evidence

package
v0.55.0 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Apr 1, 2026 License: Apache-2.0 Imports: 13 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func NewCmdEvidence

func NewCmdEvidence() *cobra.Command

NewCmdEvidence returns the evidence command group

Types

type CloudTrailData

type CloudTrailData struct {
	ErrorEvents []CloudTrailError `yaml:"errorEvents,omitempty"`
	WriteEvents []CloudTrailEvent `yaml:"writeEvents,omitempty"`
}

CloudTrailData contains CloudTrail event information

type CloudTrailError

type CloudTrailError struct {
	EventTime   string `yaml:"eventTime"`
	EventName   string `yaml:"eventName"`
	ErrorCode   string `yaml:"errorCode"`
	ErrorMsg    string `yaml:"errorMessage,omitempty"`
	Username    string `yaml:"username,omitempty"`
	Region      string `yaml:"region"`
	ConsoleLink string `yaml:"consoleLink,omitempty"`
}

CloudTrailError represents an AWS error event

type CloudTrailEvent

type CloudTrailEvent struct {
	EventTime string `yaml:"eventTime"`
	EventName string `yaml:"eventName"`
	Username  string `yaml:"username,omitempty"`
	Region    string `yaml:"region"`
}

CloudTrailEvent represents an AWS API event

type ClusterState

type ClusterState struct {
	Nodes          []NodeInfo          `yaml:"nodes,omitempty"`
	Operators      []OperatorInfo      `yaml:"operators,omitempty"`
	MachineConfigs []MachineConfigInfo `yaml:"machineConfigs,omitempty"`
	Events         []EventInfo         `yaml:"events,omitempty"`
}

ClusterState captures cluster resource states

type CollectionMetadata

type CollectionMetadata struct {
	ClusterID       string    `yaml:"clusterId"`
	ClusterName     string    `yaml:"clusterName"`
	CollectionTime  time.Time `yaml:"collectionTime"`
	CollectorUser   string    `yaml:"collectorUser,omitempty"`
	TimeWindowStart time.Time `yaml:"timeWindowStart"`
	Platform        string    `yaml:"platform"`
	IsHCP           bool      `yaml:"isHCP"`
}

CollectionMetadata contains information about the evidence collection

type DiagnosticData

type DiagnosticData struct {
	MustGatherPath string            `yaml:"mustGatherPath,omitempty"`
	CustomCommands map[string]string `yaml:"customCommands,omitempty"`
}

DiagnosticData contains diagnostic commands output

type EventInfo

type EventInfo struct {
	Type      string `yaml:"type"`
	Reason    string `yaml:"reason"`
	Message   string `yaml:"message"`
	Namespace string `yaml:"namespace"`
	Object    string `yaml:"object"`
	Timestamp string `yaml:"timestamp"`
}

EventInfo represents Kubernetes events

type EvidenceCollection

type EvidenceCollection struct {
	Metadata       CollectionMetadata `yaml:"metadata"`
	ClusterState   *ClusterState      `yaml:"clusterState,omitempty"`
	CloudTrailData *CloudTrailData    `yaml:"cloudTrailData,omitempty"`
	Diagnostics    *DiagnosticData    `yaml:"diagnostics,omitempty"`
}

EvidenceCollection represents all collected evidence

type MachineConfigInfo

type MachineConfigInfo struct {
	Name    string `yaml:"name"`
	Created string `yaml:"created"`
}

MachineConfigInfo represents MachineConfig state

type NodeInfo

type NodeInfo struct {
	Name       string   `yaml:"name"`
	Status     string   `yaml:"status"`
	Roles      []string `yaml:"roles"`
	Conditions []string `yaml:"conditions,omitempty"`
}

NodeInfo represents node state

type OperatorInfo

type OperatorInfo struct {
	Name        string `yaml:"name"`
	Available   bool   `yaml:"available"`
	Progressing bool   `yaml:"progressing"`
	Degraded    bool   `yaml:"degraded"`
	Version     string `yaml:"version,omitempty"`
}

OperatorInfo represents ClusterOperator state

type RawEventDetails

type RawEventDetails struct {
	EventVersion string `json:"eventVersion"`
	UserIdentity struct {
		AccountId      string `json:"accountId"`
		SessionContext struct {
			SessionIssuer struct {
				Type     string `json:"type"`
				UserName string `json:"userName"`
				Arn      string `json:"arn"`
			} `json:"sessionIssuer"`
		} `json:"sessionContext"`
	} `json:"userIdentity"`
	EventRegion  string `json:"awsRegion"`
	EventId      string `json:"eventID"`
	ErrorCode    string `json:"errorCode"`
	ErrorMessage string `json:"errorMessage"`
}

RawEventDetails represents CloudTrail event structure

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL