Affected by GO-2025-3917 and 3 other vulnerabilities

GO-2025-3917: NeuVector has an insecure password storage vulnerable to rainbow attack in github.com/neuvector/neuvector

GO-2025-3918: NeuVector admin account has insecure default password in github.com/neuvector/neuvector

GO-2025-3919: NeuVector process with sensitive arguments lead to leakage in github.com/neuvector/neuvector

GO-2025-4044: NeuVector telemetry sender is vulnerable to MITM and DoS in github.com/neuvector/neuvector

admission

package

v0.0.0-test Latest Latest Go to latest Published: Dec 11, 2024 License: Apache-2.0 Imports: 22 Imported by: 20

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/neuvector/neuvector

Links

Open Source Insights

Documentation ¶

Index ¶

Constants
func ConfigK8sAdmissionControl(k8sResInfo *ValidatingWebhookConfigInfo, ctrlState *share.CLUSAdmCtrlState) (bool, error)
func EchoAdmWebhookConnection(tagExpected, svcname string)
func GetAdmissionCtrlTypes(platform string) []string
func GetSvcLabelKeysForTest(svcname string) (string, string)
func InitK8sNsSelectorInfo(allowedNS, allowedNsWild, defAllowedNS utils.Set, selectorValue string, ...)
func IsNsSelectorSupported() bool
func ResetCABundle(svcName string, caBundle []byte) bool
func SetCABundle(svcName string, caBundle []byte)
func TestAdmWebhookConnection(svcname string) (int, error)
func UnregK8sAdmissionControl(admType, nvAdmName string) error
func UpdateAllowedK8sNs(isLead, admCtrlEnabled bool, newAllowedNS, newAllowedNsWild utils.Set)
func VerifyK8sNs(admCtrlEnabled bool, nsName string, nsLabels map[string]string)
type ClientConfig
type ValidateWebhookSvcInfo
- func GetValidateWebhookSvcInfo(svcname string) (error, *ValidateWebhookSvcInfo)
type ValidatingWebhookConfigInfo
type WebhookInfo
type WebhookSvcLabelKey

Constants ¶

View Source

const (
	UriAdmCtrlPrefix   = "/v1"
	UriAdmCtrlNvStatus = "nvstatus"
)

View Source

const (
	K8sResOpCreate = "create"
	K8sResOpUpdate = "update"
	K8sResOpDelete = "delete"
)

View Source

const (
	TestSucceeded = iota
	TestFailedAtRead
	TestFailedAtWrite
	TestFailed
	TestAborted
)

View Source

const (
	AdmRuleCatK8s = "Kubernetes"
)

View Source

const (
	//NvAdmMutateType   = "mutate" // for Kubernetes
	NvAdmValidateType = "validate" // for Kubernetes
)

Variables ¶

This section is empty.

Functions ¶

func ConfigK8sAdmissionControl ¶

func ConfigK8sAdmissionControl(k8sResInfo *ValidatingWebhookConfigInfo, ctrlState *share.CLUSAdmCtrlState) (bool, error)

func EchoAdmWebhookConnection ¶

func EchoAdmWebhookConnection(tagExpected, svcname string)

func GetAdmissionCtrlTypes ¶

func GetAdmissionCtrlTypes(platform string) []string

func GetSvcLabelKeysForTest ¶

func GetSvcLabelKeysForTest(svcname string) (string, string)

func InitK8sNsSelectorInfo ¶

func InitK8sNsSelectorInfo(allowedNS, allowedNsWild, defAllowedNS utils.Set, selectorValue string, admCtrlEnabled bool)

func IsNsSelectorSupported ¶

func IsNsSelectorSupported() bool

func ResetCABundle ¶

func ResetCABundle(svcName string, caBundle []byte) bool

func SetCABundle ¶

func SetCABundle(svcName string, caBundle []byte)

func TestAdmWebhookConnection ¶

func TestAdmWebhookConnection(svcname string) (int, error)

func UnregK8sAdmissionControl ¶

func UnregK8sAdmissionControl(admType, nvAdmName string) error

func UpdateAllowedK8sNs ¶

func UpdateAllowedK8sNs(isLead, admCtrlEnabled bool, newAllowedNS, newAllowedNsWild utils.Set)

func VerifyK8sNs ¶

func VerifyK8sNs(admCtrlEnabled bool, nsName string, nsLabels map[string]string)

Types ¶

type ClientConfig ¶

type ClientConfig struct {
	ClientMode  string // "service" or "url"
	ServiceName string
	Path        string // uri
	Port        int32
}

type ValidateWebhookSvcInfo ¶

type ValidateWebhookSvcInfo struct {
	Status      int
	SvcNodePort int32
	SvcType     string
	LabelTag    string
	LabelEcho   string
}

func GetValidateWebhookSvcInfo ¶

func GetValidateWebhookSvcInfo(svcname string) (error, *ValidateWebhookSvcInfo)

type ValidatingWebhookConfigInfo ¶

type ValidatingWebhookConfigInfo struct {
	Name                string
	WebhooksInfo        []*WebhookInfo
	RevertCount         *uint32
	UnexpectedMatchExpr string
}

type WebhookInfo ¶

type WebhookInfo struct {
	Name           string
	ClientConfig   ClientConfig
	FailurePolicy  string
	TimeoutSeconds int32
}

type WebhookSvcLabelKey ¶

type WebhookSvcLabelKey struct {
	TagKey  string
	EchoKey string
}

Source Files ¶

View all Source files

nvvalidatewebhookcfg.go

Directories ¶

Path	Synopsis
admission

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL