workloadsec

type Data struct {
	// TotalPods is the number of pods scanned.
	TotalPods int `json:"total_pods"`
	// PrivilegedContainers is containers, ephemeral included, running with privileged=true.
	PrivilegedContainers int `json:"privileged_containers"`
	// HostNetworkPods is pods using the host network namespace.
	HostNetworkPods int `json:"host_network_pods"`
	// HostPIDPods is pods using the host PID namespace.
	HostPIDPods int `json:"host_pid_pods"`
	// HostIPCPods is pods using the host IPC namespace.
	HostIPCPods int `json:"host_ipc_pods"`
	// HostPathVolumes is pods that mount a hostPath volume.
	HostPathVolumes int `json:"host_path_volumes"`
	// BaselineContainers is the init and regular containers, the denominator of every count
	// that feeds the admission baseline. Ephemeral containers are left out, since admission
	// never sees them.
	BaselineContainers int `json:"baseline_containers"`
	// RunAsRootContainers is baseline containers whose effective runAsUser is 0.
	RunAsRootContainers int `json:"run_as_root_containers"`
	// RunAsNonRootContainers is baseline containers explicitly non-root, by an effective
	// runAsUser above 0, or an unset one under an effective runAsNonRoot of true.
	RunAsNonRootContainers int `json:"run_as_non_root_containers"`
	// RunAsUnknownContainers is baseline containers whose spec does not settle the user, so
	// only the image can.
	RunAsUnknownContainers int `json:"run_as_unknown_containers"`
	// CapabilityAdditions is containers, ephemeral included, that add Linux capabilities beyond
	// the default set.
	CapabilityAdditions int `json:"capability_additions"`
	// MissingCapabilityDropAll is containers, ephemeral included, that do not drop ALL
	// capabilities.
	MissingCapabilityDropAll int `json:"missing_capability_drop_all"`
	// AllowPrivilegeEscalation is baseline containers that may gain privileges, by an unset or
	// true allowPrivilegeEscalation, privileged, or an added CAP_SYS_ADMIN.
	AllowPrivilegeEscalation int `json:"allow_privilege_escalation"`
	// MissingSeccompProfile is containers, ephemeral included, not confined by a RuntimeDefault
	// or Localhost seccomp profile.
	MissingSeccompProfile int `json:"missing_seccomp_profile"`
	// NoReadOnlyRoot is baseline containers without a read-only root filesystem.
	NoReadOnlyRoot int `json:"no_read_only_root"`
	// DefaultServiceAccountPods is pods using the namespace's default ServiceAccount.
	DefaultServiceAccountPods int `json:"default_service_account_pods"`
	// HighRiskPods lists the containers, ephemeral included, with the most concerning security
	// postures.
	HighRiskPods []PodRisk `json:"high_risk_pods"`
}

type PodRisk struct {
	// Namespace is the pod's namespace.
	Namespace string `json:"namespace"`
	// Pod is the pod name.
	Pod string `json:"pod"`
	// Container is the container name within the pod.
	Container string `json:"container"`
	// Risks lists the specific security risks found.
	Risks []string `json:"risks"`
}