runner

package
v0.8.1 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 1, 2026 License: AGPL-3.0 Imports: 26 Imported by: 4

Documentation

Index

Constants

View Source 
const (
	PropPluginSource = "_plugin_source"
	PropPluginDigest = "_plugin_digest"
	PropPolicySource = "_policy_source"
	PropPolicyDigest = "_policy_digest"
)

Evidence props recording where the plugin and policy bundle came from. The agent owns them; any a plugin sets are replaced.

View Source 
const MaxApiHelperMessageBytes = 256 << 20

MaxApiHelperMessageBytes bounds one message from a plugin to the agent. Evidence is streamed one per message, so this bounds a single evidence, whose PolicyEvaluation may carry a large input such as a whole cluster; gRPC's 4 MiB default is too small for that.

Variables

View Source 
var HandshakeConfig = plugin.HandshakeConfig{
	ProtocolVersion:  1,
	MagicCookieKey:   "RUNNER_PLUGIN",
	MagicCookieValue: "AC755DCE-C118-481A-8EFA-18D8675D8122",
}
View Source 
var PluginMap = map[string]plugin.Plugin{
	"runner": &RunnerGRPCPlugin{},
}

Functions

func ActivityProtoToSdk added in v0.1.0 

func ActivityProtoToSdk(activity *proto.Activity) types.Activity

func ComponentProtoToSdk added in v0.2.0 

func ComponentProtoToSdk(comp *proto.Component) types.Component

func EvidenceProtoToSdk added in v0.2.0 

func EvidenceProtoToSdk(evidence *proto.Evidence) *types.Evidence

func EvidenceStatusStateFromEnum added in v0.2.0 

func EvidenceStatusStateFromEnum(in proto.EvidenceStatusState) string

func InitWithSubjectsAndRisksFromPolicies added in v0.3.1 

func InitWithSubjectsAndRisksFromPolicies(
	ctx context.Context,
	logger hclog.Logger,
	req *proto.InitRequest,
	apiHelper ApiHelper,
	subjectTemplates []*proto.SubjectTemplate,
) (*proto.InitResponse, error)

InitWithSubjectsAndRisksFromPolicies is a helper for RunnerV2 plugins that handles the standard Init flow: upsert subject templates, then for each policy path parse risk templates and upsert them. Errors on subject template upsert are fatal; errors on individual policy paths or risk template packages are logged and skipped so that a single bad policy does not abort the rest.

func InventoryItemProtoToSdk added in v0.2.0 

func InventoryItemProtoToSdk(in *proto.InventoryItem) types.InventoryItem

func LinkProtoToSdk added in v0.1.0 

func LinkProtoToSdk(link *proto.Link) types.Link

func NewApiHelper added in v0.1.0 

func NewApiHelper(logger hclog.Logger, client *sdk.Client, agentLabels map[string]string, pluginName string, opts ...ApiHelperOption) *apiHelper

func OriginActorProtoToSdk added in v0.1.0 

func OriginActorProtoToSdk(actor *proto.OriginActor) types.OriginActor

func OriginProtoToSdk added in v0.1.0 

func OriginProtoToSdk(origin *proto.Origin) types.Origin

func PropertyProtoToSdk added in v0.1.0 

func PropertyProtoToSdk(property *proto.Property) types.Property

func ProtoToSdk added in v0.2.0 

func ProtoToSdk[I any, O any](ins []I, transformer func(I) O) *[]O

func ProtocolProtoToSdk added in v0.2.0 

func ProtocolProtoToSdk(protocol *proto.Protocol) types.Protocol

func RemediationProtoToSdk added in v0.3.0 

func RemediationProtoToSdk(remediation *proto.Remediation) *types.Remediation

func RemediationTaskProtoToSdk added in v0.3.0 

func RemediationTaskProtoToSdk(task *proto.RemediationTask) types.RemediationTask

func RiskTemplateLabelSchemaProtoToSdk added in v0.3.2 

func RiskTemplateLabelSchemaProtoToSdk(label *proto.RiskTemplateLabelSchema) types.RiskTemplateLabelSchema

func RiskTemplateProtoToSdk added in v0.3.0 

func RiskTemplateProtoToSdk(riskTemplate *proto.RiskTemplate) *types.RiskTemplate

func StepProtoToSdk added in v0.1.0 

func StepProtoToSdk(step *proto.Step) types.Step

func SubjectLabelSchemaProtoToSdk added in v0.3.0 

func SubjectLabelSchemaProtoToSdk(label *proto.SubjectLabelSchema) types.SubjectTemplateLabelSchema

func SubjectLinkProtoToSdk added in v0.3.0 

func SubjectLinkProtoToSdk(link *proto.SubjectLink) types.SubjectLink

func SubjectPropToSdk added in v0.3.0 

func SubjectPropToSdk(prop *proto.SubjectProp) types.SubjectProp

func SubjectProtoToSdk added in v0.2.0 

func SubjectProtoToSdk(subject *proto.Subject) types.Subject

func SubjectSelectorLabelProtoToSdk added in v0.3.0 

func SubjectSelectorLabelProtoToSdk(label *proto.SubjectLabelSelector) types.SubjectTemplateSelectorLabel

func SubjectTemplateProtoToSdk added in v0.3.0 

func SubjectTemplateProtoToSdk(subjectTemplate *proto.SubjectTemplate) *types.SubjectTemplate

func SubjectTypeFromEnum added in v0.2.0 

func SubjectTypeFromEnum(in proto.SubjectType) string

func ThreatRefProtoToSdk added in v0.3.0 

func ThreatRefProtoToSdk(threatRef *proto.ThreatRef) types.ThreatRef

Types

type ApiHelper added in v0.0.13 

type ApiHelper interface {
	CreateEvidence(context.Context, []*proto.Evidence) error
	UpsertRiskTemplates(context.Context, string, []*proto.RiskTemplate) error
	UpsertSubjectTemplates(context.Context, []*proto.SubjectTemplate) error
}

type ApiHelperOption added in v0.8.0 

type ApiHelperOption func(*apiHelper)

func WithPolicyPaths added in v0.8.0 

func WithPolicyPaths(paths []string) ApiHelperOption

WithPolicyPaths sets the policy bundle paths the plugin was given. The agent uploads only these bundles as artifacts, so a plugin cannot make the agent read anything else.

func WithSources added in v0.8.0 

func WithSources(plugin Source, policies map[string]Source) ApiHelperOption

WithSources sets where the plugin came from, and where each policy bundle came from, keyed by the local path the agent gave the plugin.

type EvidenceSender added in v0.8.0 

type EvidenceSender interface {
	Send(*proto.Evidence)
	Close() error
}

EvidenceSender takes evidence one at a time. Send handles each evidence as it arrives; Close reports every failure since the sender was opened.

type EvidenceStreamer added in v0.8.0 

type EvidenceStreamer interface {
	NewEvidenceSender(context.Context) EvidenceSender
}

EvidenceStreamer is implemented by ApiHelpers that can take evidence one at a time. The agent's helper does; other ApiHelpers are given the whole batch through CreateEvidence.

type GRPCApiHelperClient added in v0.0.13 

type GRPCApiHelperClient struct {
	// contains filtered or unexported fields
}

func (*GRPCApiHelperClient) CreateEvidence added in v0.2.0 

func (m *GRPCApiHelperClient) CreateEvidence(ctx context.Context, evidence []*proto.Evidence) error

CreateEvidence streams evidence to the agent. Against an agent that predates the stream, it falls back to a single CreateEvidence call.

func (*GRPCApiHelperClient) UpsertRiskTemplates added in v0.3.0 

func (m *GRPCApiHelperClient) UpsertRiskTemplates(ctx context.Context, packageName string, riskTemplates []*proto.RiskTemplate) error

func (*GRPCApiHelperClient) UpsertSubjectTemplates added in v0.3.0 

func (m *GRPCApiHelperClient) UpsertSubjectTemplates(ctx context.Context, subjectTemplates []*proto.SubjectTemplate) error

type GRPCApiHelperServer added in v0.0.13 

type GRPCApiHelperServer struct {

	// This is the real implementation
	Impl ApiHelper
	// contains filtered or unexported fields
}

func (*GRPCApiHelperServer) CreateEvidence added in v0.2.0 

func (m *GRPCApiHelperServer) CreateEvidence(ctx context.Context, req *proto.CreateEvidenceRequest) (resp *proto.CreateEvidenceResponse, err error)

