// modifySandboxNamespaceOptions apply namespace options for sandbox
494722
func modifySandboxNamespaceOptions(nsOpts *runtimeapi.NamespaceOption, hostConfig *dockercontainer.HostConfig, network *knetwork.PluginManager) {
	// The sandbox's PID namespace is the one that's shared, so CONTAINER and POD are equivalent for it
	modifyCommonNamespaceOptions(nsOpts, hostConfig)
	modifyHostOptionsForSandbox(nsOpts, network, hostConfig)
}
432997
func (p Proc) NewNamespaces() (Namespaces, error) {
	d, err := os.Open(p.path("ns"))
	if err != nil {
		return nil, err
	}
	defer d.Close()

	names, err := d.Readdirnames(-1)
	if err != nil {
		return nil, fmt.Errorf("failed to read contents of ns dir: %v", err)
	}

	ns := make(Namespaces, len(names))
	for _, name := range names {
		target, err := os.Readlink(p.path("ns", name))
		if err != nil {
			return nil, err
		}

		fields := strings.SplitN(target, ":", 2)
		if len(fields) != 2 {
			return nil, fmt.Errorf("failed to parse namespace type and inode from '%v'", target)
		}

		typ := fields[0]
		inode, err := strconv.ParseUint(strings.Trim(fields[1], "[]"), 10, 32)
		if err != nil {
			return nil, fmt.Errorf("failed to parse inode from '%v': %v", fields[1], err)
		}

		ns[name] = Namespace{typ, uint32(inode)}
	}

	return ns, nil
}
190749
func (ioctx *IOContext) SetNamespace(namespace string) {
	var c_ns *C.char
	if len(namespace) > 0 {
		c_ns = C.CString(namespace)
		defer C.free(unsafe.Pointer(c_ns))
	}
	C.rados_ioctx_set_namespace(ioctx.ioctx, c_ns)
}
961365
func Namespace(name string, s func()) error {
	defer func() {
		namespace = ""
	}()

	namespace = applyNamespace(name)
	s()
	return nil
}
99772
func WithNamespaceService(namespaceService namespacesapi.NamespacesClient) ServicesOpt {
	return func(s *services) {
		s.namespaceStore = NewNamespaceStoreFromClient(namespaceService)
	}
}
805744
func networkNamespaceMode(container *dockertypes.ContainerJSON) runtimeapi.NamespaceMode {
	if container != nil && container.HostConfig != nil && string(container.HostConfig.NetworkMode) == namespaceModeHost {
		return runtimeapi.NamespaceMode_NODE
	}
	return runtimeapi.NamespaceMode_POD
}
655423
func modifyHostConfig(sc *runtimeapi.LinuxContainerSecurityContext, hostConfig *dockercontainer.HostConfig, separator rune) error {
	if sc == nil {
		return nil
	}

	// Apply supplemental groups.
	for _, group := range sc.SupplementalGroups {
		hostConfig.GroupAdd = append(hostConfig.GroupAdd, strconv.FormatInt(group, 10))
	}

	// Apply security context for the container.
	hostConfig.Privileged = sc.Privileged
	hostConfig.ReadonlyRootfs = sc.ReadonlyRootfs
	if sc.Capabilities != nil {
		hostConfig.CapAdd = sc.GetCapabilities().AddCapabilities
		hostConfig.CapDrop = sc.GetCapabilities().DropCapabilities
	}
	if sc.SelinuxOptions != nil {
		hostConfig.SecurityOpt = addSELinuxOptions(
			hostConfig.SecurityOpt,
			sc.SelinuxOptions,
			separator,
		)
	}

	// Apply apparmor options.
	apparmorSecurityOpts, err := getApparmorSecurityOpts(sc, separator)
	if err != nil {
		return fmt.Errorf("failed to generate apparmor security options: %v", err)
	}
	hostConfig.SecurityOpt = append(hostConfig.SecurityOpt, apparmorSecurityOpts...)

	if sc.NoNewPrivs {
		hostConfig.SecurityOpt = append(hostConfig.SecurityOpt, "no-new-privileges")
	}

	if !hostConfig.Privileged {
		hostConfig.MaskedPaths = sc.MaskedPaths
		hostConfig.ReadonlyPaths = sc.ReadonlyPaths
	}

	return nil
}
1298523
func OptionHostname(name string) SandboxOption {
	return func(sb *sandbox) {
		sb.config.hostName = name
	}
}
663022
func (k *kubernetesClient) Namespaces() ([]string, error) {
	namespaces := k.client().CoreV1().Namespaces()
	ns, err := namespaces.List(v1.ListOptions{IncludeUninitialized: true})
	if err != nil {
		return nil, errors.Annotate(err, "listing namespaces")
	}
	result := make([]string, len(ns.Items))
	for i, n := range ns.Items {
		if err := checkNamespaceOwnedByJuju(&n, k.annotations); err != nil {
			continue
		}
		result[i] = n.Name
	}
	return result, nil
}
148354
func ipcNamespaceMode(container *dockertypes.ContainerJSON) runtimeapi.NamespaceMode {
	if container != nil && container.HostConfig != nil && string(container.HostConfig.IpcMode) == namespaceModeHost {
		return runtimeapi.NamespaceMode_NODE
	}
	return runtimeapi.NamespaceMode_POD
}
84847
func GetNamespaceEngine(config map[string]string) TSDSDBEngine {
	db := golkeyval.GetDBEngine(config["DBEngine"])
	db.Configure(config)
	db.CreateDB()

	ns := golkeyvalNS.GetNSDBEngine(config["NSEngine"])
	ns.Configure(db)

	tsds := GetTSDSDBEngine("namespace")
	tsds.Configure(ns)
	return tsds
}
313906
func (sc *sandboxCreate) parseOptions() []libnetwork.SandboxOption {
	var setFctList []libnetwork.SandboxOption
	if sc.HostName != "" {
		setFctList = append(setFctList, libnetwork.OptionHostname(sc.HostName))
	}
	if sc.DomainName != "" {
		setFctList = append(setFctList, libnetwork.OptionDomainname(sc.DomainName))
	}
	if sc.HostsPath != "" {
		setFctList = append(setFctList, libnetwork.OptionHostsPath(sc.HostsPath))
	}
	if sc.ResolvConfPath != "" {
		setFctList = append(setFctList, libnetwork.OptionResolvConfPath(sc.ResolvConfPath))
	}
	if sc.UseDefaultSandbox {
		setFctList = append(setFctList, libnetwork.OptionUseDefaultSandbox())
	}
	if sc.UseExternalKey {
		setFctList = append(setFctList, libnetwork.OptionUseExternalKey())
	}
	if sc.DNS != nil {
		for _, d := range sc.DNS {
			setFctList = append(setFctList, libnetwork.OptionDNS(d))
		}
	}
	if sc.ExtraHosts != nil {
		for _, e := range sc.ExtraHosts {
			setFctList = append(setFctList, libnetwork.OptionExtraHost(e.Name, e.Address))
		}
	}
	if sc.ExposedPorts != nil {
		setFctList = append(setFctList, libnetwork.OptionExposedPorts(sc.ExposedPorts))
	}
	if sc.PortMapping != nil {
		setFctList = append(setFctList, libnetwork.OptionPortMapping(sc.PortMapping))
	}
	return setFctList
}
719878
func (r *RoleV3) SetNamespaces(rct RoleConditionType, namespaces []string) {
	ncopy := utils.CopyStrings(namespaces)

	if rct == Allow {
		r.Spec.Allow.Namespaces = ncopy
	} else {
		r.Spec.Deny.Namespaces = ncopy
	}
}
697058
func (uvm *UtilityVM) isNetworkNamespaceSupported() bool {
	p, err := uvm.ComputeSystem().Properties(schema1.PropertyTypeGuestConnection)
	if err == nil {
		return p.GuestConnectionInfo.GuestDefinedCapabilities.NamespaceAddRequestSupported
	}

	return false
}
890730
func (s *PresenceService) UpsertNamespace(n services.Namespace) error {
	if err := n.CheckAndSetDefaults(); err != nil {
		return trace.Wrap(err)
	}
	value, err := services.MarshalNamespace(n)
	if err != nil {
		return trace.Wrap(err)
	}
	item := backend.Item{
		Key:     backend.Key(namespacesPrefix, n.Metadata.Name, paramsPrefix),
		Value:   value,
		Expires: n.Metadata.Expiry(),
		ID:      n.Metadata.ID,
	}

	_, err = s.Put(context.TODO(), item)
	if err != nil {
		return trace.Wrap(err)
	}
	return nil
}
767070
func NamespaceKeyFunc(ctx context.Context, prefix string, name string) (string, error) {
	key := NamespaceKeyRootFunc(ctx, prefix)
	ns, ok := genericapirequest.NamespaceFrom(ctx)
	if !ok || len(ns) == 0 {
		return "", kubeerr.NewBadRequest("Namespace parameter required.")
	}
	if len(name) == 0 {
		return "", kubeerr.NewBadRequest("Name parameter required.")
	}
	if msgs := path.IsValidPathSegmentName(name); len(msgs) != 0 {
		return "", kubeerr.NewBadRequest(fmt.Sprintf("Name parameter invalid: %q: %s", name, strings.Join(msgs, ";")))
	}
	key = key + "/" + name
	return key, nil
}
519440
func applySandboxSecurityContext(lc *runtimeapi.LinuxPodSandboxConfig, config *dockercontainer.Config, hc *dockercontainer.HostConfig, network *knetwork.PluginManager, separator rune) error {
	if lc == nil {
		return nil
	}

	var sc *runtimeapi.LinuxContainerSecurityContext
	if lc.SecurityContext != nil {
		sc = &runtimeapi.LinuxContainerSecurityContext{
			SupplementalGroups: lc.SecurityContext.SupplementalGroups,
			RunAsUser:          lc.SecurityContext.RunAsUser,
			RunAsGroup:         lc.SecurityContext.RunAsGroup,
			ReadonlyRootfs:     lc.SecurityContext.ReadonlyRootfs,
			SelinuxOptions:     lc.SecurityContext.SelinuxOptions,
			NamespaceOptions:   lc.SecurityContext.NamespaceOptions,
		}
	}

	err := modifyContainerConfig(sc, config)
	if err != nil {
		return err
	}

	if err := modifyHostConfig(sc, hc, separator); err != nil {
		return err
	}
	modifySandboxNamespaceOptions(sc.GetNamespaceOptions(), hc, network)
	return nil
}