Stratio modifications on top of projectcapsule/capsule main

[forselli-stratio]

Overview

This PR contains all Stratio-specific modifications on top of the unmodified projectcapsule/capsule main branch (0c22ce88).

The base branch main-upstream is a direct mirror of projectcapsule/capsule main - no changes, no merges with old Stratio history. This makes the diff here the authoritative view of what Stratio adds.

---

Commits in this PR

1. Stratio CICD integration

Adds the Stratio build and publish pipeline:

• Jenkinsfile - Jenkins pipeline wired to Stratio's libpipelines library
• Dockerfile - multi-stage build (Go builder + Alpine runtime) for the controller image
• VERSION / VERSION_HISTORY.md - version tracking files
• bin/change-version.sh / bin/chart.sh - release helper scripts

2. [EOS-5809] Refactor chart tag default value to ensure chart uncoupling

Changes the Helm chart's default image tag from the chart version to an empty string, so the Docker image version and Helm chart version can be bumped independently.

3. Add Docker/Helm push steps, semantic versioning, and bump version to 0.8.0-SNAPSHOT

• Adds doPushDockerECR and doPushHelmECR stages to the Jenkins pipeline to publish to Stratio's AWS ECR
• Switches versioning strategy to semver
• Bumps version to 0.8.0-SNAPSHOT

4. [Stratio] Port Stratio features onto upstream capsule sync

Two functional features added on top of upstream:

a) Capsule controller SA treated as tenant owner

The Capsule controller service account is automatically treated as a tenant owner, without needing to be listed in any tenant's .spec.owners.

Why: The controller needs to reconcile namespace-level resources on behalf of tenants. Without this, it would be denied by its own admission webhooks when acting inside a tenant namespace.

How: Uses the existing configuration.IsControllerServiceAccount(name, namespace) helper (reads the SERVICE_ACCOUNT env var already injected in charts/capsule/templates/_pod.tpl) in two places:

• pkg/users/is_tenant_owner.go:IsTenantOwnerByStatus - fast-path status-based check
• pkg/users/is_tenant_owner.go:IsCommonOwner - full ownership resolution check

Files changed: pkg/users/is_tenant_owner.go

b) ExcludeUserGroups - exclude groups from Capsule entirely

Adds a new excludeUserGroups field to CapsuleConfigurationSpec. Users whose groups match any entry are never treated as Capsule users, regardless of other group memberships. This is an early exit before any group or user matching.

Difference from ignoreUserWithGroups: ignoreUserWithGroups only fires when a user is already matched as a Capsule user via a group. excludeUserGroups fires first and prevents the user from being a Capsule user at all.

Use case: You have a broad group (e.g. system:authenticated) configured as a Capsule user group, but you want certain admin groups to bypass Capsule entirely.

Files changed:

• api/v1beta2/capsuleconfiguration_types.go - new field
• api/v1beta2/zz_generated.deepcopy.go - deepcopy for new field
• charts/capsule/crds/capsule.clastix.io_capsuleconfigurations.yaml - CRD schema
• charts/capsule/templates/configuration.yaml - Helm template
• charts/capsule/values.yaml - new capsuleExcludeUserGroups: [] value
• pkg/runtime/configuration/configuration.go - interface method
• pkg/runtime/configuration/client.go - implementation
• pkg/users/is_capsule_user.go - early-exit check

5. [BUILD] Bump Go toolchain to 1.26.4 to match go.mod requirement

go.mod requires go 1.26.4. The Dockerfile builder image and Jenkinsfile BUILDTOOL_IMAGE were on golang:1.24, causing go mod download to fail with GOTOOLCHAIN=local. Updated both to golang:1.26.4.

---

What is NOT changed from upstream

Everything else - the entire internal/, pkg/ (except the two files above), api/, config/ tree - is unmodified upstream code. No patches, no conflict resolutions, no backports.

---

Notes for future upstream syncs

To sync this branch forward when projectcapsule/capsule releases a new version:

git fetch projectcapsule
git checkout main-upstream
git reset --hard projectcapsule/main
git push upstream main-upstream --force-with-lease

git checkout stratio/features
git rebase main-upstream
# resolve any conflicts - only the 5 commits above need re-checking
git push origin stratio/features --force-with-lease

The Stratio diff is small enough (22 lines of Go across 2 files + build config) that rebases are low-friction.