controller

type ChecksLoader ¶ added in v0.24.1

type ChecksLoader struct {
	// contains filtered or unexported fields
}

func NewChecksLoader(
	cfg etc.Config,
	logger logr.Logger,
	cl client.Client,
	objectResolver kube.ObjectResolver,
	pluginContext trivyoperator.PluginContext,
	pluginConfig configauditreport.PluginInMemory,
	policyLoader policy.Loader,
) *ChecksLoader

func (r *ChecksLoader) GetPolicies(ctx context.Context) (*policy.Policies, error)

func (r *ChecksLoader) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error)

func (r *ChecksLoader) SetupWithManager(mgr ctrl.Manager) error

type Misconfiguration ¶ added in v0.7.0

type Misconfiguration struct {
	// contains filtered or unexported fields
}

type NodeCollectorJobController ¶ added in v0.11.0

type NodeCollectorJobController struct {
	logr.Logger
	etc.Config
	kube.ObjectResolver
	kube.LogsReader
	PolicyLoader policy.Loader
	trivyoperator.ConfigData
	trivyoperator.PluginContext
	configauditreport.PluginInMemory
	InfraReadWriter infraassessment.ReadWriter
	trivyoperator.BuildInfo
	ChecksLoader *ChecksLoader
}

NodeCollectorJobController watches Kubernetes jobs generates v1alpha1.ClusterInfraAssessmentReport instances using infra assessment scanner

func (r *NodeCollectorJobController) SetupWithManager(mgr ctrl.Manager) error

type NodeReconciler ¶ added in v0.11.0

type NodeReconciler struct {
	logr.Logger
	etc.Config
	PolicyLoader policy.Loader
	trivyoperator.ConfigData
	kube.ObjectResolver
	trivyoperator.PluginContext
	configauditreport.PluginInMemory
	jobs.LimitChecker
	InfraReadWriter  infraassessment.ReadWriter
	CacheSyncTimeout time.Duration
	trivyoperator.BuildInfo
}

NodeReconciler reconciles corev1.Node and corev1.Job objects

to collect cluster nodes information (fileSystem permission and process arguments) the node information will be evaluated by the compliance control checks per relevant reports, examples: cis-benchmark and nsa

func (r *NodeReconciler) SetupWithManager(mgr ctrl.Manager) error

type PolicyConfigController ¶ added in v0.8.0

type PolicyConfigController struct {
	logr.Logger
	etc.Config
	kube.ObjectResolver
	trivyoperator.PluginContext
	PolicyLoader policy.Loader
	configauditreport.PluginInMemory
	ClusterVersion string
}

PolicyConfigController watches changes on policies config map and generates v1alpha1.ConfigAuditReport instances based on OPA Rego policies as fast as possible.

func (r *PolicyConfigController) SetupWithManager(mgr ctrl.Manager) error

type ResourceController ¶

type ResourceController struct {
	logr.Logger
	etc.Config
	PolicyLoader policy.Loader
	trivyoperator.ConfigData
	kube.ObjectResolver
	trivyoperator.PluginContext
	configauditreport.PluginInMemory
	configauditreport.ReadWriter
	RbacReadWriter  rbacassessment.ReadWriter
	InfraReadWriter infraassessment.ReadWriter
	trivyoperator.BuildInfo
	ClusterVersion   string
	CacheSyncTimeout time.Duration
	ChecksLoader     *ChecksLoader
}

ResourceController watches all Kubernetes kinds and generates v1alpha1.ConfigAuditReport instances based on OPA Rego policies as fast as possible.

func (r *ResourceController) SetupWithManager(mgr ctrl.Manager) error