Documentation
¶
Index ¶
- type CgroupSink
- type LsmManager
- func (l *LsmManager) CollectObservations(ctx context.Context) ([]runtimeevent.Event, error)
- func (l *LsmManager) PodDeleted(uid string) error
- func (l *LsmManager) PodEvent(pod corev1.Pod, nsLabels map[string]string, ...) error
- func (l *LsmManager) RuntimePolicyEvent(compiledRb *compiler.EvaluationResult, eventType string) error
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type CgroupSink ¶
CgroupSink is an observation-only kernel source that must see events from the same pods the exec policies select, and from no others.
type LsmManager ¶
type LsmManager struct {
// contains filtered or unexported fields
}
func NewLsmManager ¶
func NewLsmManager(logger logr.Logger, status runtimeevent.PolicyStatusRecorder, onLoss runtimeevent.LossFunc, cgroupSinks ...CgroupSink) *LsmManager
func (*LsmManager) CollectObservations ¶
func (l *LsmManager) CollectObservations(ctx context.Context) ([]runtimeevent.Event, error)
CollectObservations drains the per-cgroup path counters of every enforcer of every attachment and turns them into events. The counters live in a map per enforcer, so every program type has to be read: stopping at the first one discards what the others saw. The kernel maps are read-and-reset, so Count is the number of occurrences since the previous call.
func (*LsmManager) PodDeleted ¶
func (l *LsmManager) PodDeleted(uid string) error
PodDeleted removes the pod's cgroups from every attached program and drops its bookkeeping.
func (*LsmManager) PodEvent ¶
func (l *LsmManager) PodEvent(pod corev1.Pod, nsLabels map[string]string, cgInfos []*containers.ContainerCgroupInfo, eventType string) error
func (*LsmManager) RuntimePolicyEvent ¶
func (l *LsmManager) RuntimePolicyEvent(compiledRb *compiler.EvaluationResult, eventType string) error
Source Files
Click to show internal directories.
Click to hide internal directories.