finding

package module
v0.0.0-...-113e60d Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Oct 31, 2026 License: Apache-2.0 Imports: 10 Imported by: 0

Documentation

Index

Constants

View Source
const (
	FindingService_Report_FullMethodName = "/finding.FindingService/Report"
)

Variables

View Source
var File_proto_finding_proto protoreflect.FileDescriptor
View Source
var FindingService_ServiceDesc = grpc.ServiceDesc{
	ServiceName: "finding.FindingService",
	HandlerType: (*FindingServiceServer)(nil),
	Methods:     []grpc.MethodDesc{},
	Streams: []grpc.StreamDesc{
		{
			StreamName:    "Report",
			Handler:       _FindingService_Report_Handler,
			ClientStreams: true,
		},
	},
	Metadata: "proto/finding.proto",
}

FindingService_ServiceDesc is the grpc.ServiceDesc for FindingService service. It's only intended for direct use with grpc.RegisterService, and not to be introspected or modified (even as a copy)

Functions

func RegisterFindingServiceServer

func RegisterFindingServiceServer(s grpc.ServiceRegistrar, srv FindingServiceServer)

Types

type Ack

type Ack struct {
	Accepted uint64 `protobuf:"varint,1,opt,name=accepted,proto3" json:"accepted,omitempty"`
	// contains filtered or unexported fields
}

Ack closes the stream, reporting how many findings the collector accepted.

func (*Ack) Descriptor deprecated

func (*Ack) Descriptor() ([]byte, []int)

Deprecated: Use Ack.ProtoReflect.Descriptor instead.

func (*Ack) GetAccepted

func (x *Ack) GetAccepted() uint64

func (*Ack) ProtoMessage

func (*Ack) ProtoMessage()

func (*Ack) ProtoReflect

func (x *Ack) ProtoReflect() protoreflect.Message

func (*Ack) Reset

func (x *Ack) Reset()

func (*Ack) String

func (x *Ack) String() string

type Dns

type Dns struct {
	Qname string `protobuf:"bytes,1,opt,name=qname,proto3" json:"qname,omitempty"`
	// contains filtered or unexported fields
}

Dns summarizes the observed question of a dns finding.

func (*Dns) Descriptor deprecated

func (*Dns) Descriptor() ([]byte, []int)

Deprecated: Use Dns.ProtoReflect.Descriptor instead.

func (*Dns) GetQname

func (x *Dns) GetQname() string

func (*Dns) ProtoMessage

func (*Dns) ProtoMessage()

func (*Dns) ProtoReflect

func (x *Dns) ProtoReflect() protoreflect.Message

func (*Dns) Reset

func (x *Dns) Reset()

func (*Dns) String

func (x *Dns) String() string

type Finding

type Finding struct {
	PolicyName string `protobuf:"bytes,1,opt,name=policy_name,json=policyName,proto3" json:"policy_name,omitempty"`
	PolicyUid  string `protobuf:"bytes,2,opt,name=policy_uid,json=policyUid,proto3" json:"policy_uid,omitempty"`
	// behavior is one of "network", "open", "exec", "protocol", "dns".
	Behavior string `protobuf:"bytes,3,opt,name=behavior,proto3" json:"behavior,omitempty"`
	// target is the behavior's object: the destination, path, executed binary,
	// protocol[/alpn], or question name.
	Target string `protobuf:"bytes,4,opt,name=target,proto3" json:"target,omitempty"`
	// result is "fail" or "warn".
	Result string `protobuf:"bytes,5,opt,name=result,proto3" json:"result,omitempty"`
	// enforced is true when the kernel denied the operation, false for a
	// monitor-mode policy's "would have been denied" counterfactual.
	Enforced  bool                   `protobuf:"varint,6,opt,name=enforced,proto3" json:"enforced,omitempty"`
	Message   string                 `protobuf:"bytes,7,opt,name=message,proto3" json:"message,omitempty"`
	Pod       *Pod                   `protobuf:"bytes,8,opt,name=pod,proto3" json:"pod,omitempty"`
	Net       *Net                   `protobuf:"bytes,9,opt,name=net,proto3" json:"net,omitempty"`
	Dns       *Dns                   `protobuf:"bytes,10,opt,name=dns,proto3" json:"dns,omitempty"`
	Process   *Process               `protobuf:"bytes,11,opt,name=process,proto3" json:"process,omitempty"`
	Timestamp *timestamppb.Timestamp `protobuf:"bytes,12,opt,name=timestamp,proto3" json:"timestamp,omitempty"`
	// contains filtered or unexported fields
}

Finding mirrors the closed struct the daemon reports: typed scalar fields only, with no map, no body, and no free-form properties. Every string field is redacted before it is sent.

func (*Finding) Descriptor deprecated

func (*Finding) Descriptor() ([]byte, []int)

Deprecated: Use Finding.ProtoReflect.Descriptor instead.

func (*Finding) GetBehavior

func (x *Finding) GetBehavior() string

func (*Finding) GetDns

func (x *Finding) GetDns() *Dns

func (*Finding) GetEnforced

func (x *Finding) GetEnforced() bool

func (*Finding) GetMessage

func (x *Finding) GetMessage() string

func (*Finding) GetNet

func (x *Finding) GetNet() *Net

func (*Finding) GetPod

func (x *Finding) GetPod() *Pod

func (*Finding) GetPolicyName

func (x *Finding) GetPolicyName() string

func (*Finding) GetPolicyUid

func (x *Finding) GetPolicyUid() string

func (*Finding) GetProcess

func (x *Finding) GetProcess() *Process

func (*Finding) GetResult

func (x *Finding) GetResult() string

func (*Finding) GetTarget

func (x *Finding) GetTarget() string

func (*Finding) GetTimestamp

func (x *Finding) GetTimestamp() *timestamppb.Timestamp

func (*Finding) ProtoMessage

func (*Finding) ProtoMessage()

func (*Finding) ProtoReflect

func (x *Finding) ProtoReflect() protoreflect.Message

func (*Finding) Reset

func (x *Finding) Reset()

func (*Finding) String

func (x *Finding) String() string

type FindingServiceClient

type FindingServiceClient interface {
	Report(ctx context.Context, opts ...grpc.CallOption) (grpc.ClientStreamingClient[Finding, Ack], error)
}

FindingServiceClient is the client API for FindingService service.

For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.

FindingService receives the findings a kyverno-runtime daemon produces. The daemon is always the client: it opens the stream and never listens.

type FindingServiceServer

type FindingServiceServer interface {
	Report(grpc.ClientStreamingServer[Finding, Ack]) error
	// contains filtered or unexported methods
}

FindingServiceServer is the server API for FindingService service. All implementations must embed UnimplementedFindingServiceServer for forward compatibility.

FindingService receives the findings a kyverno-runtime daemon produces. The daemon is always the client: it opens the stream and never listens.

type FindingService_ReportClient

type FindingService_ReportClient = grpc.ClientStreamingClient[Finding, Ack]

This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.

type FindingService_ReportServer

type FindingService_ReportServer = grpc.ClientStreamingServer[Finding, Ack]

This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.

type Net

type Net struct {
	DestIp   string `protobuf:"bytes,1,opt,name=dest_ip,json=destIp,proto3" json:"dest_ip,omitempty"`
	DestHost string `protobuf:"bytes,2,opt,name=dest_host,json=destHost,proto3" json:"dest_host,omitempty"`
	// contains filtered or unexported fields
}

Net summarizes the destination of a network finding.

func (*Net) Descriptor deprecated

func (*Net) Descriptor() ([]byte, []int)

Deprecated: Use Net.ProtoReflect.Descriptor instead.

