Documentation
¶
Index ¶
- Constants
- Variables
- func KnownChecksumFromContext(ctx context.Context) string
- func WithKnownChecksum(ctx context.Context, checksum string) context.Context
- type ProfileClient
- type ProfileCreator
- type SbomClient
- type SeccompProfileClient
- type SeccompProfileClientMock
- func (m *SeccompProfileClientMock) GetSeccompProfile(namespace, name string) (*v1beta1.SeccompProfile, error)
- func (m *SeccompProfileClientMock) ListSeccompProfiles(_ string, _ metav1.ListOptions) (*v1beta1.SeccompProfileList, error)
- func (m *SeccompProfileClientMock) WatchSeccompProfiles(_ string, _ metav1.ListOptions) (watch.Interface, error)
- type StorageClient
- type StorageHttpClientMock
- func (sc *StorageHttpClientMock) CreateContainerProfileDirect(profile *v1beta1.ContainerProfile) error
- func (sc *StorageHttpClientMock) CreateSBOM(SBOM *v1beta1.SBOMSyft) (*v1beta1.SBOMSyft, error)
- func (sc *StorageHttpClientMock) GetContainerProfile(_ context.Context, namespace, name string) (*v1beta1.ContainerProfile, error)
- func (sc *StorageHttpClientMock) GetSBOMMeta(_ string) (*v1beta1.SBOMSyft, error)
- func (sc *StorageHttpClientMock) GetStorageClient() beta1.SpdxV1beta1Interface
- func (sc *StorageHttpClientMock) PatchSBOMAnnotations(_ string, annotations map[string]any) (*v1beta1.SBOMSyft, error)
- func (sc *StorageHttpClientMock) ReplaceSBOM(SBOM *v1beta1.SBOMSyft) (*v1beta1.SBOMSyft, error)
Constants ¶
const ( NginxImageID = "nginx@sha256:6a59f1cbb8d28ac484176d52c473494859a512ddba3ea62a547258cf16c9b3ae" FluentBitImageID = "fluentbit@sha256:236f7d961b0ba8b91796955f155819d64801e0d00fa666147502ab9b5b80f623" )
const ContainerProfileChecksumAnnotationKey = "backend.kubescape.io/container-profile-checksum"
ContainerProfileChecksumAnnotationKey is the ObjectMeta annotation under which a fetched ContainerProfile carries the content checksum of its body.
CROSS-REPO CONTRACT — this exact string is part of an interface between repositories. A ProfileClient implementation that talks to a remote storage backend (today: armosec/private-node-agent's pkg/backend adapter) is responsible for re-keying whatever its own transport calls the checksum onto THIS key before returning the profile. The container-profile cache reads the validator from here and nowhere else.
Changing this value fails silently rather than loudly: the cache simply never observes a checksum, every entry keeps an empty validator, and every fetch degrades to an unconditional one. Nothing breaks; the optimization just stops existing. Treat it as frozen.
The key is deliberately namespaced under backend.kubescape.io so it cannot collide with the learning-lifecycle annotations in k8s-interface/instanceidhandler/v1/helpers, which the cache reads for status and completion.
Variables ¶
var ErrProfileUnchanged = errors.New("container profile unchanged")
ErrProfileUnchanged is returned by a ProfileClient implementation when the caller supplied a known checksum via WithKnownChecksum and the source confirmed the profile's content is byte-identical, so no body was transferred. There is no profile to return: the caller must keep the one it already holds.
Implementations that cannot answer conditionally (for example the in-cluster CRD-backed client) never return this and need no knowledge of it.
Functions ¶
func KnownChecksumFromContext ¶ added in v0.3.226
KnownChecksumFromContext returns the checksum attached by WithKnownChecksum, or "" when none was attached. "" means "send the body unconditionally".
func WithKnownChecksum ¶ added in v0.3.226
WithKnownChecksum returns a context carrying the content checksum of the ContainerProfile the caller already holds, as a hint that the body may be omitted if it still matches.
It travels on the context rather than as a parameter because ProfileClient's signature must stay stable for its checksum-unaware implementers. A client that does not support conditional fetches ignores it and returns the body as usual, so attaching it is always safe.
Attach it per call, never to a context shared by fetches of different objects: a checksum is a claim about one specific profile.
