Directories
¶
| Path | Synopsis |
|---|---|
|
Package analyzer orchestrates the individual security analysis modules (rbac, podsec, network, admission, secrets, serviceaccount, privesc), runs them in parallel against a snapshot, filters by severity threshold, and returns a sorted finding list.
|
Package analyzer orchestrates the individual security analysis modules (rbac, podsec, network, admission, secrets, serviceaccount, privesc), runs them in parallel against a snapshot, filters by severity threshold, and returns a sorted finding list. |
|
admission
Package admission analyzes Validating/MutatingWebhookConfigurations for common weaknesses like fail-open security webhooks, bypassable selectors, and exemptions that skip sensitive namespaces.
|
Package admission analyzes Validating/MutatingWebhookConfigurations for common weaknesses like fail-open security webhooks, bypassable selectors, and exemptions that skip sensitive namespaces. |
|
admission/mitigation
Package mitigation maps kubesplaining pod-security findings to the cluster admission controls that would block their workload at admission time.
|
Package mitigation maps kubesplaining pod-security findings to the cluster admission controls that would block their workload at admission time. |
|
cel
Package cel wires the user-supplied CEL rules loader/evaluator (in internal/rules/cel) into the analyzer engine's module set.
|
Package cel wires the user-supplied CEL rules loader/evaluator (in internal/rules/cel) into the analyzer engine's module set. |
|
containersec
Content for container-security findings.
|
Content for container-security findings. |
|
leastprivilege
Package leastprivilege flags RBAC grants that look broader than the subject's actual usage.
|
Package leastprivilege flags RBAC grants that look broader than the subject's actual usage. |
|
network
Package network analyzes NetworkPolicy coverage and permissiveness so that unprotected namespaces, uncovered workloads, and overly-broad policies surface as findings.
|
Package network analyzes NetworkPolicy coverage and permissiveness so that unprotected namespaces, uncovered workloads, and overly-broad policies surface as findings. |
|
podsec
Package podsec analyzes pod specs (and their controlling workloads) for container-runtime security issues like privileged containers, host namespace sharing, sensitive hostPath mounts, and insecure image tags.
|
Package podsec analyzes pod specs (and their controlling workloads) for container-runtime security issues like privileged containers, host namespace sharing, sensitive hostPath mounts, and insecure image tags. |
|
privesc
Package privesc builds a privilege-escalation graph from the snapshot and searches for paths that reach sensitive sinks like cluster-admin, kube-system secrets, or node escape, turning each viable path into a Finding.
|
Package privesc builds a privilege-escalation graph from the snapshot and searches for paths that reach sensitive sinks like cluster-admin, kube-system secrets, or node escape, turning each viable path into a Finding. |
|
rbac
Package rbac analyzes Role/ClusterRole bindings and flags subjects whose effective permissions enable privilege escalation or data exfiltration.
|
Package rbac analyzes Role/ClusterRole bindings and flags subjects whose effective permissions enable privilege escalation or data exfiltration. |
|
secrets
Package secrets analyzes Secret metadata and ConfigMap contents for hygiene issues such as legacy service-account tokens, sensitive kube-system data, credential-like keys leaked into ConfigMaps, and risky CoreDNS rules.
|
Package secrets analyzes Secret metadata and ConfigMap contents for hygiene issues such as legacy service-account tokens, sensitive kube-system data, credential-like keys leaked into ConfigMaps, and risky CoreDNS rules. |
|
serviceaccount
Package serviceaccount joins RBAC permissions with workload usage to flag ServiceAccounts that are actively mounted by pods and carry dangerous rights.
|
Package serviceaccount joins RBAC permissions with workload usage to flag ServiceAccounts that are actively mounted by pods and carry dangerous rights. |
|
Package baseline loads previously emitted findings.json files and computes a delta against a freshly produced findings slice.
|
Package baseline loads previously emitted findings.json files and computes a delta against a freshly produced findings slice. |
|
Package cli assembles the kubesplaining cobra commands that drive the collect → analyze → report pipeline and its supporting utilities.
|
Package cli assembles the kubesplaining cobra commands that drive the collect → analyze → report pipeline and its supporting utilities. |
|
Package collector snapshots a live Kubernetes cluster into a models.Snapshot, listing RBAC, workload, network, admission, and secret-related resources in parallel.
|
Package collector snapshots a live Kubernetes cluster into a models.Snapshot, listing RBAC, workload, network, admission, and secret-related resources in parallel. |
|
Package compliance maps Kubesplaining rule IDs to controls in the external compliance and hardening frameworks enterprise auditors expect to see (CIS Kubernetes Benchmark v1.9 and NSA/CISA Kubernetes Hardening Guide v1.2).
|
Package compliance maps Kubesplaining rule IDs to controls in the external compliance and hardening frameworks enterprise auditors expect to see (CIS Kubernetes Benchmark v1.9 and NSA/CISA Kubernetes Hardening Guide v1.2). |
|
Package connection builds authenticated Kubernetes client configurations from CLI flags, supporting kubeconfig, direct API server, and in-cluster modes.
|
Package connection builds authenticated Kubernetes client configurations from CLI flags, supporting kubeconfig, direct API server, and in-cluster modes. |
|
Package exclusions loads YAML rules that mute specific findings (system namespaces, expected workloads, etc.) and applies them to analyzer output.
|
Package exclusions loads YAML rules that mute specific findings (system namespaces, expected workloads, etc.) and applies them to analyzer output. |
|
Package manifest loads Kubernetes YAML/JSON manifests from disk into a Snapshot without talking to a live cluster.
|
Package manifest loads Kubernetes YAML/JSON manifests from disk into a Snapshot without talking to a live cluster. |
|
Package models defines the shared data types produced by the collector and consumed by the analyzers, exclusions, scoring, and report packages.
|
Package models defines the shared data types produced by the collector and consumed by the analyzers, exclusions, scoring, and report packages. |
|
Package permissions resolves RBAC bindings and roles into a flat "effective permissions" view keyed by subject.
|
Package permissions resolves RBAC bindings and roles into a flat "effective permissions" view keyed by subject. |
|
Package remediation generates structured fix payloads (kubectl patches, Kyverno / Gatekeeper policies, RBAC diffs) for findings emitted by the analyzer modules.
|
Package remediation generates structured fix payloads (kubectl patches, Kyverno / Gatekeeper policies, RBAC diffs) for findings emitted by the analyzer modules. |
|
Package report — attack-graph layout.
|
Package report — attack-graph layout. |
|
rules
|
|
|
cel
Package cel implements a loader and evaluator for user-supplied custom rules written as YAML files with a CEL expression body.
|
Package cel implements a loader and evaluator for user-supplied custom rules written as YAML files with a CEL expression body. |
|
Package scoring centralizes the composite risk-score formula and the tiny helpers analyzers share for score clamping and severity thresholding.
|
Package scoring centralizes the composite risk-score formula and the tiny helpers analyzers share for score clamping and severity thresholding. |
|
Package usage builds and queries an in-memory index of "what RBAC verbs has each subject actually exercised within an observation window?" It is the data layer behind the least-privilege analyzer: granted permissions come from the snapshot (point-in-time), observed permissions come from the kube-apiserver audit log (history), and the analyzer diffs them to surface narrowing opportunities.
|
Package usage builds and queries an in-memory index of "what RBAC verbs has each subject actually exercised within an observation window?" It is the data layer behind the least-privilege analyzer: granted permissions come from the snapshot (point-in-time), observed permissions come from the kube-apiserver audit log (history), and the analyzer diffs them to surface narrowing opportunities. |
Click to show internal directories.
Click to hide internal directories.