Documentation
¶
Overview ¶
Package hostidentity provides a single shared source of identity for the "host" pseudo-container (ContainerID == armotypes.HostContainerID), used to unblock the host profile, malware and (eventually) SBOM pipelines.
It lives in its own package, rather than pkg/utils as originally sketched, because pkg/config transitively imports pkg/utils (config -> exporters -> malwaremanager -> utils), so pkg/utils cannot import pkg/config without creating an import cycle. This package depends on pkg/config, pkg/hostsensormanager and pkg/objectcache, none of which import it back.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func BuildHostInstanceID ¶
func BuildHostInstanceID(hostID string) instanceidhandler.IInstanceID
BuildHostInstanceID builds a real instanceidhandler.IInstanceID for the host pseudo-container. InstanceType and TemplateHash are set explicitly since both surface via WatchedContainerData.GetLabels() / objectcache.GetLabels().
func BuildHostWatchedContainerData ¶
func BuildHostWatchedContainerData(hostID string) *objectcache.WatchedContainerData
BuildHostWatchedContainerData builds the WatchedContainerData used to represent the host pseudo-container in the shared container data cache. Every field is explicitly set (no zero-value gaps), since downstream consumers (e.g. containerprofilemanager/v1/lifecycle.go) branch on unset fields such as PreRunningContainer.
ContainerInfos/ContainerIndex are set explicitly to a single synthetic entry for the same reason: for a real container these are populated by WatchedContainerData.SetContainerInfo from a live pod spec/status (see pkg/objectcache/shared_container_data.go), a K8s-dependent path host deliberately never goes through (the single host injection point replaces, rather than falls through to, that lookup). Left unset, ContainerInfos is a nil map, and containerprofilemanager/v1/monitoring.go's saveContainerProfile unconditionally indexes watchedContainer.ContainerInfos[watchedContainer.ContainerType][watchedContainer.ContainerIndex] when building the CR -- a nil/empty slice index panics on host's very first profile save.
func BuildHostWlid ¶
BuildHostWlid builds the synthetic Wlid used to represent the host pseudo-workload for the profile/malware pipelines.
func ResolveHostID ¶
ResolveHostID returns a stable identifier for the node the agent is running on. It never silently returns an empty string: if neither source below yields a non-empty value, it returns an error instead.
Primary source: cfg.NodeName (pkg/config/config.go), populated from the NODE_NAME env var via the Kubernetes downward API - stable across restarts and already available with no new mechanism required.
Fallback (only when NodeName is empty): the host's /etc/machine-id, read through machineIDHostRoot's HOST_ROOT-aware resolution. Note this only resolves to the true node's machine-id when HOST_ROOT is mounted from the host (as the DaemonSet does); reading a container-local /etc/machine-id would return the container's own id, not the node's.
Types ¶
This section is empty.
Source Files