fix: metric recorders for all conditionals (#1998) (@oliverbaehler)

🛠 Dependency updates

• 6fbd472: fix(deps): update module sigs.k8s.io/cluster-api to v1.13.3 (#1988) (@renovate[bot])

Full Changelog: v0.13.7...v0.13.8

Check out what's new in this release

Docker Images

• ghcr.io/projectcapsule/capsule:0.13.8
• ghcr.io/projectcapsule/capsule:latest

Helm Chart
View this release on Artifact Hub or use the OCI helm chart:

• ghcr.io/projectcapsule/charts/capsule:0.13.8

Review the Major Changes section first before upgrading to a new version

Thanks to all the contributors! 🚀 🦄

v0.13.8

Compare

Choose a tag to compare

Changelog

⚠️ Security

• GHSA-gxjc-74v5-3vx3 Moderate: Malformed ForbiddenAnnotations.Regex can bypass Tenant validation and trigger namespace admission panic
• GHSA-gjw4-3v3v-rqxg High: Tenant owner bypasses Capsule's forbidden namespace/service/node label and annotation enforcement because ForbiddenListSpec.ExactMatch runs sort.SearchStrings (byte order) over a slice sorted case-insensitively
• GHSA-f94q-w3w8-cj67 Moderate: hostnameRegexHandler.OnUpdate validates stale (old) Tenant regex, allowing invalid AllowedHostnames regex to bypass webhook validation

✨ New Features

• 755cef5: feat(rules): add service enforcement rules (#1982) (@oliverbaehler) - Read More
• 755cef5: feat(chart): add flowschema and apipriority (#1982) (@oliverbaehler)
• 0b11582: feat: add scheduler enforcement rule (#1971) (@oliverbaehler) - Read More

🐛 Bug fixes

• 8d89d68: fix(sec): corrects validation for regex objects (hostname and forbidden (#1983) (@oliverbaehler)
• 4e9e529: fix(webhook): remove dead diff code block that panics on nil namespace metadata (#1976) (@jouve)

Full Changelog: v0.13.6...v0.13.7

Check out what's new in this release

Docker Images

• ghcr.io/projectcapsule/capsule:0.13.7
• ghcr.io/projectcapsule/capsule:latest

Helm Chart
View this release on Artifact Hub or use the OCI helm chart:

• ghcr.io/projectcapsule/charts/capsule:0.13.7

Review the Major Changes section first before upgrading to a new version

Thanks to all the contributors! 🚀 🦄

v0.13.7

Compare

Choose a tag to compare

Changelog

🐛 Bug fixes

• f84f9d6: fix(webhook): Release annotation on bounded ResourcePoolClaim (#1965) (@FerroO2000)
• af2f377: fix: add serviceaccount validation for tenantowners and tenants (#1966) (@oliverbaehler)
• af2f377: fix: racing condition for terminating namespaces (#1966) (@oliverbaehler)
• af2f377: fix: fix typo in namespaces/finalize (#1966) (@oliverbaehler)

Full Changelog: v0.13.5...v0.13.6

Check out what's new in this release

Docker Images

• ghcr.io/projectcapsule/capsule:0.13.6
• ghcr.io/projectcapsule/capsule:latest

Helm Chart
View this release on Artifact Hub or use the OCI helm chart:

• ghcr.io/projectcapsule/charts/capsule:0.13.6

Review the Major Changes section first before upgrading to a new version

Thanks to all the contributors! 🚀 🦄

v0.13.6

Compare

Choose a tag to compare

Changelog

✨ New Features

• e2aa501: feat(chart): allow additional controller rbac (#1958) (@oliverbaehler)
• 327296a: feat: add action type for rules and regexp cache (#1957) (@oliverbaehler)
• 34262c5: feat: add rule-based QOS enforcement (#1961) (@oliverbaehler)

🐛 Bug fixes

• 34262c5: fix: skip terminating namespaces for Tenantresources and GlobalTenantResources (#1961) (@oliverbaehler)
• 34262c5: fix: migrate registry rules api (#1961) (@oliverbaehler)
• 34262c5: fix: migrate promotions rules api (#1961) (@oliverbaehler)
• 6120885: fix: translate serviceaccounts to type serviceaccount not user (#1956) (@oliverbaehler)

Full Changelog: v0.13.4...v0.13.5

Check out what's new in this release

Docker Images

• ghcr.io/projectcapsule/capsule:0.13.5
• ghcr.io/projectcapsule/capsule:latest

Helm Chart
View this release on Artifact Hub or use the OCI helm chart:

• ghcr.io/projectcapsule/charts/capsule:0.13.5

Review the Major Changes section first before upgrading to a new version

Thanks to all the contributors! 🚀 🦄

v0.13.5

Compare

Choose a tag to compare

Changelog

🐛 Bug fixes

• 4c72af7: fix: best effort patch reconciling status (#1952) (@oliverbaehler)
• 4c4d927: fix: use different match strategy for truthy and match (#1953) (@oliverbaehler)

Full Changelog: v0.13.3...v0.13.4

Check out what's new in this release

Docker Images

• ghcr.io/projectcapsule/capsule:0.13.4
• ghcr.io/projectcapsule/capsule:latest

Helm Chart
View this release on Artifact Hub or use the OCI helm chart:

• ghcr.io/projectcapsule/charts/capsule:0.13.4

Review the Major Changes section first before upgrading to a new version

Thanks to all the contributors! 🚀 🦄

v0.13.4

Compare

Choose a tag to compare

Changelog

🐛 Bug fixes

• 780be87: fix: preserve ca-bundles injected from external providers (#1948) (@oliverbaehler)

🛠 Dependency updates

• 999869d: feat(deps): bump golang 1.26.4 (#1949) (@oliverbaehler)
• 3fc945b: fix(deps): update module sigs.k8s.io/cluster-api to v1.13.2 (#1874) (@renovate[bot])

Full Changelog: v0.13.2...v0.13.3

Check out what's new in this release

Docker Images

• ghcr.io/projectcapsule/capsule:0.13.3
• ghcr.io/projectcapsule/capsule:latest

Helm Chart
View this release on Artifact Hub or use the OCI helm chart:

• ghcr.io/projectcapsule/charts/capsule:0.13.3

Review the Major Changes section first before upgrading to a new version

Thanks to all the contributors! 🚀 🦄

v0.13.3

Compare

Choose a tag to compare