config

package
v0.3.241 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Sep 22, 2026 License: Apache-2.0 Imports: 15 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	SeccompBackendStorage = "storage"
	SeccompBackendCRD     = "crd"
)

Valid values for SeccompProfileBackend configuration

View Source 
const DefaultSyscallPollInterval = 5 * time.Second

DefaultSyscallPollInterval is SyscallPollInterval's default, matching the pre-PR-#591 RuleManager alerting cadence (see pkg/containerwatcher/v2/tracers/syscall.go). Exported so SyscallTracer's own fallback (used when constructed with a zero-value config.Config, e.g. in tests) can reference the same value instead of duplicating the literal.

View Source 
const NamespaceEnvVar = "NAMESPACE_NAME"
View Source 
const NodeNameEnvVar = "NODE_NAME"
View Source 
const PodNameEnvVar = "POD_NAME"

Variables

This section is empty.

Functions

func LoadServiceURLs added in v0.3.79 

func LoadServiceURLs(apiURL string) (schema.IBackendServices, error)

Types

type AlertDeduplicationConfig added in v0.3.142 

type AlertDeduplicationConfig struct {
	Bypass bool `mapstructure:"bypass"`
}

AlertDeduplicationConfig is a master switch that bypasses all sensor-side alert deduplication and cooldown. Off by default; intended for high-volume security-testing (DAST) use cases.

