kube

package
v0.0.0-...-7c36f52 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Sep 13, 2023 License: Apache-2.0 Imports: 31 Imported by: 0

Documentation

Overview

Package kube provides primitives for working with Kubernetes objects.

Index

Constants

This section is empty.

Variables

View Source 
var ErrNoRunningPods = errors.New("no active pods for controller")
View Source 
var ErrReplicaSetNotFound = errors.New("replicaset not found")
View Source 
var ErrUnSupportedKind = errors.New("unsupported workload kind")

Functions

func AggregateImagePullSecretsData 

func AggregateImagePullSecretsData(images ContainerImages, credentials map[string]docker.Auth) map[string][]byte

func ComputeHash 

func ComputeHash(obj interface{}) string

ComputeHash returns a hash value calculated from a given object. The hash will be safe encoded to avoid bad words.

func ComputeSpecHash 

func ComputeSpecHash(obj client.Object) (string, error)

ComputeSpecHash computes hash of the specified K8s client.Object. The hash is used to indicate whether the client.Object should be rescanned or not by adding it as the starboard.LabelResourceSpecHash label to an instance of a security report.

func DeepHashObject 

func DeepHashObject(hasher hash.Hash, objectToWrite interface{})

DeepHashObject writes specified object to hash using the spew library which follows pointers and prints actual values of the nested objects ensuring the hash does not change when a pointer changes.

func GVRForResource 

func GVRForResource(mapper meta.RESTMapper, resource string) (gvr schema.GroupVersionResource, gvk schema.GroupVersionKind, err error)

func GetActiveDeadlineSeconds 

func GetActiveDeadlineSeconds(d time.Duration) *int64

func GetPodSpec 

func GetPodSpec(obj client.Object) (corev1.PodSpec, error)

GetPodSpec returns v1.PodSpec from the specified Kubernetes client.Object. Returns error if the given client.Object is not a Kubernetes workload.

func GetTerminatedContainersStatusesByPod 

func GetTerminatedContainersStatusesByPod(pod *corev1.Pod) map[string]*corev1.ContainerStateTerminated

func IsBuiltInWorkload 

func IsBuiltInWorkload(controller *metav1.OwnerReference) bool

IsBuiltInWorkload returns true if the specified v1.OwnerReference is a built-in Kubernetes workload, false otherwise.

func IsClusterScopedKind 

func IsClusterScopedKind(kind string) bool

IsClusterScopedKind returns true if the specified kind is ClusterRole, ClusterRoleBinding, and CustomResourceDefinition.

TODO Use discovery client to have a generic implementation.

func IsPodControlledByJobNotFound 

func IsPodControlledByJobNotFound(err error) bool

func IsWorkload 

func IsWorkload(kind string) bool

IsWorkload returns true if the specified resource kinds represents Kubernetes workload, false otherwise.

func KindForObject 

func KindForObject(object metav1.Object, scheme *runtime.Scheme) (string, error)

func MapContainerNamesToDockerAuths 

func MapContainerNamesToDockerAuths(images ContainerImages, secrets []corev1.Secret) (map[string]docker.Auth, error)

MapContainerNamesToDockerAuths creates the mapping from a container name to the Docker authentication credentials for the specified kube.ContainerImages and image pull Secrets.

func MapDockerRegistryServersToAuths 

func MapDockerRegistryServersToAuths(imagePullSecrets []corev1.Secret) (map[string]docker.Auth, error)

MapDockerRegistryServersToAuths creates the mapping from a Docker registry server to the Docker authentication credentials for the specified slice of image pull Secrets.

func NewImagePullSecret 

func NewImagePullSecret(meta metav1.ObjectMeta, server, username, password string) (*corev1.Secret, error)

NewImagePullSecret constructs a new image pull Secret with the specified registry server and basic authentication credentials.

func ObjectRefToLabels 

func ObjectRefToLabels(obj ObjectRef) map[string]string

ObjectRefToLabels encodes the specified ObjectRef as a set of labels.

