Documentation
¶
Overview ¶
Package attention builds the list of things an operator should look at right now, shared by the CLI and the MCP server.
Index ¶
Constants ¶
const ( Critical = "critical" Warning = "warning" Info = "info" )
Severity levels, critical first. Info is for resolved items that need no action, such as a login that expired.
const ( KindDeviceLogin = "device_login" KindDeviceLoginResolved = "device_login_resolved" KindApproval = "approval" KindTokenExpiring = "token_expiring" //nolint:gosec // item kind name, not a credential KindTokenExpired = "token_expired" //nolint:gosec // item kind name, not a credential KindDataCopy = "data_copy" KindBackupOverdue = "backup_overdue" KindInvites = "invites" KindLoginCode = "login_code" KindLoginApproval = "login_approval" KindLoginAnomaly = "login_anomaly" KindAccountFlagged = "account_flagged" KindTokenUnused = "token_unused" //nolint:gosec // item kind name, not a credential KindDBSecurityUpdates = "db_security_updates" KindDBEOL = "db_eol" KindDBUpgradeFailed = "db_upgrade_failed" KindDockerGuard = "docker_guard" KindUpgradeBlocked = "upgrade_blocked" KindResourceAdvice = "resource_advice" KindSecretRotationDue = "secret_rotation_due" KindSecretRotationFail = "secret_rotation_failed" KindQuotaNearLimit = "quota_near_limit" KindAccessReviewOverdue = "access_review_overdue" )
Item kinds that block on a person, ranked ahead of other items of the same severity.
const ( ClassIncident = "incident" ClassRecommendation = "recommendation" )
Class separates things that are broken or about to break from setup and hardening advice. Only incidents belong on the dashboard and the header chip; recommendations live in the notification centre.
const EnvShortLivedCert = "APP_ATTENTION_SHORT_LIVED_CERT"
EnvShortLivedCert tunes how short a certificate lifetime counts as auto-renewed internal issuance that never needs attention.
Variables ¶
This section is empty.
Functions ¶
func CertExpiryClass ¶
CertExpiryClass returns ClassIncident when the certificate's expiry needs an operator, else "". Internal-CA, proxy-owned and unrouted certificates never raise one, and an auto-renewing ACME certificate only does once it expired or its renewal stalled. Uploaded certificates do not renew themselves, so they count as soon as they enter the warning window.
func ClassOf ¶
ClassOf classifies one item. An enforce-mode guard denial and every other unlisted kind is an incident.
func DoctorClass ¶
DoctorClass classifies a doctor check that is not ok. A failed check is always an incident.
func ShortLivedCertLimit ¶
ShortLivedCertLimit reads APP_ATTENTION_SHORT_LIVED_CERT.
Types ¶
type CertFacts ¶
type CertFacts struct {
Issuer string
Source string
TLSOwner string
Status string
Renewal string
NotBefore time.Time
NotAfter time.Time
// Routed is false for a certificate whose domain no app or site serves.
Routed bool
}
CertFacts is what the expiry rules decide from.
type Input ¶
type Input struct {
Apps []apiclient.AppStatusEntry
Nodes []apiclient.NodeResource
Certs []apiclient.CertificateResource
Doctor apiclient.SystemDoctorResource
Failed []apiclient.FailedDeployResource
Status apiclient.SystemStatusResource
Updates apiclient.UpdatesResource
// Devices are CLI logins waiting for approval, Approvals are pending
// deploy approvals. Now defaults to time.Now when zero.
Devices []apiclient.DevicePendingLogin
Approvals []apiclient.DeployApprovalResource
// Resolved are recent expired or denied CLI logins the caller has not
// dismissed. Feed holds the server-built items for tokens, data copies,
// backups and invitations, already limited to what the caller may see.
Resolved []apiclient.DeviceActivity
Feed []apiclient.AttentionFeedItem
Now time.Time
}
Input is everything Build reads; any field may be zero when its endpoint was unavailable.
type Item ¶
type Item struct {
Severity string `json:"severity"`
Kind string `json:"kind"`
Subject string `json:"subject"`
Detail string `json:"detail"`
// Fixable is set on deploy and app items whose diagnosis carries a
// one-click fix.
Fixable bool `json:"fixable,omitempty"`
// ID is stable across polls for the same condition. Title is one plain
// line, Action the next step, Link a dashboard path to do it in.
ID string `json:"id"`
Title string `json:"title"`
Action string `json:"action"`
Link string `json:"link"`
Params map[string]string `json:"params,omitempty"`
// Class is ClassIncident or ClassRecommendation.
Class string `json:"class"`
}
Item is one thing that needs an operator's attention.
func Build ¶
Build mirrors web/src/lib/attention.ts: disk pressure, failing apps, recent failed deploys, offline nodes, bad certificates, and doctor warnings or failures, critical first.
Source Files