imagerules

Documentation

Index

• Constants
• func CheckImageAgainstRules(ctx context.Context, c client.Reader, ...) error
• func CheckImageAllowed(ctx context.Context, c client.Reader, ...) error
• func CheckRoleAuthorizations(ctx context.Context, c client.Reader, namespace, imageName, digest string, ...) ([]internaladminv1.RoleAuthorizations, error)
• func GetAuthorizedPermissions(ctx context.Context, c client.Reader, namespace, imageName, digest string) ([]v1.Permissions, error)
• type ErrImageNotAllowed
  • func (e *ErrImageNotAllowed) Error() string
  • func (e *ErrImageNotAllowed) Is(target error) bool

Constants

const ErrImageNotAllowedIdentifier = "not allowed by any ImageAllowRule"

Functions

func CheckImageAgainstRules

func CheckImageAgainstRules(ctx context.Context, c client.Reader, namespace, imageName, resolvedName, digest string, imageAllowRules []v1.ImageAllowRuleInstance, opts ...remote.Option) error

CheckImageAgainstRules checks if the image is allowed by the given ImageAllowRules If no rules are given, the image is denied. ! Only one single rule has to allow the image for this to pass !

About image references: @param imageName: the image how it was called (e.g. how it was specified by the user in `acorn run`) @param resolvedName: the image name after resolution (e.g. resolved to an internal image ID) @param digest: the digest of the image We will use all of those to check if an image is covered by an IAR. We will prefer resolvedName to find signature artifacts (potentially in the internal registry)

func CheckImageAllowed

func CheckImageAllowed(ctx context.Context, c client.Reader, namespace, imageName, resolvedName, digest string, opts ...remote.Option) error

CheckImageAllowed checks if the image is allowed by the ImageAllowRules on cluster and project level

func CheckRoleAuthorizations

func CheckRoleAuthorizations(ctx context.Context, c client.Reader, namespace, imageName, digest string, iras []internaladminv1.ImageRoleAuthorizationInstance, opts ...remote.Option) ([]internaladminv1.RoleAuthorizations, error)

func GetAuthorizedPermissions

func GetAuthorizedPermissions(ctx context.Context, c client.Reader, namespace, imageName, digest string) ([]v1.Permissions, error)

Types

type ErrImageNotAllowed

type ErrImageNotAllowed struct {
	Image string
}

func (*ErrImageNotAllowed) Error

func (e *ErrImageNotAllowed) Error() string

func (*ErrImageNotAllowed) Is

func (e *ErrImageNotAllowed) Is(target error) bool