type Config 

type Config struct {
	BlockEvents                    bool                                 `mapstructure:"blockEvents"`
	CelConfigCache                 cache.FunctionCacheConfig            `mapstructure:"celConfigCache"`
	ContainerEolNotificationBuffer int                                  `mapstructure:"containerEolNotificationBuffer"`
	DBpf                           bool                                 `mapstructure:"dBpf"`
	DCapSys                        bool                                 `mapstructure:"dCapSys"`
	DDns                           bool                                 `mapstructure:"dDns"`
	DExec                          bool                                 `mapstructure:"dExec"`
	DExit                          bool                                 `mapstructure:"dExit"`
	DFork                          bool                                 `mapstructure:"dFork"`
	DHardlink                      bool                                 `mapstructure:"dHardlink"`
	DHttp                          bool                                 `mapstructure:"dHttp"`
	DIouring                       bool                                 `mapstructure:"dIouring"`
	DKmod                          bool                                 `mapstructure:"dKmod"`
	DNSCacheSize                   int                                  `mapstructure:"dnsCacheSize"`
	DNetwork                       bool                                 `mapstructure:"dNetwork"`
	DOpen                          bool                                 `mapstructure:"dOpen"`
	DPtrace                        bool                                 `mapstructure:"dPtrace"`
	DRandomx                       bool                                 `mapstructure:"dRandomx"`
	DSeccomp                       bool                                 `mapstructure:"dSeccomp"`
	DSsh                           bool                                 `mapstructure:"dSsh"`
	DSymlink                       bool                                 `mapstructure:"dSymlink"`
	DTop                           bool                                 `mapstructure:"dTop"`
	DUnshare                       bool                                 `mapstructure:"dUnshare"`
	EnableApplicationProfile       bool                                 `mapstructure:"applicationProfileServiceEnabled"`
	EnableEmbeddedSboms            bool                                 `mapstructure:"enableEmbeddedSBOMs"`
	EnableFIM                      bool                                 `mapstructure:"fimEnabled"`
	EnableFullPathTracing          bool                                 `mapstructure:"fullPathTracingEnabled"`
	EnableHttpDetection            bool                                 `mapstructure:"httpDetectionEnabled"`
	EnableMalwareDetection         bool                                 `mapstructure:"malwareDetectionEnabled"`
	EnableNetworkStreaming         bool                                 `mapstructure:"networkStreamingEnabled"`
	EnableNetworkTracing           bool                                 `mapstructure:"networkServiceEnabled"`
	EnableNodeProfile              bool                                 `mapstructure:"nodeProfileServiceEnabled"`
	EnablePartialProfileGeneration bool                                 `mapstructure:"partialProfileGenerationEnabled"`
	EnableMetricsExporter          bool                                 `mapstructure:"prometheusExporterEnabled"`
	EnableRuntimeDetection         bool                                 `mapstructure:"runtimeDetectionEnabled"`
	EnableSbomFailureReporting     bool                                 `mapstructure:"sbomFailureReportingEnabled"`
	EnableSbomGeneration           bool                                 `mapstructure:"sbomGenerationEnabled"`
	EnableSeccomp                  bool                                 `mapstructure:"seccompServiceEnabled"`
	HostMonitoringEnabled          bool                                 `mapstructure:"hostMonitoringEnabled"`
	HostSBOMRescanInterval         time.Duration                        `mapstructure:"hostSBOMRescanInterval"`
	HostSbomScanParallelism        int                                  `mapstructure:"hostSbomScanParallelism"`
	HostSbomOffloadEnabled         bool                                 `mapstructure:"hostSbomOffloadEnabled"`
	StandaloneMonitoringEnabled    bool                                 `mapstructure:"standaloneMonitoringEnabled"`
	SeccompProfileBackend          string                               `mapstructure:"seccompProfileBackend"`
	EventBatchSize                 int                                  `mapstructure:"eventBatchSize"`
	AlertDeduplication             AlertDeduplicationConfig             `mapstructure:"alertDeduplication"`
	EventDedup                     EventDedupConfig                     `mapstructure:"eventDedup"`
	ExcludeJsonPaths               []string                             `mapstructure:"excludeJsonPaths"`
	ExcludeLabels                  map[string][]string                  `mapstructure:"excludeLabels"`
	ExcludeNamespaces              []string                             `mapstructure:"excludeNamespaces"`
	ExitCleanup                    processtreecreator.ExitCleanupConfig `mapstructure:"exitCleanup"`
	Exporters                      exporters.ExportersConfig            `mapstructure:"exporters"`
	FIM                            FIMConfig                            `mapstructure:"fim"`
	IgnoreRuleBindings             bool                                 `mapstructure:"ignoreRuleBindings"`
	IncludeNamespaces              []string                             `mapstructure:"includeNamespaces"`
	InitialDelay                   time.Duration                        `mapstructure:"initialDelay"`
	KubernetesMode                 bool                                 `mapstructure:"kubernetesMode"`
	MaxDelaySeconds                int                                  `mapstructure:"maxDelaySeconds"`
	MaxImageSize                   int64                                `mapstructure:"maxImageSize"`
	MaxJitterPercentage            int                                  `mapstructure:"maxJitterPercentage"`
	MaxSBOMSize                    int                                  `mapstructure:"maxSBOMSize"`
	MaxSniffingTime                time.Duration                        `mapstructure:"maxSniffingTimePerContainer"`
	MaxTsProfileSize               int64                                `mapstructure:"maxTsProfileSize"`
	NamespaceName                  string                               `mapstructure:"namespaceName"`
	NetworkStreamingInterval       time.Duration                        `mapstructure:"networkStreamingInterval"`
	NodeName                       string                               `mapstructure:"nodeName"`
	NodeProfileInterval            time.Duration                        `mapstructure:"nodeProfileInterval"`
	OrderedEventQueue              OrderedEventQueueConfig              `mapstructure:"orderedEventQueue"`
	PodName                        string                               `mapstructure:"podName"`
	ProcfsPidScanInterval          time.Duration                        `mapstructure:"procfsPidScanInterval"`
	ProcfsScanInterval             time.Duration                        `mapstructure:"procfsScanInterval"`
	ProfileProjection              ProfileProjectionConfig              `mapstructure:"profileProjection"`
	ProfilesCacheRefreshRate       time.Duration                        `mapstructure:"profilesCacheRefreshRate"`
	StorageRPCBudget               time.Duration                        `mapstructure:"storageRPCBudget"`
	SyscallPollInterval            time.Duration                        `mapstructure:"syscallPollInterval"`
	RuleCoolDown                   rulecooldown.RuleCooldownConfig      `mapstructure:"ruleCooldown"`
	UpdateDataPeriod               time.Duration                        `mapstructure:"updateDataPeriod"`
	WorkerChannelSize              int                                  `mapstructure:"workerChannelSize"`
	WorkerPoolSize                 int                                  `mapstructure:"workerPoolSize"`
	// Host sensor configuration
	EnableHostSensor   bool          `mapstructure:"hostSensorEnabled"`
	HostSensorInterval time.Duration `mapstructure:"hostSensorInterval"`
}

func LoadConfig 

func LoadConfig(path string) (Config, error)

