Documentation
¶
Overview ¶
Package fleetdrift converts Fleetsweeper reports into FleetDriftReport Kubernetes custom resources, one per scanned cluster, and writes them to a local directory as YAML files. The intent is GitOps: an operator commits or reconciles the directory into a cluster, and Argo CD or Flux picks up the drift state as just another Kubernetes object.
Fleetsweeper deliberately does not write to the clusters it scans. This package writes only to the local filesystem; what happens next is the operator's choice.
Index ¶
Constants ¶
const APIVersion = "fleetsweeper.io/v1alpha1"
APIVersion is the FleetDriftReport CRD apiVersion. Bumped if and only if the resource schema changes in a backwards-incompatible way.
const Kind = "FleetDriftReport"
Kind is the FleetDriftReport CRD kind.
Variables ¶
This section is empty.
Functions ¶
func Write ¶
func Write(reports []FleetDriftReport, dir string) error
Write marshals the provided reports as YAML files into dir, one file per cluster named <sanitized-cluster>.yaml. The directory is created if it does not exist. Existing files for the same cluster are overwritten so the directory always reflects the latest scan.
Types ¶
type FindingSpec ¶
type FindingSpec struct {
// Severity is critical, warning, or info.
Severity string `json:"severity"`
// Scanner is the originating scanner name.
Scanner string `json:"scanner"`
// Title is the short human-readable name of the finding.
Title string `json:"title"`
// Description is the longer explanation.
Description string `json:"description,omitempty"`
// Affected names the resources implicated.
Affected []string `json:"affected,omitempty"`
// Remediation, when present, is the kubectl command and/or YAML manifest
// that addresses the finding.
Remediation *RemediationSpec `json:"remediation,omitempty"`
}
FindingSpec is a single finding in the report's status.
type FleetDriftReport ¶
type FleetDriftReport struct {
// APIVersion identifies the group/version of the resource.
APIVersion string `json:"apiVersion"`
// Kind identifies the resource type.
Kind string `json:"kind"`
// Metadata is the standard ObjectMeta subset relevant for GitOps reconciliation.
Metadata Metadata `json:"metadata"`
// Spec describes the cluster the report is about.
Spec Spec `json:"spec"`
// Status reflects findings and summary metrics.
Status Status `json:"status"`
}
FleetDriftReport mirrors the FleetDriftReport CRD shape declared in deploy/crds/fleetdriftreport.yaml. Marshalling uses sigs.k8s.io/yaml so the emitted document matches the conventions Kubernetes tooling expects.
func ReportsFor ¶
func ReportsFor(r *report.Report, scanID, namespace string) []FleetDriftReport
ReportsFor builds one FleetDriftReport per cluster in the supplied report.Report. Fleet-scoped findings (Cluster == "fleet") are duplicated onto every cluster's report so a single GitOps reconciler does not have to know about an out-of-band aggregate object.
type FleetScoreSpec ¶
type FleetScoreSpec struct {
// Score is the 0-100 fleet-wide health score.
Score int `json:"score"`
// Grade is the letter grade rollup.
Grade string `json:"grade"`
}
FleetScoreSpec mirrors the report.FleetScore wire shape.
type Metadata ¶
type Metadata struct {
// Name uniquely identifies the report within its namespace.
Name string `json:"name"`
// Namespace places the report. When empty, callers may treat the CR as
// cluster-scoped or apply with the GitOps tool's default namespace.
Namespace string `json:"namespace,omitempty"`
// Labels are propagated for label-selector queries by reconciliation tools.
Labels map[string]string `json:"labels,omitempty"`
}
Metadata is the minimal ObjectMeta projection needed for GitOps.
type RemediationSpec ¶
type RemediationSpec struct {
// Command is a kubectl invocation parameterized with the offending names.
Command string `json:"command,omitempty"`
// YAML is a baseline manifest the operator can apply.
YAML string `json:"yaml,omitempty"`
// RunbookURL is an optional internal runbook link.
RunbookURL string `json:"runbookURL,omitempty"`
}
RemediationSpec mirrors the report.Remediation wire shape.
type Spec ¶
type Spec struct {
// Cluster is the kubeconfig context name of the cluster.
Cluster string `json:"cluster"`
// ScanID is the Fleetsweeper-assigned scan identifier.
ScanID string `json:"scanId"`
// ScanTime is when the scan executed.
ScanTime time.Time `json:"scanTime"`
// FleetScore is the fleet-wide score (0-100) computed for this scan.
FleetScore FleetScoreSpec `json:"fleetScore"`
}
Spec captures the scan identity and the cluster the report applies to.
type Status ¶
type Status struct {
// ObservedAt is the timestamp the report was generated.
ObservedAt time.Time `json:"observedAt"`
// Summary holds the per-severity finding counts for this cluster.
Summary Summary `json:"summary"`
// Findings is the per-cluster list of findings ranked by severity.
Findings []FindingSpec `json:"findings,omitempty"`
}
Status reflects the per-cluster findings and a small summary block.
type Summary ¶
type Summary struct {
// Critical is the count of critical findings.
Critical int `json:"critical"`
// Warning is the count of warning findings.
Warning int `json:"warning"`
// Info is the count of info findings.
Info int `json:"info"`
}
Summary is the per-severity finding tally for the cluster.
Source Files