If Object's name cannot be used as the value of the starboard.LabelResourceName label, as a fallback, this method will calculate a hash of the Object's name and use it as the value of the starboard.LabelResourceNameHash label.

func ObjectToObjectMeta 

func ObjectToObjectMeta(obj client.Object, meta *metav1.ObjectMeta) error

ObjectToObjectMeta encodes the specified client.Object as a set of labels and annotations added to the given ObjectMeta.

Types

type ContainerImages 

type ContainerImages map[string]string

ContainerImages is a simple structure to hold the mapping between container names and container image references.

func GetContainerImagesFromJob 

func GetContainerImagesFromJob(job *batchv1.Job) (ContainerImages, error)

GetContainerImagesFromJob returns a map of container names to container images from the specified v1.Job. The mapping is encoded as JSON value of the AnnotationContainerImages annotation.

func GetContainerImagesFromPodSpec 

func GetContainerImagesFromPodSpec(spec corev1.PodSpec) ContainerImages

GetContainerImagesFromPodSpec returns a map of container names to container images from the specified v1.PodSpec.

func (ContainerImages) AsJSON 

func (ci ContainerImages) AsJSON() (string, error)

func (ContainerImages) FromJSON 

func (ci ContainerImages) FromJSON(value string) error

type Kind 

type Kind string

Kind represents the type of Kubernetes client.Object. 

const (
	KindUnknown Kind = "Unknown"

	KindNode      Kind = "Node"
	KindNamespace Kind = "Namespace"

	KindPod                   Kind = "Pod"
	KindReplicaSet            Kind = "ReplicaSet"
	KindReplicationController Kind = "ReplicationController"
	KindDeployment            Kind = "Deployment"
	KindStatefulSet           Kind = "StatefulSet"
	KindDaemonSet             Kind = "DaemonSet"
	KindCronJob               Kind = "CronJob"
	KindJob                   Kind = "Job"
	KindService               Kind = "Service"
	KindConfigMap             Kind = "ConfigMap"
	KindRole                  Kind = "Role"
	KindRoleBinding           Kind = "RoleBinding"
	KindNetworkPolicy         Kind = "NetworkPolicy"
	KindIngress               Kind = "Ingress"
	KindResourceQuota         Kind = "ResourceQuota"
	KindLimitRange            Kind = "LimitRange"

	KindClusterRole              Kind = "ClusterRole"
	KindClusterRoleBindings      Kind = "ClusterRoleBinding"
	KindCustomResourceDefinition Kind = "CustomResourceDefinition"
	KindPodSecurityPolicy        Kind = "PodSecurityPolicy"
)

type LogsReader 

type LogsReader interface {
	GetLogsByJobAndContainerName(ctx context.Context, job *batchv1.Job, containerName string) (io.ReadCloser, error)
	GetTerminatedContainersStatusesByJob(ctx context.Context, job *batchv1.Job) (map[string]*corev1.ContainerStateTerminated, error)
}

func NewLogsReader 

func NewLogsReader(clientset kubernetes.Interface) LogsReader

type ObjectRef 

type ObjectRef struct {
	Kind      Kind
	Name      string
	Namespace string
}

ObjectRef is a simplified representation of a Kubernetes client.Object. Each object has Kind, which designates the type of the entity it represents. Objects have names and many of them live in namespaces.

func ObjectRefFromKindAndObjectKey 

func ObjectRefFromKindAndObjectKey(kind Kind, name client.ObjectKey) ObjectRef

func ObjectRefFromObjectMeta 

func ObjectRefFromObjectMeta(objectMeta metav1.ObjectMeta) (ObjectRef, error)

type ObjectResolver 

type ObjectResolver struct {
	client.Client
}

func (*ObjectResolver) CronJobByJob 

func (o *ObjectResolver) CronJobByJob(ctx context.Context, job *batchv1.Job) (*batchv1beta1.CronJob, error)

func (*ObjectResolver) GetNodeName 

func (o *ObjectResolver) GetNodeName(ctx context.Context, obj client.Object) (string, error)

