config

Documentation

Overview

Package config holds the typed objects that define the schemas for ConfigMap objects that pertain to our API objects. This ConfigMap gets created by the Reconciler by combining all the ClusterImagePolicy CR into a single ConfigMap so that the AdmissionController only needs to deal with a single resource when validationg.

Index

• Constants
• func ConvertCertificateAuthority(source v1alpha1.CertificateAuthority) (*pbtrustroot.CertificateAuthority, error)
• func ConvertTransparencyLogInstance(source v1alpha1.TransparencyLogInstance) (*pbtrustroot.TransparencyLogInstance, error)
• func DeserializeCertChain(chain []byte) (*pbcommon.X509CertificateChain, error)
• func DeserializePublicKey(publicKey []byte) (*pbcommon.PublicKey, crypto.PublicKey, error)
• func HashStringToHashAlgorithm(hash string) pbcommon.HashAlgorithm
• func SerializeCertChain(certChain *pbcommon.X509CertificateChain) []byte
• func SerializePublicKey(publicKey *pbcommon.PublicKey) []byte
• func ToContext(ctx context.Context, c *Config) context.Context
• type CertificateAuthority
• type Config
  • func FromContext(ctx context.Context) *Config
  • func FromContextOrDefaults(ctx context.Context) *Config
• type DistinguishedName
• type ImagePolicyConfig
  • func NewImagePoliciesConfigFromConfigMap(config *corev1.ConfigMap) (*ImagePolicyConfig, error)
  • func NewImagePoliciesConfigFromMap(data map[string]string) (*ImagePolicyConfig, error)
  • func (p *ImagePolicyConfig) GetMatchingPolicies(image string, kind, apiVersion string, labels map[string]string) (map[string]webhookcip.ClusterImagePolicy, error)
• type LogID
• type SigstoreKeys
  • func ConvertSigstoreKeys(_ context.Context, source *v1alpha1.SigstoreKeys) (sk *SigstoreKeys, err error)
• type SigstoreKeysMap
  • func NewSigstoreKeysFromConfigMap(config *corev1.ConfigMap) (*SigstoreKeysMap, error)
  • func NewSigstoreKeysFromMap(data map[string]string) (*SigstoreKeysMap, error)
• type Store
  • func NewStore(logger configmap.Logger, onAfterStore ...func(name string, value interface{})) *Store
  • func (s *Store) Load() *Config
  • func (s *Store) ToContext(ctx context.Context) context.Context
• type TimeRange
• type Timestamp
• type TransparencyLogInstance

Constants

const (
	// ImagePoliciesConfigName is the name of ConfigMap created by the
	// reconciler and consumed by the admission webhook.
	ImagePoliciesConfigName = "config-image-policies"
)

const (
	// SigstoreKeysConfigName is the name of ConfigMap created by the
	// reconciler and consumed by the admission webhook for determining
	// which Keys/Certificates are trusted for things like Fulcio/Rekor, etc.
	SigstoreKeysConfigName = "config-sigstore-keys"
)

Functions

func ConvertCertificateAuthority

func ConvertCertificateAuthority(source v1alpha1.CertificateAuthority) (*pbtrustroot.CertificateAuthority, error)

ConvertCertificateAuthority converts public into private CertificateAuthority

func ConvertTransparencyLogInstance

func ConvertTransparencyLogInstance(source v1alpha1.TransparencyLogInstance) (*pbtrustroot.TransparencyLogInstance, error)

ConvertTransparencyLogInstance converts public into private TransparencyLogInstance.

func DeserializeCertChain

func DeserializeCertChain(chain []byte) (*pbcommon.X509CertificateChain, error)

func DeserializePublicKey

func DeserializePublicKey(publicKey []byte) (*pbcommon.PublicKey, crypto.PublicKey, error)

func HashStringToHashAlgorithm

func HashStringToHashAlgorithm(hash string) pbcommon.HashAlgorithm

func SerializeCertChain

func SerializeCertChain(certChain *pbcommon.X509CertificateChain) []byte

func SerializePublicKey

func SerializePublicKey(publicKey *pbcommon.PublicKey) []byte

func ToContext

func ToContext(ctx context.Context, c *Config) context.Context

ToContext attaches the provided Config to the provided context, returning the new context with the Config attached.

Types

type CertificateAuthority

type CertificateAuthority = pbtrustroot.CertificateAuthority

type Config

type Config struct {
	ImagePolicyConfig  *ImagePolicyConfig
	SigstoreKeysConfig *SigstoreKeysMap
}

Config holds the collection of configurations that we attach to contexts. +k8s:deepcopy-gen=false

func FromContext

func FromContext(ctx context.Context) *Config

FromContext extracts a Config from the provided context.

func FromContextOrDefaults

func FromContextOrDefaults(ctx context.Context) *Config

FromContextOrDefaults is like FromContext, but when no Config is attached it returns a Config populated with the defaults for each of the Config fields.

type DistinguishedName

type DistinguishedName = pbcommon.DistinguishedName

type ImagePolicyConfig

type ImagePolicyConfig struct {
	// This is the list of ImagePolicies that a admission controller uses
	// to make policy decisions.
	Policies map[string]webhookcip.ClusterImagePolicy
}

func NewImagePoliciesConfigFromConfigMap

func NewImagePoliciesConfigFromConfigMap(config *corev1.ConfigMap) (*ImagePolicyConfig, error)

NewImagePoliciesConfigFromConfigMap creates a Features from the supplied ConfigMap

func NewImagePoliciesConfigFromMap

func NewImagePoliciesConfigFromMap(data map[string]string) (*ImagePolicyConfig, error)

NewImagePoliciesConfigFromMap creates an ImagePolicyConfig from the supplied Map

func (*ImagePolicyConfig) GetMatchingPolicies

func (p *ImagePolicyConfig) GetMatchingPolicies(image string, kind, apiVersion string, labels map[string]string) (map[string]webhookcip.ClusterImagePolicy, error)

GetMatchingPolicies returns all matching Policies and their Authorities that need to be matched for the given kind, version and labels (if provided) to then match the Image. Returned map contains the name of the CIP as the key, and a normalized ClusterImagePolicy for it.

type LogID

type LogID = pbcommon.LogId

type SigstoreKeys

type SigstoreKeys = pbtrustroot.TrustedRoot

SigstoreKeys contains all the necessary Keys and Certificates for validating against a specific instance of Sigstore.

func ConvertSigstoreKeys

func ConvertSigstoreKeys(_ context.Context, source *v1alpha1.SigstoreKeys) (sk *SigstoreKeys, err error)

ConvertSigstoreKeys takes a source and converts into a SigstoreKeys suitable for serialization into a ConfigMap entry.

type SigstoreKeysMap

type SigstoreKeysMap struct {
	SigstoreKeys map[string]*SigstoreKeys
}

func NewSigstoreKeysFromConfigMap

func NewSigstoreKeysFromConfigMap(config *corev1.ConfigMap) (*SigstoreKeysMap, error)

NewImagePoliciesConfigFromConfigMap creates a Features from the supplied ConfigMap

func NewSigstoreKeysFromMap

func NewSigstoreKeysFromMap(data map[string]string) (*SigstoreKeysMap, error)

NewSigstoreKeysFromMap creates a map of SigstoreKeys to use for validation.

type Store

type Store struct {
	*configmap.UntypedStore
}

Store is a typed wrapper around configmap.Untyped store to handle our configmaps. +k8s:deepcopy-gen=false

func NewStore

func NewStore(logger configmap.Logger, onAfterStore ...func(name string, value interface{})) *Store

NewStore creates a new store of Configs and optionally calls functions when ConfigMaps are updated.

func (*Store) Load

func (s *Store) Load() *Config

Load creates a Config from the current config state of the Store.

func (*Store) ToContext

func (s *Store) ToContext(ctx context.Context) context.Context

ToContext attaches the current Config state to the provided context.

type TimeRange

type TimeRange = pbcommon.TimeRange

type Timestamp

type Timestamp = timestamppb.Timestamp

type TransparencyLogInstance

type TransparencyLogInstance = pbtrustroot.TransparencyLogInstance