Documentation
¶
Index ¶
Constants ¶
const DefaultListLimit = 500
DefaultListLimit is the per-page size used by ListAll for scanner lists. Five hundred is the upstream client-go default for paginated lists and gives a reasonable tradeoff between request count and memory pressure on the apiserver.
const DefaultListTimeout = 30 * time.Second
DefaultListTimeout caps each individual list call so a slow apiserver cannot hang a full fleet sweep on one bad cluster.
Variables ¶
var ErrScan = errors.New("scan failed")
ErrScan indicates a scanner failed to collect data from a cluster.
Functions ¶
func CacheReadOptions ¶
func CacheReadOptions() metav1.ListOptions
CacheReadOptions returns ListOptions configured to read from the apiserver watch cache. Use these for any read that does not need a strict-consistency guarantee against etcd; on a busy cluster this is an order-of-magnitude reduction in apiserver load. Scanners can also extend the returned options with their own FieldSelector or LabelSelector when needed.
Types ¶
type ListPager ¶
ListPager paginates an apiserver list call using Continue tokens and the supplied list function. The list function should call the typed client's List method with the provided options and return the raw list result; the caller is responsible for appending each page's items into its accumulator inside the callback. ResourceVersion is fixed at "0" with NotOlderThan match semantics so reads come from the apiserver watch cache rather than etcd, dramatically reducing load on large clusters.
type Registry ¶
type Registry struct {
// contains filtered or unexported fields
}
Registry maps scanner names to their implementations.
type Result ¶
type Result struct {
// Scanner is the name identifying which scanner produced this result.
Scanner string `json:"scanner"`
// Data is the scanner-specific payload.
Data any `json:"data"`
}
Result holds the output of a single scanner run against one cluster.
type ScannerFunc ¶
ScannerFunc adapts a plain function to the Scanner interface.
Source Files
Directories
¶
| Path | Synopsis |
|---|---|
|
Package admission audits MutatingWebhookConfigurations and ValidatingWebhookConfigurations for two failure modes that silently break clusters: webhooks whose backing service has zero healthy endpoints, and webhooks whose caBundle is expiring soon.
|
Package admission audits MutatingWebhookConfigurations and ValidatingWebhookConfigurations for two failure modes that silently break clusters: webhooks whose backing service has zero healthy endpoints, and webhooks whose caBundle is expiring soon. |
|
Package certs scans TLS Secrets, Ingress TLS references, and admission webhook caBundles for upcoming expiry.
|
Package certs scans TLS Secrets, Ingress TLS references, and admission webhook caBundles for upcoming expiry. |
|
Package clusterinfo collects node OS, kernel, container runtime, kubelet and kube-proxy versions and reports drift within a single cluster.
|
Package clusterinfo collects node OS, kernel, container runtime, kubelet and kube-proxy versions and reports drift within a single cluster. |
|
Package crd enumerates the CustomResourceDefinitions installed on a cluster and surfaces per-cluster CRD divergence as a scanner result.
|
Package crd enumerates the CustomResourceDefinitions installed on a cluster and surfaces per-cluster CRD divergence as a scanner result. |
|
Package deprecatedapis identifies in-use API versions that Kubernetes has deprecated or removed.
|
Package deprecatedapis identifies in-use API versions that Kubernetes has deprecated or removed. |
|
Package events scans the apiserver's recent Event stream and aggregates per-namespace warning counts, surfacing clusters whose signal-to-noise has degraded.
|
Package events scans the apiserver's recent Event stream and aggregates per-namespace warning counts, surfacing clusters whose signal-to-noise has degraded. |
|
Package geo locates clusters on Earth from node region/zone labels.
|
Package geo locates clusters on Earth from node region/zone labels. |
|
Package imageaudit reports image hygiene across the fleet: digest pinning, latest-tag usage, distinct image counts, and optional registry probes for age and signature checks.
|
Package imageaudit reports image hygiene across the fleet: digest pinning, latest-tag usage, distinct image counts, and optional registry probes for age and signature checks. |
|
Package policyreportingest reads wgpolicyk8s.io PolicyReport and ClusterPolicyReport custom resources written by other tools (Kyverno, Gatekeeper, Trivy, kube-bench) and aggregates their fail/warn results per cluster.
|
Package policyreportingest reads wgpolicyk8s.io PolicyReport and ClusterPolicyReport custom resources written by other tools (Kyverno, Gatekeeper, Trivy, kube-bench) and aggregates their fail/warn results per cluster. |
|
Package quota inspects ResourceQuota and LimitRange coverage across namespaces.
|
Package quota inspects ResourceQuota and LimitRange coverage across namespaces. |
|
Package rbac scans the cluster's RBAC graph (ClusterRoles, RoleBindings, ServiceAccounts) and flags wildcard permissions and over-broad bindings.
|
Package rbac scans the cluster's RBAC graph (ClusterRoles, RoleBindings, ServiceAccounts) and flags wildcard permissions and over-broad bindings. |
|
Package security audits security-affecting workload configuration: PodSecurityStandards labels, default-deny NetworkPolicy presence, and similar fleet-wide hardening signals.
|
Package security audits security-affecting workload configuration: PodSecurityStandards labels, default-deny NetworkPolicy presence, and similar fleet-wide hardening signals. |
|
Package version reports the Kubernetes server version from each cluster and detects fleet-wide skew.
|
Package version reports the Kubernetes server version from each cluster and detects fleet-wide skew. |
|
Package vulnerabilities reads aquasecurity.github.io/v1alpha1 VulnerabilityReport custom resources produced by the Trivy Operator and aggregates their severity counts into a per-cluster baseline.
|
Package vulnerabilities reads aquasecurity.github.io/v1alpha1 VulnerabilityReport custom resources produced by the Trivy Operator and aggregates their severity counts into a per-cluster baseline. |
|
Package workloadcoverage reports on PDB and HPA coverage of replicated workloads.
|
Package workloadcoverage reports on PDB and HPA coverage of replicated workloads. |