Help us shape the future of Go! Take the 2026 Go Developer Survey

config

package
v0.3.310 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Nov 3, 2026 License: Apache-2.0 Imports: 21 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	SeccompBackendStorage = "storage"
	SeccompBackendCRD     = "crd"
)

Valid values for SeccompProfileBackend configuration

View Source 
const DefaultSyscallPollInterval = 5 * time.Second

DefaultSyscallPollInterval is SyscallPollInterval's default, matching the pre-PR-#591 RuleManager alerting cadence (see pkg/containerwatcher/v2/tracers/syscall.go). Exported so SyscallTracer's own fallback (used when constructed with a zero-value config.Config, e.g. in tests) can reference the same value instead of duplicating the literal.

View Source 
const NamespaceEnvVar = "NAMESPACE_NAME"
View Source 
const NodeNameEnvVar = "NODE_NAME"
View Source 
const PodNameEnvVar = "POD_NAME"

Variables

This section is empty.

Functions

func LoadServiceURLs added in v0.3.79 

func LoadServiceURLs(apiURL string) (schema.IBackendServices, error)

func NormalizeDNSSuffix added in v0.3.278 

func NormalizeDNSSuffix(s string) string

NormalizeDNSSuffix lowercases s and ensures it carries a leading and a trailing dot, so ".Example.COM" and "example.com." both become ".example.com.". An empty or dots-only string returns "".

Types

type AlertDeduplicationConfig added in v0.3.142 

type AlertDeduplicationConfig struct {
	Bypass bool `mapstructure:"bypass"`
}

AlertDeduplicationConfig is a master switch that bypasses all sensor-side alert deduplication and cooldown. Off by default; intended for high-volume security-testing (DAST) use cases.

