capabilities

Documentation

Index

• Constants
• Variables
• func IsCapabilityInAddList(container *k8s.ContainerV1, capability string) bool
• func IsDropAll(container *k8s.ContainerV1) bool
• func SecurityContextOrCapabilities(container *k8s.ContainerV1) bool
• type Capabilities
  • func New(config Config) *Capabilities
  • func (a *Capabilities) Audit(resource k8s.Resource, _ []k8s.Resource) ([]*kubeaudit.AuditResult, error)
• type Config
  • func (config *Config) GetAllowAddList() []string

Constants

const (
	// CapabilityAdded occurs when a capability is in the capability add list of a container's security context
	CapabilityAdded = "CapabilityAdded"
	// CapabilityShouldDropAll occurs when there's a drop list instead of having drop "ALL"
	CapabilityShouldDropAll = "CapabilityShouldDropAll"
	// CapabilityOrSecurityContextMissing  occurs when either the Security Context or Capabilities are not specified
	CapabilityOrSecurityContextMissing = "CapabilityOrSecurityContextMissing"
)

const Name = "capabilities"

Variables

var DefaultAllowAddList = []string{""}

var DefaultDropList = []string{"ALL"}

Functions

func IsCapabilityInAddList

func IsCapabilityInAddList(container *k8s.ContainerV1, capability string) bool

func IsDropAll

func IsDropAll(container *k8s.ContainerV1) bool

func SecurityContextOrCapabilities

func SecurityContextOrCapabilities(container *k8s.ContainerV1) bool

Types

type Capabilities

type Capabilities struct {
	// contains filtered or unexported fields
}

Capabilities implements Auditable

func New

func New(config Config) *Capabilities

func (*Capabilities) Audit

func (a *Capabilities) Audit(resource k8s.Resource, _ []k8s.Resource) ([]*kubeaudit.AuditResult, error)

Audit checks that bad capabilities are dropped with ALL and no capabilities are added

type Config

type Config struct {
	AllowAddList []string `yaml:"allowAddList"`
}

func (*Config) GetAllowAddList

func (config *Config) GetAllowAddList() []string