chore(deps): update helm release capsule to v0.13.1

[renovate]

This PR contains the following updates:

Package	Update	Change
capsule (source)	minor	0.10.9 → 0.13.1

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

projectcapsule/capsule (capsule)

v0.13.1

Compare Source

Changelog

🐛 Bug fixes

• 33f11b9: fix: correct helm docs for webhook service port schema (#​1929) (@​bakito)
• ce6fb68: fix: correct helm values schema for webservcie ports (#​1928) (@​bakito)
• 279f3a7: fix: reuse webhookport from values (#​1927) (@​oliverbaehler)

Full Changelog: projectcapsule/capsule@v0.13.0...v0.13.1

Check out what's new in this release

Docker Images

• ghcr.io/projectcapsule/capsule:0.13.1
• ghcr.io/projectcapsule/capsule:latest

Helm Chart
View this release on Artifact Hub or use the OCI helm chart:

• ghcr.io/projectcapsule/charts/capsule:0.13.1

Review the Major Changes section first before upgrading to a new version

[!IMPORTANT]
Kubernetes compatibility

Note that the Capsule project offers support only for the latest minor version of Kubernetes.
Backwards compatibility with older versions of Kubernetes and OpenShift is offered by vendors.

Kubernetes version	Minimum required
v1.35	>= 1.35.0

Thanks to all the contributors! 🚀 🦄

v0.13.0

Compare Source

Changelog

✨ Breaking Changes

• 0515880: feat: use cert-manager certificates by default. By default, Capsule now uses self-signed cert-manager certificates for its admission webhooks. This used to be an optional setting and has now become the default. If you don’t have cert-manager installed, you must explicitly re-enable the Capsule TLS controller as documented here. (#​1818) (@​oliverbaehler)

Security 🔒

• Advisory GHSA-qjjm-7j9w-pw72 - High - Users can create cluster scoped resources anywhere in the cluster if they are allowed to create TenantResources. To immediately mitigate this, make sure to use Impersonation for TenantResources.
• Advisory GHSA-2ww6-hf35-mfjm - Moderate - Users may hijack namespaces via namespaces/status privileges. These privileges must have been explicitly granted by Platform Administrators through RBAC rules to be affected. Requests for the namespaces/status subresource are now sent to the Capsule admission webhook as well.

✨ New Features

• cc4fb45: feat: add new Quota System with GlobalCustomQuotas and CustomQuotas(#​1841) (@​oliverbaehler)
• cc4fb45: feat: refactor of GlobalTenantResources and TenantResources (#​1841) (@​oliverbaehler)
• cc4fb45: feat: added new label projectcapsule.dev/tenant which is added for all namespaced resources belonging to a Tenant (#​1841) (@​oliverbaehler)
• cc4fb45: feat: Resources labeled with projectcapsule.dev/managed-by=controller can only be created, updated or deleted by the Capsule controller and administrators, and are rejected for all other operations. This prevents deletion of managed resources by users, which are not identified as capsule users (current behavior) (#​1841) (@​oliverbaehler)
• cc4fb45: feat: migrated event emissions to events.k8s.io/v1 from legacy core/v1 (#​1841) (@​oliverbaehler)
• cc4fb45: feat: tenant scoped additional metadata is validated via admission (#​1841) (@​oliverbaehler)
• cc4fb45: feat: adding .spec.data for Tenant to allow providing custom data for templating purposes (#​1841) (@​oliverbaehler)
• cc4fb45: feat: Added configuration options for managed RBAC (#​1841) (@​oliverbaehler)
• cc4fb45: feat: Added configuration options for Impersonation (#​1841) (@​oliverbaehler)
• cc4fb45: feat: Added configuration options for Cache invalidation (#​1841) (@​oliverbaehler)
• cc4fb45: feat: Added configuration options for Dynamic Admission Webhooks (#​1841) (@​oliverbaehler)
• 730151c: feat: add dynamic capsule user evaluation (#​1811) (@​oliverbaehler)
• 0744924: feat: add e2e openshift support (#​1894) (@​Svarrogh1337)
• a6b830b: feat: add ruleset api(#​1844) (@​oliverbaehler)
• 0abc77b: feat: diverse performance improvements (#​1861) (@​oliverbaehler)
• cc4fb45: feat: upstream enterprise preview (#​1841) (@​oliverbaehler)

