config

Documentation

Index

• Constants
• Variables
• func GetOperatorNamespace() string
• func TryToGetOperatorNamespace() (string, error)

Constants

const (
	// OperatorName is the name when referring to the operator.
	OperatorName = "security-profiles-operator"

	// Service Account for the security-profiles-operator daemon.
	SPOdServiceAccount = "spod"

	// OperatorRoot is the root directory of the operator.
	OperatorRoot = "/var/lib/security-profiles-operator"

	// UserRootless is the user which runs the operator.
	UserRootless = 65535

	// KubeletSeccompRootPath specifies the path where all kubelet seccomp
	// profiles are stored.
	KubeletSeccompRootPath = "/var/lib/kubelet/seccomp"

	// ProfilesRootPath specifies the path where the operator stores seccomp
	// profiles.
	ProfilesRootPath = KubeletSeccompRootPath + "/operator"

	// NodeNameEnvKey is the default environment variable key for retrieving
	// the name of the current node.
	NodeNameEnvKey = "NODE_NAME"

	// OperatorNamespaceEnvKey is the default environment variable key for retrieving
	// the operator's namespace.
	OperatorNamespaceEnvKey = "OPERATOR_NAMESPACE"

	// RestrictNamespaceEnvKey is the environment variable key for restricting
	// the operator to work on only a single Kubernetes namespace.
	RestrictNamespaceEnvKey = "RESTRICT_TO_NAMESPACE"

	// SeccompProfileRecordAnnotationKey is the annotation on a Pod that
	// triggers the oci-seccomp-bpf-hook to trace the syscalls of a Pod and
	// created a seccomp profile.
	SeccompProfileRecordAnnotationKey = "io.containers.trace-syscall"
)

Variables

var ErrPodNamespaceEnvNotFound = errors.New("the env variable OPERATOR_NAMESPACE hasn't been set")

var ProfileRecordingOutputPath = filepath.Join(os.TempDir(), "security-profiles-operator-recordings")

ProfileRecordingOutputPath is the path where the recorded profiles will be stored. Those profiles are going to be reconciled into native CRDs and therefore have a limited lifetime.

Functions

func GetOperatorNamespace

func GetOperatorNamespace() string

GetOperatorNamespace gets the namespace that the operator is currently running on. Failure to get the namespace results in a panic.

func TryToGetOperatorNamespace

func TryToGetOperatorNamespace() (string, error)