Documentation ¶
Overview ¶
Package kube provides primitives for working with Kubernetes objects.
Index ¶
- Constants
- Variables
- func AggregateImagePullSecretsData(images ContainerImages, credentials map[string]docker.Auth) map[string][]byte
- func ComputeHash(obj interface{}) string
- func ComputeSpecHash(obj client.Object) (string, error)
- func DeepHashObject(hasher hash.Hash, objectToWrite interface{})
- func GVRForResource(mapper meta.RESTMapper, resource string) (gvr schema.GroupVersionResource, gvk schema.GroupVersionKind, err error)
- func GetActiveDeadlineSeconds(d time.Duration) *int64
- func GetPodSpec(obj client.Object) (corev1.PodSpec, error)
- func GetTerminatedContainersStatusesByPod(pod *corev1.Pod) map[string]*corev1.ContainerStateTerminated
- func IsBuiltInWorkload(controller *metav1.OwnerReference) bool
- func IsClusterScopedKind(kind string) bool
- func IsPodControlledByJobNotFound(err error) bool
- func IsWorkload(kind string) bool
- func KindForObject(object metav1.Object, scheme *runtime.Scheme) (string, error)
- func MapContainerNamesToDockerAuths(images ContainerImages, secrets []corev1.Secret) (map[string]docker.Auth, error)
- func MapDockerRegistryServersToAuths(imagePullSecrets []corev1.Secret) (map[string]docker.Auth, error)
- func MarkOldReportForImmediateDeletion(ctx context.Context, resolver ObjectResolver, namespace string, ...) error
- func NewImagePullSecret(meta metav1.ObjectMeta, server, username, password string) (*corev1.Secret, error)
- func NewRunnableJob(scheme *runtime.Scheme, clientset kubernetes.Interface, job *batchv1.Job, ...) runner.Runnable
- func ObjectRefToLabels(obj ObjectRef) map[string]string
- func ObjectToObjectMeta(obj client.Object, meta *metav1.ObjectMeta) error
- type CompatibleMgr
- type CompatibleObjectMapper
- type ContainerImages
- type Kind
- type LogsReader
- type ObjectRef
- type ObjectResolver
- func (o *ObjectResolver) CronJobByJob(ctx context.Context, job *batchv1.Job) (client.Object, error)
- func (o *ObjectResolver) GetNodeName(ctx context.Context, obj client.Object) (string, error)
- func (o *ObjectResolver) GetPodsByLabelSelector(ctx context.Context, namespace string, labelSelector labels.Set) ([]corev1.Pod, error)
- func (o *ObjectResolver) IsActiveReplicaSet(ctx context.Context, workloadObj client.Object, ...) (bool, error)
- func (o *ObjectResolver) IsActiveReplicationController(ctx context.Context, workloadObj client.Object, ...) (bool, error)
- func (o *ObjectResolver) JobByPod(ctx context.Context, pod *corev1.Pod) (*batchv1.Job, error)
- func (o *ObjectResolver) ObjectFromObjectRef(ctx context.Context, ref ObjectRef) (client.Object, error)
- func (o *ObjectResolver) RelatedReplicaSetName(ctx context.Context, object ObjectRef) (string, error)
- func (o *ObjectResolver) ReplicaSetByDeployment(ctx context.Context, deployment *appsv1.Deployment) (*appsv1.ReplicaSet, error)
- func (o *ObjectResolver) ReplicaSetByDeploymentRef(ctx context.Context, deploymentRef ObjectRef) (*appsv1.ReplicaSet, error)
- func (o *ObjectResolver) ReplicaSetByPod(ctx context.Context, pod *corev1.Pod) (*appsv1.ReplicaSet, error)
- func (o *ObjectResolver) ReplicaSetByPodRef(ctx context.Context, object ObjectRef) (*appsv1.ReplicaSet, error)
- func (o *ObjectResolver) ReportOwner(ctx context.Context, obj client.Object) (client.Object, error)
- type ScannerOpts
- type SecretsReader
Constants ¶
const (
DeployerPodForDeploymentLabel string = "openshift.io/deployer-pod-for.name"
)
Variables ¶
var ErrNoRunningPods = errors.New("no active pods for controller")
var ErrReplicaSetNotFound = errors.New("replicaset not found")
var ErrUnSupportedKind = errors.New("unsupported workload kind")
Functions ¶
func AggregateImagePullSecretsData ¶ added in v0.15.19
func ComputeHash ¶ added in v0.15.19
func ComputeHash(obj interface{}) string
ComputeHash returns a hash value calculated from a given object. The hash will be safe encoded to avoid bad words.
