Documentation
¶
Index ¶
Constants ¶
const DefaultListLimit = 500
DefaultListLimit is the per-page size used by ListAll for scanner lists. Five hundred is the upstream client-go default for paginated lists and gives a reasonable tradeoff between request count and memory pressure on the apiserver.
const DefaultListTimeout = 30 * time.Second
DefaultListTimeout caps each individual list call so a slow apiserver cannot hang a full fleet sweep on one bad cluster.
const DefaultScanTimeout = 60 * time.Second
DefaultScanTimeout bounds how long a single scanner may run against one cluster before it is abandoned, so a hung API call on one outlier cluster cannot stall the whole fleet sweep.
Variables ¶
var ErrScan = errors.New("scan failed")
ErrScan indicates a scanner failed to collect data from a cluster.
Functions ¶
func CacheReadOptions ¶
func CacheReadOptions() metav1.ListOptions
CacheReadOptions returns ListOptions configured to read from the apiserver watch cache. Use these for any read that does not need a strict-consistency guarantee against etcd; on a busy cluster this is an order-of-magnitude reduction in apiserver load. Scanners can also extend the returned options with their own FieldSelector or LabelSelector when needed.
Types ¶
type ListPager ¶
ListPager paginates an apiserver list call using Continue tokens and the supplied list function. The list function should call the typed client's List method with the provided options and return the raw list result; the caller is responsible for appending each page's items into its accumulator inside the callback. ResourceVersion is fixed at "0" with NotOlderThan match semantics so reads come from the apiserver watch cache rather than etcd, dramatically reducing load on large clusters.
type Registry ¶
type Registry struct {
// contains filtered or unexported fields
}
Registry maps scanner names to their implementations.
type Result ¶
type Result struct {
// Scanner is the name identifying which scanner produced this result.
Scanner string `json:"scanner"`
// State records how much to trust Data. The zero value means StateOK.
State State `json:"state,omitempty"`
// Reason is a short explanation when State is not OK. Empty otherwise.
Reason string `json:"reason,omitempty"`
// Data is the scanner-specific payload.
Data any `json:"data"`
}
Result holds the output of a single scanner run against one cluster.
func ErroredResult ¶ added in v0.2.0
ErroredResult builds a result that records a failed scan for one cluster so the fleet report can surface the failure instead of dropping it silently.
func RunWithTimeout ¶ added in v0.5.0
func RunWithTimeout(ctx context.Context, s Scanner, client *kube.Client, timeout time.Duration) (Result, error)
RunWithTimeout runs a scanner against a client under a deadline. A zero or negative timeout disables the deadline. A timeout surfaces as an ordinary scan error, which the caller records as degraded coverage rather than a clean result.
type ScannerFunc ¶
ScannerFunc adapts a plain function to the Scanner interface.
type State ¶ added in v0.2.0
type State string
State describes how much to trust a scanner's data for one cluster. It exists so an unreachable or forbidden API produces a degraded or errored result instead of an empty payload that reads as a clean, zero-resource cluster.
const ( // StateOK means the scanner completed and its data is complete. It is the // zero value's meaning, so scanners that cannot fail need not set it. StateOK State = "" // StateDegraded means the scanner completed but some data is missing // because one or more API calls failed. The data present is real but // partial, so consumers must not read absent fields as zero. StateDegraded State = "degraded" // StateErrored means the scanner could not collect its data because an API // call failed or access was denied. The data must never be read as a real // "clean, zero resources" result. StateErrored State = "errored" // CRD that is not installed. This is a trustworthy "nothing here", not a // failure. StateUnavailable State = "unavailable" )
Source Files
Directories
¶
| Path | Synopsis |
|---|---|
|
Package admission audits MutatingWebhookConfigurations and ValidatingWebhookConfigurations for two failure modes that silently break clusters: webhooks whose backing service has zero healthy endpoints, and webhooks whose caBundle is expiring soon.
