Documentation
¶
Index ¶
Constants ¶
const ( NodeNameMetadataKey = "kubescape.io/node-name" ScannerMemoryLimitAnnotation = "kubescape.io/scanner-memory-limit" )
const HostMaxSBOMSizeAnnotation = "kubescape.io/host-max-sbom-size"
HostMaxSBOMSizeAnnotation records cfg.MaxSBOMSize at the time a host SBOM was marked TooLarge, so hostTooLargeReleased can detect a later config change and release the block. It is a dedicated key, not ScannerMemoryLimitAnnotation.
The host scan can now run in the sbom-scanner sidecar, so "the host has no sidecar" is no longer why -- but the conclusion is unchanged, and for a sharper reason: ScannerMemoryLimitAnnotation records the limit that decides whether the SIDECAR's own memory is exceeded, whereas what marks a host SBOM TooLarge is always cfg.MaxSBOMSize (either via size.Of client-side, or via the sidecar's transfer-budget check, which is likewise unrelated to the scanner's memory limit). Recording the scanner memory limit here would mean cfg.MaxSBOMSize -- the value that actually gates the host size check -- could never unblock a stuck TooLarge host SBOM.
const HostSbomNameLabelKey = "kubescape.io/host"
HostSbomNameLabelKey labels the host SBOM with the node it describes, since none of the image-derived labels (image ID/name/tag) apply to a host.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type HTTPSbomFailureReporter ¶ added in v0.3.79
type HTTPSbomFailureReporter struct {
// contains filtered or unexported fields
}
HTTPSbomFailureReporter sends scan failure reports to careportreceiver via HTTP POST. Uses the same endpoint and auth as kubevuln: POST /k8s/v2/scanFailure with X-API-KEY header.
func NewHTTPSbomFailureReporter ¶ added in v0.3.79
func NewHTTPSbomFailureReporter(eventReceiverURL, accessKey, accountID, clusterName string) *HTTPSbomFailureReporter
NewHTTPSbomFailureReporter creates a reporter that POSTs to the given event receiver URL. eventReceiverURL is the base URL (e.g., "http://event-receiver-http.kubescape.svc.cluster.local:8080"). accessKey is the cluster access key for the X-API-KEY header.
func (*HTTPSbomFailureReporter) ReportSbomFailure ¶ added in v0.3.79
func (r *HTTPSbomFailureReporter) ReportSbomFailure(ctx context.Context, report scanfailure.ScanFailureReport) error
type SbomManager ¶
type SbomManager struct {
// contains filtered or unexported fields
}
func CreateSbomManager ¶
func CreateSbomManager(ctx context.Context, cfg config.Config, socketPath string, storageClient storage.SbomClient, k8sObjectCache objectcache.K8sObjectCache, scannerClient sbomscanner.SBOMScannerClient, failureReporter sbommanager.SbomFailureReporter, metrics metricsmanager.MetricsManager) (*SbomManager, error)
CreateSbomManager builds a SbomManager wired with the given dependencies, including the host filesystem root (HOST_ROOT, defaulting to /host) used by the separate host SBOM scan branch.
func (*SbomManager) ContainerCallback ¶
func (s *SbomManager) ContainerCallback(notif containercollection.PubSubEvent)
ContainerCallback handles add/remove container-collection events. Host pseudo-container events are routed to the separate host SBOM scan branch (startHostSbomLifecycle); everything else follows the image/mount-driven container SBOM path.
Source Files
Directories