Versions in this module Expand all Collapse all v0 v0.6.0 Nov 2, 2026 v0.5.0 Oct 28, 2026 v0.4.4 Oct 23, 2026 v0.4.3 Oct 19, 2026 v0.4.2 Oct 16, 2026 Changes in this version + const AccessReadWriteOnce + const ActionImagePull + const ActionImageRemove + const ActionPodDelete + const ActionRemove + const ActionRestart + const ActionStart + const ActionStop + const ActionWorkloadDelete + const ActionWorkloadRestart + const ActionWorkloadScale + const AgentNonceParam + const CapabilityContainerConfigure + const CapabilityContainerInspect + const CapabilityContainerInspectHealth + const CapabilityContainerInspectVerdict + const CapabilityDeploymentApply + const CapabilityDeploymentPull + const CapabilityDeploymentRemove + const CapabilityInventoryRefresh + const CapabilityKubernetesClaims + const CapabilityKubernetesDeploy + const CapabilityKubernetesInspect + const CapabilityKubernetesInventory + const CapabilityKubernetesManifestsRun + const CapabilityKubernetesRemove + const CapabilityKubernetesServiceIPs + const CapabilityKubernetesWorkloads + const CapabilityKubernetesWorkloadsRun + const CapabilityPodExec + const CapabilityPodLogs + const CloseDuplicate + const CloseIncompatible + const CloseKeyPending + const CloseKeyRetired + const CloseProtocol + const CloseRejected + const CloseRevoked + const CloseShutdown + const CloseTimeout + const CodeLegacy + const ConfigurationLifetime + const ContextAuth + const ContextEnroll + const ContextRotate + const ContextServer + const DeploymentLifetime + const DetailRetained + const ExecAbsoluteTimeout + const ExecGrantLifetime + const ExecIdleTimeout + const ExplicitProject + const ExplicitRevision + const HealthDegraded + const HealthHealthy + const HealthUnknown + const InspectionLifetime + const KindDeployment + const LogFollowBuffer + const MaxArgv + const MaxArgvEntryBytes + const MaxClaims + const MaxClockSkew + const MaxConfigurationFrameBytes + const MaxConfigurationLabelValueBytes + const MaxConfigurationNetworks + const MaxContainers + const MaxDeploymentEnvBytes + const MaxDeploymentEnvEntries + const MaxDeploymentEnvValueBytes + const MaxDeploymentPorts + const MaxDeploymentRequestBytes + const MaxDeploymentRequestBytesLegacy + const MaxDeploymentResultBytes + const MaxDeploymentResultSteps + const MaxDeploymentServices + const MaxDeploymentStepDetailBytes + const MaxDeploymentVolumes + const MaxExecArgs + const MaxExecArgumentBytes + const MaxExecChunkBytes + const MaxExecDimension + const MaxExecFrameBytes + const MaxExecStreamsPerEndpoint + const MaxImageRefBytes + const MaxImageReferenceBytes + const MaxImages + const MaxInspectionEntries + const MaxInspectionFrameBytes + const MaxInspectionsPerEndpoint + const MaxKubeImageBytes + const MaxKubeNameBytes + const MaxKubeObjectName + const MaxKubeShortBytes + const MaxKubernetesClaims + const MaxKubernetesMounts + const MaxLabelBytes + const MaxLabels + const MaxListEntries + const MaxListEntryBytes + const MaxLogBytes + const MaxLogChunkBytes + const MaxLogFrameBytes + const MaxLogLines + const MaxLogOptions + const MaxLogStreamsPerEndpoint + const MaxLogTail + const MaxMetricsBytes + const MaxMountPathBytes + const MaxMounts + const MaxNameBytes + const MaxNamespaces + const MaxNetworkAttachments + const MaxNetworks + const MaxNodeRoles + const MaxNodes + const MaxPodContainers + const MaxPods + const MaxQuantityBytes + const MaxRegistryAuthHosts + const MaxRegistryAuthSecretBytes + const MaxRemovalTargets + const MaxResourceVersionBytes + const MaxRestartCount + const MaxResultDetailBytes + const MaxSamples + const MaxServicePorts + const MaxServices + const MaxSnapshotBytes + const MaxStatusBytes + const MaxStorageClasses + const MaxUnsupported + const MaxVolumes + const MaxWorkloadApplyBytes + const MaxWorkloadConditions + const MaxWorkloadContainers + const MaxWorkloadEnv + const MaxWorkloadEnvFrom + const MaxWorkloadImages + const MaxWorkloadPods + const MaxWorkloadReplicas + const MaxWorkloadUnsupported + const MaxWorkloads + const MountBind + const MountOther + const MountTmpfs + const MountVolume + const OutcomeDenied + const OutcomeFailed + const OutcomeSkipped + const OutcomeSucceeded + const OutcomeTimedOut + const OutcomeUnknown + const ResultBusy + const ResultClockSkew + const ResultInvalidRequest + const ResultRestarted + const ResultStepFailed + const ResultUnreadable + const ResultWrongEndpoint + const RuntimeDocker + const RuntimeKubernetes + const StepApply + const StepCreate + const StepImage + const StepPrecondition + const StepPull + const StepRecheck + const StepRemove + const StepRename + const StepRollback + const StepRollout + const StepStart + const StepStop + const StepVolume + const TokenSize + const TypeApproved + const TypeAuth + const TypeChallenge + const TypeCommand + const TypeConfigurationCancel + const TypeConfigurationOpen + const TypeConfigurationResult + const TypeDeploymentApply + const TypeDeploymentRemove + const TypeDeploymentResult + const TypeError + const TypeExecCancel + const TypeExecClose + const TypeExecInput + const TypeExecOpen + const TypeExecOutput + const TypeExecReady + const TypeExecResize + const TypeHeartbeat + const TypeHello + const TypeInspectionCancel + const TypeInspectionOpen + const TypeInspectionResult + const TypeInventory + const TypeInventoryRefresh + const TypeLogCancel + const TypeLogChunk + const TypeLogClose + const TypeLogOpen + const TypeMetrics + const TypeResult + const TypeRotate + const TypeRotated + const TypeWorkloadApply + const Version + const WorkloadApplyService + const WorkloadDaemonSet + const WorkloadDeployment + const WorkloadPod + const WorkloadStatefulSet + var ConfigurationOnlyCodes = []string + var ErrClockSkew = errors.New("clock skew exceeds 5 minutes") + var ErrExecForbidden = errors.New("forbidden") + var ErrExecPodSecurity = errors.New("pod_security") + var ErrSnapshotShape = errors.New("the snapshot does not match the endpoint's runtime") + var HealthStates = map[string]bool + var UnsupportedCodes = []string + var WorkloadUnsupportedCodes = []string + func AdmitLongWait(ctx context.Context) bool + func AgentNonce(q url.Values) ([]byte, error) + func AuthPreimage(endpointID string, nonce []byte, serverHost string, version int) []byte + func CapabilitiesFit(runtime string, capabilities []string) bool + func ChallengePreimage(nonce, agentNonce []byte, serverHost, instanceFingerprint string) []byte + func CheckRuntimeShape(runtime string, s *Snapshot) error + func Clamp(s *Snapshot) + func CleanText(s string, max int) string + func ClusterHealth(active bool, s *Snapshot) string + func ExecRefusal(err error) string + func Fingerprint(publicKey []byte) string + func IsExecRefusal(reason string) bool + func IsImageAction(action string) bool + func KubernetesNames(project string, services []string) map[string]string + func NamespaceNetwork(name string) bool + func Preimage(context string, fields ...[]byte) []byte + func RawFingerprint(publicKey []byte) []byte + func RunDeployment(raw json.RawMessage, target WorkloadRef) (*appsv1.Deployment, error) + func Shrink(s *Snapshot) []byte + func SplitImageReference(s string) (name, tag string) + func StorageSizeBytes(s string) (int64, bool) + func UnmarshalHelloBounded(data []byte, h *Hello) error + func UnmarshalSnapshotBounded(data []byte, s *Snapshot) error + func ValidClusterIP(s string) bool + func ValidConfigurationEnvName(name string) bool + func ValidContainerHexID(s string) bool + func ValidContainerID(s string) bool + func ValidDNSLabel(s string) bool + func ValidDNSSubdomain(s string) bool + func ValidDeploymentID(id string) bool + func ValidExecID(id string) bool + func ValidImageReference(s string) bool + func ValidLabelValue(s string) bool + func ValidRequestID(id string) bool + func ValidServiceName(s string) bool + func ValidStorageClass(s string) bool + func VerifyAuth(publicKey []byte, endpointID string, nonce []byte, serverHost string, ...) bool + func VerifyEnrollment(publicKey, token, proof []byte) bool + func VerifyRotation(currentKey, currentRawFingerprint, newKey, signature []byte) bool + func WithLongWait(ctx context.Context, admit func() bool) context.Context + type Auth struct + EndpointID string + Fingerprint string + Signature []byte + Version int + type Challenge struct + InstanceFingerprint string + InstanceKey []byte + Nonce []byte + Signature []byte + Versions []int + func SignChallenge(instance ed25519.PrivateKey, nonce, agentNonce []byte, serverHost string) Challenge + func (c Challenge) Proven(agentNonce []byte, serverHost, pinned string) bool + type Claim struct + Capacity string + Name string + Namespace string + Phase string + StorageClass string + type Command struct + Action string + Capability string + Container string + Deadline time.Time + Endpoint string + Env string + Expects Expectation + ID string + Org string + Reference string + RequestID string + type ConfigurationCancel = InspectionCancel + type ConfigurationOpen = InspectionOpen + type ConfigurationResult struct + Request string + Result *ContainerConfiguration + Status string + Workload *WorkloadConfiguration + func (r ConfigurationResult) Validate() error + type Container struct + ComposeProject string + CreatedAt time.Time + Health string + ID string + Image string + ImageID string + Labels map[string]string + Mounts []Mount + MountsTruncated bool + Name string + NetworkAttachments []NetworkAttachment + Networks []string + Ports []Port + RestartPolicy string + StartedAt time.Time + State string + Status string + func (c *Container) UnmarshalJSON(data []byte) error + type ContainerConfiguration struct + CapAdd []string + CapDrop []string + Command []string + DNS []string + Devices []Device + Entrypoint []string + Env []EnvEntry + ExtraHosts []string + Healthcheck *Healthcheck + Hostname string + Image ImagePull + ImageID string + Init bool + Labels map[string]string + Log LogConfig + Mounts []Mount + Name string + NetworkMode string + Networks []NetworkAttachmentSpec + ObservedAt time.Time + Ports []Port + Privileged bool + ReadOnlyRootfs bool + Resources Resources + Restart string + RestartRetries int + SecurityOpt []string + StdinOpen bool + StopSignal string + StopTimeout *int + TTY bool + Target InspectionTarget + Unsupported []string + User string + WorkingDir string + func (c *ContainerConfiguration) Validate(target InspectionTarget, now time.Time) error + type ContainerInspection struct + AutoRemove bool + ConfigurationVerified bool + Health string + ImagePlatform ImagePlatform + Mounts MountCounts + NetworkCount int + NetworkMode string + ObservedAt time.Time + Ports []Port + Privileged bool + ReadOnlyRootFS bool + RestartCount int + RestartPolicy string + RestartRetries int + State string + Target InspectionTarget + Unsupported []string + Workload *WorkloadStatus + func (r ContainerInspection) Validate(target InspectionTarget, now time.Time, health bool) error + type DeploymentIdentity struct + ContainerID string + CreatedUnix int64 + Generation int64 + ImageDigest string + ImageID string + Kind string + Name string + Namespace string + Service string + UID string + type DeploymentRequest struct + Deadline time.Time + Deployment string + Endpoint string + Explicit bool + IssuedAt time.Time + Kubernetes *KubernetesTarget + Project string + Registries map[string]RegistryAuth + RequestID string + Revision int + Services []DeploymentService + Volumes []string + func (r DeploymentRequest) Validate(now time.Time) error + func (r DeploymentRequest) ValidateFor(runtime string, now time.Time) error + type DeploymentResult struct + Code string + Deployment string + Outcome string + RequestID string + Services []DeploymentIdentity + Steps []DeploymentStep + func (r DeploymentResult) Validate() error + type DeploymentService struct + ClusterIP string + ContainerName string + Env map[string]string + Explicit *ExplicitService + ImageID string + Mounts []Mount + Name string + Ports []Port + Pull *ImagePull + Replaces InspectionTarget + Restart string + SecretKeys []string + Volumes []KubernetesMount + type DeploymentStep struct + Code string + Detail string + Outcome string + Service string + Step string + type Device struct + Container string + Host string + Permissions string + type Engine struct + APIVersion string + Arch string + CPUs int + Hostname string + Kernel string + MemoryBytes int64 + OS string + Runtime string + Version string + type EnvEntry struct + Name string + Value string + type Envelope