hooks

Documentation

Index

• func NewPodMutator(c client.Client, log logr.Logger, dec *admission.Decoder, prof SecurityProfile) http.Handler
• func NewPodValidator(c client.Client, log logr.Logger, dec *admission.Decoder, prof SecurityProfile) http.Handler
• type SecurityProfile

Functions

func NewPodMutator

func NewPodMutator(c client.Client, log logr.Logger, dec *admission.Decoder, prof SecurityProfile) http.Handler

NewPodMutator creates a webhook handler for Pod.

func NewPodValidator

func NewPodValidator(c client.Client, log logr.Logger, dec *admission.Decoder, prof SecurityProfile) http.Handler

NewPodValidator creates a webhook handler for Pod.

Types

type SecurityProfile

type SecurityProfile struct {
	Name string `json:"name"`

	HostNamespace            bool                         `json:"hostNamespace"`
	Privileged               bool                         `json:"privileged"`
	Capabilities             bool                         `json:"capabilities"`
	AdditionalCapabilities   []string                     `json:"additionalCapabilities"`
	HostPathVolumes          bool                         `json:"hostPathVolumes"`
	AllowedHostPaths         []validators.AllowedHostPath `json:"allowedHostPaths"`
	NonCoreVolumeTypes       bool                         `json:"nonCoreVolumeTypes"`
	HostPorts                bool                         `json:"hostPorts"`
	AllowedHostPorts         []validators.PortRange       `json:"allowedHostPorts"`
	AppArmor                 bool                         `json:"appArmor"`
	SELinux                  bool                         `json:"seLinux"`
	ProcMount                bool                         `json:"procMount"`
	Sysctls                  bool                         `json:"sysctls"`
	AllowPrivilegeEscalation bool                         `json:"allowPrivilegeEscalation"`
	RunAsRoot                bool                         `json:"runAsRoot"`
	ForceRunAsNonRoot        bool                         `json:"forceRunAsNonRoot"`
	RootGroups               bool                         `json:"rootGroups"`
	Seccomp                  bool                         `json:"seccomp"`
}

SecurityProfile is a config for pod-security-admission