LoadConfig reads configuration from file or environment variables.

func LoadConfigOptional added in v0.3.75 

func LoadConfigOptional(path string, errNotFound bool) (Config, error)

LoadConfigOptional reads configuration from path, applying defaults for every unset field. When errNotFound is false, a missing config file is tolerated and defaults are used instead of returning an error.

func (*Config) IgnoreContainer added in v0.2.325 

func (c *Config) IgnoreContainer(ns, podName string, labels map[string]string) bool

func (*Config) IsMetricsEnabled added in v0.3.216 

func (c *Config) IsMetricsEnabled() bool

IsMetricsEnabled returns true if metrics export is enabled via config or OTEL env vars.

func (*Config) SkipNamespace added in v0.2.101 

func (c *Config) SkipNamespace(ns string) bool

type EventDedupConfig added in v0.3.91 

type EventDedupConfig struct {
	Enabled       bool  `mapstructure:"enabled"`
	SlotsExponent uint8 `mapstructure:"slotsExponent"`
}

type FIMConfig added in v0.2.393 

type FIMConfig struct {
	Directories    []FIMDirectoryConfig                 `mapstructure:"directories"`
	BackendConfig  hostfimsensor.HostFimBackendConfig   `mapstructure:"backendConfig"`
	BatchConfig    hostfimsensor.HostFimBatchConfig     `mapstructure:"batchConfig"`
	DedupConfig    hostfimsensor.HostFimDedupConfig     `mapstructure:"dedupConfig"`
	PeriodicConfig *hostfimsensor.HostFimPeriodicConfig `mapstructure:"periodicConfig"`
	Exporters      FIMExportersConfig                   `mapstructure:"exporters"`
}

FIMConfig defines the configuration for File Integrity Monitoring

func (*FIMConfig) GetFIMExportersConfig added in v0.2.393 

func (c *FIMConfig) GetFIMExportersConfig() exporters.ExportersConfig

GetFIMExportersConfig returns the exporters configuration for FIM

func (*FIMConfig) GetFIMPathConfigs added in v0.2.393 

func (c *FIMConfig) GetFIMPathConfigs() []hostfimsensor.HostFimPathConfig

GetFIMPathConfigs converts FIMDirectoryConfig to HostFimPathConfig

type FIMDirectoryConfig added in v0.2.393 

type FIMDirectoryConfig struct {
	Path     string `mapstructure:"path"`
	OnCreate bool   `mapstructure:"onCreate"`
	OnChange bool   `mapstructure:"onChange"`
	OnRemove bool   `mapstructure:"onRemove"`
	OnRename bool   `mapstructure:"onRename"`
	OnChmod  bool   `mapstructure:"onChmod"`
	OnMove   bool   `mapstructure:"onMove"`
}

FIMDirectoryConfig defines configuration for a directory to monitor

type FIMExportersConfig added in v0.2.393 

type FIMExportersConfig struct {
	StdoutExporter           *bool                         `mapstructure:"stdoutExporter"`
	HTTPExporterConfig       *exporters.HTTPExporterConfig `mapstructure:"httpExporterConfig"`
	SyslogExporter           string                        `mapstructure:"syslogExporterURL"`
	AlertManagerExporterUrls []string                      `mapstructure:"alertManagerExporterUrls"`
}

FIMExportersConfig defines which exporters to use for FIM events

type OrderedEventQueueConfig added in v0.3.3 

type OrderedEventQueueConfig struct {
	Size            int           `mapstructure:"size"`
	CollectionDelay time.Duration `mapstructure:"collectionDelay"`
}

type ProfileProjectionConfig added in v0.3.111 

type ProfileProjectionConfig struct {
	// DetailedMetricsEnabled enables per-rule stale-entry and literal-miss counters.
	DetailedMetricsEnabled bool `mapstructure:"detailedMetricsEnabled"`
	// StrictValidation rejects rules with profileDependency>0 but no profileDataRequired.
	// Defaults to false (soft mode: log + metric only).
	StrictValidation bool `mapstructure:"strictValidation"`
}

EventDedupConfig controls eBPF event deduplication before CEL rule evaluation. ProfileProjectionConfig controls rule-aware profile projection behaviour.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.