Documentation
¶
Overview ¶
Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. *
This product includes software developed at Datadog (https://www.datadoghq.com) Copyright 2024 Datadog, Inc.
Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. *
This product includes software developed at Datadog (https://www.datadoghq.com) Copyright 2024 Datadog, Inc.
Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. *
This product includes software developed at Datadog (https://www.datadoghq.com) Copyright 2024 Datadog, Inc.
Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. *
This product includes software developed at Datadog (https://www.datadoghq.com) Copyright 2024 Datadog, Inc.
Package utils contains various utility functions to use in other packages
Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. *
This product includes software developed at Datadog (https://www.datadoghq.com) Copyright 2024 Datadog, Inc.
Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. *
This product includes software developed at Datadog (https://www.datadoghq.com) Copyright 2024 Datadog, Inc.
Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. *
This product includes software developed at Datadog (https://www.datadoghq.com) Copyright 2024 Datadog, Inc.
Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. *
This product includes software developed at Datadog (https://www.datadoghq.com) Copyright 2024 Datadog, Inc.
Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. *
This product includes software developed at Datadog (https://www.datadoghq.com) Copyright 2024 Datadog, Inc.
Index ¶
- Constants
- func AdjustNumWorkers(workers int) int
- func AvailableCPUs() int
- func CPUBound(ctx context.Context, fn func() error) error
- func ChooseQueryID(queryID, legacyQueryID string) string
- func Contains(target, list interface{}) bool
- func ContainsInString(target string, list []string) bool
- func DecryptAnsibleVault(ctx context.Context, fileContent []byte, secret string) []byte
- func ExtensionFromPath(path string) string
- func ForEach[T any](ctx context.Context, items []T, opts PoolOptions, ...) error
- func GetExtension(ctx context.Context, path string) (string, error)
- func GetExtensionWithFS(ctx context.Context, fsys vfs.FS, path string) (string, error)
- func GetVaultPassword() string
- func HandlePanic(ctx context.Context, r any, errMessage string)
- func IsAnsibleVaultEncrypted(content []byte) bool
- func LineCounter(ctx context.Context, path string) (int, error)
- func MergeMaps(map1, map2 map[string]interface{})
- func NextRandom() string
- func NormalizeAnsibleResourceType(resourceType string) string
- func ReadVaultPassword(filePath string) string
- func SplitLines(content string) *[]string
- func ToID(platform, provider, dir string) string
- func ToSlug(name string) string
- type PoolOptions
Constants ¶
const ( UndetectedVulnerabilityLine = -1 DefaultQueryID = "Undefined" DefaultQueryName = "Anonymous" DefaultExperimental = false DefaultQueryDescription = "Undefined" DefaultQueryDescriptionID = "Undefined" DefaultQueryURI = "https://github.com/DataDog/datadog-iac-scanner/" UnresolvedPlaceholder = "__UNRESOLVED__" // RegoQuery is the OPA query evaluated against every rule module. RegoQuery = `result = data.datadog.DatadogPolicy` )
Constants with default query values
const ( IOMinWorkers = 4 IOMaxWorkers = 64 )
IO worker bounds. I/O-bound pools (file open/read) fan out wider than the core count because workers spend most of their time blocked on the kernel, so more goroutines than cores keeps the disk/FS queue full. The floor guarantees useful parallelism on tiny machines; the ceiling caps open file descriptors.
Variables ¶
This section is empty.
Functions ¶
func AdjustNumWorkers ¶
AdjustNumWorkers normalizes a requested worker count. A value of 0 means "auto-detect": use the number of CPUs the process may actually use.
func AvailableCPUs ¶ added in v1.7.0
func AvailableCPUs() int
AvailableCPUs returns the number of CPUs this process can realistically use, as a whole number >= 1. We trust GOMAXPROCS: as of Go 1.25 the runtime initializes GOMAXPROCS from the cgroup CPU bandwidth limit on Linux (and keeps it updated), so in a container it already reflects the CPU quota rather than the host core count.
