# What's New ✨

> Discover new features from the current version in one place.

> For the complete documentation index, see [llms.txt](https://projectcapsule.dev/llms.txt).
> The HTML version of this page is at https://projectcapsule.dev/docs/whats-new/.

## Events 📅

<div class="events-calendar pe-md-3 pe-xl-4">
  <div class="mb-4">
    <p>
      Upcoming opportunities to meet the Project Capsule community. The list
      is sorted automatically from the shared event data.
    </p>
    
      <a class="btn btn-outline-primary btn-sm"
         href="/docs/whats-new/index.xml"
         rel="alternate"
         type="application/rss+xml">
        <i class="fa-solid fa-rss me-1" aria-hidden="true"></i>
        Subscribe to event updates
      </a>
    
  </div>

  
    <details class="mb-4" open>
      <summary class="h4 mb-3">
        Upcoming events
        <span class="badge rounded-pill text-bg-light align-middle fs-6">
          2
        </span>
      </summary>
      <div>
        
          <article class="card mb-3" id="event-swiss-dev-confederation-2026">
  <div class="card-body">
    <div class="row g-3 align-items-start">
      <div class="col-12 col-sm-3 col-lg-2">
        <time class="d-block rounded border text-center px-2 py-2"
              datetime="2026-10-27">
          
            <span class="d-block small fw-semibold text-uppercase text-muted">
              Oct
            </span>
          
          <span class="d-block fs-4 fw-bold lh-sm">27</span>
          <span class="d-block small text-muted">2026</span>
        </time>
      </div>
      <div class="col-12 col-sm-9 col-lg-10">
        <h3 class="h5 mb-1">
          <a href="https://reg.experiences.redhat.com/flow/redhat/3624601/redhatfieldeventspreregnoappform/page/landingregistrationpage" rel="noopener">Swiss Dev Confederation</a>
          <span aria-hidden="true">🇨🇭</span>
        </h3>
        <p class="small fw-semibold text-muted mb-2">27 October 2026</p>
        <div class="mb-0">Together with a long-term adopter, we will demonstrate how Capsule can enhance the multi-tenancy experience with Red Hat OpenShift.</div>
        
      </div>
    </div>
  </div>
</article>

        
          <article class="card mb-3" id="event-kubecon-cloudnativecon-north-america-2026">
  <div class="card-body">
    <div class="row g-3 align-items-start">
      <div class="col-12 col-sm-3 col-lg-2">
        <time class="d-block rounded border text-center px-2 py-2"
              datetime="2026-11-09">
          
            <span class="d-block small fw-semibold text-uppercase text-muted">
              Nov
            </span>
          
          <span class="d-block fs-4 fw-bold lh-sm">9–12</span>
          <span class="d-block small text-muted">2026</span>
        </time>
      </div>
      <div class="col-12 col-sm-9 col-lg-10">
        <h3 class="h5 mb-1">
          <a href="https://events.linuxfoundation.org/kubecon-cloudnativecon-north-america/" rel="noopener">KubeCon &#43; CloudNativeCon North America</a>
          <span aria-hidden="true">🇺🇸</span>
        </h3>
        <p class="small fw-semibold text-muted mb-2">9–12 November 2026</p>
        <div class="mb-0">Visit the Project Capsule kiosk in the Solutions Showcase.</div>
        
          <ul class="mb-0 mt-2">
            <li>Kiosk shift: Thursday, 10:15–11:55</li><li>Kiosk number: P-4B</li><li>Location: Level 1, Hall 5</li>
          </ul>
        
      </div>
    </div>
  </div>
</article>

        
      </div>
    </details>
  

  
    <details class="mt-4">
      <summary class="h4 mb-3">
        Past events
        <span class="badge rounded-pill text-bg-light align-middle fs-6">
          2
        </span>
      </summary>
      <div>
        
          <article class="card mb-3" id="event-kcd-sofia-2026">
  <div class="card-body">
    <div class="row g-3 align-items-start">
      <div class="col-12 col-sm-3 col-lg-2">
        <time class="d-block rounded border text-center px-2 py-2"
              datetime="2026-09-29">
          
