rules

package
v0.2.1 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 26, 2026 License: Apache-2.0 Imports: 18 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	LivenessRuleName  = "liveness-probe"
	ReadinessRuleName = "readiness-probe"
)
View Source 
const (
	APIVersionRuleName = "object-api-version"
)
View Source 
const (
	CheckReadOnlyRootFilesystemRuleName = "read-only-root-filesystem"
)
View Source 
const (
	ContainerImageNameRuleName = "container-image-name"
)
View Source 
const (
	ContainerSecurityContextRuleName = "security-context"
)
View Source 
const (
	ControllerSecurityContextRuleName = "controller-security-context"
)
View Source 
const (
	DNSPolicyRuleName = "dns-policy"
)
View Source 
const (
	EnvVariablesDuplicatesRuleName = "env-variables-duplicates"
)
View Source 
const (
	HostNetworkPortsRuleName = "host-network-ports"
)
View Source 
const (
	ImageDigestRuleName = "image-digest"
)
View Source 
const (
	ImagePullPolicyRuleName = "image-pull-policy"
)
View Source 
const (
	MountPointsRuleName = "mount-points"
)
View Source 
const (
	NameDuplicatesRuleName = "name-duplicates"
)
View Source 
const (
	NamespaceLabelsRuleName = "object-namespace-labels"
)
View Source 
const (
	NoNewPrivilegesRuleName = "no-new-privileges"
)
View Source 
const (
	PortsRuleName = "ports"
)
View Source 
const (
	PriorityClassRuleName = "object-priority-class"
)
View Source 
const (
	RecommendedLabelsRuleName = "object-recommended-labels"
)
View Source 
const (
	ResourcesRuleName = "resources"
)
View Source 
const (
	RevisionHistoryLimitRuleName = "object-revision-history-limit"
)
View Source 
const (
	SeccompProfileRuleName = "seccomp-profile"
)
View Source 
const (
	SysCgroupMountRuleName = "sys-cgroup-mount"
)

Variables

This section is empty.

Functions

func FindObjectRawImages added in v0.1.80 

func FindObjectRawImages(path string) ([]string, error)

FindObjectRawImages finds all strings that match the imageRawRegex pattern in the given file. The returned strings are the last quoted arguments of helm_lib_module_image on a line, supporting both: 

image: {{ include "helm_lib_module_image" . "imageName" }}
image: {{ include "helm_lib_module_image" (list . "imageName") }}

Types

type APIVersionRule 

type APIVersionRule struct {
	pkg.RuleMeta
	// contains filtered or unexported fields
}

func NewAPIVersionRule 

func NewAPIVersionRule(m pkg.Module, errorList *errors.LintRuleErrorsList) *APIVersionRule

func (*APIVersionRule) Check added in v0.2.0 

func (r *APIVersionRule) Check(_ context.Context)

type CheckReadOnlyRootFilesystemRule 

type CheckReadOnlyRootFilesystemRule struct {
	pkg.RuleMeta
	pkg.ContainerRule
	// contains filtered or unexported fields
}

func NewCheckReadOnlyRootFilesystemRule 

func NewCheckReadOnlyRootFilesystemRule(excludeRules []pkg.ContainerRuleExclude,
	objects []ObjectContainers, errorList *errors.LintRuleErrorsList) *CheckReadOnlyRootFilesystemRule

func (*CheckReadOnlyRootFilesystemRule) Check added in v0.2.0 

func (r *CheckReadOnlyRootFilesystemRule) Check(_ context.Context)

type ContainerImageNameRule added in v0.1.80 

type ContainerImageNameRule struct {
	pkg.RuleMeta
	pkg.ContainerRule
	// contains filtered or unexported fields
}

func NewContainerImageNameRule added in v0.1.80 

func NewContainerImageNameRule(excludeRules []pkg.ContainerRuleExclude,
	objects []ObjectContainers, errorList *errors.LintRuleErrorsList) *ContainerImageNameRule

