Directories
¶
| Path | Synopsis |
|---|---|
|
Package audit provides structured audit logging for policy decisions.
|
Package audit provides structured audit logging for policy decisions. |
|
cmds
|
|
|
allowlist
Package allowlist implements the `c8s allowlist` operator CLI for reading and mutating the CDS-served image allowlist that nri-image-policy enforces on every node.
|
Package allowlist implements the `c8s allowlist` operator CLI for reading and mutating the CDS-served image allowlist that nri-image-policy enforces on every node. |
|
allowlistproxy
Package allowlistproxy implements the loopback proxy used by tls-lb to publish CDS's allowlist API.
|
Package allowlistproxy implements the loopback proxy used by tls-lb to publish CDS's allowlist API. |
|
attestproxy
Package attestproxy implements the node-local front door to the attestation-api.
|
Package attestproxy implements the node-local front door to the attestation-api. |
|
cds
Package cds implements the Certificate Distribution Service subcommand: the c8s trust root (attestation, EAR issuance, mesh CA, leaf signing).
|
Package cds implements the Certificate Distribution Service subcommand: the c8s trust root (attestation, EAR issuance, mesh CA, leaf signing). |
|
cdsattest
Package cdsattest implements the tls-lb attestation + over-encryption sidecar: the *dynamic* client-facing endpoints of the c8s-verify protocol.
|
Package cdsattest implements the tls-lb attestation + over-encryption sidecar: the *dynamic* client-facing endpoints of the c8s-verify protocol. |
|
cdsconn
Package cdsconn builds what an operator CLI needs to reach CDS: an HTTP client that has verified the endpoint's attestation, and the operator credential that signs a write.
|
Package cdsconn builds what an operator CLI needs to reach CDS: an HTTP client that has verified the endpoint's attestation, and the operator credential that signs a write. |
|
cmdsutil
Package cmdsutil holds tiny helpers shared across the c8s subcommand packages under internal/cmds/.
|
Package cmdsutil holds tiny helpers shared across the c8s subcommand packages under internal/cmds/. |
|
credrelease
Package credrelease implements the in-guest credential-release service (B4 of the operator-key design).
|
Package credrelease implements the in-guest credential-release service (B4 of the operator-key design). |
|
getcert
Package getcert implements the get-cert subcommand: it requests a TLS certificate from CDS by proving the caller runs inside a TEE.
|
Package getcert implements the get-cert subcommand: it requests a TLS certificate from CDS by proving the caller runs inside a TEE. |
|
getkubeconfig
Package getkubeconfig implements the operator-side client (B4 client) that obtains a kube credential from a measured CVM: it attests the node, confirms the full measured identity — on TDX the image tuple (MRTD, RTMR[1], RTMR[2]) plus the RTMR[3] chain seeded by the operator's key and extended by the expected workload images; on SEV-SNP the pinned per-SMP launch digest plus the operator-key HOSTDATA binding — then exchanges a CSR for a short-lived kube client cert over the cred-release endpoint and assembles a kubeconfig.
|
Package getkubeconfig implements the operator-side client (B4 client) that obtains a kube credential from a measured CVM: it attests the node, confirms the full measured identity — on TDX the image tuple (MRTD, RTMR[1], RTMR[2]) plus the RTMR[3] chain seeded by the operator's key and extended by the expected workload images; on SEV-SNP the pinned per-SMP launch digest plus the operator-key HOSTDATA binding — then exchanges a CSR for a short-lived kube client cert over the cred-release endpoint and assembles a kubeconfig. |
|
getsecret
Package getsecret implements the get-secret subcommand: the sidecar that fetches a workload's secrets from CDS and writes them into the pod.
|
Package getsecret implements the get-secret subcommand: the sidecar that fetches a workload's secrets from CDS and writes them into the pod. |
|
getvolume
Package getvolume implements the get-volume subcommand: the sidecar that fetches a volume's key blob from CDS and hands it to the node's volumed, which opens the device and mounts it into this pod.
|
Package getvolume implements the get-volume subcommand: the sidecar that fetches a volume's key blob from CDS and hands it to the node's volumed, which opens the device and mounts it into this pod. |
|
katameasure
Package katameasure implements `c8s kata measure`: the offline predictor for a kata confidential guest's launch measurement, on SEV-SNP and on TDX.
|
Package katameasure implements `c8s kata measure`: the offline predictor for a kata confidential guest's launch measurement, on SEV-SNP and on TDX. |
|
measurements
Package measurements implements the `c8s measurements` command group: deriving a measurements config from built images, and checking one.
|
Package measurements implements the `c8s measurements` command group: deriving a measurements config from built images, and checking one. |
|
nri-image-policy
Package nriimagepolicy is an NRI plugin that validates container images against a digest allowlist.
|
Package nriimagepolicy is an NRI plugin that validates container images against a digest allowlist. |
|
policymonitor
Package policymonitor implements the in-VM container-digest enforcement daemon baked into kata-guest-base.
|
Package policymonitor implements the in-VM container-digest enforcement daemon baked into kata-guest-base. |
|
probefile
Package probefile implements the probe-file subcommand: a tiny file-existence helper for distroless containers.