struct + Deadline *time.Time + Endpoint string + Env string + ID string + Org string + Payload json.RawMessage + RequestID string + Type string + V int + type ExecClose struct + ExitCode *int + Reason string + Stream string + type ExecData struct + Data []byte + Stream string + type ExecOpen struct + Actor string + Connection []byte + Endpoint string + Expires time.Time + Size TerminalSize + Spec ExecSpec + Stream string + func (r ExecOpen) Validate(now time.Time) error + type ExecResize struct + Size TerminalSize + Stream string + type ExecSpec struct + Argv []string + Container string + ImageID string + Pod *PodTarget + User string + func (s ExecSpec) Validate() error + func (s ExecSpec) ValidateFor(runtime string) error + type ExecStatus struct + ExitCode *int + Running bool + type ExecStream struct + Stream string + type Expectation struct + ImageDigest string + Replicas *int32 + State string + type ExplicitService struct + AcknowledgedBinds []string + CapAdd []string + CapDrop []string + Command []string + DNS []string + Devices []Device + Entrypoint []string + ExtraHosts []string + Healthcheck *Healthcheck + Hostname string + Init bool + Labels map[string]string + Log LogConfig + NetworkMode string + Networks []NetworkAttachmentSpec + Privileged bool + ReadOnlyRootfs bool + Resources Resources + RestartRetries int + SecurityOpt []string + StdinOpen bool + StopSignal string + StopTimeout *int + TTY bool + User string + WorkingDir string + type FieldError struct + Field string + Message string + func (e *FieldError) Error() string + type Healthcheck struct + IntervalSeconds float64 + Retries int + StartPeriodSeconds float64 + Test []string + TimeoutSeconds float64 + type Hello struct + AgentVersion string + Capabilities []string + HeartbeatSeconds int + State string + type Image struct + CreatedAt time.Time + Digests []string + ID string + SizeBytes int64 + Tags []string + type ImagePlatform struct + Architecture string + OS string + Variant string + type ImagePull struct + Digest string + Reference string + Tag string + func (p ImagePull) Host() string + type InspectionCancel struct + Request string + type InspectionOpen struct + Actor string + Connection []byte + Endpoint string + Expires time.Time + Request string + Target InspectionTarget + func (r InspectionOpen) ValidateFor(now time.Time, runtime string) error + func (r InspectionOpen) ValidateWithin(now time.Time, lifetime time.Duration, runtime string) error + type InspectionResult struct + Request string + Result *ContainerInspection + Status string + type InspectionTarget struct + ContainerID string + CreatedUnix int64 + ImageID string + Workload WorkloadRef + func (t InspectionTarget) Validate() error + func (t InspectionTarget) ValidateFor(runtime string) error + type KubernetesClaim struct + AccessMode string + Name string + Size string + StorageClass string + type KubernetesInventory struct + Claims []Claim + Namespaces []string + Nodes []Node + Pods []Pod + Services []Service + StorageClasses []StorageClass + Workloads []Workload + type KubernetesMount struct + Claim string + MountPath string + ReadOnly bool + type KubernetesTarget struct + ApplicationID string + Claims []KubernetesClaim + InstanceID string + Namespace string + SpecDigest string + func (k KubernetesTarget) Validate() error + type LogCancel struct + Stream string + type LogChunk struct + Data string + Dropped int64 + Stream string + type LogClose struct + Failed bool + Reason string + Stream string + type LogConfig struct + Driver string + Options map[string]string + type LogRequest struct + Container string + Follow bool + Pod *PodTarget + Since time.Time + Stream string + Tail int + Timestamps bool + func (r LogRequest) ValidateFor(runtime string) error + type Metrics struct + ObservedAt time.Time + Samples []Sample + func ShrinkMetrics(m Metrics) Metrics + type Mount struct + Kind string + ReadOnly bool + Source string + Target string + type MountCounts struct + Bind int + Other int + ReadOnly int + Tmpfs int + Volume int + type Network struct + Driver string + ID string + Name string + Scope string + type NetworkAttachment struct + IP string + IP6 