types

Documentation

Index

• Constants
• Variables
• type ContainerSecuritySpec
• type Metadata
• type PSPGrant
• type PodSecuritySpec
• type SASecuritySpec
  • func NewSASecuritySpec(ns, sa string) *SASecuritySpec
  • func (s *SASecuritySpec) AddContainerSecuritySpec(css ContainerSecuritySpec)
  • func (s *SASecuritySpec) AddPodSecuritySpec(pss PodSecuritySpec)
  • func (s *SASecuritySpec) GenerateComment() string
  • func (s *SASecuritySpec) GeneratePSPName() string
  • func (s *SASecuritySpec) GenerateRole() *rbacv1.Role
  • func (s *SASecuritySpec) GenerateRoleBinding() *rbacv1.RoleBinding
  • func (s *SASecuritySpec) GetWorkloadImages() []string
  • func (s *SASecuritySpec) IsDefaultServiceAccount() bool
• type SASecuritySpecList
  • func (sl SASecuritySpecList) Len() int
  • func (sl SASecuritySpecList) Less(i, j int) bool
  • func (sl SASecuritySpecList) Swap(i, j int)

Constants

const (
	Role           = "Role"
	RoleBinding    = "RoleBinding"
	ServiceAccount = "ServiceAccount"
)

const (
	Version1_11 = "v1.11"
)

Variables

var (
	DefaultCaps = []string{
		"SETPCAP",
		"MKNOD",
		"AUDIT_WRITE",
		"CHOWN",
		"NET_RAW",
		"DAC_OVERRIDE",
		"FOWNER",
		"FSETID",
		"KILL",
		"SETGID",
		"SETUID",
		"NET_BIND_SERVICE",
		"SYS_CHROOT",
		"SETFCAP",
	}
)

Types

type ContainerSecuritySpec

type ContainerSecuritySpec struct {
	Metadata                 Metadata `json:"parentMetadata"`
	ContainerID              string   `json:"containerID"`
	ContainerName            string   `json:"containerName"`
	PodName                  string   `json:"podName"`
	Namespace                string   `json:"namespace"`
	ImageName                string   `json:"imageName"`
	ImageSHA                 string   `json:"imageSHA"`
	HostName                 string   `json:"hostName"`
	Capabilities             []string `json:"effectiveCapabilities,omitempty"`
	DroppedCap               []string `json:"droppedCapabilities,omitempty"`
	AddedCap                 []string `json:"addedCapabilities,omitempty"`
	Privileged               bool     `json:"privileged,omitempty"`
	ReadOnlyRootFS           bool     `json:"readOnlyRootFileSystem,omitempty"`
	RunAsNonRoot             *bool    `json:"runAsNonRoot,omitempty"`
	AllowPrivilegeEscalation *bool    `json:"allowPrivilegeEscalation,omitempty"`
	RunAsUser                *int64   `json:"runAsUser,omitempty"`
	RunAsGroup               *int64   `json:"runAsGroup,omitempty"`
	HostPorts                []int32  `json:"hostPorts,omitempty"`
	ServiceAccount           string   `json:"serviceAccount,omitempty"`
}

type Metadata

type Metadata struct {
	Name string `json:"name"`
	Kind string `json:"kind"`
}

type PSPGrant

type PSPGrant struct {
	Comment           string
	PodSecurityPolicy *v1beta1.PodSecurityPolicy
	Role              *rbacv1.Role
	RoleBinding       *rbacv1.RoleBinding
}

type PodSecuritySpec

type PodSecuritySpec struct {
	Metadata       Metadata        `json:"metadata"`
	Namespace      string          `json:"namespace"`
	HostPID        bool            `json:"hostPID,omitempty"`
	HostNetwork    bool            `json:"hostNetwork,omitempty"`
	HostIPC        bool            `json:"hostIPC,omitempty"`
	VolumeTypes    []string        `json:"volumeTypes,omitempty"`
	MountHostPaths map[string]bool `json:"mountedHostPath,omitempty"`
	ServiceAccount string          `json:"serviceAccount,omitempty"`
}

type SASecuritySpec

type SASecuritySpec struct {
	PSPName string // psp name

	ServiceAccount string // serviceAccount

	Namespace string // namespace

	ContainerSecuritySpecList []ContainerSecuritySpec

	PodSecuritySpecList []PodSecuritySpec
}

func NewSASecuritySpec

func NewSASecuritySpec(ns, sa string) *SASecuritySpec

func (*SASecuritySpec) AddContainerSecuritySpec

func (s *SASecuritySpec) AddContainerSecuritySpec(css ContainerSecuritySpec)

AddContainerSecuritySpec adds container security spec object to the associated service account

func (*SASecuritySpec) AddPodSecuritySpec

func (s *SASecuritySpec) AddPodSecuritySpec(pss PodSecuritySpec)

AddPodSecuritySpec adds pod security spec object to the associated service account

func (*SASecuritySpec) GenerateComment

func (s *SASecuritySpec) GenerateComment() string

GenerateComment generate comments for the psp grants (no psp will be created for default service account)

func (*SASecuritySpec) GeneratePSPName

func (s *SASecuritySpec) GeneratePSPName() string

GeneratePSPName generates psp name

func (*SASecuritySpec) GenerateRole

func (s *SASecuritySpec) GenerateRole() *rbacv1.Role

GenerateRole creates a role object contains the privilege to use the psp

func (*SASecuritySpec) GenerateRoleBinding

func (s *SASecuritySpec) GenerateRoleBinding() *rbacv1.RoleBinding

GenerateRoleBinding creates a rolebinding for the service account to use the psp

func (*SASecuritySpec) GetWorkloadImages

func (s *SASecuritySpec) GetWorkloadImages() []string

GetWorkloadImages returns a list of workload images in the format of "kind, Name, Image Name"

func (*SASecuritySpec) IsDefaultServiceAccount

func (s *SASecuritySpec) IsDefaultServiceAccount() bool

IsDefaultServiceAccount returns whether the service account is default

type SASecuritySpecList

type SASecuritySpecList []*SASecuritySpec

func (SASecuritySpecList) Len

func (sl SASecuritySpecList) Len() int

func (SASecuritySpecList) Less

func (sl SASecuritySpecList) Less(i, j int) bool

func (SASecuritySpecList) Swap

func (sl SASecuritySpecList) Swap(i, j int)