Documentation
¶
Index ¶
- Constants
- Variables
- func ConvertToMetaV1Objects(data *bytes.Buffer) []metav1.Object
- func DetectLineBreak(haystack []byte) string
- func FindLineNumbers(data *bytes.Buffer) []int
- func GetErrorFixes() []string
- func IsImageAllowed(image string) bool
- func KubevalLint(data *bytes.Buffer, filename string)
- func Lint(k8sObjects []*YamlDerivedKubernetesResource, standaloneLintMode bool, fix bool) int
- func LinterMessage(message string, resources []*YamlDerivedKubernetesResource) string
- func Report(rule *Rule)
- type Level
- type Metadata
- type Rule
- func ContainerRules(container *v1.Container, resource *YamlDerivedKubernetesResource) []*Rule
- func CronJobRules(resource *YamlDerivedKubernetesResource) []*Rule
- func DeploymentRules(resource *YamlDerivedKubernetesResource) []*Rule
- func DeprecatedDeploymentAPIVersion(resource *YamlDerivedKubernetesResource) []*Rule
- func DeprecatedNetworkPolicyAPIVersion(resource *YamlDerivedKubernetesResource) []*Rule
- func IngressRules(resource *YamlDerivedKubernetesResource) []*Rule
- func InterdependentRules(context []*YamlDerivedKubernetesResource) []*Rule
- func JobRules(resource *YamlDerivedKubernetesResource) []*Rule
- func MatchingNamespace(resource *YamlDerivedKubernetesResource, ...) *Rule
- func NamespaceRules(resource *YamlDerivedKubernetesResource) []*Rule
- func NetworkPolicyRules(resource *YamlDerivedKubernetesResource) []*Rule
- func PersistentVolumeClaimRules(resource *YamlDerivedKubernetesResource) []*Rule
- func PodRules(podSpec *v1.PodSpec, resource *YamlDerivedKubernetesResource) []*Rule
- func RoleBindingRules(resource *YamlDerivedKubernetesResource) []*Rule
- func RoleRules(resource *YamlDerivedKubernetesResource) []*Rule
- func ServiceAccountRules(resource *YamlDerivedKubernetesResource) []*Rule
- func ServiceRules(resource *YamlDerivedKubernetesResource) []*Rule
- type RuleID
- type RuleSorter
- type YamlDerivedKubernetesResource
Constants ¶
const ( SUCCESS = 0 ERROR = 1 WARN = 2 )
const ( // container tests CONTAINER_EXISTS_SECURITY_CONTEXT = iota CONTAINER_ALLOW_PRIVILEGE_ESCALATION_FALSE CONTAINER_VALID_IMAGE CONTAINER_PRIVILEGED_FALSE CONTAINER_EXISTS_RESOURCE_LIMITS_AND_REQUESTS CONTAINER_REQUESTS_CPU_REASONABLE // deployment specific tests DEPLOYMENT_EXISTS_PROJECT_LABEL DEPLOYMENT_EXISTS_APP_K8S_LABEL DEPLOYMENT_WITHIN_NAMESPACE DEPLOYMENT_CONTAINER_EXISTS_LIVENESS DEPLOYMENT_CONTAINER_EXISTS_READINESS DEPLOYMENT_API_VERSION DEPLOYMENT_LIVENESS_READINESS_NONMATCHING // cronjob tests CRONJOB_WITHIN_NAMESPACE CRONJOB_FORBID_CONCURRENT // network policy rules NETWORK_POLICY_API_VERSION // interdependent rules INTERDEPENDENT_AT_MOST_1_SERVICE INTERDEPENDENT_NAMESPACE_REQUIRED INTERDEPENDENT_NETWORK_POLICY_FOR_NAMESPACE INTERDEPENDENT_EXACTLY_1_NAMESPACE INTERDEPENDENT_MATCHING_NAMESPACE // job rules JOB_WITHIN_NAMESPACE JOB_RESTART_NEVER JOB_EXISTS_TTL // namespace rules NAMESPACE_VALID_DNS // pod spec rules POD_NON_NIL_SECURITY_CONTEXT POD_RUN_AS_NON_ROOT POD_CORRECT_USER_GROUP_ID POD_NON_ZERO_CONTAINERS POD_EXACTLY_1_CONTAINER // service rules SERVICE_WITHIN_NAMESPACE SERVICE_NAME_VALID_DNS )
const ACCEPTABLE_DNS = `^[a-zA-Z][a-zA-Z0-9\-\.]+[a-zA-Z0-9]$`
Variables ¶
var ALLOWED_DOCKER_REGISTRIES []string = []string{"277433404353.dkr.ecr.eu-central-1.amazonaws.com"}
Functions ¶
func ConvertToMetaV1Objects ¶
* * This will take a buffer of bytes that encode a YAML object definition (potentially multi-doc) * and will return one or many (in the case of multiple objects) metav1Objects * This is an interface defined in meta/v1 and it's probably the most convenient to use. I love it. * You can access common properties of resources like Name, Namespace, Kind. *
func DetectLineBreak ¶
copied from https://github.com/instrumenta/kubeval/blob/9c9c0a5b3cc619dbd94129af77c8512bfd0f1763/kubeval/utils.go#L24
func FindLineNumbers ¶
* * For each object (in the order that they occur in the yaml file), tell me what line number the object starts on. * This is brittle, will break as soon as kubernetes objects aren't given the apiVersion as the first key sorry about this.