type Config 

type Config struct {
	GVisorStart                    gvisor.IntegrationConfig             `mapstructure:"gVisorStart"`
	BlockEvents                    bool                                 `mapstructure:"blockEvents"`
	CelConfigCache                 cache.FunctionCacheConfig            `mapstructure:"celConfigCache"`
	ContainerEolNotificationBuffer int                                  `mapstructure:"containerEolNotificationBuffer"`
	DBpf                           bool                                 `mapstructure:"dBpf"`
	DCapSys                        bool                                 `mapstructure:"dCapSys"`
	DDns                           bool                                 `mapstructure:"dDns"`
	DExec                          bool                                 `mapstructure:"dExec"`
	DExit                          bool                                 `mapstructure:"dExit"`
	DFork                          bool                                 `mapstructure:"dFork"`
	DHardlink                      bool                                 `mapstructure:"dHardlink"`
	DHttp                          bool                                 `mapstructure:"dHttp"`
	DIouring                       bool                                 `mapstructure:"dIouring"`
	DKmod                          bool                                 `mapstructure:"dKmod"`
	DNSCacheSize                   int                                  `mapstructure:"dnsCacheSize"`
	DNetwork                       bool                                 `mapstructure:"dNetwork"`
	DOpen                          bool                                 `mapstructure:"dOpen"`
	DPtrace                        bool                                 `mapstructure:"dPtrace"`
	DRandomx                       bool                                 `mapstructure:"dRandomx"`
	DSeccomp                       bool                                 `mapstructure:"dSeccomp"`
	DSsh                           bool                                 `mapstructure:"dSsh"`
	DSymlink                       bool                                 `mapstructure:"dSymlink"`
	DTop                           bool                                 `mapstructure:"dTop"`
	DUnshare                       bool                                 `mapstructure:"dUnshare"`
	EnableApplicationProfile       bool                                 `mapstructure:"applicationProfileServiceEnabled"`
	EnableEmbeddedSboms            bool                                 `mapstructure:"enableEmbeddedSBOMs"`
	EnableFIM                      bool                                 `mapstructure:"fimEnabled"`
	EnableFullPathTracing          bool                                 `mapstructure:"fullPathTracingEnabled"`
	EnableHttpDetection            bool                                 `mapstructure:"httpDetectionEnabled"`
	EnableMalwareDetection         bool                                 `mapstructure:"malwareDetectionEnabled"`
	EnableNetworkStreaming         bool                                 `mapstructure:"networkStreamingEnabled"`
	EnableNetworkTracing           bool                                 `mapstructure:"networkServiceEnabled"`
	EnableNodeProfile              bool                                 `mapstructure:"nodeProfileServiceEnabled"`
	EnablePartialProfileGeneration bool                                 `mapstructure:"partialProfileGenerationEnabled"`
	EnableMetricsExporter          bool                                 `mapstructure:"prometheusExporterEnabled"`
	EnableRuntimeDetection         bool                                 `mapstructure:"runtimeDetectionEnabled"`
	EnableSbomFailureReporting     bool                                 `mapstructure:"sbomFailureReportingEnabled"`
	EnableSbomGeneration           bool                                 `mapstructure:"sbomGenerationEnabled"`
	EnableSeccomp                  bool                                 `mapstructure:"seccompServiceEnabled"`
	HostMonitoringEnabled          bool                                 `mapstructure:"hostMonitoringEnabled"`
	HostSBOMRescanInterval         time.Duration                        `mapstructure:"hostSBOMRescanInterval"`
	HostSbomScanParallelism        int                                  `mapstructure:"hostSbomScanParallelism"`
	HostSbomOffloadEnabled         bool                                 `mapstructure:"hostSbomOffloadEnabled"`
	StandaloneMonitoringEnabled    bool                                 `mapstructure:"standaloneMonitoringEnabled"`
	SeccompProfileBackend          string                               `mapstructure:"seccompProfileBackend"`
	EventBatchSize                 int                                  `mapstructure:"eventBatchSize"`
	AlertDeduplication             AlertDeduplicationConfig             `mapstructure:"alertDeduplication"`
	DNSRuleForwarding              DNSRuleForwardingConfig              `mapstructure:"dnsRuleForwarding"`
	EventDedup                     EventDedupConfig                     `mapstructure:"eventDedup"`
	ExcludeJsonPaths               []string                             `mapstructure:"excludeJsonPaths"`
	ExcludeLabels                  map[string][]string                  `mapstructure:"excludeLabels"`
	ExcludeNamespaces              []string                             `mapstructure:"excludeNamespaces"`
	ExitCleanup                    processtreecreator.ExitCleanupConfig `mapstructure:"exitCleanup"`
	Exporters                      exporters.ExportersConfig            `mapstructure:"exporters"`
	FIM                            FIMConfig                            `mapstructure:"fim"`
	IgnoreRuleBindings             bool                                 `mapstructure:"ignoreRuleBindings"`
	IncludeNamespaces              []string                             `mapstructure:"includeNamespaces"`
	InitialDelay                   time.Duration                        `mapstructure:"initialDelay"`
	KubernetesMode                 bool                                 `mapstructure:"kubernetesMode"`
	MaxDelaySeconds                int                                  `mapstructure:"maxDelaySeconds"`
	MaxImageSize                   int64                                `mapstructure:"maxImageSize"`
	MaxJitterPercentage            int                                  `mapstructure:"maxJitterPercentage"`
	MaxSBOMSize                    int                                  `mapstructure:"maxSBOMSize"`
	MaxSniffingTime                time.Duration                        `mapstructure:"maxSniffingTimePerContainer"`
	MaxTsProfileSize               int64                                `mapstructure:"maxTsProfileSize"`
	NamespaceFilterFile            string                               `mapstructure:"namespaceFilterFile"`
	NamespaceName                  string                               `mapstructure:"namespaceName"`
	NetworkStreamingInterval       time.Duration                        `mapstructure:"networkStreamingInterval"`
	NodeName                       string                               `mapstructure:"nodeName"`
	NodeProfileInterval            time.Duration                        `mapstructure:"nodeProfileInterval"`
	OrderedEventQueue              OrderedEventQueueConfig              `mapstructure:"orderedEventQueue"`
	PodName                        string                               `mapstructure:"podName"`
	ProcfsPidScanInterval          time.Duration                        `mapstructure:"procfsPidScanInterval"`
	ProcfsScanInterval             time.Duration                        `mapstructure:"procfsScanInterval"`
	ProfileProjection              ProfileProjectionConfig              `mapstructure:"profileProjection"`
	ProfilesCacheRefreshRate       time.Duration                        `mapstructure:"profilesCacheRefreshRate"`
	StorageRPCBudget               time.Duration                        `mapstructure:"storageRPCBudget"`
	SyscallPollInterval            time.Duration                        `mapstructure:"syscallPollInterval"`
	RuleCoolDown                   rulecooldown.RuleCooldownConfig      `mapstructure:"ruleCooldown"`
	UpdateDataPeriod               time.Duration                        `mapstructure:"updateDataPeriod"`
	WorkerChannelSize              int                                  `mapstructure:"workerChannelSize"`
	WorkerPoolSize                 int                                  `mapstructure:"workerPoolSize"`
	// Host sensor configuration
	EnableHostSensor          bool          `mapstructure:"hostSensorEnabled"`
	HostSensorInterval        time.Duration `mapstructure:"hostSensorInterval"`
	HostSensorExcludedSensors []string      `mapstructure:"hostSensorExcludedSensors"`
	// contains filtered or unexported fields
}