            <span class="d-block small fw-semibold text-uppercase text-muted">
              Sep
            </span>
          
          <span class="d-block fs-4 fw-bold lh-sm">29</span>
          <span class="d-block small text-muted">2026</span>
        </time>
      </div>
      <div class="col-12 col-sm-9 col-lg-10">
        <h3 class="h5 mb-1">
          <a href="https://kcd.bg/agenda/" rel="noopener">KCD Sofia 2026</a>
          <span aria-hidden="true">🇧🇬</span>
        </h3>
        <p class="small fw-semibold text-muted mb-2">29 September 2026</p>
        <div class="mb-0">Hristo Hristov will speak about Capsule and why Namespaces alone do not provide multi-tenancy.</div>
        
      </div>
    </div>
  </div>
</article>

        
          <article class="card mb-3" id="event-swiss-cloud-native-day-2026">
  <div class="card-body">
    <div class="row g-3 align-items-start">
      <div class="col-12 col-sm-3 col-lg-2">
        <time class="d-block rounded border text-center px-2 py-2"
              datetime="2026-09-17">
          
            <span class="d-block small fw-semibold text-uppercase text-muted">
              Sep
            </span>
          
          <span class="d-block fs-4 fw-bold lh-sm">17</span>
          <span class="d-block small text-muted">2026</span>
        </time>
      </div>
      <div class="col-12 col-sm-9 col-lg-10">
        <h3 class="h5 mb-1">
          <a href="https://cloudnativeday.ch/" rel="noopener">Swiss Cloud Native Day</a>
          <span aria-hidden="true">🇨🇭</span>
        </h3>
        <p class="small fw-semibold text-muted mb-2">17 September 2026</p>
        <div class="mb-0">Meet the Capsule maintainers at Swiss Cloud Native Day 2026. We will be there with a booth sponsored by Peak Scale.</div>
        
      </div>
    </div>
  </div>
</article>

        
      </div>
    </details>
  
</div>


## Security 🔒

* Advisory [GHSA-pvhj-cqh2-rpq8](https://github.com/projectcapsule/capsule-proxy/security/advisories/GHSA-pvhj-cqh2-rpq8) - **High** - Tenant Owners could grant themselves cross-tenant and cluster-scoped read access through `clusterResources` in a namespaced `ProxySetting`. Affects Capsule Proxy `<= 0.14.1`.
* **(Enterprise)**: Projectcapsule is now providing their releases on an immutable OCI registry, which allows users to verify the integrity of the images and provides a more secure way to distribute the images. Which is not possible on GHCR due to the fact that GHCR does not support immutability of images.
* [OpenShift] Added documentation showing how to prevent CapsuleUsers from modifying OpenShift-managed namespace labels and annotations, including `openshift.io/run-level`, to help prevent SecurityContextConstraints bypasses. [Read More](/docs/operating/setup/openshift/#example-tenant-and-tenantowners)

## Breaking Changes ⚠️

* **Proxy**: A namespaced [`ProxySetting`](/docs/proxy/proxysettings/#proxysetting) can no longer grant `clusterResources`. Move existing grants to a [`GlobalProxySettings`](/docs/proxy/proxysettings/#globalproxysettings), which requires the `ProxyClusterScoped` feature gate.

## Features ✨

* **Capsule**: [Resource policies](/docs/operating/concepts/managed-resources/#resource-policy) for `TenantResource` and `GlobalTenantResource` add conditional application and control over resource adoption, protection, and cleanup.

* **Capsule**: The rules API now offers more ways to configure and enforce namespace profiles:

