api

Documentation

Overview

Package api contains constants and helpers for PodSecurity admission label keys and values

Index

• Constants
• func CompareLevels(a, b Level) int
• type Attributes
  • func RequestAttributes(request *admissionv1.AdmissionRequest, decoder runtime.Decoder) Attributes
• type AttributesRecord
  • func (a *AttributesRecord) GetKind() schema.GroupVersionKind
  • func (a *AttributesRecord) GetName() string
  • func (a *AttributesRecord) GetNamespace() string
  • func (a *AttributesRecord) GetObject() (runtime.Object, error)
  • func (a *AttributesRecord) GetOldObject() (runtime.Object, error)
  • func (a *AttributesRecord) GetOperation() admissionv1.Operation
  • func (a *AttributesRecord) GetResource() schema.GroupVersionResource
  • func (a *AttributesRecord) GetSubresource() string
  • func (a *AttributesRecord) GetUserName() string
• type Level
  • func ParseLevel(level string) (Level, error)
  • func (l *Level) Valid() bool
• type LevelVersion
  • func (lv *LevelVersion) Equivalent(other *LevelVersion) bool
  • func (lv LevelVersion) String() string
• type Policy
  • func PolicyToEvaluate(labels map[string]string, defaults Policy) (Policy, field.ErrorList)
  • func (p *Policy) Equivalent(other *Policy) bool
  • func (p *Policy) FullyPrivileged() bool
  • func (p *Policy) String() string
• type Version
  • func GetAPIVersion() Version
  • func LatestVersion() Version
  • func MajorMinorVersion(major, minor int) Version
  • func ParseVersion(version string) (Version, error)
  • func (v *Version) Latest() bool
  • func (v *Version) Major() int
  • func (v *Version) Minor() int
  • func (v *Version) Older(other Version) bool
  • func (v Version) String() string

Constants

const (
	EnforceLevelLabel   = labelPrefix + "enforce"
	EnforceVersionLabel = labelPrefix + "enforce-version"
	AuditLevelLabel     = labelPrefix + "audit"
	AuditVersionLabel   = labelPrefix + "audit-version"
	WarnLevelLabel      = labelPrefix + "warn"
	WarnVersionLabel    = labelPrefix + "warn-version"

	ExemptionReasonAnnotationKey = "exempt"
	AuditViolationsAnnotationKey = "audit-violations"
	EnforcedPolicyAnnotationKey  = "enforce-policy"
)

const AuditAnnotationPrefix = labelPrefix

const VersionLatest = "latest"

Functions

func CompareLevels

func CompareLevels(a, b Level) int

CompareLevels returns an integer comparing two levels by strictness. The result will be 0 if a==b, -1 if a is less strict than b, and +1 if a is more strict than b.

Types

type Attributes

type Attributes interface {
	// GetName is the name of the object associated with the request.
	GetName() string
	// GetNamespace is the namespace associated with the request (if any)
	GetNamespace() string
	// GetResource is the name of the resource being requested.  This is not the kind.  For example: pods
	GetResource() schema.GroupVersionResource
	// GetKind is the name of the kind being requested.  For example: Pod
	GetKind() schema.GroupVersionKind
	// GetSubresource is the name of the subresource being requested.  This is a different resource, scoped to the parent resource, but it may have a different kind.
	// For instance, /pods has the resource "pods" and the kind "Pod", while /pods/foo/status has the resource "pods", the sub resource "status", and the kind "Pod"
	// (because status operates on pods). The binding resource for a pod though may be /pods/foo/binding, which has resource "pods", subresource "binding", and kind "Binding".
	GetSubresource() string
	// GetOperation is the operation being performed
	GetOperation() admissionv1.Operation

	// GetObject returns the typed Object from incoming request.
	// For objects in the core API group, the result must use the v1 API.
	GetObject() (runtime.Object, error)
	// GetOldObject returns the typed existing object. Only populated for UPDATE requests.
	// For objects in the core API group, the result must use the v1 API.
	GetOldObject() (runtime.Object, error)
	// GetUserName is the requesting user's authenticated name.
	GetUserName() string
}

Attributes exposes the admission request parameters consumed by the PodSecurity admission controller.