func (*Net) GetDestHost

func (x *Net) GetDestHost() string

func (*Net) GetDestIp

func (x *Net) GetDestIp() string

func (*Net) ProtoMessage

func (*Net) ProtoMessage()

func (*Net) ProtoReflect

func (x *Net) ProtoReflect() protoreflect.Message

func (*Net) Reset

func (x *Net) Reset()

func (*Net) String

func (x *Net) String() string

type Pod

type Pod struct {
	Uid         string `protobuf:"bytes,1,opt,name=uid,proto3" json:"uid,omitempty"`
	Namespace   string `protobuf:"bytes,2,opt,name=namespace,proto3" json:"namespace,omitempty"`
	Name        string `protobuf:"bytes,3,opt,name=name,proto3" json:"name,omitempty"`
	Container   string `protobuf:"bytes,4,opt,name=container,proto3" json:"container,omitempty"`
	ContainerId string `protobuf:"bytes,5,opt,name=container_id,json=containerId,proto3" json:"container_id,omitempty"`
	// owner_kind and owner_name are best-effort correlation metadata read
	// verbatim from the pod's ownerReferences. Kubernetes validates that field
	// structurally, not behaviorally, so any principal able to create or patch a
	// pod can name any owner it likes. A receiver must not treat these as an
	// authenticated identity or use them as a security boundary.
	OwnerKind      string `protobuf:"bytes,6,opt,name=owner_kind,json=ownerKind,proto3" json:"owner_kind,omitempty"`
	OwnerName      string `protobuf:"bytes,7,opt,name=owner_name,json=ownerName,proto3" json:"owner_name,omitempty"`
	NodeName       string `protobuf:"bytes,8,opt,name=node_name,json=nodeName,proto3" json:"node_name,omitempty"`
	ServiceAccount string `protobuf:"bytes,9,opt,name=service_account,json=serviceAccount,proto3" json:"service_account,omitempty"`
	// contains filtered or unexported fields
}

Pod identifies the workload a finding is attributed to. Pod labels are absent by design: arbitrary user-controlled key/values are not sent.

func (*Pod) Descriptor deprecated

func (*Pod) Descriptor() ([]byte, []int)

Deprecated: Use Pod.ProtoReflect.Descriptor instead.

func (*Pod) GetContainer

func (x *Pod) GetContainer() string

func (*Pod) GetContainerId

func (x *Pod) GetContainerId() string

func (*Pod) GetName

func (x *Pod) GetName() string

func (*Pod) GetNamespace

func (x *Pod) GetNamespace() string

func (*Pod) GetNodeName

func (x *Pod) GetNodeName() string

func (*Pod) GetOwnerKind

func (x *Pod) GetOwnerKind() string

func (*Pod) GetOwnerName

func (x *Pod) GetOwnerName() string

func (*Pod) GetServiceAccount

func (x *Pod) GetServiceAccount() string

func (*Pod) GetUid

func (x *Pod) GetUid() string

func (*Pod) ProtoMessage

func (*Pod) ProtoMessage()

func (*Pod) ProtoReflect

func (x *Pod) ProtoReflect() protoreflect.Message

func (*Pod) Reset

func (x *Pod) Reset()

func (*Pod) String

func (x *Pod) String() string

type Process

type Process struct {
	Comm string `protobuf:"bytes,1,opt,name=comm,proto3" json:"comm,omitempty"`
	Argv string `protobuf:"bytes,2,opt,name=argv,proto3" json:"argv,omitempty"`
	// contains filtered or unexported fields
}

Process summarizes the process of an exec/open finding.

func (*Process) Descriptor deprecated

func (*Process) Descriptor() ([]byte, []int)

Deprecated: Use Process.ProtoReflect.Descriptor instead.

func (*Process) GetArgv

func (x *Process) GetArgv() string

func (*Process) GetComm

func (x *Process) GetComm() string

func (*Process) ProtoMessage

func (*Process) ProtoMessage()

func (*Process) ProtoReflect

func (x *Process) ProtoReflect() protoreflect.Message

func (*Process) Reset

func (x *Process) Reset()

func (*Process) String

func (x *Process) String() string

type UnimplementedFindingServiceServer

type UnimplementedFindingServiceServer struct{}

UnimplementedFindingServiceServer must be embedded to have forward compatible implementations.

NOTE: this should be embedded by value instead of pointer to avoid a nil pointer dereference when methods are called.

func (UnimplementedFindingServiceServer) Report

type UnsafeFindingServiceServer

type UnsafeFindingServiceServer interface {
	// contains filtered or unexported methods
}

UnsafeFindingServiceServer may be embedded to opt out of forward compatibility for this service. Use of this interface is not recommended, as added methods to FindingServiceServer will result in compilation errors.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL