seccomp

Documentation

Index

• Constants
• type ByRemovingSeccompProfileInContainer
  • func (pending *ByRemovingSeccompProfileInContainer) Apply(resource k8s.Resource) []k8s.Resource
  • func (pending *ByRemovingSeccompProfileInContainer) Plan() string
• type BySettingSeccompProfile
  • func (pending *BySettingSeccompProfile) Apply(resource k8s.Resource) []k8s.Resource
  • func (pending *BySettingSeccompProfile) Plan() string
• type BySettingSeccompProfileInContainer
  • func (pending *BySettingSeccompProfileInContainer) Apply(resource k8s.Resource) []k8s.Resource
  • func (pending *BySettingSeccompProfileInContainer) Plan() string
• type Seccomp
  • func New() *Seccomp
  • func (a *Seccomp) Audit(resource k8s.Resource, _ []k8s.Resource) ([]*kubeaudit.AuditResult, error)

Constants

const (
	// SeccompDeprecatedAnnotations occurs when deprecated seccomp annotations are present
	SeccompDeprecatedAnnotations = "SeccompDeprecatedAnnotations"
	// SeccompProfileMissing occurs when there are no seccomp profiles (pod nor container level)
	SeccompProfileMissing = "SeccompProfileMissing"
	// SeccompDisabledPod occurs when the pod-level seccomp profile is set to a value which disables seccomp
	SeccompDisabledPod = "SeccompDisabledPod"
	// SeccompDisabledContainer occurs when the container-level seccomp profile is set to a value which disables seccomp
	SeccompDisabledContainer = "SeccompDisabledContainer"
)

const (
	// ProfileRuntimeDefault represents the default seccomp profile used by container runtime
	ProfileRuntimeDefault = apiv1.SeccompProfileTypeRuntimeDefault
	// ProfileLocalhost represents the localhost seccomp profile used by container runtime
	ProfileLocalhost = apiv1.SeccompProfileTypeLocalhost
	// ContainerAnnotationKeyPrefix represents the key of a seccomp profile applied to one container of a pod
	ContainerAnnotationKeyPrefix = apiv1.SeccompContainerAnnotationKeyPrefix
	// PodAnnotationKey represents the key of a seccomp profile applied to all containers of a pod
	PodAnnotationKey = apiv1.SeccompPodAnnotationKey
)

const Name = "seccomp"

Types

type ByRemovingSeccompProfileInContainer

type ByRemovingSeccompProfileInContainer struct {
	// contains filtered or unexported fields
}

func (*ByRemovingSeccompProfileInContainer) Apply

func (pending *ByRemovingSeccompProfileInContainer) Apply(resource k8s.Resource) []k8s.Resource

func (*ByRemovingSeccompProfileInContainer) Plan

func (pending *ByRemovingSeccompProfileInContainer) Plan() string

type BySettingSeccompProfile

type BySettingSeccompProfile struct {
	// contains filtered or unexported fields
}

func (*BySettingSeccompProfile) Apply

func (pending *BySettingSeccompProfile) Apply(resource k8s.Resource) []k8s.Resource

func (*BySettingSeccompProfile) Plan

func (pending *BySettingSeccompProfile) Plan() string

type BySettingSeccompProfileInContainer

type BySettingSeccompProfileInContainer struct {
	// contains filtered or unexported fields
}

func (*BySettingSeccompProfileInContainer) Apply

func (pending *BySettingSeccompProfileInContainer) Apply(resource k8s.Resource) []k8s.Resource

func (*BySettingSeccompProfileInContainer) Plan

func (pending *BySettingSeccompProfileInContainer) Plan() string

type Seccomp

type Seccomp struct{}

Seccomp implements Auditable

func New

func New() *Seccomp

func (*Seccomp) Audit

func (a *Seccomp) Audit(resource k8s.Resource, _ []k8s.Resource) ([]*kubeaudit.AuditResult, error)

Audit checks that Seccomp is enabled for all containers