security

Documentation

Index

• Variables
• func AllowRestrictedPodSecurityStandard(ctx context.Context, kubeClient kubernetes.Interface, pod *corev1.Pod) error
• func IsRestrictedPodSecurityEnforced(ctx context.Context, kubeClient kubernetes.Interface, namespace string) (bool, error)

Variables

var DefaultContainerSecurityContext = corev1.SecurityContext{
	AllowPrivilegeEscalation: ptr.Bool(false),
	Capabilities: &corev1.Capabilities{
		Drop: []corev1.Capability{"ALL"},
	},
}

var DefaultPodSecurityContext = corev1.PodSecurityContext{
	RunAsNonRoot: ptr.Bool(true),
	SeccompProfile: &corev1.SeccompProfile{
		Type: corev1.SeccompProfileTypeRuntimeDefault,
	},
}

Functions

func AllowRestrictedPodSecurityStandard

func AllowRestrictedPodSecurityStandard(ctx context.Context, kubeClient kubernetes.Interface, pod *corev1.Pod) error

AllowRestrictedPodSecurityStandard adds SecurityContext to Pod and its containers so that it can run in a namespace with enforced "restricted" security standard.

func IsRestrictedPodSecurityEnforced

func IsRestrictedPodSecurityEnforced(ctx context.Context, kubeClient kubernetes.Interface, namespace string) (bool, error)

IsRestrictedPodSecurityEnforced checks if the given namespace has enforced restricted security standard.