policyfilter

Documentation

Overview

SPDX-License-Identifier: Apache-2.0 Copyright Authors of Tetragon

SPDX-License-Identifier: Apache-2.0 Copyright Authors of Tetragon

Index

• Constants
• func New() (*state, error)
• type CgroupID
• type PfMap
  • func OpenMap(fname string) (PfMap, error)
  • func (m PfMap) Dump() (map[PolicyID]map[CgroupID]struct{}, error)
• type PodID
  • func (i PodID) String() string
• type PolicyID
• type State
  • func GetState() (State, error)

Constants

const (
	MapName = "policy_filter_maps"
)

Functions

func New

func New() (*state, error)

New creates a new State of the policy filter code. Callers should call Close() to release allocated resources (namely the bpf map).

Types

type CgroupID

type CgroupID uint64

type PfMap

type PfMap struct {
	*ebpf.Map
}

PfMap is a simple wrapper for ebpf.Map so that we can write methods for it

func OpenMap

func OpenMap(fname string) (PfMap, error)

func (PfMap) Dump

func (m PfMap) Dump() (map[PolicyID]map[CgroupID]struct{}, error)

type PodID

type PodID uuid.UUID

func (PodID) String

func (i PodID) String() string

type PolicyID

type PolicyID uint32

type State

type State interface {
	// AddPolicy adds state a policy to the state
	AddPolicy(polID PolicyID, namespace string) error
	// DelPolicy will removes a policy from the state
	DelPolicy(polID PolicyID) error

	// AddPodContainer informs policyfilter about a new container in a pod.
	// if the cgroup id of the container is known, cgID is not nil and it contains its value.
	//
	// The pod might or might not have been encountered before.
	AddPodContainer(podID PodID, namespace string, containerID string, cgIDp *CgroupID) error
	// DelPodContainer informs policyfilter that a container was deleted from a pod
	DelPodContainer(podID PodID, containerID string) error
	// DelPod informs policyfilter that a pod has been deleted
	DelPod(podID PodID) error

	// RegisterPodHandlers can be used to register appropriate pod handlers to a pod informer
	// that for keeping the policy filter state up-to-date.
	RegisterPodHandlers(podInformer cache.SharedIndexInformer)

	// Close releases resources allocated by the Manager. Specifically, we close and unpin the
	// policy filter map.
	Close() error
}

State is the policyfilter state interface It handles two things:

• policies being added and removed
• pod continers being created and deleted.

func GetState

func GetState() (State, error)

GetState returns global state for policyfilter