chore: rephrase docs to block all openshift label mutations by users

[sandert-k8s]

No description provided.

[netlify]

✅ Deploy Preview for docs-projectcapsule ready!

Name	Link
🔨 Latest commit	02bc64c
🔍 Latest deploy log	https://app.netlify.com/projects/docs-projectcapsule/deploys/6aa40802fc8086000820272b
😎 Deploy Preview	https://deploy-preview-136--docs-projectcapsule.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[Copilot]

🟡 Changes recommended

The OpenShift example contains two unresolved critical issues that prevent the documented protections from working.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Updates OpenShift documentation to describe protecting namespace metadata from CapsuleUsers.

Changes:

• Rephrases the security release note.
• Expands the OpenShift metadata-protection example.
• Adds guidance for labels, annotations, and pod-security metadata.

File summaries

File	Summary
content/en/docs/whats-new.md	Updates the security release note.
content/en/docs/operating/setup/openshift.md	Adds the metadata-protection example. Two critical findings remain: the metadata key is treated literally and lacks regex support (3 votes), and the deny entry lacks the required values matcher (2 votes). One capitalization nit remains (1 vote).

Review details

Suppressed comments (3)

content/en/docs/operating/setup/openshift.md:151

• The annotation key is written as a regex too, but metadata rules do not support regex matching for annotation names. Therefore openshift.io/sa.scc.uid-range will not be covered by this example, despite the warning saying it must not be user-modifiable. Enumerate the sensitive annotation keys or use a legacy/secondary admission policy.

              ".*openshift.io/.*":

content/en/docs/operating/setup/openshift.md:154

• This annotation deny entry also omits the values matcher. Since deny rules match configured values, required: false does not make this a presence-only deny; add an all-values matcher so changes to pod-security.kubernetes.io/enforce are actually blocked.

              "pod-security.kubernetes.io/enforce":
                required: false

content/en/docs/operating/setup/openshift.md:158

• OpenShift is the product name, so the alert title should use the established capitalization rather than openshift.

{{% alert title="Block openshift labels and annotations" color="warning" %}}

• Files reviewed: 2/2 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.