containerprofilemanager

package
v0.3.307 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Nov 2, 2026 License: Apache-2.0 Imports: 52 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	MaxSniffingTimeLabel          = "kubescape.io/max-sniffing-time"
	MaxWaitForSharedContainerData = 10 * time.Minute
	MaxWaitForAck                 = 30 * time.Second
)
View Source 
const (
	InternalTrafficType = "internal"
	ExternalTrafficType = "external"
)

Variables

View Source 
var (
	ErrContainerNotFound        = errors.New("container not found")
	ErrInvalidContainerID       = errors.New("invalid container ID")
	ContainerHasTerminatedError = errors.New("container has terminated")
	ContainerReachedMaxTime     = errors.New("container reached max time")
	ProfileRequiresSplit        = errors.New("profile requires split")
)
View Source 
var DefaultLabelsToIgnore = map[string]struct{}{
	"controller-revision-hash":           {},
	"pod-template-generation":            {},
	"pod-template-hash":                  {},
	"apps.kubernetes.io/pod-index":       {},
	"statefulset.kubernetes.io/pod-name": {},
}

Functions

func CalculateHTTPEndpointHash 

func CalculateHTTPEndpointHash(endpoint *v1beta1.HTTPEndpoint) string

func CalculateSHA256CallStackHash 

func CalculateSHA256CallStackHash(callStack v1beta1.IdentifiedCallStack) string

func GetEndpointIdentifier 

func GetEndpointIdentifier(request utils.HttpEvent) (string, error)

func GetNewEndpoint 

func GetNewEndpoint(event utils.HttpEvent, identifier string) (*v1beta1.HTTPEndpoint, error)

func IsPolicyIncluded 

func IsPolicyIncluded(existingPolicy, newPolicy *v1beta1.RulePolicy) bool

Types

type ContainerEntry 

type ContainerEntry struct {
	// contains filtered or unexported fields
}

ContainerEntry holds container data with its own mutex for fine-grained locking

type ContainerProfileManager 

type ContainerProfileManager struct {
	// contains filtered or unexported fields
}

ContainerProfileManager manages container profiles and their lifecycle

func NewContainerProfileManager 

func NewContainerProfileManager(
	ctx context.Context,
	cfg config.Config,
	k8sClient k8sclient.K8sClientInterface,
	k8sObjectCache objectcache.K8sObjectCache,
	storageClient storage.ProfileCreator,
	dnsResolverClient dnsmanager.DNSResolver,
	seccompManager seccompmanager.SeccompManagerClient,
	enricher containerprofilemanager.Enricher,
	ruleBindingCache rulebindingmanager.RuleBindingCache,
	cloudMetadata *armotypes.CloudMetadata,
) (*ContainerProfileManager, error)

NewContainerProfileManager creates a new container profile manager

func (*ContainerProfileManager) Close added in v0.3.63 

func (cpm *ContainerProfileManager) Close()

Close stops container timers, the persistent queue, and the Kubernetes inventory.

func (*ContainerProfileManager) ContainerCallback 

func (cpm *ContainerProfileManager) ContainerCallback(notif containercollection.PubSubEvent)

ContainerCallback handles container lifecycle events

func (*ContainerProfileManager) OnQueueError 

func (cpm *ContainerProfileManager) OnQueueError(_ *v1beta1.ContainerProfile, containerID string, err error)

OnQueueError implements the queue.ErrorCallback interface This method is called by the queue for terminal storage errors.

func (*ContainerProfileManager) RegisterForContainerEndOfLife 

func (cpm *ContainerProfileManager) RegisterForContainerEndOfLife(notificationChannel chan *containercollection.Container)

RegisterForContainerEndOfLife registers a channel to receive notifications when a container reaches its max sniffing time

func (*ContainerProfileManager) ReportCapability 

func (cpm *ContainerProfileManager) ReportCapability(containerID, capability string)

ReportCapability reports a capability event for a container

func (*ContainerProfileManager) ReportDroppedEvent 

func (cpm *ContainerProfileManager) ReportDroppedEvent(containerID string)

ReportDroppedEvent reports a dropped event (currently just logs)

func (*ContainerProfileManager) ReportFileExec 

func (cpm *ContainerProfileManager) ReportFileExec(containerID string, event utils.ExecEvent)

ReportFileExec reports a file execution event for a container

func (*ContainerProfileManager) ReportFileOpen 

func (cpm *ContainerProfileManager) ReportFileOpen(containerID string, event utils.OpenEvent)

ReportFileOpen reports a file open event for a container

func (*ContainerProfileManager) ReportHTTPEvent 

func (cpm *ContainerProfileManager) ReportHTTPEvent(containerID string, event utils.HttpEvent)

ReportHTTPEvent reports an HTTP event for a container

func (*ContainerProfileManager) ReportHardlinkEvent 

func (cpm *ContainerProfileManager) ReportHardlinkEvent(containerID string, event utils.LinkEvent)

ReportHardlinkEvent reports a hardlink creation event for a container

func (*ContainerProfileManager) ReportIdentifiedCallStack 

func (cpm *ContainerProfileManager) ReportIdentifiedCallStack(containerID string, callStack *v1beta1.IdentifiedCallStack)

ReportIdentifiedCallStack reports a call stack for a container

func (*ContainerProfileManager) ReportNetworkEvent 

func (cpm *ContainerProfileManager) ReportNetworkEvent(containerID string, event utils.NetworkEvent)

ReportNetworkEvent reports a network event for a container

func (*ContainerProfileManager) ReportProcfsExec added in v0.3.273 

func (cpm *ContainerProfileManager) ReportProcfsExec(containerID string, path string, argv []string)

ReportProcfsExec records a process the agent found already running, from the procfs scan rather than from an exec event (entlein/node-agent#22).

An exec that happened before the tracer attached cannot be replayed, but the process it started is usually still there, and procfs carries the same two facts an exec event would have: the resolved binary and the argv. So the learning is retried against the live process rather than reconstructed from the pod spec, which would state what was asked for instead of what ran.

Same identifier as an observed exec, so a process seen both ways is recorded once and neither source shadows the other.

func (*ContainerProfileManager) ReportRulePolicy 

func (cpm *ContainerProfileManager) ReportRulePolicy(containerID, ruleId, allowedProcess string, allowedContainer bool)

ReportRulePolicy reports a rule policy for a container

func (*ContainerProfileManager) ReportSymlinkEvent 

func (cpm *ContainerProfileManager) ReportSymlinkEvent(containerID string, event utils.LinkEvent)

ReportSymlinkEvent reports a symlink creation event for a container

func (*ContainerProfileManager) ReportSyscalls added in v0.3.206 

func (cpm *ContainerProfileManager) ReportSyscalls(containerID string, syscalls []string)

ReportSyscalls reports a batch of syscalls for a container in a single locked operation - one container-lock acquisition and one size update, rather than one per syscall. The eBPF syscall tracer decodes a whole periodically- or on-demand-fetched bitmap at once (see pkg/containerwatcher/v2/tracers/syscall.go), so this is called with that whole batch directly, bypassing the generic per-event pipeline entirely for this consumer (kubescape/node-agent#922).

func (*ContainerProfileManager) SetCompletionNotifier added in v0.3.115 

func (cpm *ContainerProfileManager) SetCompletionNotifier(n objectcache.CompletionNotifier)

func (*ContainerProfileManager) SetK8sInventory added in v0.3.254 

func (cpm *ContainerProfileManager) SetK8sInventory(k8sInventory common.K8sInventoryCache)

SetK8sInventory sets the k8s inventory cache (primarily used in tests)

func (*ContainerProfileManager) SetSyscallFlusher added in v0.3.206 

func (cpm *ContainerProfileManager) SetSyscallFlusher(flush func())

SetSyscallFlusher preserves the legacy request-only callback API. Returning from that callback cannot prove delivery, so finalization remains partial.

func (*ContainerProfileManager) SetSyscallFlusherWithContext added in v0.3.293 

func (cpm *ContainerProfileManager) SetSyscallFlusherWithContext(flush func(context.Context) error)

SetSyscallFlusherWithContext registers an acknowledged, cancellable flush.

type Destination 

type Destination struct {
	Namespace string
	Name      string
	Kind      EndpointKind
	PodLabels string
	IPAddress string
}

type EndpointKind 

type EndpointKind string
const (
	EndpointKindPod     EndpointKind = "pod"
	EndpointKindService EndpointKind = "svc"
	EndpointKindRaw     EndpointKind = "raw"
)

type NetworkEvent 

type NetworkEvent struct {
	Port        uint16
	PktType     string
	Protocol    string
	PodLabels   string
	Destination Destination
}

func (*NetworkEvent) GetDestinationPodLabels 

func (ne *NetworkEvent) GetDestinationPodLabels() map[string]string

GetDestinationPodLabels returns a map of pod labels from the string in the network event. The labels are saved separated by commas, so we need to split them

func (*NetworkEvent) SetDestinationPodLabels 

func (ne *NetworkEvent) SetDestinationPodLabels(podLabels map[string]string)

func (*NetworkEvent) SetPodLabels 

func (ne *NetworkEvent) SetPodLabels(podLabels map[string]string)

func (*NetworkEvent) String 

func (ne *NetworkEvent) String() string

Source Files

View all Source files

Directories

Path Synopsis

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.