|
Package probefile implements the probe-file subcommand: a tiny file-existence helper for distroless containers. |
|
rtmr3measurer
Package rtmr3measurer is the in-VM workload measurer: it scans kata-agent's container bundles under /run/kata-containers and extends TDX RTMR[3] with each deployed workload's image digest, binding WHICH container ran into the guest's attestation — dynamically, for any image, with no baked allowlist.
|
Package rtmr3measurer is the in-VM workload measurer: it scans kata-agent's container bundles under /run/kata-containers and extends TDX RTMR[3] with each deployed workload's image digest, binding WHICH container ran into the guest's attestation — dynamically, for any image, with no baked allowlist. |
|
secrets
Package secrets implements the `c8s secrets` operator CLI for the CDS secret store.
|
Package secrets implements the `c8s secrets` operator CLI for the CDS secret store. |
|
sidecar
Package sidecar holds the CDS-release plumbing shared by the get-secret and get-volume sidecars: the config they render from the webhook, the mTLS client bound to the pod's leaf, the challenge/sandbox-token dance around each store request, and the retry loop that turns "not released yet" into bounded patience.
|
Package sidecar holds the CDS-release plumbing shared by the get-secret and get-volume sidecars: the config they render from the webhook, the mTLS client bound to the pod's leaf, the challenge/sandbox-token dance around each store request, and the retry loop that turns "not released yet" into bounded patience. |
|
volume
Package volume implements the `c8s volume` operator CLI: building an encrypted block image and putting its key into the CDS secret store.
|
Package volume implements the `c8s volume` operator CLI: building an encrypted block image and putting its key into the CDS secret store. |
|
volumed
Package volumed implements the node agent that opens encrypted volumes for the pods on it.
|
Package volumed implements the node agent that opens encrypted volumes for the pods on it. |
|
Package containerd provides tag-to-digest resolution via the containerd image store.
|
Package containerd provides tag-to-digest resolution via the containerd image store. |
|
Package controller hosts the controller-runtime manager, the slim ConfidentialWorkload status-mirror reconciler, and the admission webhook.
|
Package controller hosts the controller-runtime manager, the slim ConfidentialWorkload status-mirror reconciler, and the admission webhook. |
|
Package crane wraps the crane CLI (github.com/google/go-containerregistry): digest resolution, image config, manifest existence, and the error shapes callers key behaviour on.
|
Package crane wraps the crane CLI (github.com/google/go-containerregistry): digest resolution, image config, manifest existence, and the error shapes callers key behaviour on. |
|
cranetest
Package cranetest installs a crane CLI stub on PATH for tests of crane-backed commands, so they run without a registry or the real binary.
|
Package cranetest installs a crane CLI stub on PATH for tests of crane-backed commands, so they run without a registry or the real binary. |
|
Package fileutil holds small filesystem helpers shared across c8s commands.
|
Package fileutil holds small filesystem helpers shared across c8s commands. |
|
Package helmchart bundles the c8s Helm chart into the Go binary so `c8s install` is a single-file install tool — no side chart download.
|
Package helmchart bundles the c8s Helm chart into the Go binary so `c8s install` is a single-file install tool — no side chart download. |
|
Package httputil holds small HTTP-handler utilities shared across c8s internal packages.
|
Package httputil holds small HTTP-handler utilities shared across c8s internal packages. |
|
Package issuer generates CA keypairs and signs workload X.509 certificates in-process.
|
Package issuer generates CA keypairs and signs workload X.509 certificates in-process. |
|
Package kataspec reads the parts of kata-agent's on-disk container bundle that c8s makes trust decisions on.
|
Package kataspec reads the parts of kata-agent's on-disk container bundle that c8s makes trust decisions on. |
|
Package lbdiscovery consumes the tls-lb front-door discovery contract (types.DiscoveryDocument, served at /v1/discovery, written by get-cert).
|
Package lbdiscovery consumes the tls-lb front-door discovery contract (types.DiscoveryDocument, served at /v1/discovery, written by get-cert). |
|
Package localverify verifies attestation evidence in-process with attestation-go (the Go port of the attestation-rs engine the cluster runs), auto-detecting the platform from the envelope tag.
|
Package localverify verifies attestation evidence in-process with attestation-go (the Go port of the attestation-rs engine the cluster runs), auto-detecting the platform from the envelope tag. |
|
Package sandboxledger records which node's admission inventory vouched for a pod sandbox, so a later decision about that sandbox asks the same inventory rather than one the requester names.
|
Package sandboxledger records which node's admission inventory vouched for a pod sandbox, so a later decision about that sandbox asks the same inventory rather than one the requester names. |
|
Package secrets holds the CDS secret store and the policy that gates access to it.
|
Package secrets holds the CDS secret store and the policy that gates access to it. |
|
Package testattest serves a fake attestation-api for tests.
|
Package testattest serves a fake attestation-api for tests. |
|
Package version exposes the c8s build version.
|
Package version exposes the c8s build version. |
|
Package webhook contains the mutating admission webhook that injects the c8s get-cert containers into pods opted in by annotation.
|
Package webhook contains the mutating admission webhook that injects the c8s get-cert containers into pods opted in by annotation. |
Click to show internal directories.
Click to hide internal directories.