kube

Documentation

Index

• Constants
• func AggregateImagePullSecretsData(images ContainerImages, credentials map[string]docker.Auth) map[string][]byte
• func GVKForObject(obj runtime.Object, scheme *runtime.Scheme) (schema.GroupVersionKind, error)
• func GVRForResource(mapper meta.RESTMapper, resource string) (gvr schema.GroupVersionResource, gvk schema.GroupVersionKind, err error)
• func KindForObject(object metav1.Object, scheme *runtime.Scheme) (string, error)
• func MapContainerNamesToDockerAuths(images ContainerImages, secrets []corev1.Secret) (map[string]docker.Auth, error)
• func MapDockerRegistryServersToAuths(imagePullSecrets []corev1.Secret) (map[string]docker.Auth, error)
• func NewImagePullSecret(meta metav1.ObjectMeta, server, username, password string) (*corev1.Secret, error)
• func NewRunnableJob(scheme *runtime.Scheme, clientset kubernetes.Interface, job *batchv1.Job, ...) runner.Runnable
• type CRManager
  • func NewCRManager(clientset kubernetes.Interface, ...) *CRManager
  • func (m *CRManager) Cleanup(ctx context.Context) (err error)
  • func (m *CRManager) Init(ctx context.Context) (err error)
• type ContainerImages
  • func (ci ContainerImages) AsJSON() (string, error)
  • func (ci ContainerImages) FromJSON(value string) error
• type Kind
• type Object
  • func ObjectFromLabelsSet(set labels.Set) (Object, error)
• type ScannerOpts
• type SecretsReader
  • func NewControllerRuntimeSecretsReader(client client.Client) SecretsReader
  • func NewSecretsReader(clientset kubernetes.Interface) SecretsReader

Constants

const (
	// TODO I'm wondering if we should rename starboard.resource.* labels to starboard.object.*
	// TODO In Kubernetes API terminology a resource is usually lowercase, plural word (e.g. pods) identifying a set of
	// TODO HTTP endpoints (paths) exposing the CRUD semantics of a certain object type in the system
	LabelResourceKind      = "starboard.resource.kind"
	LabelResourceName      = "starboard.resource.name"
	LabelResourceNamespace = "starboard.resource.namespace"

	LabelContainerName = "starboard.container.name"
	LabelPodSpecHash   = "pod-spec-hash"

	LabelScannerName   = "starboard.scanner.name"
	LabelScannerVendor = "starboard.scanner.vendor"

	LabelK8SAppManagedBy = "app.kubernetes.io/managed-by"
	AppStarboardOperator = "starboard-operator"
)

const (
	AnnotationContainerImages = "starboard.container-images"
)

Functions

func AggregateImagePullSecretsData

func AggregateImagePullSecretsData(images ContainerImages, credentials map[string]docker.Auth) map[string][]byte

func GVKForObject

func GVKForObject(obj runtime.Object, scheme *runtime.Scheme) (schema.GroupVersionKind, error)

func GVRForResource

func GVRForResource(mapper meta.RESTMapper, resource string) (gvr schema.GroupVersionResource, gvk schema.GroupVersionKind, err error)

func KindForObject

func KindForObject(object metav1.Object, scheme *runtime.Scheme) (string, error)

func MapContainerNamesToDockerAuths

func MapContainerNamesToDockerAuths(images ContainerImages, secrets []corev1.Secret) (map[string]docker.Auth, error)

MapContainerNamesToDockerAuths creates the mapping from a container name to the Docker authentication credentials for the specified kube.ContainerImages and image pull Secrets.

func MapDockerRegistryServersToAuths

func MapDockerRegistryServersToAuths(imagePullSecrets []corev1.Secret) (map[string]docker.Auth, error)

MapDockerRegistryServersToAuths creates the mapping from a Docker registry server to the Docker authentication credentials for the specified slice of image pull Secrets.

func NewImagePullSecret

func NewImagePullSecret(meta metav1.ObjectMeta, server, username, password string) (*corev1.Secret, error)

NewImagePullSecret constructs a new image pull Secret with the specified registry server and basic authentication credentials.

func NewRunnableJob

func NewRunnableJob(
	scheme *runtime.Scheme,
	clientset kubernetes.Interface,
	job *batchv1.Job,
	secrets ...*corev1.Secret,
) runner.Runnable

NewRunnableJob constructs a new Runnable task defined as Kubernetes job configuration and secrets that it references.

Types

type CRManager

type CRManager struct {
	// contains filtered or unexported fields
}

func NewCRManager

func NewCRManager(
	clientset kubernetes.Interface,
	clientsetext extapi.ApiextensionsV1beta1Interface,
	configManager starboard.ConfigManager,
) *CRManager

NewCRManager constructs a CRManager with the given starboard.ConfigManager and kubernetes.Interface.

func (*CRManager) Cleanup

func (m *CRManager) Cleanup(ctx context.Context) (err error)

func (*CRManager) Init

func (m *CRManager) Init(ctx context.Context) (err error)

type ContainerImages

type ContainerImages map[string]string

ContainerImages is a simple structure to hold the mapping between container names and container image references.

func (ContainerImages) AsJSON

func (ci ContainerImages) AsJSON() (string, error)

func (ContainerImages) FromJSON

func (ci ContainerImages) FromJSON(value string) error

type Kind

type Kind string

Kind represents the type of a Kubernetes Object.

const (
	KindUnknown Kind = "Unknown"

	KindNode Kind = "Node"

	KindPod                   Kind = "Pod"
	KindReplicaSet            Kind = "ReplicaSet"
	KindReplicationController Kind = "ReplicationController"
	KindDeployment            Kind = "Deployment"
	KindStatefulSet           Kind = "StatefulSet"
	KindDaemonSet             Kind = "DaemonSet"
	KindCronJob               Kind = "CronJob"
	KindJob                   Kind = "Job"
)

type Object

type Object struct {
	Kind      Kind
	Name      string
	Namespace string
}

Object is a simplified representation of a Kubernetes object. Each object has kind, which designates the type of the entity it represents. Objects have names and many of them live in namespaces.

func ObjectFromLabelsSet

func ObjectFromLabelsSet(set labels.Set) (Object, error)

type ScannerOpts

type ScannerOpts struct {
	ScanJobTimeout time.Duration
	DeleteScanJob  bool
}

ScannerOpts holds configuration of the vulnerability Scanner.

type SecretsReader

type SecretsReader interface {
	ListByLocalObjectReferences(ctx context.Context, refs []corev1.LocalObjectReference, ns string) ([]corev1.Secret, error)
	ListByServiceAccount(ctx context.Context, name string, ns string) ([]corev1.Secret, error)
	ListImagePullSecretsByPodSpec(ctx context.Context, spec corev1.PodSpec, ns string) ([]corev1.Secret, error)
}

SecretsReader defines methods for reading Secrets.

func NewControllerRuntimeSecretsReader

func NewControllerRuntimeSecretsReader(client client.Client) SecretsReader

NewControllerRuntimeSecretsReader constructs a new SecretsReader which is using the client package provided by the controller-runtime libraries for interacting with the Kubernetes API server.

func NewSecretsReader

func NewSecretsReader(clientset kubernetes.Interface) SecretsReader

NewSecretsReader constructs a new SecretsReader which is using the client-go module for interacting with the Kubernetes API server.