Documentation
¶
Index ¶
Constants ¶
const ( ReasonQueueFull = "queue_full" ReasonSendFailed = "send_failed" )
Reasons a finding never reached the collector.
const DefaultQueueSize = 4096
DefaultQueueSize is how many findings may await transmission. The queue is memory on a privileged DaemonSet pod, so it is bounded and the overflow is counted rather than allowed to grow with a collector that stops reading.
const SourceName = "pushsink"
SourceName is the source label of every drop this sink counts.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type GRPCSink ¶
type GRPCSink struct {
// contains filtered or unexported fields
}
GRPCSink streams findings to a collector over a client-streaming RPC. It is a monitor.FindingSink: Report never blocks the event path, and everything it puts on the wire has been through reporter.Redact.
The daemon is the client. Nothing here listens, so a node running this sink opens no port.
func New ¶
New builds a sink for opts. It fails rather than starting a daemon whose findings would silently go nowhere: an unreadable certificate is a configuration error, not something to discover on the first violation.
func (*GRPCSink) Report ¶
Report queues f for transmission. It never blocks: when the queue is full the oldest finding is dropped and counted, so a collector that stops reading costs the newest observations rather than the event path.
Redaction happens here rather than at send time: what the queue holds is already scrubbed and bounded, so raw argv never sits in daemon memory waiting for a collector to come back.
type Options ¶
type Options struct {
// Target is the collector's address, as accepted by grpc.NewClient.
Target string
// CAFile verifies the collector. CertFile and KeyFile are this daemon's
// client certificate.
CAFile string
CertFile string
KeyFile string
// QueueSize bounds the send queue (default DefaultQueueSize).
QueueSize int
// LossFunc counts findings that never reached the collector, by reason.
// May be nil.
LossFunc func(reason string, delta uint64)
}
Options configures a GRPCSink. Target and all three TLS paths are required: there is no value of this struct that transmits a finding in the clear.
Source Files