Documentation
¶
Index ¶
- Constants
- Variables
- func RegisterFindingServiceServer(s grpc.ServiceRegistrar, srv FindingServiceServer)
- type Ack
- type Dns
- type Finding
- func (*Finding) Descriptor() ([]byte, []int)deprecated
- func (x *Finding) GetBehavior() string
- func (x *Finding) GetDns() *Dns
- func (x *Finding) GetEnforced() bool
- func (x *Finding) GetMessage() string
- func (x *Finding) GetNet() *Net
- func (x *Finding) GetPod() *Pod
- func (x *Finding) GetPolicyName() string
- func (x *Finding) GetPolicyUid() string
- func (x *Finding) GetProcess() *Process
- func (x *Finding) GetResult() string
- func (x *Finding) GetTarget() string
- func (x *Finding) GetTimestamp() *timestamppb.Timestamp
- func (*Finding) ProtoMessage()
- func (x *Finding) ProtoReflect() protoreflect.Message
- func (x *Finding) Reset()
- func (x *Finding) String() string
- type FindingServiceClient
- type FindingServiceServer
- type FindingService_ReportClient
- type FindingService_ReportServer
- type Net
- type Pod
- func (*Pod) Descriptor() ([]byte, []int)deprecated
- func (x *Pod) GetContainer() string
- func (x *Pod) GetContainerId() string
- func (x *Pod) GetName() string
- func (x *Pod) GetNamespace() string
- func (x *Pod) GetNodeName() string
- func (x *Pod) GetOwnerKind() string
- func (x *Pod) GetOwnerName() string
- func (x *Pod) GetServiceAccount() string
- func (x *Pod) GetUid() string
- func (*Pod) ProtoMessage()
- func (x *Pod) ProtoReflect() protoreflect.Message
- func (x *Pod) Reset()
- func (x *Pod) String() string
- type Process
- type UnimplementedFindingServiceServer
- type UnsafeFindingServiceServer
Constants ¶
const (
FindingService_Report_FullMethodName = "/finding.FindingService/Report"
)
Variables ¶
var File_proto_finding_proto protoreflect.FileDescriptor
var FindingService_ServiceDesc = grpc.ServiceDesc{ ServiceName: "finding.FindingService", HandlerType: (*FindingServiceServer)(nil), Methods: []grpc.MethodDesc{}, Streams: []grpc.StreamDesc{ { StreamName: "Report", Handler: _FindingService_Report_Handler, ClientStreams: true, }, }, Metadata: "proto/finding.proto", }
FindingService_ServiceDesc is the grpc.ServiceDesc for FindingService service. It's only intended for direct use with grpc.RegisterService, and not to be introspected or modified (even as a copy)
Functions ¶
func RegisterFindingServiceServer ¶
func RegisterFindingServiceServer(s grpc.ServiceRegistrar, srv FindingServiceServer)
Types ¶
type Ack ¶
type Ack struct {
Accepted uint64 `protobuf:"varint,1,opt,name=accepted,proto3" json:"accepted,omitempty"`
// contains filtered or unexported fields
}
Ack closes the stream, reporting how many findings the collector accepted.
func (*Ack) Descriptor
deprecated
func (*Ack) GetAccepted ¶
func (*Ack) ProtoMessage ¶
func (*Ack) ProtoMessage()
func (*Ack) ProtoReflect ¶
func (x *Ack) ProtoReflect() protoreflect.Message
type Dns ¶
type Dns struct {
Qname string `protobuf:"bytes,1,opt,name=qname,proto3" json:"qname,omitempty"`
// contains filtered or unexported fields
}
Dns summarizes the observed question of a dns finding.
func (*Dns) Descriptor
deprecated
func (*Dns) ProtoMessage ¶
func (*Dns) ProtoMessage()
func (*Dns) ProtoReflect ¶
func (x *Dns) ProtoReflect() protoreflect.Message
type Finding ¶
type Finding struct {
PolicyName string `protobuf:"bytes,1,opt,name=policy_name,json=policyName,proto3" json:"policy_name,omitempty"`
PolicyUid string `protobuf:"bytes,2,opt,name=policy_uid,json=policyUid,proto3" json:"policy_uid,omitempty"`
// behavior is one of "network", "open", "exec", "protocol", "dns".