🐛 Bug fixes

• cc4fb45: fix: Improved matchConditions for admission webhooks that intercept all namespaced items, to avoid processing subresource requests and Events, improving performance and reducing log noise. (#​1841) (@​oliverbaehler)
• cc4fb45: fix: PersistentVolumeClaims support now providing .spec.selector. When .spec.selector is provided we always aggregate a custom matchExpressions for the PersistentVolumeClaims to ensure that only the PersistentVolumeClaims created in the Tenant can mount PersistentVolumes provisioned from/for the same Tenant (#​1841) (@​oliverbaehler)
• cc4fb45: fix: Regex-Selectors were not considered on classes driven Tenant status reconciles (#​1841) (@​oliverbaehler)
• cc4fb45: fix: A single Unready namespace could cause the entire Tenant reconcilation to be incomplete. Now unready or terminating namespaces are ignored for further processing ensuring that ready/new namespaces get their required contents (#​1841) (@​oliverbaehler)
• cc4fb45: fix: When a Tenant is cordoned, namespaces can no longer be deleted. (#​1841) (@​oliverbaehler)
• cc4fb45: fix: TLS controller correctly patches all the webhooks with the same CA Bundle, to avoid issues with multiple webhooks and ensure that all webhooks are correctly secured, if enabled (#​1841) (@​oliverbaehler)
• 61429d1: fix(docs): update home in chart.yaml (#​1864) (@​sandert-k8s)
• 58b25e3: fix(webhook): adapt to controller-runtime breaking change in newwebhookmanagedby (#​1898) (@​Svarrogh1337)
• c6e109c: fix: release workflows (#​1919) (@​oliverbaehler)

🛠 Dependency updates

• 9c02af5: fix(deps): update k8s.io/utils digest to 383b50a (#​1804) (@​renovate[bot])
• aaa3ec4: fix(deps): update k8s.io/utils digest to 718f0e5 (#​1806) (@​renovate[bot])
• e8bb238: fix(deps): update k8s.io/utils digest to 914a6e7 (#​1822) (@​renovate[bot])
• 53a4f5d: fix(deps): update k8s.io/utils digest to 98d557b (#​1803) (@​renovate[bot])
• 7efaa9e: fix(deps): update kubernetes packages to v0.35.0 (#​1797) (@​renovate[bot])
• 7e2dc68: fix(deps): update module github.com/onsi/ginkgo/v2 to v2.27.3 (#​1776) (@​renovate[bot])
• 45e3a5d: fix(deps): update module github.com/onsi/ginkgo/v2 to v2.27.4 (#​1825) (@​renovate[bot])
• 768b334: fix(deps): update module github.com/onsi/gomega to v1.38.3 (#​1777) (@​renovate[bot])
• 1f91adc: fix(deps): update module github.com/onsi/gomega to v1.39.0 (#​1826) (@​renovate[bot])
• b8d3852: fix(deps): update module k8s.io/dynamic-resource-allocation to v0.35.0 (#​1798) (@​renovate[bot])
• abc03ad: fix(deps): update module sigs.k8s.io/cluster-api to v1.12.1 (#​1784) (@​renovate[bot])

🚀 Build process updates

• 77e7532: ci: pin slsa provenance workflow (#​1903) (@​AkashKumar7902)

Full Changelog: projectcapsule/capsule@v0.12.4...v0.13.0

Check out what's new in this release

Docker Images

• ghcr.io/projectcapsule/capsule:0.13.0
• ghcr.io/projectcapsule/capsule:latest

Helm Chart
View this release on Artifact Hub or use the OCI helm chart:

• ghcr.io/projectcapsule/charts/capsule:0.13.0

Review the Major Changes section first before upgrading to a new version

[!IMPORTANT]
Kubernetes compatibility

Note that the Capsule project offers support only for the latest minor version of Kubernetes.
Backwards compatibility with older versions of Kubernetes and OpenShift is offered by vendors.

Kubernetes version	Minimum required
v1.35	>= 1.35.0

Thanks to all the contributors! 🚀 🦄

v0.12.4

Compare Source

Changelog

🐛 Bug fixes

• a42d910: fix(controller): template concurrency (#​1802) (@​oliverbaehler)

🛠 Dependency updates

• 8eea907: fix(deps): update k8s.io/utils digest to 61b37f7 (#​1801) (@​renovate[bot])

Full Changelog: projectcapsule/capsule@v0.12.3...v0.12.4

Check out what's new in this release

Docker Images

• ghcr.io/projectcapsule/capsule:0.12.4
• ghcr.io/projectcapsule/capsule:latest

Helm Chart
View this release on Artifact Hub or use the OCI helm chart:

• ghcr.io/projectcapsule/charts/capsule:0.12.4

Review the Major Changes section first before upgrading to a new version

[!IMPORTANT]
Kubernetes compatibility

Note that the Capsule project offers support only for the latest minor version of Kubernetes.
Backwards compatibility with older versions of Kubernetes and OpenShift is offered by vendors.

Kubernetes version	Minimum required
v1.34	>= 1.34.0

Thanks to all the contributors! 🚀 🦄

v0.12.3

Compare Source

Changelog

🐛 Bug fixes

• e19575b: fix(controller): allow no spaces in template references (#​1789) (@​oliverbaehler)

Full Changelog: projectcapsule/capsule@v0.12.2...v0.12.3

Check out what's new in this release

Docker Images

• ghcr.io/projectcapsule/capsule:0.12.3
• ghcr.io/projectcapsule/capsule:latest

Helm Chart
View this release on Artifact Hub or use the OCI helm chart:

• ghcr.io/projectcapsule/charts/capsule:0.12.3

Review the Major Changes section first before upgrading to a new version

[!IMPORTANT]
Kubernetes compatibility

Note that the Capsule project offers support only for the latest minor version of Kubernetes.
Backwards compatibility with older versions of Kubernetes and OpenShift is offered by vendors.

Kubernetes version	Minimum required
v1.34	>= 1.34.0

Thanks to all the contributors! 🚀 🦄

v0.12.2

Compare Source

Changelog

🐛 Bug fixes

• c06f54a: fix(controller): decode old object for delete requests (#​1787) (@​oliverbaehler)

🛠 Dependency updates

• c832f56: fix(deps): update module golang.org/x/sync to v0.19.0 (#​1774) (@​renovate[bot])
• cd5e2a8: fix(deps): update module k8s.io/apiextensions-apiserver to v0.34.3 (#​1785) (@​renovate[bot])
• 2583215: fix(deps): update module k8s.io/dynamic-resource-allocation to v0.34.3 (#​1786) (@​renovate[bot])

Full Changelog: projectcapsule/capsule@v0.12.1...v0.12.2

Check out what's new in this release

Docker Images

• ghcr.io/projectcapsule/capsule:0.12.2
• ghcr.io/projectcapsule/capsule:latest

Helm Chart
View this release on Artifact Hub or use the OCI helm chart:

• ghcr.io/projectcapsule/charts/capsule:0.12.2

Review the Major Changes section first before upgrading to a new version

[!IMPORTANT]
Kubernetes compatibility

Note that the Capsule project offers support only for the latest minor version of Kubernetes.
Backwards compatibility with older versions of Kubernetes and OpenShift is offered by vendors.

Kubernetes version	Minimum required
v1.34	>= 1.34.0

Thanks to all the contributors! 🚀 🦄

v0.12.1

Compare Source

Changelog

🐛 Bug fixes

• 936a152: fix(controller): make device and gateway class optional (#​1775) (@​oliverbaehler)
• 711cef9: fix(e2e): resourcepool condition (#​1773) (@​CorentinPtrl)

Full Changelog: projectcapsule/capsule@v0.12.0...v0.12.1

Check out what's new in this release

Docker Images

• ghcr.io/projectcapsule/capsule:0.12.1
• ghcr.io/projectcapsule/capsule:latest

Helm Chart
View this release on Artifact Hub or use the OCI helm chart:

• ghcr.io/projectcapsule/charts/capsule:0.12.1

Review the Major Changes section first before upgrading to a new version

[!IMPORTANT]
Kubernetes compatibility

Note that the Capsule project offers support only for the latest minor version of Kubernetes.
Backwards compatibility with older versions of Kubernetes and OpenShift is offered by vendors.

Kubernetes version	Minimum required
v1.34	>= 1.34.0

Thanks to all the contributors! 🚀 🦄

v0.12.0

Compare Source

Changelog

✨ New Features

• 584d372: feat(config): add combined users property as successor for usergroups (#​1767) (@​oliverbaehler)
• 7e7d9d0: feat(config): administrators get delete privileges for tenant namespaces (#​1749) (@​oliverbaehler)
• 581a8fe: feat(controller): administration persona (#​1739) (@​oliverbaehler)
• dd39e1a: feat(dra): support dra device classes (#​1759) (@​Svarrogh1337)
• 5899e6d: feat(tenant): add available classes as status fields (#​1751) (@​oliverbaehler)
• d812a0c: feat(tenant): add dedicated tenantowner crd (#​1764) (@​oliverbaehler)
• 6e8405d: feat: refactor core webhooks (#​1756) (@​oliverbaehler)

🐛 Bug fixes

• a270d67: fix(admission): consistently inspect ownerreferences for namespace validations (#​1758) (@​oliverbaehler)

🛠 Dependency updates

• 866c69f: fix(deps): update module github.com/onsi/ginkgo/v2 to v2.27.2 (#​1725) (@​renovate[bot])
• 550f3cc: fix(deps): update module go.uber.org/zap to v1.27.1 (#​1748) (@​renovate[bot])
• 92d73ae: fix(deps): update module golang.org/x/sync to v0.18.0 (#​1734) (@​renovate[bot])
• 9e73320: fix(deps): update module sigs.k8s.io/cluster-api to v1.11.3 (#​1732) (@​renovate[bot])
• 3c5708a: fix(deps): update module sigs.k8s.io/controller-runtime to v0.22.4 (#​1731) (@​renovate[bot])
• 007cea9: fix(deps): update module sigs.k8s.io/gateway-api to v1.4.1 (#​1770) (@​renovate[bot])

Full Changelog: projectcapsule/capsule@v0.11.1...v0.12.0

Check out what's new in this release

Docker Images

• ghcr.io/projectcapsule/capsule:0.12.0
• ghcr.io/projectcapsule/capsule:latest

Helm Chart
View this release on Artifact Hub or use the OCI helm chart:

• ghcr.io/projectcapsule/charts/capsule:0.12.0

Review the Major Changes section first before upgrading to a new version

[!IMPORTANT]
Kubernetes compatibility

Note that the Capsule project offers support only for the latest minor version of Kubernetes.
Backwards compatibility with older versions of Kubernetes and OpenShift is offered by vendors.

Kubernetes version	Minimum required
v1.34	>= 1.34.0

Thanks to all the contributors! 🚀 🦄

v0.11.2

Compare Source

v0.11.1

Compare Source

Changelog

✨ New Features

• 9537c06: feat(charts/capsule): added extra manifests in values file (#​1653) (@​Llyth)
• 634ed49: feat(controller): add controller concurrency (#​1722) (@​oliverbaehler)

🐛 Bug fixes

• 63eb807: fix(controller): change log levels for debug logs (#​1716) (@​oliverbaehler)

🛠 Dependency updates

• 009b34b: fix(deps): update module github.com/onsi/ginkgo/v2 to v2.27.1 (#​1714) (@​renovate[bot])

Full Changelog: projectcapsule/capsule@v0.11.0...v0.11.1

Docker Images

• ghcr.io/projectcapsule/capsule:0.11.1
• ghcr.io/projectcapsule/capsule:latest

Helm Chart
View this release on Artifact Hub or use the OCI helm chart:

• ghcr.io/projectcapsule/charts/capsule:0.11.1

Review the Major Changes section first before upgrading to a new version

[!IMPORTANT]
Kubernetes compatibility

Note that the Capsule project offers support only for the latest minor version of Kubernetes.
Backwards compatibility with older versions of Kubernetes and OpenShift is offered by vendors.

Kubernetes version	Minimum required
v1.34	>= 1.34.0

Thanks to all the contributors! 🚀 🦄

v0.11.0

Compare Source

Changelog

✨ New Features

• c901412: feat(api): migrate capsule.clastix.io/managed-by to meta api (#​1691) (@​oliverbaehler)
• 9fa1aba: feat(controller): allow owners to promote serviceaccounts within tenant as owners (#​1626) (@​oliverbaehler)
• 5ac0f83: feat(controller): refactor namespace core loop and state management (#​1680) (@​oliverbaehler)
• 2261ea6: feat(helm): add labels and annotations for capsuleconfiguration (#​1710) (@​oliverbaehler)
• beafe09: feat(tenant): allow additional metadata for rolebindings (#​1695) (@​oliverbaehler)
• dd70ac2: feat(tenant): owners are now an optional property (#​1654) (@​oliverbaehler)
• 14e09ea: feat: pre-release correctures (#​1682) (@​oliverbaehler)

🐛 Bug fixes

• ea2b6ec: fix(chart): disable node webhook by default (#​1685) (@​oliverbaehler)
• deb4db7: fix(docs): add static width per logo for adopters (#​1700) (@​sandert-k8s)
• 4878e1a: fix: bypass resourepool limits (#​1669) (@​Svarrogh1337)

🛠 Dependency updates

• ba15a83: fix(deps): update k8s.io/utils digest to bc988d5 (#​1676) (@​renovate[bot])
• 54e80f8: fix(deps): update module github.com/onsi/ginkgo/v2 to v2.25.3 (#​1605) (@​renovate[bot])
• 40d17bc: fix(deps): update module github.com/onsi/ginkgo/v2 to v2.26.0 (#​1678) (@​renovate[bot])
• c65a142: fix(deps): update module github.com/prometheus/client_golang to v1.23.1 (#​1639) (@​renovate[bot])
• bb8a511: fix(deps): update module github.com/prometheus/client_golang to v1.23.2 (#​1642) (@​renovate[bot])
• b1d0f8b: fix(deps): update module sigs.k8s.io/cluster-api to v1.11.2 (#​1688) (@​renovate[bot])
• e2418ab: fix(deps): update module sigs.k8s.io/controller-runtime to v0.22.1 (#​1620) (@​renovate[bot])
• 8254c55: fix(deps): update module sigs.k8s.io/controller-runtime to v0.22.2 (#​1684) (@​renovate[bot])
• e7da3b0: fix(deps): update module sigs.k8s.io/controller-runtime to v0.22.3 (#​1697) (@​renovate[bot])
• 7ccb64d: fix(deps): update module sigs.k8s.io/gateway-api to v1.4.0 (#​1681) (@​renovate[bot])

Full Changelog: projectcapsule/capsule@v0.10.9...v0.11.0

Docker Images

• ghcr.io/projectcapsule/capsule:0.11.0
• ghcr.io/projectcapsule/capsule:latest

Helm Chart
View this release on Artifact Hub or use the OCI helm chart:

• ghcr.io/projectcapsule/charts/capsule:0.11.0

Review the Major Changes section first before upgrading to a new version

[!IMPORTANT]
Kubernetes compatibility

Note that the Capsule project offers support only for the latest minor version of Kubernetes.
Backwards compatibility with older versions of Kubernetes and OpenShift is offered by vendors.

Kubernetes version	Minimum required
v1.34	>= 1.34.0

Thanks to all the contributors! 🚀 🦄

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.