Documentation
¶
Overview ¶
Package security audits security-affecting workload configuration: PodSecurityStandards labels, default-deny NetworkPolicy presence, and similar fleet-wide hardening signals.
Index ¶
Constants ¶
View Source
const Name = "security"
Name is the registry key for this scanner.
Variables ¶
This section is empty.
Functions ¶
func Enforced ¶ added in v0.14.0
Enforced reports whether a PSS enforce level restricts pods. An empty level and privileged both enforce nothing.
func NewScanner ¶
NewScanner returns a scanner that checks Pod Security Standards labels on namespaces.
Types ¶
type Data ¶
type Data struct {
// NamespaceCount is the total number of namespaces.
NamespaceCount int `json:"namespace_count"`
// EnforcedCount is the number of namespaces with a PSS enforce label above privileged.
EnforcedCount int `json:"enforced_count"`
// UnenforcedCount is the number of namespaces with no PSS enforce label or with enforce
// privileged, which enforces nothing.
UnenforcedCount int `json:"unenforced_count"`
// LevelDistribution maps PSS enforce levels to namespace counts, with "none" for unlabeled.
LevelDistribution map[string]int `json:"level_distribution"`
// Namespaces lists per-namespace security details.
Namespaces []NamespaceSecurity `json:"namespaces"`
}
Data holds security posture information for one cluster.
type NamespaceSecurity ¶
type NamespaceSecurity struct {
// Namespace is the namespace name.
Namespace string `json:"namespace"`
// Enforce is the enforce level (privileged, baseline, restricted).
Enforce string `json:"enforce,omitempty"`
// EnforceVersion is the enforce version.
EnforceVersion string `json:"enforce_version,omitempty"`
// Audit is the audit level.
Audit string `json:"audit,omitempty"`
// AuditVersion is the audit version.
AuditVersion string `json:"audit_version,omitempty"`
// Warn is the warn level.
Warn string `json:"warn,omitempty"`
// WarnVersion is the warn version.
WarnVersion string `json:"warn_version,omitempty"`
}
NamespaceSecurity describes the Pod Security Standards labels on a namespace.
Click to show internal directories.
Click to hide internal directories.