kube

type AlarmNotifier interface {
	NotifyKubeAlarm(alarm *model.KubeAlarm)
}

type Container struct {
	Name                     string
	Image                    string
	Privileged               bool
	AllowPrivilegeEscalation *bool
	RunAsUser                *int64
	RunAsNonRoot             *bool
	ReadOnlyRootFilesystem   *bool
	AddedCapabilities        []string
	DroppedCapabilities      []string
	SELinuxOptions           map[string]string
	SeccompProfile           string // RuntimeDefault / Localhost / Unconfined / ""
	HostPorts                []int32
}

type DetectionRule struct {
	ID          string
	Name        string
	Severity    string
	AlarmType   model.KubeAlarmType
	Description string
	Remediation string // 处置建议
	Match       func(event *model.AuditEvent) bool
}

type KubeAlarmService struct {
	// contains filtered or unexported fields
}

type KubeAuditProcessor struct {
	// contains filtered or unexported fields
}

type KubeDetector struct {
	// contains filtered or unexported fields
}

type KubeRuleEngine struct {
	// contains filtered or unexported fields
}

type PodSpec struct {
	HostNetwork    bool
	HostPID        bool
	HostIPC        bool
	HostUsers      *bool // nil = 集群默认
	Containers     []Container
	InitContainers []Container
	Volumes        []Volume
}

type Profile string

type Violation struct {
	Field    string // 字段路径, e.g. "spec.containers[0].securityContext.privileged"
	Reason   string
	Severity string // critical / high / medium
}

type Volume struct {
	Name string
	Type string // hostPath / emptyDir / configMap / secret / pvc / ...
}