validate

Documentation

Index

• Constants
• Variables
• func AddCapabilities(validation *Validation) (bool, error)
• func AllowPrivilegeEscalation(validation *Validation) (bool, error)
• func DefaultServiceAccount(validation *Validation) (bool, error)
• func DropCapabilities(validation *Validation) (bool, error)
• func HostIPC(validation *Validation) (bool, error)
• func HostNetwork(validation *Validation) (bool, error)
• func HostPID(validation *Validation) (bool, error)
• func ImageRegistry(validation *Validation) (bool, error)
• func Privileged(validation *Validation) (bool, error)
• func RunAsNonRoot(validation *Validation) (bool, error)
• type Validation
  • func NewValidation(name string, validateLogic ValidationLogic) *Validation
  • func (validation *Validation) AnnotationOverride() string
  • func (validation *Validation) EnvironmetVariableOverride() string
  • func (validation *Validation) Execute() (bool, error)
  • func (validation *Validation) Failed(parentErr error, failedContainers ...corev1.Container) (bool, error)
• type ValidationLogic

Constants

const (
	AddCapabilitiesValidationName  = "verify-add-container-capabilities"
	DropCapabilitiesValidationName = "verify-drop-container-capabilities"
)

const (
	HostPIDValidationName     = "host-pid"
	HostIPCValidationName     = "host-ipc"
	HostNetworkValidationName = "host-network"
)

const (
	ImageRegistryValidationName = "trusted-image-registry"
	ImageRegistryEnv            = "TRUSTED_IMAGE_REGISTRY"
	ImageRegistriesEnv          = "TRUSTED_IMAGE_REGISTRIES"
)

const (
	RunAsNonRootValidationName             = "run-as-non-root"
	PrivilegedValidationName               = "privileged-container"
	AllowPrivilegeEscalationValidationName = "privilege-escalation-container"
)

const (
	DefaultServiceAccountValidationName = "default-service-account"
)

const SkipValidationEnvValue = "false"

Variables

var (
	ErrContainerRequestAddCapabilities  = errors.New("unable to permit container adding escalated capabilities")
	ErrContainerMissingDropCapabilities = errors.New("unable to permit container missing either drop capabilities of ALL or NET_RAW")
)

var (
	ErrPodHostPID     = errors.New("unable to permit pod with hostPID")
	ErrPodHostIPC     = errors.New("unable to permit pod with hostIPC")
	ErrPodHostNetwork = errors.New("unable to permit pod with hostNetwork")
)

var (
	ErrPodRunAsNonRoot          = errors.New("unable to permit pod attempting to run as root")
	ErrContainerPrivileged      = errors.New("unable to permit privileged container")
	ErrContainerAllowPrivileged = errors.New("unable to permit container which allows privileged escalation")
)

var (
	ErrPodDefaultServiceAccount = errors.New("unable to permit pod attempting to use the default service account")
	ErrPodMissingServiceAccount = errors.New("unable to permit pod attempting to use empty service account")
)

var ErrPodImageRegistry = errors.New("unable to permit pod with images from an untrusted registry")

Functions

func AddCapabilities

func AddCapabilities(validation *Validation) (bool, error)

AddCapabilities validates whether a pod spec has the appropriate drop capabilities set.

func AllowPrivilegeEscalation

func AllowPrivilegeEscalation(validation *Validation) (bool, error)

AllowPrivilegeEscalation validates whether a container is allowing privilege escalation.

func DefaultServiceAccount

func DefaultServiceAccount(validation *Validation) (bool, error)

DefaultServiceAccount validates whether a pod is attempting to launch with the namespace default service account.

func DropCapabilities

func DropCapabilities(validation *Validation) (bool, error)

DropCapabilities validates whether a pod spec has the appropriate drop capabilities set.

func HostIPC

func HostIPC(validation *Validation) (bool, error)

HostIPC validates whether a pod spec has the hostIPC value set.

func HostNetwork

func HostNetwork(validation *Validation) (bool, error)

HostNetwork validates whether a pod is rquesting binding to the host network.

func HostPID

func HostPID(validation *Validation) (bool, error)

HostPID validates whether a pod spec has the hostPID value set.

func ImageRegistry

func ImageRegistry(validation *Validation) (bool, error)

ImageRegistry validates whether a pod spec has a valid registry.

func Privileged

func Privileged(validation *Validation) (bool, error)

Privileged validates whether a pod spec has the privileged value set.

func RunAsNonRoot

func RunAsNonRoot(validation *Validation) (bool, error)

RunAsNonRoot validates whether a container or pod is set to enforce running as a non-root user.

Types

type Validation

type Validation struct {
	Name     string
	Resource client.Object
	PodSpec  *corev1.PodSpec
	Run      ValidationLogic
	Skip     bool
}

func NewValidation

func NewValidation(name string, validateLogic ValidationLogic) *Validation

NewValidation return an instance of a new validation.

func (*Validation) AnnotationOverride

func (validation *Validation) AnnotationOverride() string

AnnotationOverride returns the expected annotation variable override given the name of the validation.

func (*Validation) EnvironmetVariableOverride

func (validation *Validation) EnvironmetVariableOverride() string

EnvironmetVariableOverride returns the expected environment variable override given the name of the validation.

func (*Validation) Execute

func (validation *Validation) Execute() (bool, error)

Execute executes the validation logic.

func (*Validation) Failed

func (validation *Validation) Failed(parentErr error, failedContainers ...corev1.Container) (bool, error)

Failed returns the error message for a failed validation and a false boolean to indicate that the validation logic has failed for a ValidationLogic function.

type ValidationLogic

type ValidationLogic func(*Validation) (bool, error)