Documentation
¶
Overview ¶
Package verifier implements the /checkimages endpoint called by Kyverno.
Index ¶
- type Option
- func WithAllowedUsers(users []string) Option
- func WithCacheEnabled(useCache bool) Option
- func WithEnableDebug(debug bool) Option
- func WithImagePullSecrets(secrets string) Option
- func WithInsecureRegistry(insecureRegistry bool) Option
- func WithMaxCacheSize(maxCacheSize int64) Option
- func WithMaxCacheTTL(maxCacheTTL time.Duration) Option
- func WithMaxSignatureAttempts(maxSignatureAttempts int) Option
- func WithPluginConfig(pluginConfigMap string) Option
- func WithProviderKeychain(keychain authn.Keychain) Option
- func WithTokenReviewAudiences(audiences []string) Option
- func WithTokenReviewEnabled(enableTokenReview bool) Option
- type Response
- type Verifier
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Option ¶
type Option func(*verifier)
Option configures the verifier.
func WithAllowedUsers ¶
func WithCacheEnabled ¶
func WithEnableDebug ¶
func WithImagePullSecrets ¶
func WithInsecureRegistry ¶
func WithMaxCacheSize ¶
func WithMaxCacheTTL ¶
func WithPluginConfig ¶
func WithProviderKeychain ¶
WithProviderKeychain sets the keychain used for registries without an image pull secret (e.g. the ECR credential helper). Resolved credentials are cached per registry, see newCachingKeychain.
func WithTokenReviewAudiences ¶
WithTokenReviewAudiences sets TokenReview.Spec.Audiences. Empty means the API server's default audience.
func WithTokenReviewEnabled ¶
type Response ¶
type Response interface {
GetResponse() types.ResponseData
GetImageList() map[string]types.AttestationList
AddImage(imageRef string, img *types.ImageInfo)
BuildAttestationList(Attestations []types.AttestationsInfo) error
VerificationFailed(msg string) (types.ResponseData, error)
VerificationSucceeded(msg string) (types.ResponseData, error)
}
func NewResponse ¶
func NewResponse(log *zap.SugaredLogger) Response
type Verifier ¶
type Verifier interface {
// HandleCheckImages is a handler function that takes Kyverno images variable in body and returns JSONPatch compatible object in response
HandleCheckImages(w http.ResponseWriter, r *http.Request)
// UpdateNotationVerifier reloads trust policies and trust stores and clears the cache.
UpdateNotationVerifier() error
// Stop shuts down the informers and the cache.
Stop()
}
func NewVerifier ¶
func NewVerifier(logger *zap.SugaredLogger, opts ...Option) (Verifier, error)
Source Files
Click to show internal directories.
Click to hide internal directories.