Skip to content

feat: add ruleset api and new oci api#1844

Merged
oliverbaehler merged 32 commits intoprojectcapsule:mainfrom
oliverbaehler:feat/oci-registry
Jan 27, 2026
Merged

feat: add ruleset api and new oci api#1844
oliverbaehler merged 32 commits intoprojectcapsule:mainfrom
oliverbaehler:feat/oci-registry

Conversation

@oliverbaehler
Copy link
Collaborator

@oliverbaehler oliverbaehler commented Jan 22, 2026 •
edited
Loading

By default a rule is applied to all namespaces within a Tenant. However you can select a subset of namespaces to apply the rule on, by using a namespaceSelector. This selector works the same way as a standard Kubernetes label selector:

---
apiVersion: capsule.clastix.io/v1beta2
kind: Tenant
metadata:
  name: solar
spec:
  ...
  rules:
    # Matches all Namespaces and enforces the rule for all of them
    - enforce:
        registries:
        -  url: "harbor/v2/customer-registry/.*"
           policy: [ "IfNotPresent" ]

    # Select a subset of namespaces (enviornment=prod) to allow further registries
    - namespaceSelector:
        matchExpressions:
          - key: env
            operator: In
            values: ["prod"]
      enforce:    
        registries:
         -  url: "harbor/v2/prod-registry/.*"
            policy: [ "IfNotPresent" ]

Note that rules are combined together. In the above example, all namespaces within the solar tenant will be enforced to use images from harbor/v2/customer-registry/, while namespaces labeled with env=prod will also be allowed to pull images from harbor/v2/prod-registry/.

@oliverbaehler
fix(controller): decode old object for delete requests
9d887cd 
Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com>
@oliverbaehler
chore: modernize golang
221e0e8 
Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com>
@oliverbaehler
chore: modernize golang
052660e 
Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com>
@oliverbaehler
chore: modernize golang
7c418d0 
Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com>
@oliverbaehler
Merge branch 'main' of github.com:projectcapsule/capsule
7db5048
@oliverbaehler
Merge branch 'main' of github.com:projectcapsule/capsule
98f9add
@oliverbaehler
Merge branch 'main' of github.com:projectcapsule/capsule
f448bdf
@oliverbaehler
Merge branch 'main' of github.com:projectcapsule/capsule
033e098
@oliverbaehler
Merge branch 'main' of github.com:projectcapsule/capsule
21cd932
@oliverbaehler
Merge branch 'main' of github.com:projectcapsule/capsule
1e28f1b
@oliverbaehler
fix(config): remove usergroups default
668c847 
Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com>
@oliverbaehler
fix(config): remove usergroups default
5b05b17 
Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com>
@oliverbaehler
sec(GHSA-2ww6-hf35-mfjm): intercept namespace subresource
2327f9c 
Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com>
@oliverbaehler
feat(api): add rulestatus api
1cc70ee 
Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com>
@oliverbaehler
chore: conflicts
3c17c8f 
Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com>
@oliverbaehler
chore: conflicts
3203d4d 
Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com>
@oliverbaehler
chore: conflicts
b41cbdf 
Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com>
@oliverbaehler
chore: conflicts
b926322 
Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com>
@oliverbaehler
chore: conflicts
98c1732 
Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com>
@oliverbaehler
chore: conflicts
7747ade 
Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com>
@oliverbaehler
chore: conflicts
44e27bc 
Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com>
@oliverbaehler
chore: conflicts
d771a15 
Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com>
@oliverbaehler
chore: conflicts
17544df 
Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com>
Svarrogh1337
Svarrogh1337 approved these changes Jan 23, 2026
View reviewed changes
Copy link
Collaborator

@Svarrogh1337 Svarrogh1337 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@oliverbaehler
chore: conflicts
3cce446 
Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com>
@oliverbaehler
chore: conflicts
a671091 
Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com>
@oliverbaehler
chore: conflicts
b622023 
Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com>
@oliverbaehler
feat(api): add rulestatus api
174d884 
Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com>
@oliverbaehler
feat(api): add rulestatus api
f41a3f3 
Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com>
@oliverbaehler
feat(api): add rulestatus api
548803e 
Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com>
@oliverbaehler
feat(api): add rulestatus api
50c04c2 
Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com>
@oliverbaehler
feat(api): add rulestatus api
820f6b5 
Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com>
@oliverbaehler
feat(api): add rulestatus api
45531a5 
Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com>
@oliverbaehler oliverbaehler merged commit a6b830b into projectcapsule:main Jan 27, 2026
15 of 20 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Svarrogh1337 Svarrogh1337 Svarrogh1337 approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@oliverbaehler @Svarrogh1337