isolation

Documentation

Index

• Constants
• func GetImageInfo(imagePath string, context *IsolationResult) (*containerdisk.DiskInfo, error)
• type IsolationResult
  • func NewIsolationResult(pid int, slice string, controller []string) *IsolationResult
  • func NodeIsolationResult() *IsolationResult
  • func (r *IsolationResult) Controller() []string
  • func (r *IsolationResult) IsMounted(mountPoint string) (bool, error)
  • func (r *IsolationResult) MountInfoRoot() (*MountInfo, error)
  • func (r *IsolationResult) MountNamespace() string
  • func (r *IsolationResult) MountRoot() string
  • func (r *IsolationResult) NetNamespace() string
  • func (r *IsolationResult) PIDNamespace() string
  • func (r *IsolationResult) ParentMountInfoFor(mountInfo *MountInfo) (*MountInfo, error)
  • func (r *IsolationResult) Pid() int
  • func (r *IsolationResult) Slice() string
• type MockPodIsolationDetector
  • func NewMockPodIsolationDetector(ctrl *gomock.Controller) *MockPodIsolationDetector
  • func (_m *MockPodIsolationDetector) AdjustResources(vm *v1.VirtualMachineInstance) error
  • func (_m *MockPodIsolationDetector) Detect(vm *v1.VirtualMachineInstance) (*IsolationResult, error)
  • func (_m *MockPodIsolationDetector) DetectForSocket(vm *v1.VirtualMachineInstance, socket string) (*IsolationResult, error)
  • func (_m *MockPodIsolationDetector) EXPECT() *_MockPodIsolationDetectorRecorder
  • func (_m *MockPodIsolationDetector) Whitelist(controller []string) PodIsolationDetector
• type MountInfo
• type PodIsolationDetector
  • func NewSocketBasedIsolationDetector(socketDir string) PodIsolationDetector

Constants

const (
	QEMUIMGPath = "/usr/bin/qemu-img"
)

Functions

func GetImageInfo

func GetImageInfo(imagePath string, context *IsolationResult) (*containerdisk.DiskInfo, error)

Types

type IsolationResult

type IsolationResult struct {
	// contains filtered or unexported fields
}

func NewIsolationResult

func NewIsolationResult(pid int, slice string, controller []string) *IsolationResult

func NodeIsolationResult

func NodeIsolationResult() *IsolationResult

func (*IsolationResult) Controller

func (r *IsolationResult) Controller() []string

func (*IsolationResult) IsMounted

func (r *IsolationResult) IsMounted(mountPoint string) (bool, error)

IsMounted checks if a path in the mount namespace of a given process isolation result is a mount point. Works with symlinks.

func (*IsolationResult) MountInfoRoot

func (r *IsolationResult) MountInfoRoot() (*MountInfo, error)

MountInfoRoot returns information about the root entry in /proc/mountinfo

func (*IsolationResult) MountNamespace

func (r *IsolationResult) MountNamespace() string

func (*IsolationResult) MountRoot

func (r *IsolationResult) MountRoot() string

func (*IsolationResult) NetNamespace

func (r *IsolationResult) NetNamespace() string

func (*IsolationResult) PIDNamespace

func (r *IsolationResult) PIDNamespace() string

func (*IsolationResult) ParentMountInfoFor

func (r *IsolationResult) ParentMountInfoFor(mountInfo *MountInfo) (*MountInfo, error)

ParentMountInfoFor takes the mount info from a container, and looks the corresponding entry in /proc/mountinfo of the isolation result of the given process.

func (*IsolationResult) Pid

func (r *IsolationResult) Pid() int

func (*IsolationResult) Slice

func (r *IsolationResult) Slice() string

type MockPodIsolationDetector

type MockPodIsolationDetector struct {
	// contains filtered or unexported fields
}

Mock of PodIsolationDetector interface

func NewMockPodIsolationDetector

func NewMockPodIsolationDetector(ctrl *gomock.Controller) *MockPodIsolationDetector

func (*MockPodIsolationDetector) AdjustResources

func (_m *MockPodIsolationDetector) AdjustResources(vm *v1.VirtualMachineInstance) error

func (*MockPodIsolationDetector) Detect

func (_m *MockPodIsolationDetector) Detect(vm *v1.VirtualMachineInstance) (*IsolationResult, error)

func (*MockPodIsolationDetector) DetectForSocket

func (_m *MockPodIsolationDetector) DetectForSocket(vm *v1.VirtualMachineInstance, socket string) (*IsolationResult, error)

func (*MockPodIsolationDetector) EXPECT

func (_m *MockPodIsolationDetector) EXPECT() *_MockPodIsolationDetectorRecorder

func (*MockPodIsolationDetector) Whitelist

func (_m *MockPodIsolationDetector) Whitelist(controller []string) PodIsolationDetector

type MountInfo

type MountInfo struct {
	DeviceContainingFile string
	Root                 string
	MountPoint           string
}

type PodIsolationDetector

type PodIsolationDetector interface {
	// Detect takes a vm, looks up a socket based the VM and detects pid, cgroups and namespaces of the owner of that socket.
	// It returns an IsolationResult containing all isolation information
	Detect(vm *v1.VirtualMachineInstance) (*IsolationResult, error)

	DetectForSocket(vm *v1.VirtualMachineInstance, socket string) (*IsolationResult, error)

	// Whitelist allows specifying cgroup controller which should be considered to detect the cgroup slice
	// It returns a PodIsolationDetector to allow configuring the PodIsolationDetector via the builder pattern.
	Whitelist(controller []string) PodIsolationDetector

	// Adjust system resources to run the passed VM
	AdjustResources(vm *v1.VirtualMachineInstance) error
}

PodIsolationDetector helps detecting cgroups, namespaces and PIDs of Pods from outside of them. Different strategies may be applied to do that.

func NewSocketBasedIsolationDetector

func NewSocketBasedIsolationDetector(socketDir string) PodIsolationDetector

NewSocketBasedIsolationDetector takes socketDir and creates a socket based IsolationDetector It returns a PodIsolationDetector which detects pid, cgroups and namespaces of the socket owner.