Help us shape the future of Go! Take the 2026 Go Developer Survey

security

package
v0.16.0 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Nov 2, 2026 License: MIT Imports: 6 Imported by: 0

Documentation

Overview

Package security audits security-affecting workload configuration: PodSecurityStandards labels, default-deny NetworkPolicy presence, and similar fleet-wide hardening signals.

Index

Constants

View Source
const Name = "security"

Name is the registry key for this scanner.

Variables

This section is empty.

Functions

func Enforced added in v0.14.0

func Enforced(level string) bool

Enforced reports whether a PSS enforce level restricts pods. An empty level and privileged both enforce nothing.

func NewScanner

func NewScanner() scanner.Scanner

NewScanner returns a scanner that checks Pod Security Standards labels on namespaces.

Types

type Data

type Data struct {
	// NamespaceCount is the total number of namespaces.
	NamespaceCount int `json:"namespace_count"`
	// EnforcedCount is the number of namespaces with a PSS enforce label above privileged.
	EnforcedCount int `json:"enforced_count"`
	// UnenforcedCount is the number of namespaces with no PSS enforce label or with enforce
	// privileged, which enforces nothing.
	UnenforcedCount int `json:"unenforced_count"`
	// LevelDistribution maps PSS enforce levels to namespace counts, with "none" for unlabeled.
	LevelDistribution map[string]int `json:"level_distribution"`
	// Namespaces lists per-namespace security details.
	Namespaces []NamespaceSecurity `json:"namespaces"`
}

Data holds security posture information for one cluster.

type NamespaceSecurity

type NamespaceSecurity struct {
	// Namespace is the namespace name.
	Namespace string `json:"namespace"`
	// Enforce is the enforce level (privileged, baseline, restricted).
	Enforce string `json:"enforce,omitempty"`
	// EnforceVersion is the enforce version.
	EnforceVersion string `json:"enforce_version,omitempty"`
	// Audit is the audit level.
	Audit string `json:"audit,omitempty"`
	// AuditVersion is the audit version.
	AuditVersion string `json:"audit_version,omitempty"`
	// Warn is the warn level.
	Warn string `json:"warn,omitempty"`
	// WarnVersion is the warn version.
	WarnVersion string `json:"warn_version,omitempty"`
}

NamespaceSecurity describes the Pod Security Standards labels on a namespace.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL