pod_security_policy

package

Go to main page

Versions in this module

v0

v0.8.0

Feb 22, 2021

Changes in this version

type PSP

+ func (psp *PSP) CreatePODWithCapabilities(capAdd []string, capDrop []string, probe *audit.Probe) (*apiv1.Pod, error)

+ func (psp *PSP) ExecCmd(pName *string, cmd string, probe *audit.Probe) (*kubernetes.CmdExecutionResult, error)

type PodSecurityPolicy

+ CreatePODWithCapabilities func(capAdd []string, capDrop []string, probe *audit.Probe) (*apiv1.Pod, error)

+ ExecCmd func(pName *string, cmd string, probe *audit.Probe) (*kubernetes.CmdExecutionResult, error)

v0.8.0-rc

Feb 19, 2021

v0.7.1

Feb 9, 2021

Changes in this version

+ func TestAllowedCapabilitiesAreRestricted(t *testing.T)

+ func TestAssignedCapabilitiesAreRestricted(t *testing.T)

+ func TestClusterHasPSP(t *testing.T)

+ func TestCreatePODSettingAttributes(t *testing.T)

+ func TestCreatePODSettingCapabilities(t *testing.T)

+ func TestCreatePODSettingSecurityContext(t *testing.T)

+ func TestHostIPCIsRestricted(t *testing.T)

+ func TestHostNetworkIsRestricted(t *testing.T)

+ func TestHostPIDIsRestricted(t *testing.T)

+ func TestHostPortsAreRestricted(t *testing.T)

+ func TestNETRawIsRestricted(t *testing.T)

+ func TestPSPProbeCommand(t *testing.T)

+ func TestPrivilegedAccessIsRestricted(t *testing.T)

+ func TestPrivilegedEscalationIsRestricted(t *testing.T)

+ func TestRootUserIsRestricted(t *testing.T)

+ func TestSeccompProfilesAreRestricted(t *testing.T)

+ func TestVolumeTypesAreRestricted(t *testing.T)

v0.7.0

Feb 8, 2021

Changes in this version

type PSPProbeCommand

+ const SudoChroot

v0.7.0-rc

Feb 5, 2021

v0.6.1

Feb 4, 2021

v0.6.0

Jan 25, 2021

v0.6.0-rc

Jan 22, 2021

v0.5.0

Jan 8, 2021

Changes in this version

type ProbeStruct

+ func (p ProbeStruct) Path() string

v0.5.0-rc

Jan 8, 2021

v0.4.2

Nov 27, 2020

v0.4.2-ms

Nov 27, 2020

v0.4.1

Nov 26, 2020

v0.4.0

Nov 24, 2020

Changes in this version

+ func SetPodSecurityPolicy(p PodSecurityPolicy)

+ type AzK8sConstraintTemplate struct

+ func NewAzK8sConstraintTemplate(k kubernetes.Kubernetes) *AzK8sConstraintTemplate

+ func NewDefaultAzK8sConstraintTemplate() *AzK8sConstraintTemplate

+ func (az *AzK8sConstraintTemplate) HasAllowPrivilegeEscalationRestriction() (*bool, error)

+ func (az *AzK8sConstraintTemplate) HasAllowedCapabilitiesRestriction() (*bool, error)

+ func (az *AzK8sConstraintTemplate) HasAssignedCapabilitiesRestriction() (*bool, error)

+ func (az *AzK8sConstraintTemplate) HasHostIPCRestriction() (*bool, error)

+ func (az *AzK8sConstraintTemplate) HasHostNetworkRestriction() (*bool, error)

+ func (az *AzK8sConstraintTemplate) HasHostPIDRestriction() (*bool, error)

+ func (az *AzK8sConstraintTemplate) HasHostPortRestriction() (*bool, error)

+ func (az *AzK8sConstraintTemplate) HasNETRAWRestriction() (*bool, error)

+ func (az *AzK8sConstraintTemplate) HasPrivilegedAccessRestriction() (*bool, error)

