checkpointarchive

Documentation

Overview

Package checkpointarchive reads metadata out of container checkpoint archives (the .tar files the kubelet checkpoint API produces). It is shared by the operator's controllers and the node-side CRI proxy so that both sides apply the same hardened extraction rules to archives they do not trust: exact entry-name matching, regular files only, traversal guards, and a per-file size bound.

Index

• Constants
• func ReadBaseImage(checkpointPath string) (string, error)
• func ReadPodNamespace(checkpointPath string) (string, error)
• func UntarFiles(src, dest string, files []string) error
• type PodContainerRef
  • func ReadPodContainerRef(checkpointPath string) (PodContainerRef, error)

Constants

const MaxExtractedFileSize = 16 << 20 // 16 MiB

MaxExtractedFileSize bounds any single file extracted from a checkpoint archive. The files this package extracts (config.dump, spec.dump) are small JSON documents; the bound exists so a crafted or corrupted archive with a huge (or decompression-bomb) entry cannot fill the disk of whichever component inspects it. Extraction fails when the bound is exceeded rather than silently truncating, because a truncated JSON document would produce a misleading parse error.

Functions

func ReadBaseImage

func ReadBaseImage(checkpointPath string) (string, error)

ReadBaseImage returns the base (rootfs) image name recorded in the checkpoint archive's config.dump.

func ReadPodNamespace

func ReadPodNamespace(checkpointPath string) (string, error)

ReadPodNamespace returns the namespace of the pod the checkpoint was taken from, as recorded inside the archive's spec.dump by the container runtime. It understands the three places runtimes record it: CRI-O's kubelet-labels JSON annotation, containerd's sandbox-namespace annotation, and the checkpointctl-standard annotation. It fails (rather than returning "") when none is present, so callers that use it as an authorization signal fail closed on hand-crafted archives.

func UntarFiles

func UntarFiles(src, dest string, files []string) error

UntarFiles extracts the named entries from the archive src into dest.

Entry names are compared exactly after lexical cleaning ("./spec.dump" matches "spec.dump"). This is deliberately not a substring match: an entry named "evil-spec.dump" or "x/spec.dump" is not extracted. Only regular-file entries are accepted; a matching entry of any other type (symlink, directory, device) is an error, because the callers parse the result as JSON and anything else indicates a crafted archive. Entries that escape dest ("zip slip") are rejected, and each file is limited to MaxExtractedFileSize after decompression.

Types

type PodContainerRef

type PodContainerRef struct {
	Namespace string
	Pod       string
	Container string
}

PodContainerRef identifies the Kubernetes pod container captured in a checkpoint archive.

func ReadPodContainerRef

func ReadPodContainerRef(checkpointPath string) (PodContainerRef, error)

ReadPodContainerRef returns the Kubernetes namespace, pod, and container recorded in the archive's spec.dump. It understands CRI-O's kubelet labels, containerd's CRI annotations, and checkpointctl-standard annotations. It fails closed when identity is incomplete, malformed, missing, or conflicting.