common

Documentation

Index

• Constants
• func CheckCreatorID(request *admission.Request, oldObj, newObj metav1.Object) *metav1.Status
• func CheckForVerbs(rules []rbacv1.PolicyRule) error
• func ConvertAuthnExtras(extra map[string]authnv1.ExtraValue) map[string]authzv1.ExtraValue
• func IsCreatingPSAConfig(new map[string]string) bool
• func IsUpdatingPSAConfig(old map[string]string, new map[string]string) bool
• func SetCreatorIDAnnotation(request *admission.Request, response *v1.AdmissionResponse, ...) error
• func ValidateRules(rules []rbacv1.PolicyRule, isNamespaced bool, fldPath *field.Path) error

Constants

const (
	// EnforceLabel is a that governs the PSS that is enforced for a namespace
	EnforceLabel = "pod-security.kubernetes.io/enforce"
	// EnforceVersionLabel is a label  that governs the PSS version that is enforced for a namespace
	EnforceVersionLabel = "pod-security.kubernetes.io/enforce-version"
	// AuditLabel is a label  that governs the PSS that is used for auditing a namespace
	AuditLabel = "pod-security.kubernetes.io/audit"
	// AuditVersionLabel is a label  that governs the PSS version that is used for auditing a namespace
	AuditVersionLabel = "pod-security.kubernetes.io/audit-version"
	// WarnLabel is a label  that governs the PSS that is used for warning about PSA violations in a namespace
	WarnLabel = "pod-security.kubernetes.io/warn"
	// WarnVersionLabel is a label  that governs the PSS version that is used for warning about PSA violations in a namespace
	WarnVersionLabel = "pod-security.kubernetes.io/warn-version"
)

Functions

func CheckCreatorID

func CheckCreatorID(request *admission.Request, oldObj, newObj metav1.Object) *metav1.Status

func CheckForVerbs

func CheckForVerbs(rules []rbacv1.PolicyRule) error

CheckForVerbs checks that all the rules in the given list have a verb set

func ConvertAuthnExtras

func ConvertAuthnExtras(extra map[string]authnv1.ExtraValue) map[string]authzv1.ExtraValue

ConvertAuthnExtras converts authnv1 type extras to authzv1 extras. Technically these are both type alias to string, so the conversion is straightforward

func IsCreatingPSAConfig

func IsCreatingPSAConfig(new map[string]string) bool

IsCreatingPSAConfig will indicate whether or not the labels being passed in are attempting to create PSA-related configuration.

func IsUpdatingPSAConfig

func IsUpdatingPSAConfig(old map[string]string, new map[string]string) bool

IsUpdatingPSAConfig will indicate whether or not the labels being passed in are attempting to update PSA-related configuration.

func SetCreatorIDAnnotation

func SetCreatorIDAnnotation(request *admission.Request, response *v1.AdmissionResponse, obj runtime.RawExtension, newObj metav1.Object) error

SetCreatorIDAnnotation sets the creatorID Annotation on the newObj based on the user specified in the request.

func ValidateRules

func ValidateRules(rules []rbacv1.PolicyRule, isNamespaced bool, fldPath *field.Path) error

ValidateRules calls on standard kubernetes RBAC functionality for the validation of policy rules to validate Rancher rules. This is currently used in the validation of roletemplate external rules.