validators

type AllowedHostPath ¶ added in v0.2.0

type AllowedHostPath struct {
	PathPrefix string `json:"pathPrefix"`
}

type DenyHostNamespace ¶

type DenyHostNamespace struct{}

DenyHostNamespace is a Validator that denies sharing the host namespaces

func (v DenyHostNamespace) Validate(ctx context.Context, pod *corev1.Pod) field.ErrorList

type DenyHostPathVolumes ¶

type DenyHostPathVolumes struct {
	// contains filtered or unexported fields
}

DenyHostPathVolumes is a Validator that denies usage of HostPath volumes

func NewDenyHostPaths(hostPaths []AllowedHostPath) DenyHostPathVolumes

func (v DenyHostPathVolumes) Validate(ctx context.Context, pod *corev1.Pod) field.ErrorList

type DenyHostPorts ¶

type DenyHostPorts struct {
	// contains filtered or unexported fields
}

DenyHostPorts is a Validator that denies usage of HostPorts

func NewDenyHostPorts(hostPorts []PortRange) DenyHostPorts

func (v DenyHostPorts) Validate(ctx context.Context, pod *corev1.Pod) field.ErrorList

type DenyNonCoreVolumeTypes ¶

type DenyNonCoreVolumeTypes struct{}

DenyNonCoreVolumeTypes is a Validator that denies usage of non-core volume types

func (v DenyNonCoreVolumeTypes) Validate(ctx context.Context, pod *corev1.Pod) field.ErrorList

type DenyPrivilegeEscalation ¶

type DenyPrivilegeEscalation struct{}

DenyPrivilegeEscalation is a Validator that denies privilege escalation

func (v DenyPrivilegeEscalation) Validate(ctx context.Context, pod *corev1.Pod) field.ErrorList

type DenyPrivilegedContainers ¶

type DenyPrivilegedContainers struct{}

DenyPrivilegedContainers is a Validator that denies privileged containers

func (v DenyPrivilegedContainers) Validate(ctx context.Context, pod *corev1.Pod) field.ErrorList

type DenyRootGroups ¶

type DenyRootGroups struct{}

DenyRootGroups is a Validator that denies running with a root primary or supplementary GID

func (v DenyRootGroups) Validate(ctx context.Context, pod *corev1.Pod) field.ErrorList

type DenyRunAsRoot ¶

type DenyRunAsRoot struct{}

DenyRunAsRoot is a Validator that denies running as root users

func (v DenyRunAsRoot) Validate(ctx context.Context, pod *corev1.Pod) field.ErrorList

type DenyUnsafeAppArmor ¶

type DenyUnsafeAppArmor struct{}

DenyUnsafeAppArmor is a Validator that denies overriding or disabling the default AppArmor profile

func (v DenyUnsafeAppArmor) Validate(ctx context.Context, pod *corev1.Pod) field.ErrorList

type DenyUnsafeCapabilities ¶

type DenyUnsafeCapabilities struct {
	// contains filtered or unexported fields
}

DenyUnsafeCapabilities is a Validator that denies adding capabilities beyond the default set

func NewDenyUnsafeCapabilities(capabilities []string) DenyUnsafeCapabilities

func (v DenyUnsafeCapabilities) Validate(ctx context.Context, pod *corev1.Pod) field.ErrorList

type DenyUnsafeProcMount ¶

type DenyUnsafeProcMount struct{}

DenyUnsafeProcMount is a Validator that denies unmasked proc mount

func (v DenyUnsafeProcMount) Validate(ctx context.Context, pod *corev1.Pod) field.ErrorList

type DenyUnsafeSELinux ¶

type DenyUnsafeSELinux struct{}

DenyUnsafeSELinux is a Validator that denies setting custom SELinux options

func (v DenyUnsafeSELinux) Validate(ctx context.Context, pod *corev1.Pod) field.ErrorList

type DenyUnsafeSeccomp ¶

type DenyUnsafeSeccomp struct{}

DenyUnsafeSeccomp is a Validator that denies usage of non-default Seccomp profile

func (v DenyUnsafeSeccomp) Validate(ctx context.Context, pod *corev1.Pod) field.ErrorList

type DenyUnsafeSysctls ¶

type DenyUnsafeSysctls struct{}

DenyUnsafeSysctls is a Validator that denies usage of unsafe sysctls

func (v DenyUnsafeSysctls) Validate(ctx context.Context, pod *corev1.Pod) field.ErrorList

type PortRange ¶

type PortRange struct {
	Min int32 `json:"min"`
	Max int32 `json:"max"`
}

type Validator ¶

type Validator interface {
	Validate(ctx context.Context, pod *corev1.Pod) field.ErrorList
}

Validator is an interface for validator