func CPUBound ¶ added in v1.7.0
CPUBound runs fn while holding one slot of the process-wide CPU budget. It blocks until a slot is free or ctx is canceled (returning ctx.Err()).
func ChooseQueryID ¶ added in v1.3.0
func Contains ¶
func Contains(target, list interface{}) bool
Contains if a function to check if list contains target
func ContainsInString ¶
ContainsInString verifies if some string in list contains the specified target
func DecryptAnsibleVault ¶
DecryptAnsibleVault verifies if the fileContent is encrypted by ansible-vault. If yes, the function decrypts it
func ExtensionFromPath ¶ added in v1.7.2
ExtensionFromPath returns the extension from path alone (no stat/read).
func ForEach ¶ added in v1.7.0
func ForEach[T any](ctx context.Context, items []T, opts PoolOptions, fn func(ctx context.Context, item T, index int) error) error
ForEach runs fn over every item using a bounded worker pool. It replaces the hand-rolled "jobs channel + N goroutines + WaitGroup + closer" pattern that was duplicated across the engine, analyzer and Terraform-module parsers.
fn receives the original slice index so callers can write results into a preallocated, index-aligned output slice without sharing mutable state.
If opts.CPUBound is set, each invocation of fn is wrapped in CPUBound so the work draws from the shared process-wide CPU budget. The first non-nil error cancels the remaining work and is returned.
SetLimit and CPUBound are two distinct limits and both are needed:
- g.SetLimit caps goroutines for THIS pool. It bounds fan-out width and memory per pool, and applies to I/O-bound pools too (where it can exceed the core count, e.g. [4,64], so blocked file reads keep the disk busy).
- CPUBound draws from a single semaphore shared by ALL pools process-wide. It bounds how much CPU-heavy work runs at once regardless of how pools nest — N per-platform scans each running their own query pool cannot collectively oversubscribe the cores. SetLimit alone can't do this: each pool's limit is independent, so nesting would multiply (N x limit).
func GetExtension ¶
GetExtension gets the extension of a file path on the real filesystem.
func GetExtensionWithFS ¶ added in v1.7.0
GetExtensionWithFS gets the extension of a file path, reading file metadata and content through fsys. The HTTP server passes an in-memory FS so extension detection works for pushed content that never touches disk; the CLI passes the real disk (the default, via GetExtension), preserving existing behavior.
func GetVaultPassword ¶ added in v0.0.9
func GetVaultPassword() string
GetVaultPassword returns the vault password read from ANSIBLE_VAULT_PASSWORD_FILE, cached after the first call.
func IsAnsibleVaultEncrypted ¶ added in v0.0.9
IsAnsibleVaultEncrypted reports whether content is Ansible Vault encrypted.
func LineCounter ¶
LineCounter get the number of lines of a given file
func NormalizeAnsibleResourceType ¶ added in v0.0.5
NormalizeAnsibleResourceType returns the Ansible content name (last segment after ".") from a fully qualified collection name (FQCN) or short name. Used so that rego rules can output either "community.aws.ec2_instance" or "ec2_instance" and we consistently expose "ec2_instance". If resourceType has no ".", it is returned unchanged.
func ReadVaultPassword ¶ added in v0.0.9
ReadVaultPassword reads the vault password from the file at filePath.
Types ¶
type PoolOptions ¶ added in v1.7.0
type PoolOptions struct {
// Workers is the desired fan-out width. 0 means auto-detect (AvailableCPUs).
Workers int
// MinWorkers, when > 0, raises an AUTO-DETECTED worker count up to this floor.
// It does not apply when Workers is set explicitly: an explicit low count is
// a deliberate concurrency limit and must be honored, not floored.
MinWorkers int
// MaxWorkers, when > 0, caps Workers at this ceiling (applies to both
// auto-detected and explicit counts; e.g. an open-file-descriptor cap).
MaxWorkers int
// CPUBound, when true, makes each item acquire one slot of the shared CPU
// budget before running. Leave false for I/O-bound work (file reads, network)
// so it does not occupy a CPU slot while blocked.
CPUBound bool
}
PoolOptions configures ForEach.
Source Files