kube

package
v0.15.10 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Sep 28, 2022 License: Apache-2.0 Imports: 37 Imported by: 14

Documentation

Overview

Package kube provides primitives for working with Kubernetes objects.

Index

Constants

This section is empty.

Variables

View Source 
var ErrNoRunningPods = errors.New("no active pods for controller")
View Source 
var ErrReplicaSetNotFound = errors.New("replicaset not found")
View Source 
var ErrUnSupportedKind = errors.New("unsupported workload kind")

Functions

func AggregateImagePullSecretsData added in v0.7.1 

func AggregateImagePullSecretsData(images ContainerImages, credentials map[string]docker.Auth) map[string][]byte

func ComputeHash added in v0.10.0 

func ComputeHash(obj interface{}) string

ComputeHash returns a hash value calculated from a given object. The hash will be safe encoded to avoid bad words.

func ComputeSpecHash added in v0.12.0 

func ComputeSpecHash(obj client.Object) (string, error)

ComputeSpecHash computes hash of the specified K8s client.Object. The hash is used to indicate whether the client.Object should be rescanned or not by adding it as the starboard.LabelResourceSpecHash label to an instance of a security report.

func DeepHashObject added in v0.10.0 

func DeepHashObject(hasher hash.Hash, objectToWrite interface{})

DeepHashObject writes specified object to hash using the spew library which follows pointers and prints actual values of the nested objects ensuring the hash does not change when a pointer changes.

func GVRForResource added in v0.3.0 

func GVRForResource(mapper meta.RESTMapper, resource string) (gvr schema.GroupVersionResource, gvk schema.GroupVersionKind, err error)

func GetActiveDeadlineSeconds added in v0.9.0 

func GetActiveDeadlineSeconds(d time.Duration) *int64

func GetPodSpec added in v0.10.0 

func GetPodSpec(obj client.Object) (corev1.PodSpec, error)

GetPodSpec returns v1.PodSpec from the specified Kubernetes client.Object. Returns error if the given client.Object is not a Kubernetes workload.

func GetTerminatedContainersStatusesByPod added in v0.9.0 

func GetTerminatedContainersStatusesByPod(pod *corev1.Pod) map[string]*corev1.ContainerStateTerminated

func IsBuiltInWorkload added in v0.10.0 

func IsBuiltInWorkload(controller *metav1.OwnerReference) bool

IsBuiltInWorkload returns true if the specified v1.OwnerReference is a built-in Kubernetes workload, false otherwise.

func IsClusterScopedKind added in v0.12.0 

func IsClusterScopedKind(kind string) bool

IsClusterScopedKind returns true if the specified kind is ClusterRole, ClusterRoleBinding, and CustomResourceDefinition.

TODO Use discovery client to have a generic implementation.

func IsPodControlledByJobNotFound added in v0.15.0 

func IsPodControlledByJobNotFound(err error) bool

func IsWorkload added in v0.15.0 

func IsWorkload(kind string) bool

IsWorkload returns true if the specified resource kinds represents Kubernetes workload, false otherwise.

func KindForObject added in v0.3.0 

func KindForObject(object metav1.Object, scheme *runtime.Scheme) (string, error)

func MapContainerNamesToDockerAuths added in v0.7.1 

func MapContainerNamesToDockerAuths(images ContainerImages, secrets []corev1.Secret) (map[string]docker.Auth, error)

MapContainerNamesToDockerAuths creates the mapping from a container name to the Docker authentication credentials for the specified kube.ContainerImages and image pull Secrets.

func MapDockerRegistryServersToAuths added in v0.7.1 

func MapDockerRegistryServersToAuths(imagePullSecrets []corev1.Secret) (map[string]docker.Auth, error)

MapDockerRegistryServersToAuths creates the mapping from a Docker registry server to the Docker authentication credentials for the specified slice of image pull Secrets.

func NewImagePullSecret added in v0.7.1 

func NewImagePullSecret(meta metav1.ObjectMeta, server, username, password string) (*corev1.Secret, error)

NewImagePullSecret constructs a new image pull Secret with the specified registry server and basic authentication credentials.

func NewRunnableJob 

func NewRunnableJob(
	scheme *runtime.Scheme,
	clientset kubernetes.Interface,
	job *batchv1.Job,
	secrets ...*corev1.Secret,
) runner.Runnable

NewRunnableJob constructs a new Runnable task defined as Kubernetes job configuration and secrets that it references.

func ObjectRefToLabels added in v0.14.0 

func ObjectRefToLabels(obj ObjectRef) map[string]string

ObjectRefToLabels encodes the specified ObjectRef as a set of labels.

If Object's name cannot be used as the value of the starboard.LabelResourceName label, as a fallback, this method will calculate a hash of the Object's name and use it as the value of the starboard.LabelResourceNameHash label.

func ObjectToObjectMeta added in v0.15.0 

func ObjectToObjectMeta(obj client.Object, meta *metav1.ObjectMeta) error

ObjectToObjectMeta encodes the specified client.Object as a set of labels and annotations added to the given ObjectMeta.