func GetErrorFixes ¶
func GetErrorFixes() []string
func IsImageAllowed ¶
func KubevalLint ¶
func Lint ¶
func Lint(k8sObjects []*YamlDerivedKubernetesResource, standaloneLintMode bool, fix bool) int
main function that performs the linting
func LinterMessage ¶
func LinterMessage(message string, resources []*YamlDerivedKubernetesResource) string
Types ¶
type Rule ¶
type Rule struct {
ID RuleID
Prereqs []RuleID
Condition func() bool
Message string
Level Level
Resources []*YamlDerivedKubernetesResource
Fix func() bool
FixDescription string
}
Represents a Linter Rule
func ContainerRules ¶
func ContainerRules(container *v1.Container, resource *YamlDerivedKubernetesResource) []*Rule
func CronJobRules ¶
func CronJobRules(resource *YamlDerivedKubernetesResource) []*Rule
func DeploymentRules ¶
func DeploymentRules(resource *YamlDerivedKubernetesResource) []*Rule
func DeprecatedDeploymentAPIVersion ¶
func DeprecatedDeploymentAPIVersion(resource *YamlDerivedKubernetesResource) []*Rule
func DeprecatedNetworkPolicyAPIVersion ¶
func DeprecatedNetworkPolicyAPIVersion(resource *YamlDerivedKubernetesResource) []*Rule
func IngressRules ¶
func IngressRules(resource *YamlDerivedKubernetesResource) []*Rule
func InterdependentRules ¶
func InterdependentRules(context []*YamlDerivedKubernetesResource) []*Rule
func JobRules ¶
func JobRules(resource *YamlDerivedKubernetesResource) []*Rule
func MatchingNamespace ¶
func MatchingNamespace(resource *YamlDerivedKubernetesResource, namespace *YamlDerivedKubernetesResource) *Rule
func NamespaceRules ¶
func NamespaceRules(resource *YamlDerivedKubernetesResource) []*Rule
func NetworkPolicyRules ¶
func NetworkPolicyRules(resource *YamlDerivedKubernetesResource) []*Rule
func PersistentVolumeClaimRules ¶
func PersistentVolumeClaimRules(resource *YamlDerivedKubernetesResource) []*Rule
func RoleBindingRules ¶
func RoleBindingRules(resource *YamlDerivedKubernetesResource) []*Rule
func RoleRules ¶
func RoleRules(resource *YamlDerivedKubernetesResource) []*Rule
func ServiceAccountRules ¶
func ServiceAccountRules(resource *YamlDerivedKubernetesResource) []*Rule
func ServiceRules ¶
func ServiceRules(resource *YamlDerivedKubernetesResource) []*Rule
type RuleID ¶
type RuleID int
I'm defining an enum for all the test IDs so we know at compile time whether we're trying to access a non-existent test. The old way caused a panic at runtime and was a bit silly.
type RuleSorter ¶
type RuleSorter struct {
// contains filtered or unexported fields
}
This object is used to store all the rules belonging to a resource group and looks like:
&rulesorter.RuleSorter{
rules:24:(*lint.Rule)(0xc00039caf0),
edges:24:map[lint.RuleID]lint.RuleID{}
}
func NewRuleSorter ¶
func NewRuleSorter(rules []*Rule) *RuleSorter
* * Create a new RuleSorter given a list of rules * Usual use case is to use the RuleSorter to access the rules in the correct order! *
func (*RuleSorter) Get ¶
func (r *RuleSorter) Get(id RuleID) *Rule
* * Retrieve the rule given its ID * May as well implement this since I have to make a map for other operations anyway *
func (*RuleSorter) GetDependentRules ¶
func (r *RuleSorter) GetDependentRules(masterId RuleID) []*Rule
func (*RuleSorter) IsEmpty ¶
func (r *RuleSorter) IsEmpty() bool
func (*RuleSorter) PopDependentRules ¶
func (r *RuleSorter) PopDependentRules(masterId RuleID) []*Rule
* * Use this when you want to retrieve AND get rid of all rules that are dependent on a particular rule. * Usually you want to use this when a rule fails, and you would like to avoid executing * the rules that depend on this rule's success. *
func (*RuleSorter) PopNextAvailable ¶
func (r *RuleSorter) PopNextAvailable() *Rule
* * When you need to know which rule you should execute next, call this method. It will remove * the rule from the data structure and return it. * The algorithm is as follows:
1. Find a rule with no dependencies, in case of multiple such rules the first one is chosen 2. Find all the rules which depend on this rule, and remove it from it's dependency list 3. Remove the rule itself from the edge map 4. Return the rule *
type YamlDerivedKubernetesResource ¶
func AttachMetaData ¶
func AttachMetaData(data *bytes.Buffer, yamlFilePath string) []*YamlDerivedKubernetesResource
Source Files