admission

Documentation

Index

• Constants
• func AdmitImage(size int64, limit kapi.LimitRangeItem) error
• func GetImageReferenceForObjectReference(namespace string, objRef *kapi.ObjectReference) (string, error)
• func GetImageStreamUsage(is *imageapi.ImageStream) kapi.ResourceList
• func NewImageLimitRangerPlugin(config io.Reader) (admission.Interface, error)
• func ProcessImageStreamImages(is *imageapi.ImageStream, specOnly bool, handler InternalImageReferenceHandler) error
• type InternalImageReferenceHandler
• type LimitRangesForNamespaceFunc
  • func (fn LimitRangesForNamespaceFunc) LimitsForNamespace(namespace string) (kapi.ResourceList, error)
• type LimitVerifier
  • func NewLimitVerifier(limiter NamespaceLimiter) LimitVerifier
• type NamespaceLimiter

Constants

const (
	PluginName = "openshift.io/ImageLimitRange"
)

Functions

func AdmitImage

func AdmitImage(size int64, limit kapi.LimitRangeItem) error

AdmitImage checks if the size is greater than the limit range. Abstracted for reuse in the registry.

func GetImageReferenceForObjectReference

func GetImageReferenceForObjectReference(namespace string, objRef *kapi.ObjectReference) (string, error)

GetImageReferenceForObjectReference returns corresponding image reference for the given object reference representing either an image stream image or image stream tag or docker image.

func GetImageStreamUsage

func GetImageStreamUsage(is *imageapi.ImageStream) kapi.ResourceList

GetImageStreamUsage counts number of unique internally managed images occupying given image stream. It returns a number of unique image references found in the image stream spec not contained in processedSpecRefs and a number of unique image hashes contained in iS status not contained in processedStatusRefs. Given sets will be updated with new references found.

func NewImageLimitRangerPlugin

func NewImageLimitRangerPlugin(config io.Reader) (admission.Interface, error)

NewImageLimitRangerPlugin provides a new imageLimitRangerPlugin.

func ProcessImageStreamImages

func ProcessImageStreamImages(is *imageapi.ImageStream, specOnly bool, handler InternalImageReferenceHandler) error

ProcessImageStreamImages is a utility method that calls a given handler on every image reference found in the given image stream. If specOnly is true, only image references found in is spec will be processed. The handler will be called just once for each unique image reference.

Types

type InternalImageReferenceHandler

type InternalImageReferenceHandler func(imageReference string, inSpec, inStatus bool) error

InternalImageReferenceHandler is a function passed to the computer when processing images that allows a caller to perform actions on image references. The handler is called on a unique image reference just once. Argument inSpec says whether the image reference is present in an image stream spec. The inStatus says the same for an image stream status.

The reference can either be:

1. a docker image reference (e.g. 172.30.12.34:5000/test/is2:tag)
2. an image stream tag (e.g. project/isname:latest)
3. an image ID (e.g. sha256:2643199e5ed5047eeed22da854748ed88b3a63ba0497601ba75852f7b92d4640)

The first two a can be obtained only from IS spec. Processing of IS status can generate only the 3rd option.

The docker image reference will always be normalized such that registry url is always specified while a default docker namespace and tag are stripped.

type LimitRangesForNamespaceFunc

type LimitRangesForNamespaceFunc func(namespace string) ([]*kapi.LimitRange, error)

func (LimitRangesForNamespaceFunc) LimitsForNamespace

func (fn LimitRangesForNamespaceFunc) LimitsForNamespace(namespace string) (kapi.ResourceList, error)

type LimitVerifier

type LimitVerifier interface {
	VerifyLimits(namespace string, is *imageapi.ImageStream) error
}

func NewLimitVerifier

func NewLimitVerifier(limiter NamespaceLimiter) LimitVerifier

NewLimitVerifier accepts a NamespaceLimiter

type NamespaceLimiter

type NamespaceLimiter interface {
	LimitsForNamespace(namespace string) (kapi.ResourceList, error)
}