kubernetes

package

Go to main page

Versions in this module

v0

v0.0.7

Oct 27, 2026

Changes in this version

type BrokerSource

+ Records secretbroker.ExecutorRecords

type Executor

+ func (e *Executor) IsolationRuntime() (string, bool)

+ func (e *Executor) ProbeIsolation(ctx context.Context) (executor.IsolationProbe, error)

v0.0.6

Oct 16, 2026

Changes in this version

+ const EnvWorkspaceHost

v0.0.5

Oct 12, 2026

Changes in this version

+ const DefaultGitCABundleKey

+ const LabelRunID

+ const PodGitCADir

+ const PodGitCAFile

type EgressFilter

+ DenyCIDRs []string

+ func (f EgressFilter) MetadataFindings() []cloudmeta.Finding

+ func (f EgressFilter) OwnRules() *executor.FirewallRules

type Executor

+ func (e *Executor) AddHandleRedactions(handleID string, values ...string) bool

+ func (e *Executor) EgressPosture() executor.EgressPosture

+ func (e *Executor) ProjectResult(handleID string) (executor.ProjectResult, error)

+ func (e *Executor) ReapRun(ctx context.Context, runID string) ([]string, error)

+ func (e *Executor) RefreshSecretFiles(ctx context.Context, req executor.SecretRefreshRequest) executor.SecretRefreshReport

+ type GitCABundle struct

+ ConfigMap string

+ Key string

+ URLs []string

+ func (b GitCABundle) Enabled() bool

+ func (b GitCABundle) Normalize() (GitCABundle, error)

type Options

+ GitCABundle GitCABundle

v0.0.4

Sep 27, 2026

v0.0.3

Sep 27, 2026

v0.0.2

Sep 17, 2026

Changes in this version

+ const CurrentProbeVersion

+ const DefaultVerdictMaxAge

+ var ErrProbeInconclusive = errors.New("kubernetes: network policy probe inconclusive")

+ func ProbeCommand(executorID string) string

type EgressFilter

+ AllowAllPorts bool

+ type EnforcementStatus string

+ const EnforcementAsserted

+ const EnforcementDenied

+ const EnforcementProven

+ const EnforcementRefuted

+ const EnforcementUnverified

+ func (s EnforcementStatus) Enforced() bool

type Executor

+ func (e *Executor) Attach(ctx context.Context, req executor.AttachRequest) (executor.AttachConn, error)

+ func (e *Executor) EnforcementState() (EnforcementStatus, string, ProbeVerdict)

+ func (e *Executor) EnforcementStatus() EnforcementStatus

+ func (e *Executor) ExplainEgressScopeRefusal() string

+ func (e *Executor) KernelIsolated() bool

+ func (e *Executor) ProbeNetworkPolicyEnforcement(ctx context.Context, opts ProbeOptions) (ProbeVerdict, error)

+ func (e *Executor) RecordNetworkPolicyVerdict(v ProbeVerdict)

+ type NetworkPolicyEnforcement struct

+ Assertion *bool

+ MaxVerdictAge time.Duration

+ Verdict ProbeVerdict

+ func (n NetworkPolicyEnforcement) Resolve(executorID string, now time.Time) (EnforcementStatus, string)

+ func (n NetworkPolicyEnforcement) Status(executorID string, now time.Time) EnforcementStatus

type Options

+ NetworkPolicyEnforcement NetworkPolicyEnforcement

+ type ProbeOptions struct

+ Image string

+ Logf func(format string, args ...any)