|
Package admission audits MutatingWebhookConfigurations and ValidatingWebhookConfigurations for two failure modes that silently break clusters: webhooks whose backing service has zero healthy endpoints, and webhooks whose caBundle is expiring soon. |
|
Package certs scans TLS Secrets, Ingress TLS references, and admission webhook caBundles for upcoming expiry.
|
Package certs scans TLS Secrets, Ingress TLS references, and admission webhook caBundles for upcoming expiry. |
|
Package clusterinfo collects node OS, kernel, container runtime, kubelet and kube-proxy versions and reports drift within a single cluster.
|
Package clusterinfo collects node OS, kernel, container runtime, kubelet and kube-proxy versions and reports drift within a single cluster. |
|
Package crd enumerates the CustomResourceDefinitions installed on a cluster and surfaces per-cluster CRD divergence as a scanner result.
|
Package crd enumerates the CustomResourceDefinitions installed on a cluster and surfaces per-cluster CRD divergence as a scanner result. |
|
Package deprecatedapis identifies in-use API versions that Kubernetes has deprecated or removed.
|
Package deprecatedapis identifies in-use API versions that Kubernetes has deprecated or removed. |
|
Package events scans the apiserver's recent Event stream and aggregates per-namespace warning counts, surfacing clusters whose signal-to-noise has degraded.
|
Package events scans the apiserver's recent Event stream and aggregates per-namespace warning counts, surfacing clusters whose signal-to-noise has degraded. |
|
Package geo locates clusters on Earth from node region/zone labels.
|
Package geo locates clusters on Earth from node region/zone labels. |
|
Package imageaudit reports image hygiene across the fleet: digest pinning, latest-tag usage, distinct image counts, and optional registry probes for age and signature checks.
|
Package imageaudit reports image hygiene across the fleet: digest pinning, latest-tag usage, distinct image counts, and optional registry probes for age and signature checks. |
|
Package policyreportingest reads wgpolicyk8s.io PolicyReport and ClusterPolicyReport custom resources written by other tools (Kyverno, Gatekeeper, Trivy, kube-bench) and aggregates their fail/warn results per cluster.
|
Package policyreportingest reads wgpolicyk8s.io PolicyReport and ClusterPolicyReport custom resources written by other tools (Kyverno, Gatekeeper, Trivy, kube-bench) and aggregates their fail/warn results per cluster. |
|
Package quota inspects ResourceQuota and LimitRange coverage across namespaces.
|
Package quota inspects ResourceQuota and LimitRange coverage across namespaces. |
|
Package rbac scans the cluster's RBAC graph (ClusterRoles, RoleBindings, ServiceAccounts) and flags wildcard permissions and over-broad bindings.
|
Package rbac scans the cluster's RBAC graph (ClusterRoles, RoleBindings, ServiceAccounts) and flags wildcard permissions and over-broad bindings. |
|
Package security audits security-affecting workload configuration: PodSecurityStandards labels, default-deny NetworkPolicy presence, and similar fleet-wide hardening signals.
|
Package security audits security-affecting workload configuration: PodSecurityStandards labels, default-deny NetworkPolicy presence, and similar fleet-wide hardening signals. |
|
Package version reports the Kubernetes server version from each cluster and detects fleet-wide skew.
|
Package version reports the Kubernetes server version from each cluster and detects fleet-wide skew. |
|
Package vulnerabilities reads aquasecurity.github.io/v1alpha1 VulnerabilityReport custom resources produced by the Trivy Operator and aggregates their severity counts into a per-cluster baseline.
|
Package vulnerabilities reads aquasecurity.github.io/v1alpha1 VulnerabilityReport custom resources produced by the Trivy Operator and aggregates their severity counts into a per-cluster baseline. |
|
Package workloadcoverage reports on PDB and HPA coverage of replicated workloads.
|
Package workloadcoverage reports on PDB and HPA coverage of replicated workloads. |