func (*ContainerImageNameRule) Check added in v0.2.0 

func (r *ContainerImageNameRule) Check(_ context.Context)

func (*ContainerImageNameRule) Enabled added in v0.1.80 

func (r *ContainerImageNameRule) Enabled(object storage.StoreObject, container *corev1.Container) bool

type ContainerSecurityContextRule 

type ContainerSecurityContextRule struct {
	pkg.RuleMeta
	pkg.ContainerRule
	// contains filtered or unexported fields
}

func NewContainerSecurityContextRule 

func NewContainerSecurityContextRule(excludeRules []pkg.ContainerRuleExclude,
	objects []ObjectContainers, errorList *errors.LintRuleErrorsList) *ContainerSecurityContextRule

func (*ContainerSecurityContextRule) Check added in v0.2.0 

func (r *ContainerSecurityContextRule) Check(_ context.Context)

type ControllerSecurityContextRule 

type ControllerSecurityContextRule struct {
	pkg.RuleMeta
	pkg.KindRule
	// contains filtered or unexported fields
}

func NewControllerSecurityContextRule 

func NewControllerSecurityContextRule(excludeRules []pkg.KindRuleExclude,
	m pkg.Module, errorList *errors.LintRuleErrorsList) *ControllerSecurityContextRule

func (*ControllerSecurityContextRule) Check added in v0.2.0 

func (r *ControllerSecurityContextRule) Check(_ context.Context)

type DNSPolicyRule 

type DNSPolicyRule struct {
	pkg.RuleMeta
	pkg.KindRule
	// contains filtered or unexported fields
}

func NewDNSPolicyRule 

func NewDNSPolicyRule(excludeRules []pkg.KindRuleExclude,
	m pkg.Module, errorList *errors.LintRuleErrorsList) *DNSPolicyRule

func (*DNSPolicyRule) Check added in v0.2.0 

func (r *DNSPolicyRule) Check(_ context.Context)

type EnvVariablesDuplicatesRule 

type EnvVariablesDuplicatesRule struct {
	pkg.RuleMeta
	// contains filtered or unexported fields
}

func NewEnvVariablesDuplicatesRule 

func NewEnvVariablesDuplicatesRule(objects []ObjectContainers, errorList *errors.LintRuleErrorsList) *EnvVariablesDuplicatesRule

func (*EnvVariablesDuplicatesRule) Check added in v0.2.0 

func (r *EnvVariablesDuplicatesRule) Check(_ context.Context)

type HostNetworkPortsRule 

type HostNetworkPortsRule struct {
	pkg.RuleMeta
	pkg.ContainerRule
	// contains filtered or unexported fields
}

func NewHostNetworkPortsRule 

func NewHostNetworkPortsRule(excludeRules []pkg.ContainerRuleExclude,
	objects []ObjectContainers, errorList *errors.LintRuleErrorsList) *HostNetworkPortsRule

func (*HostNetworkPortsRule) Check added in v0.2.0 

func (r *HostNetworkPortsRule) Check(_ context.Context)

type ImageDigestRule 

type ImageDigestRule struct {
	pkg.RuleMeta
	pkg.ContainerRule
	// contains filtered or unexported fields
}

func NewImageDigestRule 

func NewImageDigestRule(excludeRules []pkg.ContainerRuleExclude,
	objects []ObjectContainers, errorList *errors.LintRuleErrorsList) *ImageDigestRule

func (*ImageDigestRule) Check added in v0.2.0 

func (r *ImageDigestRule) Check(_ context.Context)

func (*ImageDigestRule) Enabled 

func (r *ImageDigestRule) Enabled(object storage.StoreObject, container *corev1.Container) bool

type ImagePullPolicyRule 

type ImagePullPolicyRule struct {
	pkg.RuleMeta
	// contains filtered or unexported fields
}

func NewImagePullPolicyRule 

func NewImagePullPolicyRule(objects []ObjectContainers, errorList *errors.LintRuleErrorsList) *ImagePullPolicyRule