func ComputeSpecHash ¶ added in v0.15.19
ComputeSpecHash computes hash of the specified K8s client.Object. The hash is used to indicate whether the client.Object should be rescanned or not by adding it as the starboard.LabelResourceSpecHash label to an instance of a security report.
func DeepHashObject ¶ added in v0.15.19
DeepHashObject writes specified object to hash using the spew library which follows pointers and prints actual values of the nested objects ensuring the hash does not change when a pointer changes.
func GVRForResource ¶
func GVRForResource(mapper meta.RESTMapper, resource string) (gvr schema.GroupVersionResource, gvk schema.GroupVersionKind, err error)
func GetActiveDeadlineSeconds ¶ added in v0.15.19
func GetPodSpec ¶ added in v0.15.19
GetPodSpec returns v1.PodSpec from the specified Kubernetes client.Object. Returns error if the given client.Object is not a Kubernetes workload.
func GetTerminatedContainersStatusesByPod ¶ added in v0.15.19
func GetTerminatedContainersStatusesByPod(pod *corev1.Pod) map[string]*corev1.ContainerStateTerminated
func IsBuiltInWorkload ¶ added in v0.15.19
func IsBuiltInWorkload(controller *metav1.OwnerReference) bool
IsBuiltInWorkload returns true if the specified v1.OwnerReference is a built-in Kubernetes workload, false otherwise.
func IsClusterScopedKind ¶ added in v0.15.19
IsClusterScopedKind returns true if the specified kind is ClusterRole, ClusterRoleBinding, and CustomResourceDefinition.
TODO Use discovery client to have a generic implementation.
func IsPodControlledByJobNotFound ¶ added in v0.15.19
func IsWorkload ¶ added in v0.15.19
IsWorkload returns true if the specified resource kinds represents Kubernetes workload, false otherwise.
func KindForObject ¶
func MapContainerNamesToDockerAuths ¶ added in v0.15.19
func MapContainerNamesToDockerAuths(images ContainerImages, secrets []corev1.Secret) (map[string]docker.Auth, error)
MapContainerNamesToDockerAuths creates the mapping from a container name to the Docker authentication credentials for the specified kube.ContainerImages and image pull Secrets.
func MapDockerRegistryServersToAuths ¶ added in v0.15.19
func MapDockerRegistryServersToAuths(imagePullSecrets []corev1.Secret) (map[string]docker.Auth, error)
MapDockerRegistryServersToAuths creates the mapping from a Docker registry server to the Docker authentication credentials for the specified slice of image pull Secrets.
func MarkOldReportForImmediateDeletion ¶ added in v0.15.19
func MarkOldReportForImmediateDeletion(ctx context.Context, resolver ObjectResolver, namespace string, resourceName string) error
MarkOldReportForImmediateDeletion set old (historical replicaSets) reports with TTL = 0 for immediate deletion
func NewImagePullSecret ¶ added in v0.15.19
func NewImagePullSecret(meta metav1.ObjectMeta, server, username, password string) (*corev1.Secret, error)
NewImagePullSecret constructs a new image pull Secret with the specified registry server and basic authentication credentials.
func NewRunnableJob ¶
func NewRunnableJob( scheme *runtime.Scheme, clientset kubernetes.Interface, job *batchv1.Job, secrets ...*corev1.Secret, ) runner.Runnable
NewRunnableJob constructs a new Runnable task defined as Kubernetes job configuration and secrets that it references.
func ObjectRefToLabels ¶ added in v0.15.19
ObjectRefToLabels encodes the specified ObjectRef as a set of labels.
If Object's name cannot be used as the value of the starboard.LabelResourceName label, as a fallback, this method will calculate a hash of the Object's name and use it as the value of the starboard.LabelResourceNameHash label.
func ObjectToObjectMeta ¶ added in v0.15.19
func ObjectToObjectMeta(obj client.Object, meta *metav1.ObjectMeta) error
ObjectToObjectMeta encodes the specified client.Object as a set of labels and annotations added to the given ObjectMeta.