+ func (az *AzK8sConstraintTemplate) HasRootUserRestriction() (*bool, error)

+ func (az *AzK8sConstraintTemplate) HasSeccompProfileRestriction() (*bool, error)

+ func (az *AzK8sConstraintTemplate) HasSecurityPolicies() (*bool, error)

+ func (az *AzK8sConstraintTemplate) HasVolumeTypeRestriction() (*bool, error)

+ type KubePodSecurityPolicyProvider struct

+ func NewKubePodSecurityPolicyProvider(k kubernetes.Kubernetes) *KubePodSecurityPolicyProvider

+ func (p *KubePodSecurityPolicyProvider) HasAllowPrivilegeEscalationRestriction() (*bool, error)

+ func (p *KubePodSecurityPolicyProvider) HasAllowedCapabilitiesRestriction() (*bool, error)

+ func (p *KubePodSecurityPolicyProvider) HasAssignedCapabilitiesRestriction() (*bool, error)

+ func (p *KubePodSecurityPolicyProvider) HasHostIPCRestriction() (*bool, error)

+ func (p *KubePodSecurityPolicyProvider) HasHostNetworkRestriction() (*bool, error)

+ func (p *KubePodSecurityPolicyProvider) HasHostPIDRestriction() (*bool, error)

+ func (p *KubePodSecurityPolicyProvider) HasHostPortRestriction() (*bool, error)

+ func (p *KubePodSecurityPolicyProvider) HasNETRAWRestriction() (*bool, error)

+ func (p *KubePodSecurityPolicyProvider) HasPrivilegedAccessRestriction() (*bool, error)

+ func (p *KubePodSecurityPolicyProvider) HasRootUserRestriction() (*bool, error)

+ func (p *KubePodSecurityPolicyProvider) HasSeccompProfileRestriction() (*bool, error)

+ func (p *KubePodSecurityPolicyProvider) HasSecurityPolicies() (*bool, error)

+ func (p *KubePodSecurityPolicyProvider) HasVolumeTypeRestriction() (*bool, error)

+ type PSP struct

+ func NewDefaultPSP() *PSP

+ func NewPSP(k kubernetes.Kubernetes, sp *[]SecurityPolicyProvider) *PSP

+ func (psp *PSP) AllowedCapabilitiesAreRestricted() (*bool, error)

+ func (psp *PSP) AssignedCapabilitiesAreRestricted() (*bool, error)

+ func (psp *PSP) ClusterHasPSP() (*bool, error)

+ func (psp *PSP) ClusterIsDeployed() *bool

+ func (psp *PSP) CreateConfigMap() error

+ func (psp *PSP) CreatePODSettingAttributes(hostPID *bool, hostIPC *bool, hostNetwork *bool, probe *summary.Probe) (*apiv1.Pod, error)

+ func (psp *PSP) CreatePODSettingCapabilities(c *[]string, probe *summary.Probe) (*apiv1.Pod, error)

+ func (psp *PSP) CreatePODSettingSecurityContext(pr *bool, pe *bool, runAsUser *int64, probe *summary.Probe) (*apiv1.Pod, error)

+ func (psp *PSP) CreatePodFromYaml(y []byte, probe *summary.Probe) (*apiv1.Pod, error)

+ func (psp *PSP) DeleteConfigMap() error

+ func (psp *PSP) ExecPSPProbeCmd(pName *string, cmd PSPProbeCommand, probe *summary.Probe) (*kubernetes.CmdExecutionResult, error)

+ func (psp *PSP) HostIPCIsRestricted() (*bool, error)

+ func (psp *PSP) HostNetworkIsRestricted() (*bool, error)

+ func (psp *PSP) HostPIDIsRestricted() (*bool, error)

+ func (psp *PSP) HostPortsAreRestricted() (*bool, error)

+ func (psp *PSP) NETRawIsRestricted() (*bool, error)

+ func (psp *PSP) PrivilegedAccessIsRestricted() (*bool, error)

+ func (psp *PSP) PrivilegedEscalationIsRestricted() (*bool, error)

+ func (psp *PSP) RootUserIsRestricted() (*bool, error)

+ func (psp *PSP) SeccompProfilesAreRestricted() (*bool, error)

+ func (psp *PSP) TeardownPodSecurityProbe(p *string, e string) error

+ func (psp *PSP) VolumeTypesAreRestricted() (*bool, error)

+ type PSPProbeCommand int

+ const Chroot

+ const EnterHostIPCNS

+ const EnterHostNetworkNS

+ const EnterHostPIDNS

+ const Ls

+ const NetCat

+ const NetRawProbe

+ const SpecialCapProbe

+ const Unshare

+ const VerifyNonRootUID

+ func (c PSPProbeCommand) String() string

+ type PodSecurityPolicy interface

+ AllowedCapabilitiesAreRestricted func() (*bool, error)

+ AssignedCapabilitiesAreRestricted func() (*bool, error)

+ ClusterHasPSP func() (*bool, error)

+ ClusterIsDeployed func() *bool

+ CreateConfigMap func() error

+ CreatePODSettingAttributes func(hostPID *bool, hostIPC *bool, hostNetwork *bool, probe *summary.Probe) (*apiv1.Pod, error)

+ CreatePODSettingCapabilities func(c *[]string, probe *summary.Probe) (*apiv1.Pod, error)

+ CreatePODSettingSecurityContext func(pr *bool, pe *bool, runAsUser *int64, probe *summary.Probe) (*apiv1.Pod, error)

+ CreatePodFromYaml func(y []byte, probe *summary.Probe) (*apiv1.Pod, error)

+ DeleteConfigMap func() error

+ ExecPSPProbeCmd func(pName *string, cmd PSPProbeCommand, probe *summary.Probe) (*kubernetes.CmdExecutionResult, error)

+ HostIPCIsRestricted func() (*bool, error)

+ HostNetworkIsRestricted func() (*bool, error)

+ HostPIDIsRestricted func() (*bool, error)

+ HostPortsAreRestricted func() (*bool, error)

+ NETRawIsRestricted func() (*bool, error)

+ PrivilegedAccessIsRestricted func() (*bool, error)

+ PrivilegedEscalationIsRestricted func() (*bool, error)

+ RootUserIsRestricted func() (*bool, error)

+ SeccompProfilesAreRestricted func() (*bool, error)

+ TeardownPodSecurityProbe func(p *string, e string) error

+ VolumeTypesAreRestricted func() (*bool, error)

+ type PrivilegedAccess int

+ const WithPrivilegedAccess

+ const WithoutPrivilegedAccess

+ type ProbeStruct struct

+ var Probe ProbeStruct

+ func (p ProbeStruct) Name() string

+ func (p ProbeStruct) ProbeInitialize(ctx *godog.TestSuiteContext)

+ func (p ProbeStruct) ScenarioInitialize(ctx *godog.ScenarioContext)

+ type SecurityPolicyProvider interface

+ HasAllowPrivilegeEscalationRestriction func() (*bool, error)

+ HasAllowedCapabilitiesRestriction func() (*bool, error)

+ HasAssignedCapabilitiesRestriction func() (*bool, error)

+ HasHostIPCRestriction func() (*bool, error)

+ HasHostNetworkRestriction func() (*bool, error)

+ HasHostPIDRestriction func() (*bool, error)

+ HasHostPortRestriction func() (*bool, error)

+ HasNETRAWRestriction func() (*bool, error)

+ HasPrivilegedAccessRestriction func() (*bool, error)

+ HasRootUserRestriction func() (*bool, error)

+ HasSeccompProfileRestriction func() (*bool, error)

+ HasSecurityPolicies func() (*bool, error)

+ HasVolumeTypeRestriction func() (*bool, error)

+ type VerificationProbe struct

+ Cmd PSPProbeCommand

+ ExpectedExitCode int

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL