storage

package
v0.3.241 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Sep 22, 2026 License: Apache-2.0 Imports: 8 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	NginxImageID     = "nginx@sha256:6a59f1cbb8d28ac484176d52c473494859a512ddba3ea62a547258cf16c9b3ae"
	FluentBitImageID = "fluentbit@sha256:236f7d961b0ba8b91796955f155819d64801e0d00fa666147502ab9b5b80f623"
)
View Source 
const ContainerProfileChecksumAnnotationKey = "backend.kubescape.io/container-profile-checksum"

ContainerProfileChecksumAnnotationKey is the ObjectMeta annotation under which a fetched ContainerProfile carries the content checksum of its body.

CROSS-REPO CONTRACT — this exact string is part of an interface between repositories. A ProfileClient implementation that talks to a remote storage backend (today: armosec/private-node-agent's pkg/backend adapter) is responsible for re-keying whatever its own transport calls the checksum onto THIS key before returning the profile. The container-profile cache reads the validator from here and nowhere else.

Changing this value fails silently rather than loudly: the cache simply never observes a checksum, every entry keeps an empty validator, and every fetch degrades to an unconditional one. Nothing breaks; the optimization just stops existing. Treat it as frozen.

The key is deliberately namespaced under backend.kubescape.io so it cannot collide with the learning-lifecycle annotations in k8s-interface/instanceidhandler/v1/helpers, which the cache reads for status and completion.

Variables

View Source 
var ErrProfileUnchanged = errors.New("container profile unchanged")

ErrProfileUnchanged is returned by a ProfileClient implementation when the caller supplied a known checksum via WithKnownChecksum and the source confirmed the profile's content is byte-identical, so no body was transferred. There is no profile to return: the caller must keep the one it already holds.

Implementations that cannot answer conditionally (for example the in-cluster CRD-backed client) never return this and need no knowledge of it.

Functions

func KnownChecksumFromContext added in v0.3.226 

func KnownChecksumFromContext(ctx context.Context) string

KnownChecksumFromContext returns the checksum attached by WithKnownChecksum, or "" when none was attached. "" means "send the body unconditionally".

func WithKnownChecksum added in v0.3.226 

func WithKnownChecksum(ctx context.Context, checksum string) context.Context

WithKnownChecksum returns a context carrying the content checksum of the ContainerProfile the caller already holds, as a hint that the body may be omitted if it still matches.

It travels on the context rather than as a parameter because ProfileClient's signature must stay stable for its checksum-unaware implementers. A client that does not support conditional fetches ignores it and returns the body as usual, so attaching it is always safe.

Attach it per call, never to a context shared by fetches of different objects: a checksum is a claim about one specific profile.

Types

type ProfileClient added in v0.3.3 

type ProfileClient interface {
	GetContainerProfile(ctx context.Context, namespace, name string) (*v1beta1.ContainerProfile, error)
}

type ProfileCreator added in v0.3.3 

type ProfileCreator interface {
	CreateContainerProfileDirect(profile *v1beta1.ContainerProfile) error
}

ProfileCreator defines the interface for creating container profiles

type SbomClient added in v0.3.3 

type SbomClient interface {
	CreateSBOM(SBOM *v1beta1.SBOMSyft) (*v1beta1.SBOMSyft, error)
	GetSBOMMeta(name string) (*v1beta1.SBOMSyft, error)
	ReplaceSBOM(SBOM *v1beta1.SBOMSyft) (*v1beta1.SBOMSyft, error)
	// PatchSBOMAnnotations updates only metadata.annotations via a merge patch, never sending
	// spec. A nil value for a key deletes that annotation. Safe to call regardless of whether
	// the caller holds the SBOM's real spec (e.g. after a metadata-only GetSBOMMeta fetch),
	// since spec is never part of the patch payload.
	PatchSBOMAnnotations(name string, annotations map[string]any) (*v1beta1.SBOMSyft, error)
}

type SeccompProfileClient added in v0.3.11 

type SeccompProfileClient interface {
	WatchSeccompProfiles(namespace string, opts metav1.ListOptions) (watch.Interface, error)
	ListSeccompProfiles(namespace string, opts metav1.ListOptions) (*v1beta1.SeccompProfileList, error)
	GetSeccompProfile(namespace, name string) (*v1beta1.SeccompProfile, error)
}

SeccompProfileClient defines the interface for SeccompProfile operations This interface abstracts the backend (storage vs CRD) from consumers

type SeccompProfileClientMock added in v0.3.11 

type SeccompProfileClientMock struct {
	Profiles     []*v1beta1.SeccompProfile
	WatchEvents  chan watch.Event
	WatchStopped bool
	GetError     error
	ListError    error
	WatchError   error
}

SeccompProfileClientMock is a mock implementation of SeccompProfileClient for testing

func NewSeccompProfileClientMock added in v0.3.11 

func NewSeccompProfileClientMock() *SeccompProfileClientMock

func (*SeccompProfileClientMock) GetSeccompProfile added in v0.3.11 

func (m *SeccompProfileClientMock) GetSeccompProfile(namespace, name string) (*v1beta1.SeccompProfile, error)

func (*SeccompProfileClientMock) ListSeccompProfiles added in v0.3.11 

func (m *SeccompProfileClientMock) ListSeccompProfiles(_ string, _ metav1.ListOptions) (*v1beta1.SeccompProfileList, error)

func (*SeccompProfileClientMock) WatchSeccompProfiles added in v0.3.11 

func (m *SeccompProfileClientMock) WatchSeccompProfiles(_ string, _ metav1.ListOptions) (watch.Interface, error)

type StorageClient 

type StorageClient interface {
	GetStorageClient() spdxv1beta1.SpdxV1beta1Interface
}

type StorageHttpClientMock 

type StorageHttpClientMock struct {
	SyftSBOMs         []*spdxv1beta1.SBOMSyft
	ContainerProfiles []*v1beta1.ContainerProfile
	ImageCounters     map[string]int
	// contains filtered or unexported fields
}

func (*StorageHttpClientMock) ContainerProfilesSnapshot added in v0.3.241 

func (sc *StorageHttpClientMock) ContainerProfilesSnapshot() []*v1beta1.ContainerProfile

ContainerProfilesSnapshot returns a thread-safe copy of the container profiles recorded so far. Use this instead of reading ContainerProfiles directly when CreateContainerProfileDirect may still be called concurrently (e.g. while polling for delivery via require.Eventually).

func (*StorageHttpClientMock) CreateContainerProfileDirect added in v0.2.351 

func (sc *StorageHttpClientMock) CreateContainerProfileDirect(profile *v1beta1.ContainerProfile) error

CreateContainerProfileDirect records profile as if it had been persisted to storage. Guarded by containerProfilesMu since it may be invoked from a caller's own background goroutine (e.g. the container profile manager's persistent queue processing loop).

func (*StorageHttpClientMock) CreateSBOM added in v0.2.197 

func (sc *StorageHttpClientMock) CreateSBOM(SBOM *v1beta1.SBOMSyft) (*v1beta1.SBOMSyft, error)

func (*StorageHttpClientMock) GetContainerProfile added in v0.3.108 

func (sc *StorageHttpClientMock) GetContainerProfile(_ context.Context, namespace, name string) (*v1beta1.ContainerProfile, error)

GetContainerProfile finds a previously recorded profile by namespace and name, or (nil, nil) if none matches.

func (*StorageHttpClientMock) GetSBOMMeta added in v0.2.197 

func (sc *StorageHttpClientMock) GetSBOMMeta(_ string) (*v1beta1.SBOMSyft, error)

func (*StorageHttpClientMock) GetStorageClient added in v0.3.3 

func (sc *StorageHttpClientMock) GetStorageClient() beta1.SpdxV1beta1Interface

func (*StorageHttpClientMock) PatchSBOMAnnotations added in v0.3.158 

func (sc *StorageHttpClientMock) PatchSBOMAnnotations(_ string, annotations map[string]any) (*v1beta1.SBOMSyft, error)

func (*StorageHttpClientMock) ReplaceSBOM added in v0.2.197 

func (sc *StorageHttpClientMock) ReplaceSBOM(SBOM *v1beta1.SBOMSyft) (*v1beta1.SBOMSyft, error)

Source Files

View all Source files

Directories

Path Synopsis

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.