Documentation
¶
Index ¶
- type AdmissionPolicy
- func (p *AdmissionPolicy) HasActiveRules() bool
- func (p *AdmissionPolicy) ValidateImageAllowlist(imageRef string) *field.Error
- func (p *AdmissionPolicy) ValidateImageDigest(imageRef string) *field.Error
- func (p *AdmissionPolicy) ValidateRuntimePolicy(storageMountCount int, labels map[string]string) field.ErrorList
- type PolicyFlags
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type AdmissionPolicy ¶
type AdmissionPolicy struct {
ImageAllowlist []string
RequireImageDigest bool
MaxStorageMounts *int
RequiredLabels []string
}
AdmissionPolicy holds the operator-level policy configuration for webhook admission decisions. It is parsed once at startup and injected into the webhook handler.
func ParseAdmissionPolicy ¶
func ParseAdmissionPolicy(log logr.Logger, flags PolicyFlags) *AdmissionPolicy
ParseAdmissionPolicy reads admission policy from CLI flags and environment variable fallbacks. Flag values take precedence over env vars.
func (*AdmissionPolicy) HasActiveRules ¶
func (p *AdmissionPolicy) HasActiveRules() bool
HasActiveRules returns true if the policy has any active enforcement rules configured.
func (*AdmissionPolicy) ValidateImageAllowlist ¶
func (p *AdmissionPolicy) ValidateImageAllowlist(imageRef string) *field.Error
ValidateImageAllowlist checks that imageRef starts with one of the allowed prefixes. Returns nil if the allowlist is empty (no restriction) or the image matches. Prefix matching enforces a path boundary to prevent "ghcr.io/trusted" from matching "ghcr.io/trusted-evil/...".
func (*AdmissionPolicy) ValidateImageDigest ¶
func (p *AdmissionPolicy) ValidateImageDigest(imageRef string) *field.Error
ValidateImageDigest checks that imageRef contains a valid digest reference (@sha256:<64 hex chars>) when RequireImageDigest is true.
func (*AdmissionPolicy) ValidateRuntimePolicy ¶
func (p *AdmissionPolicy) ValidateRuntimePolicy(storageMountCount int, labels map[string]string) field.ErrorList
ValidateRuntimePolicy checks storage mount count and required labels against policy rules. The caller extracts these values from the MCPServer to avoid an import cycle between this package and api/v1alpha1.
Source Files