+ Timeout time.Duration

+ type ProbeVerdict struct

+ Detail string

+ Enforced bool

+ ExecutorID string

+ Namespace string

+ ObservedAt time.Time

+ ProbeVersion int

+ func (v ProbeVerdict) Age(now time.Time) time.Duration

+ func (v ProbeVerdict) Recorded() bool

+ func (v ProbeVerdict) Stale(now time.Time, maxAge time.Duration) bool

type RESTConfig

+ func (rc *RESTConfig) Transport(responseHeaderTimeout time.Duration) (*http.Transport, error)

v0.0.1

Sep 13, 2026

Changes in this version

+ const AnnotationArgv

+ const AnnotationEgressMode

+ const AnnotationEgressWarnings

+ const AnnotationProjectPath

+ const AnnotationSandboxHash

+ const ContainerName

+ const DefaultID

+ const DefaultImage

+ const DefaultKillGracePeriod

+ const DefaultNamespace

+ const DefaultOrphanGracePeriod

+ const DefaultRunAsGroup

+ const DefaultRunAsUser

+ const DefaultServiceAccountDir

+ const DefaultTerminationGracePeriod

+ const EnvWorkspaceToken

+ const EnvWorkspaceUser

+ const InitContainerName

+ const LabelEgress

+ const LabelExecutorID

+ const LabelHandleID

+ const LabelManaged

+ const LabelProject

+ const LabelTaskID

+ const LevelFail

+ const LevelOK

+ const LevelWarn

+ const PodWorkspace

+ var ErrNoKubeconfigGrant = errors.New("kubernetes: no kubeconfig grant is available for this executor")

+ var ErrNotInCluster = errors.New(...)

+ func AuditCapabilities(opts Options) (executor.Capabilities, error)

+ func AuditPodImage(ctx context.Context, opts Options, spec executor.Spec) (string, error)

+ func AuditPodJSON(ctx context.Context, opts Options, spec executor.Spec, workspaceSecret string) ([]byte, error)

+ func ImageWarnings(ref string) []string

+ func ValidateImageRef(ref string) error

+ func ValidateNamespace(ns string) error

+ func ValidateQuantity(q string) error

+ func ValidateRuntimeClass(name string) error

+ type APIError struct

+ Code int

+ Message string

+ Path string

+ Reason string

+ Verb string

+ func (e *APIError) Error() string

+ func (e *APIError) Expired() bool

+ func (e *APIError) NotFound() bool

+ func (e *APIError) Retryable() bool

+ type BrokerSource struct

+ Actor string

+ Broker *secretbroker.Broker

+ Context string

+ ExecutorID string

+ SecretRef string

+ func NewBrokerSource(b *secretbroker.Broker, executorID, secretRef, kubeContext string) (*BrokerSource, error)

+ func (s *BrokerSource) Acquire(ctx context.Context, projectID string) (*Credentials, error)

+ func (s *BrokerSource) Describe() string

+ func (s *BrokerSource) Release(leaseID string)

+ func (s *BrokerSource) Renew(ctx context.Context, leaseID string) (*Credentials, error)

+ type CredentialSource interface

+ Acquire func(ctx context.Context, projectID string) (*Credentials, error)

+ Describe func() string

+ Release func(leaseID string)

+ Renew func(ctx context.Context, leaseID string) (*Credentials, error)

+ type Credentials struct

+ ExpiresAt time.Time

+ LeaseID string

+ Namespace string

+ Rest *RESTConfig

+ SecretName string

+ Summary string

+ type EgressFilter struct

+ AllowClusterDNS *bool

+ AllowPublicInternet bool

+ CIDRs []string

+ Enabled bool

+ Ports []int

+ Resolvers []string

+ func (f EgressFilter) AllowsEgress() bool

+ func (f EgressFilter) ClusterDNSAllowed() bool

+ func (f EgressFilter) Compile() (netfilter.Policy, error)

+ func (f EgressFilter) Describe() string

+ func (f EgressFilter) Input() (netfilter.Input, error)

+ func (f EgressFilter) Normalize() (EgressFilter, error)

+ type Executor struct

+ func Ensure(reg *executor.Registry, opts Options) (*Executor, error)

+ func New(opts Options) (*Executor, error)

+ func (e *Executor) AttachHandleStore(store executor.HandleStore)