func (*ImagePullPolicyRule) Check added in v0.2.0 

func (r *ImagePullPolicyRule) Check(_ context.Context)

type LivenessRule 

type LivenessRule struct {
	pkg.RuleMeta
	pkg.ContainerRule
	// contains filtered or unexported fields
}

func NewLivenessRule 

func NewLivenessRule(excludeRules []pkg.ContainerRuleExclude,
	objects []ObjectContainers, errorList *errors.LintRuleErrorsList) *LivenessRule

func (*LivenessRule) Check added in v0.2.0 

func (r *LivenessRule) Check(_ context.Context)

type MountPointsRule added in v0.1.89 

type MountPointsRule struct {
	pkg.RuleMeta
	pkg.StringRule
	// contains filtered or unexported fields
}

func NewMountPointsRule added in v0.1.89 

func NewMountPointsRule(excludeRules []pkg.StringRuleExclude, modulePath string,
	objects []ObjectContainers, errorList *errors.LintRuleErrorsList) *MountPointsRule

func (*MountPointsRule) Check added in v0.2.0 

func (r *MountPointsRule) Check(_ context.Context)

type NameDuplicatesRule 

type NameDuplicatesRule struct {
	pkg.RuleMeta
	// contains filtered or unexported fields
}

func NewNameDuplicatesRule 

func NewNameDuplicatesRule(objects []ObjectContainers, errorList *errors.LintRuleErrorsList) *NameDuplicatesRule

func (*NameDuplicatesRule) Check added in v0.2.0 

func (r *NameDuplicatesRule) Check(_ context.Context)

type NamespaceLabelsRule 

type NamespaceLabelsRule struct {
	pkg.RuleMeta
	pkg.KindRule
	// contains filtered or unexported fields
}

func NewNamespaceLabelsRule 

func NewNamespaceLabelsRule(excludeRules []pkg.KindRuleExclude,
	m pkg.Module, errorList *errors.LintRuleErrorsList) *NamespaceLabelsRule

func (*NamespaceLabelsRule) Check added in v0.2.0 

func (r *NamespaceLabelsRule) Check(_ context.Context)

type NoNewPrivilegesRule added in v0.1.51 

type NoNewPrivilegesRule struct {
	pkg.RuleMeta
	pkg.ContainerRule
	// contains filtered or unexported fields
}

func NewNoNewPrivilegesRule added in v0.1.51 

func NewNoNewPrivilegesRule(excludeRules []pkg.ContainerRuleExclude,
	objects []ObjectContainers, errorList *errors.LintRuleErrorsList) *NoNewPrivilegesRule

func (*NoNewPrivilegesRule) Check added in v0.2.0 

func (r *NoNewPrivilegesRule) Check(_ context.Context)

type ObjectContainers added in v0.2.0 

type ObjectContainers struct {
	Object storage.StoreObject

	// All comes from GetAllContainers and is never empty: objects without
	// containers are dropped, which is what stops container rules from running
	// on them.
	All []corev1.Container

	// NotInit comes from GetContainers and is empty when the object has no
	// non-init containers, which is what stops the probe rules from running.
	NotInit []corev1.Container
}

ObjectContainers is a rendered object together with the containers extracted from it. The linter builds these once, so the extraction — and the diagnostic it can produce — happens exactly once per object rather than once per rule.

func CollectObjectContainers added in v0.2.0 

func CollectObjectContainers(
	storageMap map[storage.ResourceIndex]storage.StoreObject,
	errorList *errors.LintRuleErrorsList,
) []ObjectContainers

CollectObjectContainers extracts containers from every object in storageMap, reproducing the gates the container linter has always applied: an object whose containers cannot be extracted, or which has none, takes no further part. The extraction failure is reported here — once per object, with no rule ID — exactly as the old dispatcher did.

