creds

Documentation

Index

• Constants
• type BasicRegCred
  • func CreateBasicRegCred(clientset kubernetes.Interface, secretNamespace string) *BasicRegCred
  • func (u *BasicRegCred) Add(job *batchv1.Job)
  • func (u *BasicRegCred) ShouldAdd() bool
• type CredentialAdder
• type ECR
  • func CreateECR(clientset kubernetes.Interface, secretNamespace string) *ECR
  • func (e *ECR) Add(job *batchv1.Job)
  • func (e *ECR) ShouldAdd() bool
• type FakeCredAdder
  • func CreateFakeCredAdder(fakeEnvToAdd *corev1.EnvVar, shouldAdd bool) *FakeCredAdder
  • func (f *FakeCredAdder) Add(job *batchv1.Job)
  • func (f *FakeCredAdder) ShouldAdd() bool
• type GCR
  • func CreateGCR(clientset kubernetes.Interface, secretNamespace string) *GCR
  • func (g *GCR) Add(job *batchv1.Job)
  • func (g *GCR) ShouldAdd() bool

Constants

const (
	AwsAccessKeyID     = "AWS_ACCESS_KEY_ID"
	AwsSecretAccessKey = "AWS_SECRET_ACCESS_KEY"
	AwsDefaultRegion   = "AWS_DEFAULT_REGION"
	EcrSaSecretName    = "ecr-sa"
)

nolint: gosec

const (
	BasicRegCredSecretName = "basic-regcred" // nolint: gosec
)

const (
	GcrSaSecretName = "gcr-sa"
)

nolint:gosec

Types

type BasicRegCred

type BasicRegCred struct {
	// contains filtered or unexported fields
}

func CreateBasicRegCred

func CreateBasicRegCred(clientset kubernetes.Interface, secretNamespace string) *BasicRegCred

func (*BasicRegCred) Add

func (u *BasicRegCred) Add(job *batchv1.Job)

Add the BasicRegCred image pull secret to the job by mounting it as a volume and configuring the IMAGE_PULL_SECRET_PATH environment variable.

func (*BasicRegCred) ShouldAdd

func (u *BasicRegCred) ShouldAdd() bool

type CredentialAdder

type CredentialAdder interface {
	// ShouldAdd returns true if credentials should be added to a scanner job
	ShouldAdd() bool
	// Add adds credentials to a scanner job
	Add(job *batchv1.Job)
}

type ECR

type ECR struct {
	// contains filtered or unexported fields
}

func CreateECR

func CreateECR(clientset kubernetes.Interface, secretNamespace string) *ECR

func (*ECR) Add

func (e *ECR) Add(job *batchv1.Job)

Add The scanner is using AWS SDK to pull the username and the password required to pull the image. We need to set the following env variables from the `EcrSaSecretName` secret: 1. AWS_ACCESS_KEY_ID 2. AWS_SECRET_ACCESS_KEY 3. AWS_DEFAULT_REGION.

func (*ECR) ShouldAdd

func (e *ECR) ShouldAdd() bool

type FakeCredAdder

type FakeCredAdder struct {
	// contains filtered or unexported fields
}

func CreateFakeCredAdder

func CreateFakeCredAdder(fakeEnvToAdd *corev1.EnvVar, shouldAdd bool) *FakeCredAdder

func (*FakeCredAdder) Add

func (f *FakeCredAdder) Add(job *batchv1.Job)

func (*FakeCredAdder) ShouldAdd

func (f *FakeCredAdder) ShouldAdd() bool

type GCR

type GCR struct {
	// contains filtered or unexported fields
}

func CreateGCR

func CreateGCR(clientset kubernetes.Interface, secretNamespace string) *GCR

func (*GCR) Add

func (g *GCR) Add(job *batchv1.Job)

Add The scanner is using google SDK to pull the username and the password required to pull the image. We need to do the following: 1. Create a volume that holds the `gcrSaSecretFileName` data 2. Mount the volume into each container to a specific path (`gcrVolumeMountPath`/`gcrSaSecretFileName`) 3. Set `GOOGLE_APPLICATION_CREDENTIALS` to point to the mounted file.

func (*GCR) ShouldAdd

func (g *GCR) ShouldAdd() bool