+ func (e *Executor) Capabilities() executor.Capabilities

+ func (e *Executor) Close()

+ func (e *Executor) HandleStatuses(ctx context.Context) ([]executor.Status, error)

+ func (e *Executor) Handles() []string

+ func (e *Executor) HealthCheck(ctx context.Context) error

+ func (e *Executor) HoldsLease(leaseID string) bool

+ func (e *Executor) ID() string

+ func (e *Executor) Image() string

+ func (e *Executor) Kind() string

+ func (e *Executor) Leases() []string

+ func (e *Executor) Namespace() string

+ func (e *Executor) Preflight(ctx context.Context) PreflightReport

+ func (e *Executor) ReconcileOrphans(ctx context.Context) ([]string, error)

+ func (e *Executor) Revocations() []executor.RevokeOutcome

+ func (e *Executor) RevokeLease(ctx context.Context, req executor.RevokeRequest) executor.RevokeOutcome

+ func (e *Executor) RuntimeClass() string

+ func (e *Executor) ServerVersion(ctx context.Context) (string, error)

+ func (e *Executor) Signal(ctx context.Context, handleID string, sig executor.Signal) error

+ func (e *Executor) Start(ctx context.Context, spec executor.Spec) (executor.Handle, error)

+ func (e *Executor) Status(ctx context.Context, handleID string) (executor.Status, error)

+ func (e *Executor) Stream(ctx context.Context, handleID string) (<-chan executor.LogLine, error)

+ func (e *Executor) SupportsRevocation() bool

+ func (e *Executor) Virtualized() bool

+ type Finding struct

+ Fix string

+ Level string

+ Message string

+ Name string

+ type InClusterSource struct

+ Dir string

+ Host string

+ Namespace string

+ Port string

+ func NewInClusterSource(namespaceOverride string) (*InClusterSource, error)

+ func (s *InClusterSource) Acquire(ctx context.Context, projectID string) (*Credentials, error)

+ func (s *InClusterSource) Describe() string

+ func (s *InClusterSource) Release(string)

+ func (s *InClusterSource) Renew(ctx context.Context, leaseID string) (*Credentials, error)

+ type Options struct

+ ActiveDeadlineSeconds int64

+ CPULimit string

+ CPURequest string

+ Credentials CredentialSource

+ EgressFilter EgressFilter

+ EphemeralStorageLimit string

+ HandleStore executor.HandleStore

+ ID string

+ Image string

+ ImagePolicy imagepolicy.Policy

+ ImagePullPolicy string

+ ImagePullSecrets []string

+ KeepCompletedPods bool

+ KillGracePeriod time.Duration

+ MaxConcurrent int

+ MemoryLimit string

+ MemoryRequest string

+ Namespace string

+ NodeSelector map[string]string

+ OrphanGracePeriod time.Duration

+ RunAsGroup int64

+ RunAsUser int64

+ RuntimeClass string

+ ServiceAccountName string

+ TerminationGracePeriod time.Duration

+ Tolerations []Toleration

+ Workspace executor.WorkspaceCredentialSource

+ WorkspaceSizeLimit string

+ func (o Options) Normalize() (Options, error)

+ type PreflightReport struct

+ ExecutorID string

+ Findings []Finding

+ Image string

+ Namespace string

+ Server string

+ func (r PreflightReport) Err() error

+ func (r PreflightReport) OK() bool

+ type RESTConfig struct

+ BearerToken string

+ CAData []byte

+ ClientCertData []byte

+ ClientKeyData []byte

+ Context string

+ Insecure bool

+ Namespace string

+ ProxyURL string

+ Server string

+ ServerName string

+ func ParseKubeconfig(raw []byte, contextName string) (*RESTConfig, error)

+ func (rc *RESTConfig) Describe() string

+ type Toleration struct

+ Effect string

+ Key string

+ Operator string

+ Seconds int64

+ Value string

+ func (t Toleration) Validate() error

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL