func (pl *ProfileLoader) handleContainerRunning(event *model.ContainerEvent) error {
	labelSelector := metav1.LabelSelector{}
	pod := event.Labels["io.kubernetes.pod.name"]
	namespace, ok := event.Labels["io.kubernetes.pod.namespace"]
	if !ok {
		namespace = "default"
		labelSelector.MatchLabels = map[string]string{
			"image": event.K8sLabelImage,
		}
		if event.Tag != "" {
			labelSelector.MatchLabels["tag"] = event.Tag
		}
	} else {
		app, ok := event.Labels["app"]
		if !ok {
			labelSelector.MatchLabels = map[string]string{
				"pod":       pod,
				"namespace": namespace,
			}
		} else {
			labelSelector.MatchLabels = map[string]string{
				"app": app,
			}
		}
	}
	// Save running container metadata
	container := ContainerMetadata{
		ContainerID: event.ContainerID,
		Image:       event.Image,
		Tag:         event.Tag,
		Pod:         pod,
		Namespace:   namespace,
		Netns:       event.Netns,
		Pidns:       event.Pidns,
		Labels:      labels.Set(labelSelector.MatchLabels),
	}
	pl.RunningContainers[event.ContainerID] = &container
	// Look for the security profile
	profiles, err := pl.SecurityProbeClientSet.SecurityprobeV1().SecurityProfiles(namespace).List(metav1.ListOptions{
		LabelSelector: labels.Set(labelSelector.MatchLabels).String(),
		Limit:         1,
	})
	if err != nil {
		return err
	}
	if len(profiles.Items) == 0 {
		// return fmt.Errorf("No security profile found for %v %v:%v", labelSelector.MatchLabels, event.Image, event.Tag)
		return nil
	}
	profileLoaderLogger.Debugf("Applying security profile %s to workload %v", profiles.Items[0].UID, labelSelector.MatchLabels)
	profileVersion := ProfileVersion{
		UID:             profiles.Items[0].UID,
		ResourceVersion: profiles.Items[0].ResourceVersion,
	}
	profile, ok := pl.LoadedProfiles[profileVersion]
	if !ok {
		profile = &ProfileMetadata{
			ProfileVersion: profileVersion,
			Profile:        &profiles.Items[0],
			ContainerIDs:   []string{},
		}
	}
	if err := pl.CommitSecurityProfile(profile, &container); err != nil {
		return err
	}
	pl.LoadedProfiles[profile.ProfileVersion] = profile
	return nil
}
// handleContainerRunning - Handles a container running event
Handles a container running event
// handleContainerRunning - Handles a container running event
func (pl *ProfileLoader) handleContainerRunning(event *model.ContainerEvent) error {
	labelSelector := metav1.LabelSelector{}
	pod := event.Labels["io.kubernetes.pod.name"]
	namespace, ok := event.Labels["io.kubernetes.pod.namespace"]
	if !ok {
		namespace = "default"
		labelSelector.MatchLabels = map[string]string{
			"image": event.K8sLabelImage,
		}
		if event.Tag != "" {
			labelSelector.MatchLabels["tag"] = event.Tag
		}
	} else {
		app, ok := event.Labels["app"]
		if !ok {
			labelSelector.MatchLabels = map[string]string{
				"pod":       pod,
				"namespace": namespace,
			}
		} else {
			labelSelector.MatchLabels = map[string]string{
				"app": app,
			}
		}
	}
	container := ContainerMetadata{
		ContainerID: event.ContainerID,
		Image:       event.Image,
		Tag:         event.Tag,
		Pod:         pod,
		Namespace:   namespace,
		Netns:       event.Netns,
		Pidns:       event.Pidns,
		Labels:      labels.Set(labelSelector.MatchLabels),
	}
	pl.RunningContainers[event.ContainerID] = &container
	profiles, err := pl.SecurityProbeClientSet.SecurityprobeV1().SecurityProfiles(namespace).List(metav1.ListOptions{
		LabelSelector: labels.Set(labelSelector.MatchLabels).String(),
		Limit:         1,
	})
	if err != nil {
		return err
	}
	if len(profiles.Items) == 0 {
		return nil
	}
	profileLoaderLogger.Debugf("Applying security profile %s to workload %v", profiles.Items[0].UID, labelSelector.MatchLabels)
	profileVersion := ProfileVersion{
		UID:             profiles.Items[0].UID,
		ResourceVersion: profiles.Items[0].ResourceVersion,
	}
	profile, ok := pl.LoadedProfiles[profileVersion]
	if !ok {
		profile = &ProfileMetadata{
			ProfileVersion: profileVersion,
			Profile:        &profiles.Items[0],
			ContainerIDs:   []string{},
		}
	}
	if err := pl.CommitSecurityProfile(profile, &container); err != nil {
		return err
	}
	pl.LoadedProfiles[profile.ProfileVersion] = profile
	return nil
}
func ( pl * ProfileLoader ) handleContainerRunning ( event * model . ContainerEvent ) error { labelSelector := metav1 . LabelSelector { } pod := event . Labels [ " " ] namespace , ok := event . Labels [ " " ] if ! ok { namespace = " " labelSelector . MatchLabels = map [ string ] string { " " : event . K8sLabelImage , } if event . Tag != " " { labelSelector . MatchLabels [ " " ] = event . Tag } } else { app , ok := event . Labels [ " " ] if ! ok { labelSelector . MatchLabels = map [ string ] string { " " : pod , " " : namespace , } } else { labelSelector . MatchLabels = map [ string ] string { " " : app , } } } container := ContainerMetadata { ContainerID : event . ContainerID , Image : event . Image , Tag : event . Tag , Pod : pod , Namespace : namespace , Netns : event . Netns , Pidns : event . Pidns , Labels : labels . Set ( labelSelector . MatchLabels ) , } pl . RunningContainers [ event . ContainerID ] = & container profiles , err := pl . SecurityProbeClientSet . SecurityprobeV1 ( ) . SecurityProfiles ( namespace ) . List ( metav1 . ListOptions { LabelSelector : labels . Set ( labelSelector . MatchLabels ) . String ( ) , Limit : 1 , } ) if err != nil { return err } if len ( profiles . Items ) == 0 { return nil } profileLoaderLogger . Debugf ( " " , profiles . Items [ 0 ] . UID , labelSelector . MatchLabels ) profileVersion := ProfileVersion { UID : profiles . Items [ 0 ] . UID , ResourceVersion : profiles . Items [ 0 ] . ResourceVersion , } profile , ok := pl . LoadedProfiles [ profileVersion ] if ! ok { profile = & ProfileMetadata { ProfileVersion : profileVersion , Profile : & profiles . Items [ 0 ] , ContainerIDs : [ ] string { } , } } if err := pl . CommitSecurityProfile ( profile , & container ) ; err != nil { return err } pl . LoadedProfiles [ profile . ProfileVersion ] = profile return nil }
Handles a container running event
Handles a container running event
// Save running container metadata // Look for the security profile // return fmt.Errorf("No security profile found for %v %v:%v", labelSelector.MatchLabels, event.Image, event.Tag)