kubernetes: k8s.io/kubernetes/pkg/security/apparmor Index | Files

package apparmor

import "k8s.io/kubernetes/pkg/security/apparmor"

Index

Package Files

helpers.go validate.go

Constants

❖
const (
    // The prefix to an annotation key specifying a container profile.
    ContainerAnnotationKeyPrefix = "container.apparmor.security.beta.kubernetes.io/"
    // The annotation key specifying the default AppArmor profile.
    DefaultProfileAnnotationKey = "apparmor.security.beta.kubernetes.io/defaultProfileName"
    // The annotation key specifying the allowed AppArmor profiles.
    AllowedProfilesAnnotationKey = "apparmor.security.beta.kubernetes.io/allowedProfileNames"

    // The profile specifying the runtime default.
    ProfileRuntimeDefault = "runtime/default"
    // The prefix for specifying profiles loaded on the node.
    ProfileNamePrefix = "localhost/"

    // Unconfined profile
    ProfileNameUnconfined = "unconfined"
)

TODO: Move these values into the API package.

func GetProfileName Uses

❖
func GetProfileName(pod *v1.Pod, containerName string) string

Returns the name of the profile to use with the container.

func GetProfileNameFromPodAnnotations Uses

❖
func GetProfileNameFromPodAnnotations(annotations map[string]string, containerName string) string

GetProfileNameFromPodAnnotations gets the name of the profile to use with container from pod annotations

func IsAppArmorEnabled Uses

❖
func IsAppArmorEnabled() bool

IsAppArmorEnabled returns true if apparmor is enabled for the host. This function is forked from https://github.com/opencontainers/runc/blob/1a81e9ab1f138c091fe5c86d0883f87716088527/libcontainer/apparmor/apparmor.go to avoid the libapparmor dependency.

func SetProfileName Uses

❖
func SetProfileName(pod *v1.Pod, containerName, profileName string) error

Sets the name of the profile to use with the container.

func SetProfileNameFromPodAnnotations Uses

❖
func SetProfileNameFromPodAnnotations(annotations map[string]string, containerName, profileName string) error

Sets the name of the profile to use with the container.

func ValidateProfileFormat Uses

❖
func ValidateProfileFormat(profile string) error

type Validator Uses

❖
type Validator interface {
    Validate(pod *v1.Pod) error
    ValidateHost() error
}

Interface for validating that a pod with an AppArmor profile can be run by a Node.

func NewValidator Uses

❖
func NewValidator(runtime string) Validator

Package apparmor imports 13 packages (graph) and is imported by 180 packages. Updated 2019-07-11. Refresh now. Tools for package owners.