func RequestAttributes

func RequestAttributes(request *admissionv1.AdmissionRequest, decoder runtime.Decoder) Attributes

RequestAttributes adapts an admission.Request to the Attributes interface.

type AttributesRecord

type AttributesRecord struct {
	Name        string
	Namespace   string
	Kind        schema.GroupVersionKind
	Resource    schema.GroupVersionResource
	Subresource string
	Operation   admissionv1.Operation
	Object      runtime.Object
	OldObject   runtime.Object
	Username    string
}

AttributesRecord is a simple struct implementing the Attributes interface.

func (*AttributesRecord) GetKind

func (a *AttributesRecord) GetKind() schema.GroupVersionKind

func (*AttributesRecord) GetName

func (a *AttributesRecord) GetName() string

func (*AttributesRecord) GetNamespace

func (a *AttributesRecord) GetNamespace() string

func (*AttributesRecord) GetObject

func (a *AttributesRecord) GetObject() (runtime.Object, error)

func (*AttributesRecord) GetOldObject

func (a *AttributesRecord) GetOldObject() (runtime.Object, error)

func (*AttributesRecord) GetOperation

func (a *AttributesRecord) GetOperation() admissionv1.Operation

func (*AttributesRecord) GetResource

func (a *AttributesRecord) GetResource() schema.GroupVersionResource

func (*AttributesRecord) GetSubresource

func (a *AttributesRecord) GetSubresource() string

func (*AttributesRecord) GetUserName

func (a *AttributesRecord) GetUserName() string

type Level

type Level string

const (
	LevelPrivileged Level = "privileged"
	LevelBaseline   Level = "baseline"
	LevelRestricted Level = "restricted"
)

func ParseLevel

func ParseLevel(level string) (Level, error)

ParseLevel returns the level that should be evaluated. level must be "privileged", "baseline", or "restricted". if level does not match one of those strings, "restricted" and an error is returned.

func (*Level) Valid

func (l *Level) Valid() bool

Valid checks whether the level l is a valid level.

type LevelVersion

type LevelVersion struct {
	Level
	Version
}

func (*LevelVersion) Equivalent

func (lv *LevelVersion) Equivalent(other *LevelVersion) bool

Equivalent determines whether two LevelVersions are functionally equivalent. LevelVersions are considered equivalent if both are privileged, or both levels & versions are equal.

func (LevelVersion) String

func (lv LevelVersion) String() string

type Policy

type Policy struct {
	Enforce LevelVersion
	Audit   LevelVersion
	Warn    LevelVersion
}

func PolicyToEvaluate

func PolicyToEvaluate(labels map[string]string, defaults Policy) (Policy, field.ErrorList)

PolicyToEvaluate resolves the PodSecurity namespace labels to the policy for that namespace, falling back to the provided defaults when a label is unspecified. A valid policy is always returned, even when an error is returned. If labels cannot be parsed correctly, the values of "restricted" and "latest" are used for level and version respectively.

func (*Policy) Equivalent

func (p *Policy) Equivalent(other *Policy) bool

Equivalent determines whether two policies are functionally equivalent. Policies are considered equivalent if all 3 modes are considered equivalent.

func (*Policy) FullyPrivileged

func (p *Policy) FullyPrivileged() bool

FullyPrivileged returns true if all 3 policy modes are privileged.

func (*Policy) String

func (p *Policy) String() string

type Version

type Version struct {
	// contains filtered or unexported fields
}

func GetAPIVersion

func GetAPIVersion() Version

GetAPIVersion get the version of apiServer and return the version major and minor

func LatestVersion

func LatestVersion() Version

func MajorMinorVersion

func MajorMinorVersion(major, minor int) Version

func ParseVersion

func ParseVersion(version string) (Version, error)

ParseVersion returns the policy version that should be evaluated. version must be "latest" or "v1.x". If version does not match one of those patterns, the latest version and an error is returned.

func (*Version) Latest

func (v *Version) Latest() bool

func (*Version) Major

func (v *Version) Major() int

func (*Version) Minor

func (v *Version) Minor() int

func (*Version) Older

func (v *Version) Older(other Version) bool

Older returns true if this version v is older than the other.

func (Version) String

func (v Version) String() string