Types ¶
type CompatibleMgr ¶ added in v0.15.19
type CompatibleMgr interface { // GetSupportedObjectByKind get specific k8s compatible object (group/api/kind) by kind GetSupportedObjectByKind(kind Kind) client.Object }
CompatibleMgr provide k8s compatible objects (group/api/kind) capabilities
func InitCompatibleMgr ¶ added in v0.15.19
func InitCompatibleMgr(restMapper meta.RESTMapper) (CompatibleMgr, error)
InitCompatibleMgr initializes a CompatibleObjectMapper who store a map the of supported kinds with it compatible Objects (group/api/kind) it dynamically fetches the compatible k8s objects (group/api/kind) by resource from the cluster and store it in kind vs k8s object mapping It will enable the operator to support old and new API resources based on cluster version support
type CompatibleObjectMapper ¶ added in v0.15.19
type CompatibleObjectMapper struct {
// contains filtered or unexported fields
}
func (*CompatibleObjectMapper) GetSupportedObjectByKind ¶ added in v0.15.19
func (o *CompatibleObjectMapper) GetSupportedObjectByKind(kind Kind) client.Object
GetSupportedObjectByKind accept kind and return the supported object (group/api/kind) of the cluster
type ContainerImages ¶
ContainerImages is a simple structure to hold the mapping between container names and container image references.
func GetContainerImagesFromJob ¶ added in v0.15.19
func GetContainerImagesFromJob(job *batchv1.Job) (ContainerImages, error)
GetContainerImagesFromJob returns a map of container names to container images from the specified v1.Job. The mapping is encoded as JSON value of the AnnotationContainerImages annotation.
func GetContainerImagesFromPodSpec ¶ added in v0.15.19
func GetContainerImagesFromPodSpec(spec corev1.PodSpec) ContainerImages
GetContainerImagesFromPodSpec returns a map of container names to container images from the specified v1.PodSpec.
func (ContainerImages) AsJSON ¶
func (ci ContainerImages) AsJSON() (string, error)
func (ContainerImages) FromJSON ¶
func (ci ContainerImages) FromJSON(value string) error
type Kind ¶
type Kind string
Kind represents the type of Kubernetes client.Object.
const ( KindUnknown Kind = "Unknown" KindNode Kind = "Node" KindNamespace Kind = "Namespace" KindPod Kind = "Pod" KindReplicaSet Kind = "ReplicaSet" KindReplicationController Kind = "ReplicationController" KindDeployment Kind = "Deployment" KindDeploymentConfig Kind = "DeploymentConfig" KindStatefulSet Kind = "StatefulSet" KindDaemonSet Kind = "DaemonSet" KindCronJob Kind = "CronJob" KindJob Kind = "Job" KindService Kind = "Service" KindConfigMap Kind = "ConfigMap" KindRole Kind = "Role" KindRoleBinding Kind = "RoleBinding" KindNetworkPolicy Kind = "NetworkPolicy" KindIngress Kind = "Ingress" KindResourceQuota Kind = "ResourceQuota" KindLimitRange Kind = "LimitRange" KindClusterRole Kind = "ClusterRole" KindClusterRoleBindings Kind = "ClusterRoleBinding" KindCustomResourceDefinition Kind = "CustomResourceDefinition" KindPodSecurityPolicy Kind = "PodSecurityPolicy" )
type LogsReader ¶ added in v0.15.19
type LogsReader interface { GetLogsByJobAndContainerName(ctx context.Context, job *batchv1.Job, containerName string) (io.ReadCloser, error) GetTerminatedContainersStatusesByJob(ctx context.Context, job *batchv1.Job) (map[string]*corev1.ContainerStateTerminated, error) }
func NewLogsReader ¶ added in v0.15.19
func NewLogsReader(clientset kubernetes.Interface) LogsReader
type ObjectRef ¶ added in v0.15.19
ObjectRef is a simplified representation of a Kubernetes client.Object. Each object has Kind, which designates the type of the entity it represents. Objects have names and many of them live in namespaces.
