Documentation
¶
Overview ¶
Package policyreport converts Fleetsweeper findings into PolicyReport CRs using the wgpolicyk8s.io/v1alpha2 schema, the CNCF-standard format consumed by Kyverno, Trivy Operator, Falco Sidekick, and the Policy Reporter UI. Emitting this format lets existing policy-report dashboards ingest Fleetsweeper findings without any custom adapter.
As with the FleetDriftReport emitter, this package writes only to the local filesystem. What an operator does with the YAML next (commit, kubectl apply, ship to a separate cluster) is their choice.
Index ¶
Constants ¶
const APIVersion = "wgpolicyk8s.io/v1alpha2"
APIVersion is the v1alpha2 PolicyReport API group/version. Stable across PolicyReporter, Kyverno, and Trivy adopters as of 2024.
const Kind = "PolicyReport"
Kind is the PolicyReport CRD kind.
const Source = "fleetsweeper"
Source identifies Fleetsweeper as the producer of the report results so dashboards can filter or group by tool.
Variables ¶
This section is empty.
Functions ¶
func Write ¶
func Write(reports []PolicyReport, dir string) error
Write marshals reports to YAML, one file per cluster, into dir.
Types ¶
type Metadata ¶
type Metadata struct {
// Name is unique within the namespace.
Name string `json:"name"`
// Namespace places the report; required for the Namespaced PolicyReport CRD.
Namespace string `json:"namespace"`
// Labels are propagated for selector-based queries.
Labels map[string]string `json:"labels,omitempty"`
}
Metadata is the standard ObjectMeta projection. Namespace is required: the upstream PolicyReport CRD is Namespaced.
type PolicyReport ¶
type PolicyReport struct {
// APIVersion identifies the resource group/version.
APIVersion string `json:"apiVersion"`
// Kind identifies the resource type.
Kind string `json:"kind"`
// Metadata holds the standard ObjectMeta projection relevant for GitOps.
Metadata Metadata `json:"metadata"`
// Summary holds per-result counts for quick dashboards.
Summary Summary `json:"summary"`
// Results is the list of policy results in this report.
Results []Result `json:"results,omitempty"`
}
PolicyReport is the on-disk shape of a wgpolicyk8s.io/v1alpha2 PolicyReport resource. Only the fields Fleetsweeper populates are modeled; the upstream CRD has more optional fields, but additive omission is forward-compatible.
func ReportsFor ¶
func ReportsFor(r *report.Report, scanID, namespace string) []PolicyReport
ReportsFor builds one PolicyReport per cluster from r. The namespace argument is required by the upstream CRD; pass the operator's preferred namespace (typically "fleetsweeper" or "policy-reporter"). Fleet-scoped findings are duplicated onto every cluster report so reconcilers do not need to special- case an aggregate.
type ResourceRef ¶
type ResourceRef struct {
// APIVersion is the object's apiVersion when known.
APIVersion string `json:"apiVersion,omitempty"`
// Kind is the object's kind when known.
Kind string `json:"kind,omitempty"`
// Namespace is the object's namespace when known.
Namespace string `json:"namespace,omitempty"`
// Name is the object's name. Always set.
Name string `json:"name"`
}
ResourceRef points at a single Kubernetes object the result concerns. We fill what we can from the finding's Affected list; ambiguous entries are rendered with just a Name.
type Result ¶
type Result struct {
// Source identifies the policy engine that produced the result.
Source string `json:"source"`
// Policy is the policy or rule family the result applies to.
Policy string `json:"policy"`
// Rule is the specific check within Policy.
Rule string `json:"rule,omitempty"`
// Category groups related results in the UI.
Category string `json:"category,omitempty"`
// Severity is critical, high, medium, low, or info.
Severity string `json:"severity"`
// Result is one of pass, fail, warn, error, skip.
Result string `json:"result"`
// Message is the human-readable explanation.
Message string `json:"message"`
// Timestamp is when the finding was produced.
Timestamp Timestamp `json:"timestamp"`
// Resources references the affected Kubernetes resources, if known.
Resources []ResourceRef `json:"resources,omitempty"`
// Properties carries arbitrary key/value metadata, including the
// Fleetsweeper remediation hint when one is available.
Properties map[string]string `json:"properties,omitempty"`
}
Result is one finding rendered as a v1alpha2 PolicyReport result entry.
type Summary ¶
type Summary struct {
// Pass is the count of result=pass entries.
Pass int `json:"pass"`
// Fail is the count of result=fail entries.
Fail int `json:"fail"`
// Warn is the count of result=warn entries.
Warn int `json:"warn"`
// Error is the count of result=error entries.
Error int `json:"error"`
// Skip is the count of result=skip entries.
Skip int `json:"skip"`
}
Summary mirrors the v1alpha2 summary block. We do not currently emit "pass" results, so Pass is always 0; we expose the field anyway so the shape matches what tooling expects.
Source Files