type PortsRule 

type PortsRule struct {
	pkg.RuleMeta
	pkg.ContainerRule
	// contains filtered or unexported fields
}

func NewPortsRule 

func NewPortsRule(excludeRules []pkg.ContainerRuleExclude,
	objects []ObjectContainers, errorList *errors.LintRuleErrorsList) *PortsRule

func (*PortsRule) Check added in v0.2.0 

func (r *PortsRule) Check(_ context.Context)

type PriorityClassRule 

type PriorityClassRule struct {
	pkg.RuleMeta
	pkg.KindRule
	// contains filtered or unexported fields
}

func NewPriorityClassRule 

func NewPriorityClassRule(excludeRules []pkg.KindRuleExclude,
	m pkg.Module, errorList *errors.LintRuleErrorsList) *PriorityClassRule

func (*PriorityClassRule) Check added in v0.2.0 

func (r *PriorityClassRule) Check(_ context.Context)

type ReadinessRuleNameRule 

type ReadinessRuleNameRule struct {
	pkg.RuleMeta
	pkg.ContainerRule
	// contains filtered or unexported fields
}

func NewReadinessRule 

func NewReadinessRule(excludeRules []pkg.ContainerRuleExclude,
	objects []ObjectContainers, errorList *errors.LintRuleErrorsList) *ReadinessRuleNameRule

func (*ReadinessRuleNameRule) Check added in v0.2.0 

func (r *ReadinessRuleNameRule) Check(_ context.Context)

type RecommendedLabelsRule 

type RecommendedLabelsRule struct {
	pkg.RuleMeta
	// contains filtered or unexported fields
}

func NewRecommendedLabelsRule 

func NewRecommendedLabelsRule(m pkg.Module, errorList *errors.LintRuleErrorsList) *RecommendedLabelsRule

func (*RecommendedLabelsRule) Check added in v0.2.0 

func (r *RecommendedLabelsRule) Check(_ context.Context)

type ResourcesRule 

type ResourcesRule struct {
	pkg.RuleMeta
	pkg.ContainerRule
	// contains filtered or unexported fields
}

func NewResourcesRule 

func NewResourcesRule(excludeRules []pkg.ContainerRuleExclude,
	objects []ObjectContainers, errorList *errors.LintRuleErrorsList) *ResourcesRule

func (*ResourcesRule) Check added in v0.2.0 

func (r *ResourcesRule) Check(_ context.Context)

type RevisionHistoryLimitRule 

type RevisionHistoryLimitRule struct {
	pkg.RuleMeta
	// contains filtered or unexported fields
}

func NewRevisionHistoryLimitRule 

func NewRevisionHistoryLimitRule(m pkg.Module, errorList *errors.LintRuleErrorsList) *RevisionHistoryLimitRule

func (*RevisionHistoryLimitRule) Check added in v0.2.0 

func (r *RevisionHistoryLimitRule) Check(_ context.Context)

type SeccompProfileRule added in v0.1.51 

type SeccompProfileRule struct {
	pkg.RuleMeta
	pkg.ContainerRule
	// contains filtered or unexported fields
}

func NewSeccompProfileRule added in v0.1.51 

func NewSeccompProfileRule(excludeRules []pkg.ContainerRuleExclude,
	objects []ObjectContainers, errorList *errors.LintRuleErrorsList) *SeccompProfileRule

func (*SeccompProfileRule) Check added in v0.2.0 

func (r *SeccompProfileRule) Check(_ context.Context)

type SysCgroupMountRule added in v0.1.104 

type SysCgroupMountRule struct {
	pkg.RuleMeta
	pkg.ContainerRule
	// contains filtered or unexported fields
}

func NewSysCgroupMountRule added in v0.1.104 

func NewSysCgroupMountRule(excludeRules []pkg.ContainerRuleExclude,
	objects []ObjectContainers, errorList *errors.LintRuleErrorsList) *SysCgroupMountRule

func (*SysCgroupMountRule) Check added in v0.2.0 

func (r *SysCgroupMountRule) Check(_ context.Context)

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.