Documentation
¶
Overview ¶
Package security audits security-affecting workload configuration: PodSecurityStandards labels, default-deny NetworkPolicy presence, and similar fleet-wide hardening signals.
Index ¶
Constants ¶
View Source
const Name = "security"
Name is the registry key for this scanner.
Variables ¶
This section is empty.
Functions ¶
func NewScanner ¶
NewScanner returns a scanner that checks Pod Security Standards labels on namespaces.
Types ¶
type Data ¶
type Data struct {
// NamespaceCount is the total number of namespaces.
NamespaceCount int `json:"namespace_count"`
// EnforcedCount is the number of namespaces with a PSS enforce label.
EnforcedCount int `json:"enforced_count"`
// UnenorcedCount is the number of namespaces without a PSS enforce label.
UnenforcedCount int `json:"unenforced_count"`
// LevelDistribution maps PSS levels to namespace counts.
LevelDistribution map[string]int `json:"level_distribution"`
// Namespaces lists per-namespace security details.
Namespaces []NamespaceSecurity `json:"namespaces"`
}
Data holds security posture information for one cluster.
type NamespaceSecurity ¶
type NamespaceSecurity struct {
// Namespace is the namespace name.
Namespace string `json:"namespace"`
// Enforce is the enforce level (privileged, baseline, restricted).
Enforce string `json:"enforce,omitempty"`
// EnforceVersion is the enforce version.
EnforceVersion string `json:"enforce_version,omitempty"`
// Audit is the audit level.
Audit string `json:"audit,omitempty"`
// AuditVersion is the audit version.
AuditVersion string `json:"audit_version,omitempty"`
// Warn is the warn level.
Warn string `json:"warn,omitempty"`
// WarnVersion is the warn version.
WarnVersion string `json:"warn_version,omitempty"`
}
NamespaceSecurity describes the Pod Security Standards labels on a namespace.
Click to show internal directories.
Click to hide internal directories.