auth

Documentation

Index

• Variables
• func NewMetaDataReaderClusterRoleBinding(saNamespace, name, saName string, owner metav1.OwnerReference) *rbacv1.ClusterRoleBinding
• func NewSCC() *security.SecurityContextConstraints
• func NewServiceAccountSCCRole(namespace, name string, owner metav1.OwnerReference) *rbacv1.Role
• func NewServiceAccountSCCRoleBinding(namespace, name, saName string, owner metav1.OwnerReference) *rbacv1.RoleBinding
• func ReconcileRBAC(er record.EventRecorder, k8sClient client.Client, saNamespace string, ...) error
• func ReconcileServiceAccount(er record.EventRecorder, k8sClient client.Client, namespace string, ...) (err error)
• func RemoveSecurityContextConstraint(k8sClient client.Client, sccName string) error

Variables

var (
	RequiredDropCapabilities = []corev1.Capability{
		"CHOWN",
		"DAC_OVERRIDE",
		"FSETID",
		"FOWNER",
		"SETGID",
		"SETUID",
		"SETPCAP",
		"NET_BIND_SERVICE",
		"KILL",
	}

	DesiredSCCVolumes = []security.FSType{"configMap", "secret", "emptyDir", "projected"}
)

Functions

func NewMetaDataReaderClusterRoleBinding

func NewMetaDataReaderClusterRoleBinding(saNamespace, name, saName string, owner metav1.OwnerReference) *rbacv1.ClusterRoleBinding

NewMetaDataReaderClusterRoleBinding stubs a clusterrolebinding to allow reading of pod metadata (i.e. labels)

func NewSCC

func NewSCC() *security.SecurityContextConstraints

func NewServiceAccountSCCRole

func NewServiceAccountSCCRole(namespace, name string, owner metav1.OwnerReference) *rbacv1.Role

func NewServiceAccountSCCRoleBinding

func NewServiceAccountSCCRoleBinding(namespace, name, saName string, owner metav1.OwnerReference) *rbacv1.RoleBinding

func ReconcileRBAC

func ReconcileRBAC(er record.EventRecorder, k8sClient client.Client, saNamespace string, resNames *factory.ForwarderResourceNames, owner metav1.OwnerReference) error

ReconcileRBAC reconciles the RBAC specifically for the service account and SCC

func ReconcileServiceAccount

func ReconcileServiceAccount(er record.EventRecorder, k8sClient client.Client, namespace string, resNames *factory.ForwarderResourceNames, owner metav1.OwnerReference) (err error)

ReconcileServiceAccount reconciles the serviceaccount for collector or logfilemetricexporter

func RemoveSecurityContextConstraint

func RemoveSecurityContextConstraint(k8sClient client.Client, sccName string) error