Behavior string `protobuf:"bytes,3,opt,name=behavior,proto3" json:"behavior,omitempty"`
// target is the behavior's object: the destination, path, executed binary,
// protocol[/alpn], or question name.
Target string `protobuf:"bytes,4,opt,name=target,proto3" json:"target,omitempty"`
// result is "fail" or "warn".
Result string `protobuf:"bytes,5,opt,name=result,proto3" json:"result,omitempty"`
// enforced is true when the kernel denied the operation, false for a
// monitor-mode policy's "would have been denied" counterfactual.
Enforced bool `protobuf:"varint,6,opt,name=enforced,proto3" json:"enforced,omitempty"`
Message string `protobuf:"bytes,7,opt,name=message,proto3" json:"message,omitempty"`
Pod *Pod `protobuf:"bytes,8,opt,name=pod,proto3" json:"pod,omitempty"`
Net *Net `protobuf:"bytes,9,opt,name=net,proto3" json:"net,omitempty"`
Dns *Dns `protobuf:"bytes,10,opt,name=dns,proto3" json:"dns,omitempty"`
Process *Process `protobuf:"bytes,11,opt,name=process,proto3" json:"process,omitempty"`
Timestamp *timestamppb.Timestamp `protobuf:"bytes,12,opt,name=timestamp,proto3" json:"timestamp,omitempty"`
// contains filtered or unexported fields
}
Finding mirrors the closed struct the daemon reports: typed scalar fields only, with no map, no body, and no free-form properties. Every string field is redacted before it is sent.
func (*Finding) Descriptor
deprecated
func (*Finding) GetBehavior ¶
func (*Finding) GetEnforced ¶
func (*Finding) GetMessage ¶
func (*Finding) GetPolicyName ¶
func (*Finding) GetPolicyUid ¶
func (*Finding) GetProcess ¶
func (*Finding) GetTimestamp ¶
func (x *Finding) GetTimestamp() *timestamppb.Timestamp
func (*Finding) ProtoMessage ¶
func (*Finding) ProtoMessage()
func (*Finding) ProtoReflect ¶
func (x *Finding) ProtoReflect() protoreflect.Message
type FindingServiceClient ¶
type FindingServiceClient interface {
Report(ctx context.Context, opts ...grpc.CallOption) (grpc.ClientStreamingClient[Finding, Ack], error)
}
FindingServiceClient is the client API for FindingService service.
For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
FindingService receives the findings a kyverno-runtime daemon produces. The daemon is always the client: it opens the stream and never listens.
func NewFindingServiceClient ¶
func NewFindingServiceClient(cc grpc.ClientConnInterface) FindingServiceClient
type FindingServiceServer ¶
type FindingServiceServer interface {
Report(grpc.ClientStreamingServer[Finding, Ack]) error
// contains filtered or unexported methods
}
FindingServiceServer is the server API for FindingService service. All implementations must embed UnimplementedFindingServiceServer for forward compatibility.
FindingService receives the findings a kyverno-runtime daemon produces. The daemon is always the client: it opens the stream and never listens.
type FindingService_ReportClient ¶
type FindingService_ReportClient = grpc.ClientStreamingClient[Finding, Ack]
This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
type FindingService_ReportServer ¶
type FindingService_ReportServer = grpc.ClientStreamingServer[Finding, Ack]
This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
type Net ¶
type Net struct {
DestIp string `protobuf:"bytes,1,opt,name=dest_ip,json=destIp,proto3" json:"dest_ip,omitempty"`
DestHost string `protobuf:"bytes,2,opt,name=dest_host,json=destHost,proto3" json:"dest_host,omitempty"`
// contains filtered or unexported fields
}
Net summarizes the destination of a network finding.
