GO-2025-3615: Kyverno vulnerable to SSRF via Service Calls in github.com/kyverno/kyverno

engine

package

v1.14.1 Latest Latest Go to latest Published: Apr 30, 2025 License: Apache-2.0 Imports: 36 Imported by: 1

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/kyverno/kyverno

Links

Open Source Insights

Documentation ¶

Index ¶

type Engine
- func NewEngine(provider Provider, nsResolver NamespaceResolver, matcher matching.Matcher, ...) Engine
type NamespaceResolver
type Policy
type Provider
- func NewKubeProvider(mgr ctrl.Manager, polexLister policiesv1alpha1listers.PolicyExceptionLister, ...) (Provider, error)
type ProviderFunc
- func NewProvider(policies []v1alpha1.ImageValidatingPolicy, ...) (ProviderFunc, error)
- func (f ProviderFunc) Fetch(ctx context.Context) ([]Policy, error)

Constants ¶

This section is empty.

Variables ¶

This section is empty.

Functions ¶

This section is empty.

Types ¶

type Engine ¶

type Engine interface {
	HandleMutating(context.Context, engine.EngineRequest) (eval.ImageVerifyEngineResponse, []jsonpatch.JsonPatchOperation, error)
	HandleValidating(context.Context, engine.EngineRequest) (eval.ImageVerifyEngineResponse, error)
}

func NewEngine ¶

func NewEngine(
	provider Provider,
	nsResolver NamespaceResolver,
	matcher matching.Matcher,
	lister k8scorev1.SecretInterface,
	registryOpts []imagedataloader.Option,
) Engine

type NamespaceResolver ¶

type NamespaceResolver = engine.NamespaceResolver

type Policy ¶

type Policy struct {
	Policy     *policiesv1alpha1.ImageValidatingPolicy
	Exceptions []*policiesv1alpha1.PolicyException
	Actions    sets.Set[admissionregistrationv1.ValidationAction]
}

type Provider ¶

type Provider = engine.Provider[Policy]

func NewKubeProvider ¶

func NewKubeProvider(
	mgr ctrl.Manager,
	polexLister policiesv1alpha1listers.PolicyExceptionLister,
	polexEnabled bool,
) (Provider, error)

type ProviderFunc ¶

type ProviderFunc func(context.Context) ([]Policy, error)

func NewProvider ¶

func NewProvider(policies []v1alpha1.ImageValidatingPolicy, exceptions []*policiesv1alpha1.PolicyException) (ProviderFunc, error)

func (ProviderFunc) Fetch ¶

func (f ProviderFunc) Fetch(ctx context.Context) ([]Policy, error)

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL