gcp

Documentation

Overview

Package gcp implements the ports.GCPService interface using the Google Cloud Go SDK. This is the only package in the module that imports GCP SDK types.

Index

• func New(ctx context.Context, projectID string, opts ...Option) (_ *gcpAdapter, retErr error)
• func NewDLPAdapter(ctx context.Context, log *slog.Logger) (*dlpAdapter, error)
• type ConfirmationRequiredError
• type CostAdapterConfig
• type CostSourceConfig
  • func NormalizeCostReasoningSources(sources []CostSourceConfig, defaultProjectID string) ([]CostSourceConfig, error)
• type NotFoundError
• type Option
  • func WithCallTimeout(d time.Duration) Option
  • func WithClientOptions(opts ...option.ClientOption) Option
  • func WithCostReasoning(cfg CostAdapterConfig) Option
  • func WithCostReasoningSources(sources []CostSourceConfig) Option
  • func WithGraphTimeout(d time.Duration) Option
  • func WithLogger(l *slog.Logger) Option
  • func WithModules(modules map[string]bool) Option
  • func WithRateLimit(rps float64, burst int) Option
  • func WithRecommender() Option
  • func WithSecurityAudit(cfg SecurityAdapterConfig) Option
  • func WithTraceBackend(backend string) Option
• type PermissionDeniedError
• type RetriableError
• type SecurityAdapterConfig

Functions

func New

func New(ctx context.Context, projectID string, opts ...Option) (_ *gcpAdapter, retErr error)

New creates a gcpAdapter, initialises the required GCP SDK clients using Application Default Credentials, and returns it as a ports.GCPService. When WithModules is provided, only the clients needed by those modules are opened.

Call Close() when done to release gRPC connections.

func NewDLPAdapter

func NewDLPAdapter(ctx context.Context, log *slog.Logger) (*dlpAdapter, error)

NewDLPAdapter creates a dlpAdapter backed by Application Default Credentials. Call Close() when done to release the gRPC connection.

Types

type ConfirmationRequiredError

type ConfirmationRequiredError = ports.ConfirmationRequiredError

ConfirmationRequiredError aliases ports.ConfirmationRequiredError for adapter-internal use.

type CostAdapterConfig

type CostAdapterConfig struct {
	QueryProjectID  string
	ExportProjectID string
	Dataset         string
	Table           string
	MaxBytesBilled  int64
}

CostAdapterConfig identifies the Cloud Billing detailed export queried by the optional cost reasoning module. QueryProjectID owns the BigQuery jobs; ExportProjectID owns the export dataset.

type CostSourceConfig

type CostSourceConfig struct {
	WorkloadProjectIDs []string
	CostAdapterConfig
}

CostSourceConfig is the compiled runtime mapping between workload projects and one Cloud Billing detailed-export source. WorkloadProjectIDs must contain real configured project IDs, never user-facing aliases.

func NormalizeCostReasoningSources

func NormalizeCostReasoningSources(sources []CostSourceConfig, defaultProjectID string) ([]CostSourceConfig, error)

NormalizeCostReasoningSources validates compiled workload-project mappings and applies non-routing defaults. It returns an independent copy.

type NotFoundError

type NotFoundError = ports.NotFoundError

NotFoundError aliases ports.NotFoundError for adapter-internal use.

type Option

type Option func(*gcpAdapter)

Option configures a gcpAdapter created by New.

func WithCallTimeout

func WithCallTimeout(d time.Duration) Option

WithCallTimeout sets the per-call context timeout applied inside every adapter method. Default: 30 seconds.

func WithClientOptions

func WithClientOptions(opts ...option.ClientOption) Option

WithClientOptions passes extra google.golang.org/api/option.ClientOption values (e.g. WithEndpoint for emulator testing).

func WithCostReasoning

func WithCostReasoning(cfg CostAdapterConfig) Option

WithCostReasoning configures the optional Cloud Billing export reader.

func WithCostReasoningSources

func WithCostReasoningSources(sources []CostSourceConfig) Option

WithCostReasoningSources configures workload-project-specific Cloud Billing export sources. Selection is immutable after construction and safe for concurrent requests.

func WithGraphTimeout

func WithGraphTimeout(d time.Duration) Option

WithGraphTimeout sets the outer context timeout for graph exports and diagram discovery. Each individual sub-call still uses the per-call callTimeout (default 30s). Default: 120 seconds.

func WithLogger

func WithLogger(l *slog.Logger) Option

WithLogger sets the structured logger used by the adapter.

func WithModules

func WithModules(modules map[string]bool) Option

WithModules restricts GCP client initialization to only the clients required by the named modules. A nil or empty map initializes all clients (default behavior).

func WithRateLimit

func WithRateLimit(rps float64, burst int) Option

WithRateLimit sets the token-bucket rate limiter. Default: 10 requests/second, burst 20.

func WithRecommender

func WithRecommender() Option

WithRecommender enables the Cloud Recommender API integration used to enrich Aura Score efficiency signals with GCP's pre-computed idle / over-provisioned recommendations and their estimated monthly cost savings.

On by default. Set RECOMMENDER_ENABLED=false to disable. Requires the service account to have the Recommender Viewer role (or individual recommender.*.list permissions listed in the README).

func WithSecurityAudit

func WithSecurityAudit(cfg SecurityAdapterConfig) Option

func WithTraceBackend

func WithTraceBackend(backend string) Option

WithTraceBackend selects the backend used by gcp_trace_list_services. Valid values: "trace" (Cloud Trace v1 REST, default) or "monitoring" (Monitoring metric proxy).

type PermissionDeniedError

type PermissionDeniedError = ports.PermissionDeniedError

PermissionDeniedError aliases ports.PermissionDeniedError for adapter-internal use.

type RetriableError

type RetriableError = ports.RetriableError

RetriableError aliases ports.RetriableError for adapter-internal use.

type SecurityAdapterConfig

type SecurityAdapterConfig struct {
	KubernetesAccess    string
	FleetProjectID      string
	ClusterConcurrency  int
	PerClusterTimeout   time.Duration
	MaxResourcesPerKind int
}

SecurityAdapterConfig controls bounded Kubernetes enrichment for the security posture collector.