Documentation
¶
Overview ¶
Package exclusions loads YAML rules that mute specific findings (system namespaces, expected workloads, etc.) and applies them to analyzer output. The standard preset is auto-applied by the scan/scan-resource/report commands so built-in Kubernetes noise (kube-system, system:*, kubeadm:*) is suppressed by default; the user can opt out with --exclusions-preset=none. Apply drops matched findings from the slice (the Excluded field on Finding is reserved for future audit-mode rendering, not used today).
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
Types ¶
type CheckExclusion ¶
type CheckExclusion struct {
Check string `yaml:"check,omitempty"`
Namespace string `yaml:"namespace,omitempty"`
Reason string `yaml:"reason,omitempty"`
}
CheckExclusion silences a specific podsec check (matched via a "check:<name>" tag), optionally scoped to a namespace.
type Config ¶
type Config struct {
Global GlobalConfig `yaml:"global"`
RBAC RBACConfig `yaml:"rbac"`
PodSecurity PodSecurityConfig `yaml:"pod_security"`
NetworkPolicy NetworkPolicyConfig `yaml:"network_policy"`
}
Config is the top-level exclusions document, split by module for readability.
func EnrichFromSnapshot ¶
EnrichFromSnapshot reads a snapshot and auto-adds any kube-*/-system namespaces to ExcludeNamespaces so a preset can adapt to the target cluster.
func Merge ¶
Merge returns the union of base and overlay: each slice field is concatenated with base entries first, and string-slice fields are deduplicated by exact match. Struct slices (subject/workload/check exclusions) are concatenated as-is — duplicates are harmless because the matcher returns on first match. Used to layer a user-supplied --exclusions-file on top of the built-in --exclusions-preset.
func Preset ¶
Preset returns one of the built-in exclusion profiles. "standard" (default) suppresses built-in Kubernetes noise — kube-system / system:* / kubeadm:* — and is auto-applied by scan/scan-resource/report unless the user passes --exclusions-preset=none (or its alias "strict") to opt out. "minimal" only filters the most obvious system noise; "none" / "strict" return an empty config so every finding surfaces.
type GlobalConfig ¶
type GlobalConfig struct {
ExcludeNamespaces []string `yaml:"exclude_namespaces,omitempty"`
ExcludeServiceAccounts []string `yaml:"exclude_service_accounts,omitempty"` // "ns:name" patterns, wildcards allowed
ExcludeClusterRoles []string `yaml:"exclude_cluster_roles,omitempty"`
ExcludeFindingIDs []string `yaml:"exclude_finding_ids,omitempty"`
ExcludeSubjects []SubjectExclusion `yaml:"exclude_subjects,omitempty"` // matches Subject Kind/Name/Namespace patterns regardless of module
}
GlobalConfig holds exclusions that apply across all modules (namespaces, specific subjects, specific rule IDs).
type MatchResult ¶
MatchResult wraps the (possibly annotated) Finding, whether an exclusion matched, and the matching reason.
type NetworkPolicyConfig ¶
type NetworkPolicyConfig struct {
ExcludeNamespaces []string `yaml:"exclude_namespaces,omitempty"`
}
NetworkPolicyConfig scopes namespace-wide exclusions for the network module.
type PodSecurityConfig ¶
type PodSecurityConfig struct {
ExcludeWorkloads []WorkloadExclusion `yaml:"exclude_workloads,omitempty"`
ExcludeChecks []CheckExclusion `yaml:"exclude_checks,omitempty"`
}
PodSecurityConfig scopes workload-identity and per-check exclusions for the podsec module.
type RBACConfig ¶
type RBACConfig struct {
ExcludeSubjects []SubjectExclusion `yaml:"exclude_subjects,omitempty"`
}
RBACConfig scopes subject-level RBAC exclusions.
type SubjectExclusion ¶
type SubjectExclusion struct {
Kind string `yaml:"kind,omitempty"`
Name string `yaml:"name,omitempty"`
Namespace string `yaml:"namespace,omitempty"`
Reason string `yaml:"reason,omitempty"`
}
SubjectExclusion silences findings whose Subject matches all set fields; Reason is surfaced in ExclusionReason.
type WorkloadExclusion ¶
type WorkloadExclusion struct {
Kind string `yaml:"kind,omitempty"`
Name string `yaml:"name,omitempty"`
NamePattern string `yaml:"name_pattern,omitempty"`
Namespace string `yaml:"namespace,omitempty"`
Reason string `yaml:"reason,omitempty"`
}
WorkloadExclusion silences findings about a specific workload; NamePattern supports shell-style globs.
Source Files