Documentation
¶
Overview ¶
Package eks implements the aws.eks source plugin: lists EKS clusters in one AWS account and emits kubernetes_cluster evidence records carrying the secrets-envelope-encryption attributes that SOC 2 CC6.7 policies consume.
Per the KISS-no-DRY axiom (docs/architecture/04-source-plugins.md §The plugin contract) the plugin caches nothing across Collect calls. N policies bound to this plugin → N invocations of Collect.
Test injection: the API interface mirrors the pattern used by the aws.iam plugin — the concrete *eks.Client satisfies it, and unit tests inject an in-memory fake.
Index ¶
Constants ¶
const EvidenceTypeID = "kubernetes_cluster"
EvidenceTypeID is the cross-vendor evidence type this plugin emits.
const SourceID = "aws.eks"
SourceID is the registered ID for the aws.eks plugin instance.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type API ¶
type API interface {
ListClusters(ctx context.Context, params *awseks.ListClustersInput, optFns ...func(*awseks.Options)) (*awseks.ListClustersOutput, error)
DescribeCluster(ctx context.Context, params *awseks.DescribeClusterInput, optFns ...func(*awseks.Options)) (*awseks.DescribeClusterOutput, error)
}
API is the subset of the EKS client this plugin uses.
type Options ¶
type Options struct {
API API
Region string
// Now is injected so tests can produce deterministic CollectedAt
// values. Production callers leave it nil → time.Now().UTC().
Now func() time.Time
}
Options is the constructor input.
type Plugin ¶
type Plugin struct {
// contains filtered or unexported fields
}
Plugin is the in-process aws.eks source.
func NewFromAWS ¶
NewFromAWS constructs a Plugin backed by the real AWS SDK.
func (*Plugin) Collect ¶
func (p *Plugin) Collect(ctx context.Context, req core.SlotRequest) ([]core.EvidenceRecord, error)
Collect lists EKS clusters in the configured region and returns one kubernetes_cluster record per cluster.
Source Files