types

Documentation

Overview

Copyright paskal.maksim@gmail.com Licensed under the Apache License, Version 2.0 (the "License") you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

Index

• Constants
• type AddDefaultResources
• type Condition
  • func (c *Condition) Validate() error
• type ConditionOperator
  • func (op ConditionOperator) IsNegate() bool
  • func (op ConditionOperator) Validate() error
  • func (op ConditionOperator) Value() ConditionOperator
• type ContainerImage
• type ContainerInfo
  • func (c *ContainerInfo) GetPodAnnotation(key string) (string, bool)
  • func (c *ContainerInfo) GetSelectedRulesEnv() []corev1.EnvVar
  • func (c *ContainerInfo) String() string
• type CreateSecret
• type PatchOperation
  • func (p *PatchOperation) String() string
• type PodContainer
  • func PodContainersFromPod(namespace *corev1.Namespace, pod *corev1.Pod) []*PodContainer
  • func (c *PodContainer) ContainerPath() string
  • func (c *PodContainer) OwnerKind() string
  • func (c *PodContainer) PodPVCNames() []string
  • func (c *PodContainer) String() string
• type PodContainerType
• type ReplaceContainerImageHost
• type Rule
  • func (r *Rule) Logf(format string, args ...interface{})
• type RunAsNonRoot
• type RunAsNonRootReplaceUser

Constants

const (

	// label for namespaces that managed by pod-admission-controller.
	LabelManaged = annotationPrefix + "/managed"
	// annotation that will added to pod if mutation executes.
	AnnotationInjected = annotationPrefix + "/injected"
	// skip mutation.
	AnnotationIgnore = annotationPrefix + "/ignore"
	// list of containers that should be skipped from RunAsNonRoot.
	AnnotationIgnoreEnv = annotationPrefix + "/ignoreEnv"
	// Deprecated: list of containers that should be skipped from RunAsNonRoot.
	AnnotationIgnoreRunAsNonRoot = annotationPrefix + "/ignoreRunAsNonRoot"
	// Deprecated: list of containers that should be skipped from AddDefaultResources.
	AnnotationIgnoreAddDefaultResources = annotationPrefix + "/ignoreAddDefaultResources"
	// Default CPU requests.
	AnnotationDefaultResourcesCPU = annotationPrefix + "/defaultResourcesCPU"
	// Default Memory requests.
	AnnotationDefaultResourcesMemory = annotationPrefix + "/defaultResourcesMemory"
	// ingress default suffix.
	AnnotationDefaultIngressSuffix = annotationPrefix + "/ingressSuffix"
	// warning when AnnotationIgnore is enabled.
	WarningObjectDoedNotNeedMutation = annotationPrefix + ": ignore mutation by annotation " + AnnotationIgnore
	// warning when no patch is generated.
	WarningNoPatchGenerated = annotationPrefix + ". No patches found"
)

Types

type AddDefaultResources

type AddDefaultResources struct {
	Enabled  bool
	LimitCPU bool
	// Deprecated: use custompatch instead
	RemoveResources bool
}

type Condition

type Condition struct {
	Key      string
	Operator ConditionOperator
	Value    string
	Values   []string
}

func (*Condition) Validate

func (c *Condition) Validate() error

type ConditionOperator

type ConditionOperator string

must be lowercase.

const (
	OperatorEqual     ConditionOperator = "equal"
	OperatorNotEqual  ConditionOperator = "notequal"
	OperatorRegexp    ConditionOperator = "regexp"
	OperatorNotRegexp ConditionOperator = "notregexp"
	OperatorIn        ConditionOperator = "in"
	OperatorNotIn     ConditionOperator = "notin"
	OperatorEmpty     ConditionOperator = "empty"
	OperatorNotEmpty  ConditionOperator = "notempty"
)

func (ConditionOperator) IsNegate

func (op ConditionOperator) IsNegate() bool

func (ConditionOperator) Validate

func (op ConditionOperator) Validate() error

func (ConditionOperator) Value

func (op ConditionOperator) Value() ConditionOperator

type ContainerImage

type ContainerImage struct {
	Domain string
	Path   string
	Name   string
	Slug   string
	Tag    string
}

type ContainerInfo

type ContainerInfo struct {
	PodContainer         *PodContainer
	ContainerName        string
	ContainerType        PodContainerType
	Namespace            string
	NamespaceAnnotations map[string]string
	NamespaceLabels      map[string]string
	Image                *ContainerImage
	PodAnnotations       map[string]string
	PodLabels            map[string]string
	SelectedRules        []*Rule
}

func (*ContainerInfo) GetPodAnnotation

func (c *ContainerInfo) GetPodAnnotation(key string) (string, bool)

return namespaced pod annotation value.

func (*ContainerInfo) GetSelectedRulesEnv

func (c *ContainerInfo) GetSelectedRulesEnv() []corev1.EnvVar

func (*ContainerInfo) String

func (c *ContainerInfo) String() string

return JSON representation of the container info.

type CreateSecret

type CreateSecret struct {
	Name string
	Type string
	Data map[string][]byte
}

type PatchOperation

type PatchOperation struct {
	Op    string      `json:"op"`
	Path  string      `json:"path"`
	Value interface{} `json:"value,omitempty"`
}

func (*PatchOperation) String

func (p *PatchOperation) String() string

type PodContainer

type PodContainer struct {
	Pod       *corev1.Pod
	Namespace *corev1.Namespace
	Order     int
	Type      PodContainerType
	Container *corev1.Container
}

func PodContainersFromPod

func PodContainersFromPod(namespace *corev1.Namespace, pod *corev1.Pod) []*PodContainer

func (*PodContainer) ContainerPath

func (c *PodContainer) ContainerPath() string

func (*PodContainer) OwnerKind

func (c *PodContainer) OwnerKind() string

return owner kind of the pod. usage: .PodContainer.OwnerKind example: ReplicaSet

func (*PodContainer) PodPVCNames

func (c *PodContainer) PodPVCNames() []string

return string array of pods pvc names. usage: .PodContainer.PodPVCNames example: ["pvc1", "pvc2"]

func (*PodContainer) String

func (c *PodContainer) String() string

type PodContainerType

type PodContainerType string

const (
	PodContainerTypeInitContainer PodContainerType = "initContainer"
	PodContainerTypeContainer     PodContainerType = "container"
)

type ReplaceContainerImageHost

type ReplaceContainerImageHost struct {
	Enabled bool
	From    string
	To      string
}

type Rule

type Rule struct {
	Debug                     bool
	Name                      string
	Env                       []corev1.EnvVar
	Conditions                []Condition
	AddDefaultResources       AddDefaultResources
	RunAsNonRoot              RunAsNonRoot
	ReplaceContainerImageHost ReplaceContainerImageHost
	Tolerations               []corev1.Toleration
	ImagePullSecrets          []corev1.LocalObjectReference
	CustomPatches             []PatchOperation
}

func (*Rule) Logf

func (r *Rule) Logf(format string, args ...interface{})

type RunAsNonRoot

type RunAsNonRoot struct {
	Enabled bool
	// replace RunAsUser in container
	ReplaceUser RunAsNonRootReplaceUser
}

type RunAsNonRootReplaceUser

type RunAsNonRootReplaceUser struct {
	Enabled  bool
	FromUser int64
	ToUser   int64
}