func (*Net) Descriptor
deprecated
func (*Net) GetDestHost ¶
func (*Net) ProtoMessage ¶
func (*Net) ProtoMessage()
func (*Net) ProtoReflect ¶
func (x *Net) ProtoReflect() protoreflect.Message
type Pod ¶
type Pod struct {
Uid string `protobuf:"bytes,1,opt,name=uid,proto3" json:"uid,omitempty"`
Namespace string `protobuf:"bytes,2,opt,name=namespace,proto3" json:"namespace,omitempty"`
Name string `protobuf:"bytes,3,opt,name=name,proto3" json:"name,omitempty"`
Container string `protobuf:"bytes,4,opt,name=container,proto3" json:"container,omitempty"`
ContainerId string `protobuf:"bytes,5,opt,name=container_id,json=containerId,proto3" json:"container_id,omitempty"`
// owner_kind and owner_name are best-effort correlation metadata read
// verbatim from the pod's ownerReferences. Kubernetes validates that field
// structurally, not behaviorally, so any principal able to create or patch a
// pod can name any owner it likes. A receiver must not treat these as an
// authenticated identity or use them as a security boundary.
OwnerKind string `protobuf:"bytes,6,opt,name=owner_kind,json=ownerKind,proto3" json:"owner_kind,omitempty"`
OwnerName string `protobuf:"bytes,7,opt,name=owner_name,json=ownerName,proto3" json:"owner_name,omitempty"`
NodeName string `protobuf:"bytes,8,opt,name=node_name,json=nodeName,proto3" json:"node_name,omitempty"`
ServiceAccount string `protobuf:"bytes,9,opt,name=service_account,json=serviceAccount,proto3" json:"service_account,omitempty"`
// contains filtered or unexported fields
}
Pod identifies the workload a finding is attributed to. Pod labels are absent by design: arbitrary user-controlled key/values are not sent.
func (*Pod) Descriptor
deprecated
func (*Pod) GetContainer ¶
func (*Pod) GetContainerId ¶
func (*Pod) GetNamespace ¶
func (*Pod) GetNodeName ¶
func (*Pod) GetOwnerKind ¶
func (*Pod) GetOwnerName ¶
func (*Pod) GetServiceAccount ¶
func (*Pod) ProtoMessage ¶
func (*Pod) ProtoMessage()
func (*Pod) ProtoReflect ¶
func (x *Pod) ProtoReflect() protoreflect.Message
type Process ¶
type Process struct {
Comm string `protobuf:"bytes,1,opt,name=comm,proto3" json:"comm,omitempty"`
Argv string `protobuf:"bytes,2,opt,name=argv,proto3" json:"argv,omitempty"`
// contains filtered or unexported fields
}
Process summarizes the process of an exec/open finding.
func (*Process) Descriptor
deprecated
func (*Process) ProtoMessage ¶
func (*Process) ProtoMessage()
func (*Process) ProtoReflect ¶
func (x *Process) ProtoReflect() protoreflect.Message
type UnimplementedFindingServiceServer ¶
type UnimplementedFindingServiceServer struct{}
UnimplementedFindingServiceServer must be embedded to have forward compatible implementations.
NOTE: this should be embedded by value instead of pointer to avoid a nil pointer dereference when methods are called.
func (UnimplementedFindingServiceServer) Report ¶
func (UnimplementedFindingServiceServer) Report(grpc.ClientStreamingServer[Finding, Ack]) error
type UnsafeFindingServiceServer ¶
type UnsafeFindingServiceServer interface {
// contains filtered or unexported methods
}
UnsafeFindingServiceServer may be embedded to opt out of forward compatibility for this service. Use of this interface is not recommended, as added methods to FindingServiceServer will result in compilation errors.