sysctl

func ConvertPodSysctlsVariableToDotsSeparator ¶ added in v1.23.0

func ConvertPodSysctlsVariableToDotsSeparator(securityContext *v1.PodSecurityContext)

ConvertPodSysctlsVariableToDotsSeparator converts sysctls variable in the Pod.Spec.SecurityContext.Sysctls slice into a dot as a separator according to the linux sysctl conversion rules. see https://man7.org/linux/man-pages/man5/sysctl.d.5.html for more details.

func NewAllowlist ¶ added in v1.23.0

func NewAllowlist(patterns []string) (*patternAllowlist, error)

NewAllowlist creates a new Allowlist from a list of sysctls and sysctl pattern (ending in *).

func SafeSysctlAllowlist ¶ added in v1.25.0

func SafeSysctlAllowlist() []string

SafeSysctlAllowlist returns the allowlist of safe sysctls and safe sysctl patterns (ending in *).

A sysctl is called safe iff - it is namespaced in the container or the pod - it is isolated, i.e. has no influence on any other pod on the same node.