security

package
v0.15.0 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Nov 2, 2026 License: MIT Imports: 6 Imported by: 0

Documentation

Overview

Package security audits security-affecting workload configuration: PodSecurityStandards labels, default-deny NetworkPolicy presence, and similar fleet-wide hardening signals.

Index

Constants

View Source
const Name = "security"

Name is the registry key for this scanner.

Variables

This section is empty.

Functions

func Enforced added in v0.14.0

func Enforced(level string) bool

Enforced reports whether a PSS enforce level restricts pods. An empty level and privileged both enforce nothing.

func NewScanner

func NewScanner() scanner.Scanner

NewScanner returns a scanner that checks Pod Security Standards labels on namespaces.

Types

type Data

type Data struct {
	// NamespaceCount is the total number of namespaces.
	NamespaceCount int `json:"namespace_count"`
	// EnforcedCount is the number of namespaces with a PSS enforce label above privileged.
	EnforcedCount int `json:"enforced_count"`
	// UnenforcedCount is the number of namespaces with no PSS enforce label or with enforce
	// privileged, which enforces nothing.
	UnenforcedCount int `json:"unenforced_count"`
	// LevelDistribution maps PSS enforce levels to namespace counts, with "none" for unlabeled.
	LevelDistribution map[string]int `json:"level_distribution"`
	// Namespaces lists per-namespace security details.
	Namespaces []NamespaceSecurity `json:"namespaces"`
}

Data holds security posture information for one cluster.

type NamespaceSecurity

type NamespaceSecurity struct {
	// Namespace is the namespace name.
	Namespace string `json:"namespace"`
	// Enforce is the enforce level (privileged, baseline, restricted).
	Enforce string `json:"enforce,omitempty"`
	// EnforceVersion is the enforce version.
	EnforceVersion string `json:"enforce_version,omitempty"`
	// Audit is the audit level.
	Audit string `json:"audit,omitempty"`
	// AuditVersion is the audit version.
	AuditVersion string `json:"audit_version,omitempty"`
	// Warn is the warn level.
	Warn string `json:"warn,omitempty"`
	// WarnVersion is the warn version.
	WarnVersion string `json:"warn_version,omitempty"`
}

NamespaceSecurity describes the Pod Security Standards labels on a namespace.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL