package sysctl

import "k8s.io/kubernetes/pkg/kubelet/sysctl"

Index ¶

• Constants
• func ConvertPodSysctlsVariableToDotsSeparator(securityContext *v1.PodSecurityContext)
• func NewAllowlist(patterns []string) (*patternAllowlist, error)
• type Namespace
• func NamespacedBy(val string) Namespace

Constants ¶

const (
	AnnotationInvalidReason = "InvalidSysctlAnnotation"
	ForbiddenReason         = "SysctlForbidden"
)

Functions ¶

func ConvertPodSysctlsVariableToDotsSeparator ¶

func ConvertPodSysctlsVariableToDotsSeparator(securityContext *v1.PodSecurityContext)

ConvertPodSysctlsVariableToDotsSeparator converts sysctls variable in the Pod.Spec.SecurityContext.Sysctls slice into a dot as a separator according to the linux sysctl conversion rules. see https://man7.org/linux/man-pages/man5/sysctl.d.5.html for more details.

func NewAllowlist ¶

func NewAllowlist(patterns []string) (*patternAllowlist, error)

NewAllowlist creates a new Allowlist from a list of sysctls and sysctl pattern (ending in *).

Types ¶

type Namespace ¶

type Namespace string

Namespace represents a kernel namespace name.

func NamespacedBy ¶

func NamespacedBy(val string) Namespace

NamespacedBy returns the namespace of the Linux kernel for a sysctl, or unknownNamespace if the sysctl is not known to be namespaced.

Source Files ¶

allowlist.go namespace.go util.go