Documentation
¶
Index ¶
Constants ¶
const ( // AdmissionWindow is admissionWindow, exported for callers outside this // package that need to size a request deadline around it. AdmissionWindow = admissionWindow )
const (
MaxgRPCMessageSize = 128 * 1024 * 1024
)
Variables ¶
var ( ErrScannerCrashed = errors.New("SBOM scanner sidecar crashed during scan") ErrScannerNotReady = errors.New("SBOM scanner sidecar not ready") ErrImageTooLarge = errors.New("image size exceeds maximum allowed size") // ErrScannerBusy reports that the sidecar could not admit this scan within // the admission window -- another scan holds the single admission slot. // // It is emphatically NOT a scan failure: no scan work was dispatched, so // neither caller may route it through its failure/retry accounting // (reportFailure, failureRetries, crashLoopRetries, or the host path's // sidecar-failure counter). Both callers retry it under a short bounded // backoff instead; see busyRetryDelay in pkg/sbommanager/v1. ErrScannerBusy = errors.New("SBOM scanner sidecar busy") // ErrHostDocumentTooLargeToTransfer reports that a host SBOM was produced // successfully but its serialized form exceeds the gRPC transfer budget, so // the sidecar declined to send it. // // It exists so that an oversized host document reaches the SAME terminal // state via the sidecar as it would in-process: without it, the send would // fail as a generic transport error and the host path would re-walk the // whole root filesystem every rescan interval forever, which is exactly the // outcome the TooLarge state machine exists to prevent. ErrHostDocumentTooLargeToTransfer = errors.New("host SBOM document exceeds the gRPC transfer budget") // ErrScannerHostScanRejected reports a pre-dispatch rejection of a host scan // request (an invalid source_name, or a HOST_ROOT that does not resolve to a // plausible host filesystem). Like ErrScannerBusy, no scan work was // dispatched, so the caller may fall back in-process for this one cycle at // no double-scan cost -- unlike ErrScannerBusy, this is a configuration // defect, not transient contention, so the caller logs it at a level an // operator will notice rather than treating it as routine. ErrScannerHostScanRejected = errors.New("SBOM scanner sidecar rejected the host scan request before dispatch") )
Functions ¶
func NewScannerServer ¶
func NewScannerServer() pb.SBOMScannerServer
Types ¶
type HostDocumentTooLargeError ¶ added in v0.3.241
type HostDocumentTooLargeError struct {
Size int64
}
HostDocumentTooLargeError carries the serialized size the sidecar measured before declining to send an oversized host document. The size is what the host path records in ResourceSizeMetadataKey and compares against cfg.MaxSBOMSize, standing in for size.Of(wipSbom) on this one path.
It unwraps to ErrHostDocumentTooLargeToTransfer, so callers that only need the classification can use errors.Is and ignore the size.
func (*HostDocumentTooLargeError) Error ¶ added in v0.3.241
func (e *HostDocumentTooLargeError) Error() string
func (*HostDocumentTooLargeError) Unwrap ¶ added in v0.3.241
func (e *HostDocumentTooLargeError) Unwrap() error
type HostScanRequest ¶ added in v0.3.241
type HostScanRequest struct {
// SourceName is the Syft source alias name, i.e. the host SBOM's CR name.
// The sidecar cannot derive it: it comes from the host identity only
// node-agent resolves.
SourceName string
EnableEmbeddedSBOMs bool
Timeout time.Duration
}
HostScanRequest is the host counterpart of ScanRequest. It carries none of the image-shaped fields (no image ID/tag, no layer paths, no CRI image status) and no root path: the sidecar resolves and validates its own HOST_ROOT. See ScanHostFilesystemRequest in the proto for why each omitted field is omitted.
type HostScanResult ¶ added in v0.3.241
type HostScanResult struct {
SyftDocument v1beta1.SyftDocument
SBOMSize int64
}
type SBOMScannerClient ¶
type SBOMScannerClient interface {
CreateSBOM(ctx context.Context, req ScanRequest) (*ScanResult, error)
// ScanHostFilesystem scans the sidecar's own view of the node root
// filesystem. It may return ErrScannerBusy (admission window exhausted, not
// a scan failure) or a *HostDocumentTooLargeError (scan succeeded, document
// undeliverable).
ScanHostFilesystem(ctx context.Context, req HostScanRequest) (*HostScanResult, error)
Ready() bool
Close() error
}
func NewSBOMScannerClient ¶
func NewSBOMScannerClient(socketPath string) (SBOMScannerClient, error)
type ScanRequest ¶
type ScanResult ¶
type ScanResult struct {
SyftDocument v1beta1.SyftDocument
SBOMSize int64
}