Types

type CompatibleMgr added in v0.15.9 

type CompatibleMgr interface {
	// GetSupportedObjectByKind get specific k8s compatible object (group/api/kind) by kind
	GetSupportedObjectByKind(kind Kind) client.Object
}

CompatibleMgr provide k8s compatible objects (group/api/kind) capabilities

func InitCompatibleMgr added in v0.15.9 

func InitCompatibleMgr(restMapper meta.RESTMapper) (CompatibleMgr, error)

InitCompatibleMgr initializes a CompatibleObjectMapper who store a map the of supported kinds with it compatible Objects (group/api/kind) it dynamically fetches the compatible k8s objects (group/api/kind) by resource from the cluster and store it in kind vs k8s object mapping It will enable the operator to support old and new API resources based on cluster version support

type CompatibleObjectMapper added in v0.15.9 

type CompatibleObjectMapper struct {
	// contains filtered or unexported fields
}

func (*CompatibleObjectMapper) GetSupportedObjectByKind added in v0.15.9 

func (o *CompatibleObjectMapper) GetSupportedObjectByKind(kind Kind) client.Object

GetSupportedObjectByKind accept kind and return the supported object (group/api/kind) of the cluster

type ContainerImages added in v0.2.6 

type ContainerImages map[string]string

ContainerImages is a simple structure to hold the mapping between container names and container image references.

func GetContainerImagesFromJob added in v0.10.0 

func GetContainerImagesFromJob(job *batchv1.Job) (ContainerImages, error)

GetContainerImagesFromJob returns a map of container names to container images from the specified v1.Job. The mapping is encoded as JSON value of the AnnotationContainerImages annotation.

func GetContainerImagesFromPodSpec added in v0.10.0 

func GetContainerImagesFromPodSpec(spec corev1.PodSpec) ContainerImages

GetContainerImagesFromPodSpec returns a map of container names to container images from the specified v1.PodSpec.

func (ContainerImages) AsJSON added in v0.2.6 

func (ci ContainerImages) AsJSON() (string, error)

func (ContainerImages) FromJSON added in v0.2.6 

func (ci ContainerImages) FromJSON(value string) error

type Kind added in v0.2.3 

type Kind string

Kind represents the type of Kubernetes client.Object. 

const (
	KindUnknown Kind = "Unknown"

	KindNode      Kind = "Node"
	KindNamespace Kind = "Namespace"

	KindPod                   Kind = "Pod"
	KindReplicaSet            Kind = "ReplicaSet"
	KindReplicationController Kind = "ReplicationController"
	KindDeployment            Kind = "Deployment"
	KindStatefulSet           Kind = "StatefulSet"
	KindDaemonSet             Kind = "DaemonSet"
	KindCronJob               Kind = "CronJob"
	KindJob                   Kind = "Job"
	KindService               Kind = "Service"
	KindConfigMap             Kind = "ConfigMap"
	KindRole                  Kind = "Role"
	KindRoleBinding           Kind = "RoleBinding"
	KindNetworkPolicy         Kind = "NetworkPolicy"
	KindIngress               Kind = "Ingress"
	KindResourceQuota         Kind = "ResourceQuota"
	KindLimitRange            Kind = "LimitRange"

	KindClusterRole              Kind = "ClusterRole"
	KindClusterRoleBindings      Kind = "ClusterRoleBinding"
	KindCustomResourceDefinition Kind = "CustomResourceDefinition"
	KindPodSecurityPolicy        Kind = "PodSecurityPolicy"
)

type LogsReader added in v0.9.0 

type LogsReader interface {
	GetLogsByJobAndContainerName(ctx context.Context, job *batchv1.Job, containerName string) (io.ReadCloser, error)
	GetTerminatedContainersStatusesByJob(ctx context.Context, job *batchv1.Job) (map[string]*corev1.ContainerStateTerminated, error)
}

func NewLogsReader added in v0.9.0 

func NewLogsReader(clientset kubernetes.Interface) LogsReader

type ObjectRef added in v0.14.0 

type ObjectRef struct {
	Kind      Kind
	Name      string
	Namespace string
}

ObjectRef is a simplified representation of a Kubernetes client.Object. Each object has Kind, which designates the type of the entity it represents. Objects have names and many of them live in namespaces.

