diff options
Diffstat (limited to 'vendor/k8s.io/kubernetes/pkg/capabilities/capabilities.go')
-rw-r--r-- | vendor/k8s.io/kubernetes/pkg/capabilities/capabilities.go | 95 |
1 files changed, 0 insertions, 95 deletions
diff --git a/vendor/k8s.io/kubernetes/pkg/capabilities/capabilities.go b/vendor/k8s.io/kubernetes/pkg/capabilities/capabilities.go deleted file mode 100644 index 0da7b9c8b..000000000 --- a/vendor/k8s.io/kubernetes/pkg/capabilities/capabilities.go +++ /dev/null @@ -1,95 +0,0 @@ -/* -Copyright 2014 The Kubernetes Authors. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -*/ - -package capabilities - -import ( - "sync" -) - -// Capabilities defines the set of capabilities available within the system. -// For now these are global. Eventually they may be per-user -type Capabilities struct { - AllowPrivileged bool - - // Pod sources from which to allow privileged capabilities like host networking, sharing the host - // IPC namespace, and sharing the host PID namespace. - PrivilegedSources PrivilegedSources - - // PerConnectionBandwidthLimitBytesPerSec limits the throughput of each connection (currently only used for proxy, exec, attach) - PerConnectionBandwidthLimitBytesPerSec int64 -} - -// PrivilegedSources defines the pod sources allowed to make privileged requests for certain types -// of capabilities like host networking, sharing the host IPC namespace, and sharing the host PID namespace. -type PrivilegedSources struct { - // List of pod sources for which using host network is allowed. - HostNetworkSources []string - - // List of pod sources for which using host pid namespace is allowed. - HostPIDSources []string - - // List of pod sources for which using host ipc is allowed. - HostIPCSources []string -} - -var capInstance struct { - once sync.Once - lock sync.Mutex - capabilities *Capabilities -} - -// Initialize the capability set. This can only be done once per binary, subsequent calls are ignored. -func Initialize(c Capabilities) { - // Only do this once - capInstance.once.Do(func() { - capInstance.capabilities = &c - }) -} - -// Setup the capability set. It wraps Initialize for improving usability. -func Setup(allowPrivileged bool, privilegedSources PrivilegedSources, perConnectionBytesPerSec int64) { - Initialize(Capabilities{ - AllowPrivileged: allowPrivileged, - PrivilegedSources: privilegedSources, - PerConnectionBandwidthLimitBytesPerSec: perConnectionBytesPerSec, - }) -} - -// SetForTests sets capabilities for tests. Convenience method for testing. This should only be called from tests. -func SetForTests(c Capabilities) { - capInstance.lock.Lock() - defer capInstance.lock.Unlock() - capInstance.capabilities = &c -} - -// Returns a read-only copy of the system capabilities. -func Get() Capabilities { - capInstance.lock.Lock() - defer capInstance.lock.Unlock() - // This check prevents clobbering of capabilities that might've been set via SetForTests - if capInstance.capabilities == nil { - Initialize(Capabilities{ - AllowPrivileged: false, - PrivilegedSources: PrivilegedSources{ - HostNetworkSources: []string{}, - HostPIDSources: []string{}, - HostIPCSources: []string{}, - }, - }) - } - return *capInstance.capabilities -} |