Types ¶
type ProfileClient ¶ added in v0.3.3
type ProfileCreator ¶ added in v0.3.3
type ProfileCreator interface {
CreateContainerProfileDirect(profile *v1beta1.ContainerProfile) error
}
ProfileCreator defines the interface for creating container profiles
type SbomClient ¶ added in v0.3.3
type SbomClient interface {
CreateSBOM(SBOM *v1beta1.SBOMSyft) (*v1beta1.SBOMSyft, error)
GetSBOMMeta(name string) (*v1beta1.SBOMSyft, error)
ReplaceSBOM(SBOM *v1beta1.SBOMSyft) (*v1beta1.SBOMSyft, error)
// PatchSBOMAnnotations updates only metadata.annotations via a merge patch, never sending
// spec. A nil value for a key deletes that annotation. Safe to call regardless of whether
// the caller holds the SBOM's real spec (e.g. after a metadata-only GetSBOMMeta fetch),
// since spec is never part of the patch payload.
PatchSBOMAnnotations(name string, annotations map[string]any) (*v1beta1.SBOMSyft, error)
}
type SeccompProfileClient ¶ added in v0.3.11
type SeccompProfileClient interface {
WatchSeccompProfiles(namespace string, opts metav1.ListOptions) (watch.Interface, error)
ListSeccompProfiles(namespace string, opts metav1.ListOptions) (*v1beta1.SeccompProfileList, error)
GetSeccompProfile(namespace, name string) (*v1beta1.SeccompProfile, error)
}
SeccompProfileClient defines the interface for SeccompProfile operations This interface abstracts the backend (storage vs CRD) from consumers
type SeccompProfileClientMock ¶ added in v0.3.11
type SeccompProfileClientMock struct {
Profiles []*v1beta1.SeccompProfile
WatchEvents chan watch.Event
WatchStopped bool
GetError error
ListError error
WatchError error
}
SeccompProfileClientMock is a mock implementation of SeccompProfileClient for testing
func NewSeccompProfileClientMock ¶ added in v0.3.11
func NewSeccompProfileClientMock() *SeccompProfileClientMock
func (*SeccompProfileClientMock) GetSeccompProfile ¶ added in v0.3.11
func (m *SeccompProfileClientMock) GetSeccompProfile(namespace, name string) (*v1beta1.SeccompProfile, error)
func (*SeccompProfileClientMock) ListSeccompProfiles ¶ added in v0.3.11
func (m *SeccompProfileClientMock) ListSeccompProfiles(_ string, _ metav1.ListOptions) (*v1beta1.SeccompProfileList, error)
func (*SeccompProfileClientMock) WatchSeccompProfiles ¶ added in v0.3.11
func (m *SeccompProfileClientMock) WatchSeccompProfiles(_ string, _ metav1.ListOptions) (watch.Interface, error)
type StorageClient ¶
type StorageClient interface {
GetStorageClient() spdxv1beta1.SpdxV1beta1Interface
}
type StorageHttpClientMock ¶
type StorageHttpClientMock struct {
SyftSBOMs []*spdxv1beta1.SBOMSyft
ContainerProfiles []*v1beta1.ContainerProfile
ImageCounters map[string]int
// contains filtered or unexported fields
}
func (*StorageHttpClientMock) CreateContainerProfileDirect ¶ added in v0.2.351
func (sc *StorageHttpClientMock) CreateContainerProfileDirect(profile *v1beta1.ContainerProfile) error
func (*StorageHttpClientMock) CreateSBOM ¶ added in v0.2.197
func (*StorageHttpClientMock) GetContainerProfile ¶ added in v0.3.108
func (sc *StorageHttpClientMock) GetContainerProfile(_ context.Context, namespace, name string) (*v1beta1.ContainerProfile, error)
func (*StorageHttpClientMock) GetSBOMMeta ¶ added in v0.2.197
func (sc *StorageHttpClientMock) GetSBOMMeta(_ string) (*v1beta1.SBOMSyft, error)
func (*StorageHttpClientMock) GetStorageClient ¶ added in v0.3.3
func (sc *StorageHttpClientMock) GetStorageClient() beta1.SpdxV1beta1Interface
Source Files
Directories