github.com/timstclair/heapster@v0.20.0-alpha1/Godeps/_workspace/src/k8s.io/kubernetes/pkg/capabilities/capabilities.go (about)

     1  /*
     2  Copyright 2014 The Kubernetes Authors All rights reserved.
     3  
     4  Licensed under the Apache License, Version 2.0 (the "License");
     5  you may not use this file except in compliance with the License.
     6  You may obtain a copy of the License at
     7  
     8      http://www.apache.org/licenses/LICENSE-2.0
     9  
    10  Unless required by applicable law or agreed to in writing, software
    11  distributed under the License is distributed on an "AS IS" BASIS,
    12  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    13  See the License for the specific language governing permissions and
    14  limitations under the License.
    15  */
    16  
    17  package capabilities
    18  
    19  import (
    20  	"sync"
    21  )
    22  
    23  // Capabilities defines the set of capabilities available within the system.
    24  // For now these are global.  Eventually they may be per-user
    25  type Capabilities struct {
    26  	AllowPrivileged bool
    27  
    28  	// Pod sources from which to allow privileged capabilities like host networking, sharing the host
    29  	// IPC namespace, and sharing the host PID namespace.
    30  	PrivilegedSources PrivilegedSources
    31  
    32  	// PerConnectionBandwidthLimitBytesPerSec limits the throughput of each connection (currently only used for proxy, exec, attach)
    33  	PerConnectionBandwidthLimitBytesPerSec int64
    34  }
    35  
    36  // PrivilegedSources defines the pod sources allowed to make privileged requests for certain types
    37  // of capabilities like host networking, sharing the host IPC namespace, and sharing the host PID namespace.
    38  type PrivilegedSources struct {
    39  	// List of pod sources for which using host network is allowed.
    40  	HostNetworkSources []string
    41  
    42  	// List of pod sources for which using host pid namespace is allowed.
    43  	HostPIDSources []string
    44  
    45  	// List of pod sources for which using host ipc is allowed.
    46  	HostIPCSources []string
    47  }
    48  
    49  // TODO: Clean these up into a singleton
    50  var once sync.Once
    51  var lock sync.Mutex
    52  var capabilities *Capabilities
    53  
    54  // Initialize the capability set.  This can only be done once per binary, subsequent calls are ignored.
    55  func Initialize(c Capabilities) {
    56  	// Only do this once
    57  	once.Do(func() {
    58  		capabilities = &c
    59  	})
    60  }
    61  
    62  // Setup the capability set.  It wraps Initialize for improving usibility.
    63  func Setup(allowPrivileged bool, privilegedSources PrivilegedSources, perConnectionBytesPerSec int64) {
    64  	Initialize(Capabilities{
    65  		AllowPrivileged:                        allowPrivileged,
    66  		PrivilegedSources:                      privilegedSources,
    67  		PerConnectionBandwidthLimitBytesPerSec: perConnectionBytesPerSec,
    68  	})
    69  }
    70  
    71  // SetCapabilitiesForTests.  Convenience method for testing.  This should only be called from tests.
    72  func SetForTests(c Capabilities) {
    73  	lock.Lock()
    74  	defer lock.Unlock()
    75  	capabilities = &c
    76  }
    77  
    78  // Returns a read-only copy of the system capabilities.
    79  func Get() Capabilities {
    80  	lock.Lock()
    81  	defer lock.Unlock()
    82  	// This check prevents clobbering of capabilities that might've been set via SetForTests
    83  	if capabilities == nil {
    84  		Initialize(Capabilities{
    85  			AllowPrivileged: false,
    86  			PrivilegedSources: PrivilegedSources{
    87  				HostNetworkSources: []string{},
    88  				HostPIDSources:     []string{},
    89  				HostIPCSources:     []string{},
    90  			},
    91  		})
    92  	}
    93  	return *capabilities
    94  }