kubernetes: k8s.io/kubernetes/pkg/security/apparmor Index | Files

package apparmor

import "k8s.io/kubernetes/pkg/security/apparmor"

Index

Package Files

helpers.go validate.go

Constants

const (
    // The prefix to an annotation key specifying a container profile.
    ContainerAnnotationKeyPrefix = "container.apparmor.security.beta.kubernetes.io/"
    // The annotation key specifying the default AppArmor profile.
    DefaultProfileAnnotationKey = "apparmor.security.beta.kubernetes.io/defaultProfileName"
    // The annotation key specifying the allowed AppArmor profiles.
    AllowedProfilesAnnotationKey = "apparmor.security.beta.kubernetes.io/allowedProfileNames"

    // The profile specifying the runtime default.
    ProfileRuntimeDefault = "runtime/default"
    // The prefix for specifying profiles loaded on the node.
    ProfileNamePrefix = "localhost/"

    // Unconfined profile
    ProfileNameUnconfined = "unconfined"
)

TODO: Move these values into the API package.

func GetProfileName Uses

func GetProfileName(pod *v1.Pod, containerName string) string

Returns the name of the profile to use with the container.

func GetProfileNameFromPodAnnotations Uses

func GetProfileNameFromPodAnnotations(annotations map[string]string, containerName string) string

GetProfileNameFromPodAnnotations gets the name of the profile to use with container from pod annotations

func IsAppArmorEnabled Uses

func IsAppArmorEnabled() bool

IsAppArmorEnabled returns true if apparmor is enabled for the host. This function is forked from https://github.com/opencontainers/runc/blob/1a81e9ab1f138c091fe5c86d0883f87716088527/libcontainer/apparmor/apparmor.go to avoid the libapparmor dependency.

func SetProfileName Uses

func SetProfileName(pod *v1.Pod, containerName, profileName string) error

Sets the name of the profile to use with the container.

func SetProfileNameFromPodAnnotations Uses

func SetProfileNameFromPodAnnotations(annotations map[string]string, containerName, profileName string) error

Sets the name of the profile to use with the container.

func ValidateProfileFormat Uses

func ValidateProfileFormat(profile string) error

type Validator Uses

type Validator interface {
    Validate(pod *v1.Pod) error
    ValidateHost() error
}

Interface for validating that a pod with an AppArmor profile can be run by a Node.

func NewValidator Uses

func NewValidator(runtime string) Validator

Package apparmor imports 13 packages (graph) and is imported by 180 packages. Updated 2019-07-11. Refresh now. Tools for package owners.