func ObjectRefFromKindAndObjectKey added in v0.15.0 

func ObjectRefFromKindAndObjectKey(kind Kind, name client.ObjectKey) ObjectRef

func ObjectRefFromObjectMeta added in v0.14.0 

func ObjectRefFromObjectMeta(objectMeta metav1.ObjectMeta) (ObjectRef, error)

type ObjectResolver added in v0.10.0 

type ObjectResolver struct {
	client.Client
	CompatibleMgr
}

func NewObjectResolver added in v0.15.9 

func NewObjectResolver(c client.Client, cm CompatibleMgr) ObjectResolver

func (*ObjectResolver) CronJobByJob added in v0.13.0 

func (o *ObjectResolver) CronJobByJob(ctx context.Context, job *batchv1.Job) (client.Object, error)

func (*ObjectResolver) GetNodeName added in v0.14.1 

func (o *ObjectResolver) GetNodeName(ctx context.Context, obj client.Object) (string, error)

GetNodeName returns the name of the node on which the given workload is scheduled. If there are no running pods then the ErrNoRunningPods error is returned. If there are no active ReplicaSets for the Deployment the ErrReplicaSetNotFound error is returned. If the specified workload is a CronJob the ErrUnSupportedKind error is returned.

func (*ObjectResolver) GetPodsByLabelSelector added in v0.14.1 

func (o *ObjectResolver) GetPodsByLabelSelector(ctx context.Context, namespace string,
	labelSelector labels.Set) ([]corev1.Pod, error)

func (*ObjectResolver) IsActiveReplicaSet added in v0.14.0 

func (o *ObjectResolver) IsActiveReplicaSet(ctx context.Context, workloadObj client.Object, controller *metav1.OwnerReference) (bool, error)

func (*ObjectResolver) JobByPod added in v0.13.0 

func (o *ObjectResolver) JobByPod(ctx context.Context, pod *corev1.Pod) (*batchv1.Job, error)

func (*ObjectResolver) ObjectFromObjectRef added in v0.14.0 

func (o *ObjectResolver) ObjectFromObjectRef(ctx context.Context, ref ObjectRef) (client.Object, error)

func (*ObjectResolver) RelatedReplicaSetName added in v0.15.0 

func (o *ObjectResolver) RelatedReplicaSetName(ctx context.Context, object ObjectRef) (string, error)

RelatedReplicaSetName attempts to find the replicaset that is associated with the given owner. If the owner is a Deployment, it will look for a ReplicaSet that is controlled by the Deployment. If the owner is a Pod, it will look for the ReplicaSet that owns the Pod.

func (*ObjectResolver) ReplicaSetByDeployment added in v0.13.0 

func (o *ObjectResolver) ReplicaSetByDeployment(ctx context.Context, deployment *appsv1.Deployment) (*appsv1.ReplicaSet, error)

ReplicaSetByDeployment returns the current revision of the specified Deployment. If the current revision cannot be found the ErrReplicaSetNotFound error is returned.

func (*ObjectResolver) ReplicaSetByDeploymentRef added in v0.15.0 

func (o *ObjectResolver) ReplicaSetByDeploymentRef(ctx context.Context, deploymentRef ObjectRef) (*appsv1.ReplicaSet, error)

ReplicaSetByDeploymentRef returns the current revision of the specified Deployment reference. If the current revision cannot be found the ErrReplicaSetNotFound error is returned.

func (*ObjectResolver) ReplicaSetByPod added in v0.13.0 

func (o *ObjectResolver) ReplicaSetByPod(ctx context.Context, pod *corev1.Pod) (*appsv1.ReplicaSet, error)

ReplicaSetByPod returns the controller ReplicaSet of the specified Pod.

func (*ObjectResolver) ReplicaSetByPodRef added in v0.15.0 

func (o *ObjectResolver) ReplicaSetByPodRef(ctx context.Context, object ObjectRef) (*appsv1.ReplicaSet, error)

ReplicaSetByPodRef returns the controller ReplicaSet of the specified Pod reference.

func (*ObjectResolver) ReportOwner added in v0.13.0 

func (o *ObjectResolver) ReportOwner(ctx context.Context, obj client.Object) (client.Object, error)

ReportOwner resolves the owner of a security report for the specified object.

type ScannerOpts added in v0.2.1 

type ScannerOpts struct {
	ScanJobTimeout time.Duration
	DeleteScanJob  bool
}

ScannerOpts holds configuration of the vulnerability Scanner. TODO Rename to CLIConfig and move it to the cmd package

type SecretsReader added in v0.7.1 

type SecretsReader interface {
	ListByLocalObjectReferences(ctx context.Context, refs []corev1.LocalObjectReference, ns string) ([]corev1.Secret, error)
	ListByServiceAccount(ctx context.Context, name string, ns string) ([]corev1.Secret, error)
	ListImagePullSecretsByPodSpec(ctx context.Context, spec corev1.PodSpec, ns string) ([]corev1.Secret, error)
	CredentialsByWorkload(ctx context.Context, workload client.Object) (map[string]docker.Auth, error)
}

SecretsReader defines methods for reading Secrets.

func NewSecretsReader added in v0.8.0 

func NewSecretsReader(client client.Client) SecretsReader

NewSecretsReader constructs a new SecretsReader which is using the client package provided by the controller-runtime libraries for interacting with the Kubernetes API server.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.