GetNodeName returns the name of the node on which the given workload is scheduled. If there are no running pods then the ErrNoRunningPods error is returned. If there are no active ReplicaSets for the Deployment the ErrReplicaSetNotFound error is returned. If the specified workload is a CronJob the ErrUnSupportedKind error is returned.

func (*ObjectResolver) GetPodsByLabelSelector 

func (o *ObjectResolver) GetPodsByLabelSelector(ctx context.Context, namespace string,
	labelSelector labels.Set) ([]corev1.Pod, error)

func (*ObjectResolver) IsActiveReplicaSet 

func (o *ObjectResolver) IsActiveReplicaSet(ctx context.Context, workloadObj client.Object, controller *metav1.OwnerReference) (bool, error)

func (*ObjectResolver) JobByPod 

func (o *ObjectResolver) JobByPod(ctx context.Context, pod *corev1.Pod) (*batchv1.Job, error)

func (*ObjectResolver) ObjectFromObjectRef 

func (o *ObjectResolver) ObjectFromObjectRef(ctx context.Context, ref ObjectRef) (client.Object, error)

func (*ObjectResolver) RelatedReplicaSetName 

func (o *ObjectResolver) RelatedReplicaSetName(ctx context.Context, object ObjectRef) (string, error)

RelatedReplicaSetName attempts to find the replicaset that is associated with the given owner. If the owner is a Deployment, it will look for a ReplicaSet that is controlled by the Deployment. If the owner is a Pod, it will look for the ReplicaSet that owns the Pod.

func (*ObjectResolver) ReplicaSetByDeployment 

func (o *ObjectResolver) ReplicaSetByDeployment(ctx context.Context, deployment *appsv1.Deployment) (*appsv1.ReplicaSet, error)

ReplicaSetByDeployment returns the current revision of the specified Deployment. If the current revision cannot be found the ErrReplicaSetNotFound error is returned.

func (*ObjectResolver) ReplicaSetByDeploymentRef 

func (o *ObjectResolver) ReplicaSetByDeploymentRef(ctx context.Context, deploymentRef ObjectRef) (*appsv1.ReplicaSet, error)

ReplicaSetByDeploymentRef returns the current revision of the specified Deployment reference. If the current revision cannot be found the ErrReplicaSetNotFound error is returned.

func (*ObjectResolver) ReplicaSetByPod 

func (o *ObjectResolver) ReplicaSetByPod(ctx context.Context, pod *corev1.Pod) (*appsv1.ReplicaSet, error)

ReplicaSetByPod returns the controller ReplicaSet of the specified Pod.

func (*ObjectResolver) ReplicaSetByPodRef 

func (o *ObjectResolver) ReplicaSetByPodRef(ctx context.Context, object ObjectRef) (*appsv1.ReplicaSet, error)

ReplicaSetByPodRef returns the controller ReplicaSet of the specified Pod reference.

func (*ObjectResolver) ReportOwner 

func (o *ObjectResolver) ReportOwner(ctx context.Context, obj client.Object) (client.Object, error)

ReportOwner resolves the owner of a security report for the specified object.

type ScannerOpts 

type ScannerOpts struct {
	ScanJobTimeout time.Duration
	DeleteScanJob  bool
}

ScannerOpts holds configuration of the vulnerability Scanner. TODO Rename to CLIConfig and move it to the cmd package

type SecretsReader 

type SecretsReader interface {
	ListByLocalObjectReferences(ctx context.Context, refs []corev1.LocalObjectReference, ns string) ([]corev1.Secret, error)
	ListByServiceAccount(ctx context.Context, name string, ns string) ([]corev1.Secret, error)
	ListImagePullSecretsByPodSpec(ctx context.Context, spec corev1.PodSpec, ns string) ([]corev1.Secret, error)
	CredentialsByWorkload(ctx context.Context, workload client.Object) (map[string]docker.Auth, error)
}

SecretsReader defines methods for reading Secrets.

func NewSecretsReader 

func NewSecretsReader(client client.Client) SecretsReader

NewSecretsReader constructs a new SecretsReader which is using the client package provided by the controller-runtime libraries for interacting with the Kubernetes API server.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.