Documentation
¶
Overview ¶
Package agent holds the agent internals as independent pieces sharing local state (ADR-0011): the sync daemon (sync/), which holds the stream, sends heartbeats and inventory, and applies each policy synchronously through the installed-policy store (enforce/); the credential holder and its renewal timer (credential/); and the flow collector and reporter (collect/). Keeping the pieces independent keeps the safety properties independently testable.
Source Files
Directories
¶
| Path | Synopsis |
|---|---|
|
Package collect is the agent's flow collection loop: a Source observes connections on the host, an Aggregator folds them into one record per (source, destination, port, protocol, decision, rule) over the reporting window the control plane configures, holding at most a bounded number of distinct keys, a bounded Buffer holds closed windows until the Reporter ships them over ReportFlows, and overflow at either bound drops what does not fit and records the loss as an evidence gap.
|
Package collect is the agent's flow collection loop: a Source observes connections on the host, an Aggregator folds them into one record per (source, destination, port, protocol, decision, rule) over the reporting window the control plane configures, holding at most a bounded number of distinct keys, a bounded Buffer holds closed windows until the Reporter ships them over ReportFlows, and overflow at either bound drops what does not fit and records the loss as an evidence gap. |
|
conntrack
Package conntrack observes inbound connections through the kernel's connection tracking over netlink (ADR-0003).
|
Package conntrack observes inbound connections through the kernel's connection tracking over netlink (ADR-0003). |
|
nflog
Package nflog observes the packets the terminal rule of the owned table logs: what the policy did not permit.
|
Package nflog observes the packets the terminal rule of the owned table logs: what the policy did not permit. |
|
Package credential is the agent's side of enrollment and renewal: it generates the workload keypair, builds certificate signing requests, calls the control plane, and keeps the resulting credential in a state directory the daemon reads (ADR-0016).
|
Package credential is the agent's side of enrollment and renewal: it generates the workload keypair, builds certificate signing requests, calls the control plane, and keeps the resulting credential in a state directory the daemon reads (ADR-0016). |
|
Package enforce holds the agent's installed-policy boundary.
|
Package enforce holds the agent's installed-policy boundary. |
|
nft
Package nft is the Linux enforcement backend: it installs a rendered WorkloadPolicy into one nftables table this agent owns, as a single atomic transaction, and never touches state outside that table (ADR-0003, ADR-0020).
|
Package nft is the Linux enforcement backend: it installs a rendered WorkloadPolicy into one nftables table this agent owns, as a single atomic transaction, and never touches state outside that table (ADR-0003, ADR-0020). |
|
Package health is reserved for a whole-process resource budget, which is deferred (ADR-0011 as amended); it holds no code.
|
Package health is reserved for a whole-process resource budget, which is deferred (ADR-0011 as amended); it holds no code. |
|
Package inventory collects the descriptive facts the agent reports: host facts (hostname, operating system, interfaces and their addresses) and a best-effort list of listening services.
|
Package inventory collects the descriptive facts the agent reports: host facts (hostname, operating system, interfaces and their addresses) and a best-effort list of listening services. |
|
Package sync maintains the agent's single persistent stream to the control plane and applies versioned desired-state updates in order (ADR-0002, ADR-0015).
|
Package sync maintains the agent's single persistent stream to the control plane and applies versioned desired-state updates in order (ADR-0002, ADR-0015). |
Click to show internal directories.
Click to hide internal directories.