func (*GRPCApiHelperServer) CreateEvidenceStream added in v0.8.0 

func (m *GRPCApiHelperServer) CreateEvidenceStream(stream proto.ApiHelper_CreateEvidenceStreamServer) error

func (*GRPCApiHelperServer) SetImpl added in v0.3.0 

func (m *GRPCApiHelperServer) SetImpl(impl ApiHelper)

func (*GRPCApiHelperServer) UpsertRiskTemplates added in v0.3.0 

func (m *GRPCApiHelperServer) UpsertRiskTemplates(ctx context.Context, req *proto.UpsertRiskTemplatesRequest) (resp *proto.UpsertRiskTemplatesResponse, err error)

func (*GRPCApiHelperServer) UpsertSubjectTemplates added in v0.3.0 

func (m *GRPCApiHelperServer) UpsertSubjectTemplates(ctx context.Context, req *proto.UpsertSubjectTemplatesRequest) (resp *proto.UpsertSubjectTemplatesResponse, err error)

type GRPCClient 

type GRPCClient struct {
	// contains filtered or unexported fields
}

GRPCClient implements Runner over go-plugin gRPC.

func (*GRPCClient) Configure 

func (m *GRPCClient) Configure(request *proto.ConfigureRequest) (*proto.ConfigureResponse, error)

func (*GRPCClient) Eval 

func (m *GRPCClient) Eval(request *proto.EvalRequest, a ApiHelper) (*proto.EvalResponse, error)

func (*GRPCClient) Init added in v0.3.0 

func (m *GRPCClient) Init(request *proto.InitRequest, a ApiHelper) (*proto.InitResponse, error)

type GRPCServer 

type GRPCServer struct {
	Impl Runner
	// contains filtered or unexported fields
}

func (*GRPCServer) Configure 

func (m *GRPCServer) Configure(ctx context.Context, req *proto.ConfigureRequest) (*proto.ConfigureResponse, error)

func (*GRPCServer) Eval 

func (m *GRPCServer) Eval(ctx context.Context, req *proto.EvalRequest) (*proto.EvalResponse, error)

func (*GRPCServer) Init added in v0.3.0 

func (m *GRPCServer) Init(ctx context.Context, req *proto.InitRequest) (*proto.InitResponse, error)

type Runner 

type Runner interface {
	Configure(request *proto.ConfigureRequest) (*proto.ConfigureResponse, error)
	Eval(request *proto.EvalRequest, a ApiHelper) (*proto.EvalResponse, error)
}

type RunnerGRPCPlugin 

type RunnerGRPCPlugin struct {
	plugin.Plugin

	// Impl Injection
	Impl Runner
}

func (*RunnerGRPCPlugin) GRPCClient 

func (p *RunnerGRPCPlugin) GRPCClient(ctx context.Context, broker *plugin.GRPCBroker, c *grpc.ClientConn) (interface{}, error)

func (*RunnerGRPCPlugin) GRPCServer 

func (p *RunnerGRPCPlugin) GRPCServer(broker *plugin.GRPCBroker, s *grpc.Server) error

type RunnerV2 added in v0.3.0 

type RunnerV2 interface {
	Runner
	Init(request *proto.InitRequest, a ApiHelper) (*proto.InitResponse, error)
}

type RunnerV2GRPCPlugin added in v0.3.0 

type RunnerV2GRPCPlugin struct {
	plugin.Plugin

	// Impl Injection
	Impl RunnerV2
}

func (*RunnerV2GRPCPlugin) GRPCClient added in v0.3.0 

func (p *RunnerV2GRPCPlugin) GRPCClient(ctx context.Context, broker *plugin.GRPCBroker, c *grpc.ClientConn) (interface{}, error)

func (*RunnerV2GRPCPlugin) GRPCServer added in v0.3.0 

func (p *RunnerV2GRPCPlugin) GRPCServer(broker *plugin.GRPCBroker, s *grpc.Server) error

type Source added in v0.8.0 

type Source struct {
	// Reference is the source configured for it: an OCI reference or a local path.
	Reference string
	// Digest is the registry digest the OCI reference resolved to when the agent downloaded
	// it, or for a local plugin binary its SHA-256. Empty when not known.
	Digest string
}

Source is where a plugin or policy bundle came from.

Source Files

View all Source files

Directories

Path Synopsis

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.