helpers

package
v0.0.229 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 5, 2026 License: Apache-2.0 Imports: 4 Imported by: 45

Documentation

Index

Constants

View Source 
const (
	ApiGroupMetadataKey                = metadataPrefix + "/workload-api-group"
	ApiVersionMetadataKey              = metadataPrefix + "/workload-api-version"
	CloudAccountIdentifierMetadataKey  = metadataPrefix + "/cloud-account-identifier"
	ClusterMetadataKey                 = metadataPrefix + "/cluster"
	ClusterRoleBindingNameMetadataKey  = metadataPrefix + "/clusterrolebinding-name"
	ClusterRoleNameMetadataKey         = metadataPrefix + "/clusterrole-name"
	CompletionMetadataKey              = metadataPrefix + "/completion"
	ContainerNameMetadataKey           = metadataPrefix + "/workload-container-name"
	ContainerTypeMetadataKey           = metadataPrefix + "/workload-container-type"
	ContextMetadataKey                 = metadataPrefix + "/context"
	EphemeralContainerNameMetadataKey  = metadataPrefix + "/workload-ephemeral-container-name" // DEPRECATED - use ContainerNameMetadataKey and ContainerTypeMetadataKey
	HostIDMetadataKey                  = metadataPrefix + "/host-id"
	HostTypeMetadataKey                = metadataPrefix + "/host-type"
	ImageIDMetadataKey                 = metadataPrefix + "/image-id"
	ImageNameMetadataKey               = metadataPrefix + "/image-name"
	ImageTagMetadataKey                = metadataPrefix + "/image-tag"
	InitContainerNameMetadataKey       = metadataPrefix + "/workload-init-container-name" // DEPRECATED - use ContainerNameMetadataKey and ContainerTypeMetadataKey
	InstanceIDMetadataKey              = metadataPrefix + "/instance-id"
	LearningPeriodMetadataKey          = metadataPrefix + "/learning-period"
	OtelSpanIDMetadataKey              = metadataPrefix + "/otel-span-id"
	OtelTraceparentMetadataKey         = metadataPrefix + "/otel-traceparent"
	ManagedByMetadataKey               = metadataPrefix + "/managed-by"
	PreviousReportTimestampMetadataKey = metadataPrefix + "/previous-report-timestamp"
	RbacResourceMetadataKey            = metadataPrefix + "/rbac-resource"
	RegionMetadataKey                  = metadataPrefix + "/region"
	RelatedKindMetadataKey             = metadataPrefix + "/workload-kind"
	RelatedNameMetadataKey             = metadataPrefix + "/workload-name"
	RelatedNamespaceMetadataKey        = metadataPrefix + "/workload-namespace"
	ReportSeriesIdMetadataKey          = metadataPrefix + "/report-series-id"
	ReportTimestampMetadataKey         = metadataPrefix + "/report-timestamp"
	ResourceSizeMetadataKey            = metadataPrefix + "/resource-size"
	ResourceVersionMetadataKey         = metadataPrefix + "/workload-resource-version"
	RoleBindingNameMetadataKey         = metadataPrefix + "/rolebinding-name"
	RoleBindingNamespaceMetadataKey    = metadataPrefix + "/rolebinding-namespace"
	RoleNameMetadataKey                = metadataPrefix + "/role-name"
	RoleNamespaceMetadataKey           = metadataPrefix + "/role-namespace"
	ScanIdMetadataKey                  = metadataPrefix + "/scan-id"
	StatusMetadataKey                  = metadataPrefix + "/status"
	SyncChecksumMetadataKey            = metadataPrefix + "/sync-checksum"
	TemplateHashKey                    = metadataPrefix + "/instance-template-hash"
	TierMetadataKey                    = metadataPrefix + "/tier"
	ToolVersionMetadataKey             = metadataPrefix + "/tool-version"
	UserDefinedProfileMetadataKey      = metadataPrefix + "/user-defined-profile" // should be used as a label!
	WlidMetadataKey                    = metadataPrefix + "/wlid"
)

metadata keys

View Source 
const (
	ContextMetadataKeyFiltered    = "filtered"
	ContextMetadataKeyNonFiltered = "non-filtered"
)

metadata values

View Source 
const (
	ManagedByUserValue            = "User"
	UserApplicationProfilePrefix  = "ug-"
	UserNetworkNeighborhoodPrefix = "ug-"
)

application profile metadata

View Source 
const (
	ArtifactTypeMetadataKey = metadataPrefix + "/sbom-type"
	ContainerArtifactType   = "container"
	HostArtifactType        = "host"
	ImageArtifactType       = "image"
	NodeArtifactType        = "node"
)

sbom metadata keys and values

View Source 
const (
	StringFormatSeparator = "/"
	PrefixApiVersion      = "apiVersion-"
	PrefixNamespace       = "namespace-"
	PrefixKind            = "kind-"
	PrefixName            = "name-"
)

string format: apiVersion-<apiVersion>/namespace-<namespace>/kind-<kind>/name-<name>/...

View Source 
const (
	Initializing      = "initializing"
	Learning          = "ready"
	Completed         = "completed"
	Incomplete        = "incomplete"
	Unauthorize       = "unauthorize"
	MissingRuntime    = "missing-runtime"
	TooLarge          = "too-large"
	Failed            = "failed" // container exited with a non-zero code
	UnsupportedSchema = "unsupported-schema"
)

Statuses

View Source 
const (
	Partial = "partial"
	Full    = "complete"
)

Completion

View Source 
const (
	CoreTier = "core"
)

Tier values

Variables

View Source 
var TemplateHashRegex = regexp.MustCompile(`^[4-9bcdf]{1,10}$`)

TemplateHashRegex matches the output domain of rand.SafeEncodeString(fmt.Sprint(podTemplateSpecHasher.Sum32())). In k8s.io/apimachinery/pkg/util/rand, SafeEncodeString encodes decimal digits '0'-'9' using alphanums = "bcdfghjklmnpqrstvwxz2456789". Because (int('0')+d) % 27 maps decimal digits 0..9 strictly to '4','5','6','7','8','9','b','c','d','f', the producer domain consists exclusively of characters [4-9bcdf], with length 1 to 10 (decimal representation of uint32).

Functions

func IgnoreOwnerReference 

func IgnoreOwnerReference(ownerKind string) bool

func IsTemplateHash added in v0.0.229 

func IsTemplateHash(s string) bool

IsTemplateHash returns true if s matches the template hash domain produced by rand.SafeEncodeString(fmt.Sprint(podTemplateSpecHasher.Sum32())).

Best-Effort Contextual Recovery & Tradeoff Contract: In Kubernetes, CronJob child Jobs are originally named "<cronjob>-<timestamp>" where timestamp is the scheduled Unix time in minutes (e.g. "backup-28677846"). When Kubescape generates an InstanceID for a Pod under such a Job, it computes a template hash via SafeEncodeString and sets AlternateName to "<cronjob>-<templateHash>" (e.g. "backup-8698448884" or "kubevuln-scheduler-b449cf78f"). When serialized via GetStringFormatted(), AlternateName replaces the timestamp-bearing name in the name field.

Because the legacy serialized string format does not retain provenance metadata:

  1. Literal names or timestamps containing non-encoder characters (e.g. '0', '1', '2', '3' present in standard Unix timestamps like "28677846", or 'x' in literal names like "backup-xxxxxxxx") are rejected and preserved literally.
  2. Alphanumeric suffixes containing 'b', 'c', 'd', 'f' cannot be Unix timestamps (which are purely decimal). However, standalone literal Jobs whose names happen to end in matching suffixes (e.g. "backup-db") will be inferred as having template hashes by this best-effort heuristic.
  3. Purely numeric suffixes (digits '4'-'9', such as "8698448884" or "backup-4") that represent valid canonical uint32 encodings are recovered as template hashes, accepting the tradeoff that literal Jobs with identical suffixes are indistinguishable without external provenance.

func IsUnixTimeInMinutes added in v0.0.229 

func IsUnixTimeInMinutes(s string) bool

IsUnixTimeInMinutes checks if a string represents a Unix timestamp in minutes. In Kubernetes, CronJob controller appends the schedule timestamp (minutes since epoch) to the child Job name.

Types

type InstanceType added in v0.0.159 

type InstanceType string

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.