func ObjectRefFromKindAndObjectKey ¶ added in v0.15.19
func ObjectRefFromObjectMeta ¶ added in v0.15.19
func ObjectRefFromObjectMeta(objectMeta metav1.ObjectMeta) (ObjectRef, error)
type ObjectResolver ¶ added in v0.15.19
type ObjectResolver struct { client.Client CompatibleMgr }
func NewObjectResolver ¶ added in v0.15.19
func NewObjectResolver(c client.Client, cm CompatibleMgr) ObjectResolver
func (*ObjectResolver) CronJobByJob ¶ added in v0.15.19
func (*ObjectResolver) GetNodeName ¶ added in v0.15.19
GetNodeName returns the name of the node on which the given workload is scheduled. If there are no running pods then the ErrNoRunningPods error is returned. If there are no active ReplicaSets for the Deployment the ErrReplicaSetNotFound error is returned. If the specified workload is a CronJob the ErrUnSupportedKind error is returned.
func (*ObjectResolver) GetPodsByLabelSelector ¶ added in v0.15.19
func (*ObjectResolver) IsActiveReplicaSet ¶ added in v0.15.19
func (o *ObjectResolver) IsActiveReplicaSet(ctx context.Context, workloadObj client.Object, controller *metav1.OwnerReference) (bool, error)
func (*ObjectResolver) IsActiveReplicationController ¶ added in v0.15.19
func (o *ObjectResolver) IsActiveReplicationController(ctx context.Context, workloadObj client.Object, controller *metav1.OwnerReference) (bool, error)
func (*ObjectResolver) ObjectFromObjectRef ¶ added in v0.15.19
func (*ObjectResolver) RelatedReplicaSetName ¶ added in v0.15.19
func (o *ObjectResolver) RelatedReplicaSetName(ctx context.Context, object ObjectRef) (string, error)
RelatedReplicaSetName attempts to find the replicaset that is associated with the given owner. If the owner is a Deployment, it will look for a ReplicaSet that is controlled by the Deployment. If the owner is a Pod, it will look for the ReplicaSet that owns the Pod.
func (*ObjectResolver) ReplicaSetByDeployment ¶ added in v0.15.19
func (o *ObjectResolver) ReplicaSetByDeployment(ctx context.Context, deployment *appsv1.Deployment) (*appsv1.ReplicaSet, error)
ReplicaSetByDeployment returns the current revision of the specified Deployment. If the current revision cannot be found the ErrReplicaSetNotFound error is returned.
func (*ObjectResolver) ReplicaSetByDeploymentRef ¶ added in v0.15.19
func (o *ObjectResolver) ReplicaSetByDeploymentRef(ctx context.Context, deploymentRef ObjectRef) (*appsv1.ReplicaSet, error)
ReplicaSetByDeploymentRef returns the current revision of the specified Deployment reference. If the current revision cannot be found the ErrReplicaSetNotFound error is returned.
func (*ObjectResolver) ReplicaSetByPod ¶ added in v0.15.19
func (o *ObjectResolver) ReplicaSetByPod(ctx context.Context, pod *corev1.Pod) (*appsv1.ReplicaSet, error)
ReplicaSetByPod returns the controller ReplicaSet of the specified Pod.
func (*ObjectResolver) ReplicaSetByPodRef ¶ added in v0.15.19
func (o *ObjectResolver) ReplicaSetByPodRef(ctx context.Context, object ObjectRef) (*appsv1.ReplicaSet, error)
ReplicaSetByPodRef returns the controller ReplicaSet of the specified Pod reference.
func (*ObjectResolver) ReportOwner ¶ added in v0.15.19
ReportOwner resolves the owner of a security report for the specified object.
type ScannerOpts ¶
ScannerOpts holds configuration of the vulnerability Scanner. TODO Rename to CLIConfig and move it to the cmd package
type SecretsReader ¶ added in v0.15.19
type SecretsReader interface { ListByLocalObjectReferences(ctx context.Context, refs []corev1.LocalObjectReference, ns string) ([]corev1.Secret, error) ListByServiceAccount(ctx context.Context, name string, ns string) ([]corev1.Secret, error) ListImagePullSecretsByPodSpec(ctx context.Context, spec corev1.PodSpec, ns string) ([]corev1.Secret, error) CredentialsByWorkload(ctx context.Context, workload client.Object) (map[string]docker.Auth, error) }
SecretsReader defines methods for reading Secrets.
func NewSecretsReader ¶ added in v0.15.19
func NewSecretsReader(client client.Client) SecretsReader
NewSecretsReader constructs a new SecretsReader which is using the client package provided by the controller-runtime libraries for interacting with the Kubernetes API server.