   * [Workload Placement Mutation](/docs/rules/mutate/workloads/#placement): Configure schedulers, node selectors, tolerations, affinity, and topology spread constraints on new Pods with merge or replace actions.
   * [Workload User Namespace Mutation](/docs/rules/mutate/workloads/#host-user-namespace): Request separate user namespaces for new Pods with `security.hostUsers: false`.
   * [Workload Read-only Root Filesystem Mutation](/docs/rules/mutate/workloads/#read-only-root-filesystem): Set `security.readOnlyRootFilesystem` for selected regular, init, and newly added ephemeral containers.
   * [Workload Seccomp Mutation](/docs/rules/mutate/workloads/#seccomp): Default or replace Pod-level seccomp profiles, including node-local profile paths.
   * [Workload AppArmor Mutation](/docs/rules/mutate/workloads/#apparmor): Default or replace Pod-level AppArmor profiles, including named profiles loaded on nodes.
   * [Mutation Conditions](/docs/rules/#mutation-conditions): Apply individual mutation entries conditionally with CEL expressions that inspect the resource and admission request.
   * [Workload Placement Enforcement](/docs/rules/enforcement/workloads/#placement): Control which schedulers, node selectors, tolerations, affinity rules, and topology spread constraints workloads may use.
   * [Workload Type Enforcement](/docs/rules/enforcement/workloads/#select-workloads): Allow, deny, or audit selected workload kinds, such as blocking DaemonSets in application namespaces.
   * [Pod Disruption Budget Enforcement](/docs/rules/enforcement/workloads/#pod-disruption-budgets): Require room for voluntary evictions, prevent overlapping PDBs, and control unhealthy Pod eviction. Checks cover PDB and workload changes, including controller scaling.
   * [Workload Seccomp Enforcement](/docs/rules/enforcement/workloads/#seccomp): Restrict effective seccomp profile types and local profile paths across selected Pods and containers.
   * [Workload AppArmor Enforcement](/docs/rules/enforcement/workloads/#apparmor): Restrict effective AppArmor profiles, including container overrides and named profiles loaded on nodes.
   * [NetworkPolicy Ingress and Egress CIDR Enforcement](/docs/rules/enforcement/network/#policies): Allow, deny, or audit IPv4 and IPv6 ingress and egress CIDR grants in selected namespaces, accounting for overlapping ranges and `ipBlock.except`.
   * [Enforcement Conditions](/docs/rules/#enforcement-conditions): Apply an enforcement block only to resources and admission requests that match your CEL conditions.
   * [Additional PersistentVolume Access](/docs/rules/enforcement/storage/): Authorize restore handoffs and other explicit PVC bindings to PVs without a Tenant label, using namespace profiles, read-only label selectors, audiences, and CEL conditions on the referenced `volume`. Existing Tenant ownership labels remain authoritative.

## Documentation 📚

We have added new documentation for a better experience. See the following topics:

* **[Best Practices for Tenants](/docs/operating/best-practices/tenants/)**
* **[Best Practices for Networking](/docs/operating/best-practices/networking/)**
* **[Best Practices for Workloads](/docs/operating/best-practices/workloads/)**

## Ecosystem 🌐

Dedicated Addons joining the capsule ecosystem

* [Change Windows](https://change-windows.addons.projectcapsule.dev/): Change Windows helps organizations plan routine IT maintenance with fewer surprises and less manual coordination. It gives teams advance notice and can prevent conflicting changes while planned work is underway. It can also pause development environments overnight and bring them back in the morning, helping control infrastructure costs. These routines run automatically on your Kubernetes platform, so teams can spend less time coordinating maintenance and more time delivering services.

* [Resource Permits](https://resource-permits.addons.projectcapsule.dev/): Resource Permits helps platform teams offer services without handling every request manually or handing out broad administrator access. Teams request a predefined service, reviewers decide whether to approve it, and Kubernetes tracks the resources and their lifecycle. Requests can be made through the Kubernetes API, the kubectl plugin, or Headlamp.

Newly added documentation to integrate Capsule with other applications:

* [Opensearch](/ecosystem/integrations/opensearch/)
* [External Secrets Operator](/ecosystem/integrations/eso/)
* [Headlamp Plugin](/ecosystem/integrations/headlamp/#plugins)

## Roadmap 🗺️

In the upcoming releases we are planning to work on the following features:

  * Capsule: Porting more Properties to the Namespace Rule Approach.
  * Capsule: Adding `triggers` for `Global`/`TenantResources`.
  * Capsule: Adding `healthChecks` for `Global`/`TenantResources`.
  * Capsule: Adding Generic Implementation for `Global`/`TenantResources`.
  * Website: Improving the documentation with more examples and use-cases.

---

Last modified October 21, 2026: chore: merge release branch (#165) (69f84ec)