string + Name string + type NetworkAttachmentSpec struct + Aliases []string + IP string + Name string + type Node struct + Arch string + KubeletVersion string + Name string + OS string + Ready bool + Roles []string + Unschedulable bool + type Pod struct + Containers []PodContainer + Name string + Namespace string + Node string + OwnerKind string + OwnerName string + Phase string + StartedAt time.Time + UID string + func (p *Pod) UnmarshalJSON(data []byte) error + type PodContainer struct + Image string + ImageID string + Name string + Ready bool + Reason string + RestartCount int32 + State string + type PodStatus struct + Containers []PodContainer + Name string + Phase string + UID string + type PodTarget struct + Container string + Name string + Namespace string + UID string + func (p PodTarget) Validate() error + type Port struct + Container int + Host int + HostIP string + Protocol string + type RegistryAuth struct + Secret string + Username string + type RemovalRequest struct + Containers []RemovalTarget + Deadline time.Time + Deployment string + Endpoint string + IssuedAt time.Time + Kubernetes *KubernetesTarget + Project string + RequestID string + Services []string + func (r RemovalRequest) Validate(now time.Time) error + func (r RemovalRequest) ValidateFor(runtime string, now time.Time) error + type RemovalTarget struct + Service string + Target InspectionTarget + type Resources struct + MemoryBytes int64 + MemorySwapBytes int64 + NanoCPUs int64 + PidsLimit int64 + type Result struct + Detail string + ID string + Outcome string + type Rotate struct + PublicKey []byte + Signature []byte + type Rotated struct + Code string + Fingerprint string + type Sample struct + CPUPercent float64 + ContainerID string + MemoryBytes int64 + MemoryLimit int64 + Pids int64 + RestartCount int64 + RxBytes int64 + TxBytes int64 + type Service struct + ClusterIP string + Instance string + Name string + Namespace string + Ports []string + Service string + Type string + type Snapshot struct + Containers []Container + Engine Engine + Generation uint64 + Images []Image + Kubernetes *KubernetesInventory + Networks []Network + ObservedAt time.Time + Truncated []string + Volumes []Volume + type StorageClass struct + Default bool + Name string + type TerminalSize struct + Columns int + Rows int + func (s TerminalSize) Validate() error + type Volume struct + CreatedAt time.Time + Driver string + Mountpoint string + Name string + Plain bool + type Workload struct + Application string + Desired int32 + Images []string + Instance string + Kind string + Name string + Namespace string + Paused bool + Ready int32 + Updated int32 + type WorkloadApply struct + Create bool + Deadline time.Time + Endpoint string + IssuedAt time.Time + Request string + ResourceVersion string + Spec WorkloadConfiguration + Target WorkloadRef + func (a WorkloadApply) Validate(now time.Time) error + type WorkloadCondition struct + Reason string + Status string + Type string + type WorkloadConfiguration struct + Containers []WorkloadContainer + EnvFrom []string + InitContainers []WorkloadContainer + Managed bool + ObservedAt time.Time + Paused bool + Replicas *int32 + ResourceVersion string + RunManifest json.RawMessage + Strategy string + Target WorkloadRef + Unsupported []string + func (c *WorkloadConfiguration) Validate(target WorkloadRef, now time.Time) error + type WorkloadContainer struct + Args []string + Command []string + Env []WorkloadEnv + Image string + ImageID string + Name string + Resources WorkloadResources + type WorkloadEnv struct + ConfigMapRef string + Name string + SecretRef string + Value string + type WorkloadRef struct + Kind string + Name string + Namespace string + UID string + func ParseWorkloadRef(reference string) (WorkloadRef, error) + func (r WorkloadRef) String() string + type WorkloadResources struct + CPULimit string + CPURequest string + MemoryLimit string + MemoryRequest string + type WorkloadStatus struct + Available int32 + Conditions []WorkloadCondition + Desired int32 + Generation int64 + Missing bool + ObservedGeneration int64 + Pods []PodStatus + Ready int32 + UID string + Updated int32
Go to main page