Documentation
¶
Overview ¶
Package policyreportingest reads wgpolicyk8s.io PolicyReport and ClusterPolicyReport custom resources written by other tools (Kyverno, Gatekeeper, Trivy, kube-bench) and aggregates their fail/warn results per cluster. Closes the loop with Fleetsweeper's own PolicyReport emission so a single dashboard can show "what every policy tool across the fleet is complaining about right now."
Index ¶
Constants ¶
const Name = "policy-reports"
Name is the registry key for this scanner.
Variables ¶
This section is empty.
Functions ¶
func NewScanner ¶
NewScanner returns a Scanner that reads both PolicyReport and ClusterPolicyReport resources. Safe to register unconditionally; the scanner returns Available=false when neither CRD is installed.
Types ¶
type Data ¶
type Data struct {
// Available is true when the wgpolicyk8s.io CRDs were discoverable.
// When false the rest of the fields stay zero so consumers can tell
// "no policy tool installed" from "policy tools installed and clean."
Available bool `json:"available"`
// Reports is the count of PolicyReport CRs read.
Reports int `json:"reports"`
// ClusterReports is the count of ClusterPolicyReport CRs read.
ClusterReports int `json:"cluster_reports"`
// TotalFail is the cluster-wide count of result=fail rows.
TotalFail int `json:"total_fail"`
// TotalWarn is the cluster-wide count of result=warn rows.
TotalWarn int `json:"total_warn"`
// TotalError is the count of result=error rows (broken policy).
TotalError int `json:"total_error"`
// BySource breaks down results by producing tool.
BySource []sourceTally `json:"by_source"`
// TopFailures lists the policies firing most often, descending.
TopFailures []PolicyFailure `json:"top_failures"`
}
Data holds the per-cluster PolicyReport aggregate.
type PolicyFailure ¶
type PolicyFailure struct {
// Source is the producing tool.
Source string `json:"source"`
// Policy is the policy name.
Policy string `json:"policy"`
// Rule is the specific rule that fired. Empty for tools that don't
// emit per-rule attribution.
Rule string `json:"rule,omitempty"`
// Fail is the count of fail results for this (source, policy, rule).
Fail int `json:"fail"`
// Warn is the count of warn results for the same tuple.
Warn int `json:"warn"`
// Severity is the highest severity seen across the contributing rows.
Severity string `json:"severity,omitempty"`
}
PolicyFailure is one top-offender policy across the cluster. The dashboard surfaces the worst-N so operators can focus on the policies firing most often.
Source Files