kubernetes/test/images/agnhost/webhook/pods.go

const podsInitContainerPatch …

const podsSidecarPatch …

// only allow pods to pull images from specific registry.
func admitPods(ar v1.AdmissionReview) *v1.AdmissionResponse { … }

func mutatePods(ar v1.AdmissionReview) *v1.AdmissionResponse { … }

func mutatePodsSidecar(ar v1.AdmissionReview) *v1.AdmissionResponse { … }

func hasContainer(containers []corev1.Container, containerName string) bool { … }

func applyPodPatch(ar v1.AdmissionReview, shouldPatchPod func(*corev1.Pod) bool, patch string) *v1.AdmissionResponse { … }

// denySpecificAttachment denies `kubectl attach to-be-attached-pod -i -c=container1"
// or equivalent client requests.
func denySpecificAttachment(ar v1.AdmissionReview) *v1.AdmissionResponse { … }