func LoadConfig 

func LoadConfig(path string) (Config, error)

LoadConfig reads configuration from file or environment variables.

func LoadConfigOptional added in v0.3.75 

func LoadConfigOptional(path string, errNotFound bool) (Config, error)

LoadConfigOptional reads configuration from path, applying defaults for every unset field. When errNotFound is false, a missing config file is tolerated and defaults are used instead of returning an error.

func (*Config) IgnoreContainer added in v0.2.325 

func (c *Config) IgnoreContainer(ns, podName string, labels map[string]string) bool

func (*Config) InitializeNamespaceFilter added in v0.3.244 

func (c *Config) InitializeNamespaceFilter() error

InitializeNamespaceFilter must run before Config is copied to managers. An explicitly configured file must be valid at startup; otherwise startup fails.

func (*Config) IsMetricsEnabled added in v0.3.216 

func (c *Config) IsMetricsEnabled() bool

IsMetricsEnabled returns true if metrics export is enabled via config or OTEL env vars.

func (*Config) IsOwnAgentPod added in v0.3.273 

func (c *Config) IsOwnAgentPod(ns, podName string) bool

IsOwnAgentPod reports whether podName is one of the node-agent DaemonSet's own pods, which must never be traced (E1). It matches the local agent exactly by PodName (any namespace, so a mis-set namespace cannot expose the agent to self-tracing) and, within the agent namespace, any pod sharing the DaemonSet's name prefix (the sibling node-agent pods the cluster-wide untraced sweep surfaces). A pod deliberately named with the node-agent prefix inside the agent namespace is a documented spoof residual — evading it requires pod-create rights in the agent namespace, which is already privileged.

func (*Config) NamespaceFilterSnapshot added in v0.3.244 

func (c *Config) NamespaceFilterSnapshot() *NamespaceFilter

NamespaceFilterSnapshot returns the current immutable filter.

func (*Config) ReloadNamespaceFilter added in v0.3.244 

func (c *Config) ReloadNamespaceFilter() (bool, error)

ReloadNamespaceFilter atomically replaces both lists. Invalid updates leave the last valid snapshot intact. This is called by the container watcher's single reload loop, never by event-processing goroutines.

func (*Config) SkipNamespace added in v0.2.101 

func (c *Config) SkipNamespace(ns string) bool

type DNSRuleForwardingConfig added in v0.3.278 

type DNSRuleForwardingConfig struct {
	Enabled bool `mapstructure:"enabled"`
	// ExcludedSuffixes lists name suffixes that are never forwarded, in
	// addition to the built-in cluster-local and reverse-lookup zones. Each
	// entry is normalized to lowercase with a leading and trailing dot.
	ExcludedSuffixes []string `mapstructure:"excludedSuffixes"`
}

DNSRuleForwardingConfig controls whether DNS queries and error responses (NXDOMAIN, SERVFAIL, REFUSED), which the DNS tracer otherwise drops, are forwarded to rule evaluation. Forwarded events reach the rule manager only and match rule expressions written for eventType "dnsQuery"; existing "dns" expressions keep seeing answered responses only. Off by default. See docs/features/dns-query-rule-forwarding.md.

type EventDedupConfig added in v0.3.91 

type EventDedupConfig struct {
	Enabled       bool  `mapstructure:"enabled"`
	SlotsExponent uint8 `mapstructure:"slotsExponent"`
}

type FIMConfig added in v0.2.393 

type FIMConfig struct {
	Directories    []FIMDirectoryConfig                 `mapstructure:"directories"`
	BackendConfig  hostfimsensor.HostFimBackendConfig   `mapstructure:"backendConfig"`
	BatchConfig    hostfimsensor.HostFimBatchConfig     `mapstructure:"batchConfig"`
	DedupConfig    hostfimsensor.HostFimDedupConfig     `mapstructure:"dedupConfig"`
	PeriodicConfig *hostfimsensor.HostFimPeriodicConfig `mapstructure:"periodicConfig"`
	Exporters      FIMExportersConfig                   `mapstructure:"exporters"`
}

FIMConfig defines the configuration for File Integrity Monitoring

func (*FIMConfig) GetFIMExportersConfig added in v0.2.393 

func (c *FIMConfig) GetFIMExportersConfig() exporters.ExportersConfig

GetFIMExportersConfig returns the exporters configuration for FIM

func (*FIMConfig) GetFIMPathConfigs added in v0.2.393 

func (c *FIMConfig) GetFIMPathConfigs() []hostfimsensor.HostFimPathConfig

GetFIMPathConfigs converts FIMDirectoryConfig to HostFimPathConfig

type FIMDirectoryConfig added in v0.2.393 

type FIMDirectoryConfig struct {
	Path     string `mapstructure:"path"`
	OnCreate bool   `mapstructure:"onCreate"`
	OnChange bool   `mapstructure:"onChange"`
	OnRemove bool   `mapstructure:"onRemove"`
	OnRename bool   `mapstructure:"onRename"`
	OnChmod  bool   `mapstructure:"onChmod"`
	OnMove   bool   `mapstructure:"onMove"`
}

FIMDirectoryConfig defines configuration for a directory to monitor

type FIMExportersConfig added in v0.2.393 

type FIMExportersConfig struct {
	StdoutExporter           *bool                         `mapstructure:"stdoutExporter"`
	HTTPExporterConfig       *exporters.HTTPExporterConfig `mapstructure:"httpExporterConfig"`
	SyslogExporter           string                        `mapstructure:"syslogExporterURL"`
	AlertManagerExporterUrls []string                      `mapstructure:"alertManagerExporterUrls"`
}

FIMExportersConfig defines which exporters to use for FIM events

type NamespaceFilter added in v0.3.244 

type NamespaceFilter struct {
	// contains filtered or unexported fields
}

NamespaceFilter is an immutable snapshot of the namespace selection policy. A non-empty include list takes precedence over the exclude list, as in the startup configuration. Namespace names are exact matches, not regexes.

func ReadNamespaceFilter added in v0.3.244 

func ReadNamespaceFilter(path string) (*NamespaceFilter, error)

ReadNamespaceFilter reopens the path on each read so Kubernetes projected volume symlink replacements are observed. Both arrays are required: a partial or malformed document must not accidentally broaden monitoring.

func (*NamespaceFilter) SkipNamespace added in v0.3.244 

func (f *NamespaceFilter) SkipNamespace(namespace string) bool

func (*NamespaceFilter) UnionExclusions added in v0.3.244 

func (f *NamespaceFilter) UnionExclusions(other *NamespaceFilter) *NamespaceFilter

UnionExclusions retains namespaces excluded by either snapshot. The reload loop uses this while retrying discovery, so newer edits can still take effect without forgetting earlier exclusion-to-inclusion transitions.

type OrderedEventQueueConfig added in v0.3.3 

type OrderedEventQueueConfig struct {
	Size            int           `mapstructure:"size"`
	CollectionDelay time.Duration `mapstructure:"collectionDelay"`
}

type ProfileProjectionConfig added in v0.3.111 

type ProfileProjectionConfig struct {
	// DetailedMetricsEnabled enables per-rule stale-entry and literal-miss counters.
	DetailedMetricsEnabled bool `mapstructure:"detailedMetricsEnabled"`
	// StrictValidation rejects rules with profileDependency>0 but no profileDataRequired.
	// Defaults to false (soft mode: log + metric only).
	StrictValidation bool `mapstructure:"strictValidation"`
}

EventDedupConfig controls eBPF event deduplication before CEL rule evaluation. ProfileProjectionConfig controls rule-aware profile projection behaviour.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.