workloadsec

type Data struct {
	// TotalPods is the number of pods scanned.
	TotalPods int `json:"total_pods"`
	// PrivilegedContainers is containers running with privileged=true.
	PrivilegedContainers int `json:"privileged_containers"`
	// HostNetworkPods is pods using the host network namespace.
	HostNetworkPods int `json:"host_network_pods"`
	// HostPIDPods is pods using the host PID namespace.
	HostPIDPods int `json:"host_pid_pods"`
	// HostIPCPods is pods using the host IPC namespace.
	HostIPCPods int `json:"host_ipc_pods"`
	// HostPathVolumes is pods that mount a hostPath volume.
	HostPathVolumes int `json:"host_path_volumes"`
	// RunAsRootContainers is containers explicitly configured to run as UID 0.
	RunAsRootContainers int `json:"run_as_root_containers"`
	// UnknownRootContainers is containers without explicit user configuration.
	// These may or may not run as root depending on the image; flag them as
	// "unknown" so operators can audit selectively rather than treating every
	// undeclared workload as a violation.
	UnknownRootContainers int `json:"unknown_root_containers"`
	// CapabilityAdditions is containers that add Linux capabilities beyond the default set.
	CapabilityAdditions int `json:"capability_additions"`
	// MissingCapabilityDropAll is containers that do not drop ALL capabilities.
	MissingCapabilityDropAll int `json:"missing_capability_drop_all"`
	// AllowPrivilegeEscalation is containers that do not explicitly set
	// allowPrivilegeEscalation=false (the field defaults to true, which is
	// the PSS-restricted defining check).
	AllowPrivilegeEscalation int `json:"allow_privilege_escalation"`
	// MissingSeccompProfile is containers/pods without an explicit seccomp profile.
	MissingSeccompProfile int `json:"missing_seccomp_profile"`
	// NoReadOnlyRoot is containers without a read-only root filesystem.
	NoReadOnlyRoot int `json:"no_read_only_root"`
	// DefaultServiceAccountPods is pods using the namespace's default ServiceAccount.
	DefaultServiceAccountPods int `json:"default_service_account_pods"`
	// HighRiskPods lists pods with the most concerning security postures.
	HighRiskPods []PodRisk `json:"high_risk_pods"`
}

type PodRisk struct {
	// Namespace is the pod's namespace.
	Namespace string `json:"namespace"`
	// Pod is the pod name.
	Pod string `json:"pod"`
	// Container is the container name within the pod.
	Container string `json:"container"`
	// Risks lists the specific security risks found.
	Risks []string `json:"risks"`
}