Directories
¶
| Path | Synopsis |
|---|---|
|
Package agent runs the egress-side Skybridge data plane in either deployment mode:
|
Package agent runs the egress-side Skybridge data plane in either deployment mode: |
|
Package certstore persists an enrolled edge's mTLS identity (ca.pem, client.crt, client.key) across process restarts.
|
Package certstore persists an enrolled edge's mTLS identity (ca.pem, client.crt, client.key) across process restarts. |
|
Package config loads Skybridge configuration from the environment.
|
Package config loads Skybridge configuration from the environment. |
|
Package edge is the customer-side execution surface of the unified Skybridge edge binary.
|
Package edge is the customer-side execution surface of the unified Skybridge edge binary. |
|
awsexec
Package awsexec runs the live, read-only AWS tools at the customer edge.
|
Package awsexec runs the live, read-only AWS tools at the customer edge. |
|
k8sexec
Package k8sexec runs governed, read-only kubectl commands at the customer edge.
|
Package k8sexec runs governed, read-only kubectl commands at the customer edge. |
|
k8stoken
Package k8stoken mints short-lived Kubernetes ServiceAccount tokens via the Kubernetes-native TokenRequest API (authentication/v1), the Kubernetes equivalent of AWS STS AssumeRole — see docs/design/kubernetes-access-broker.md §4/§7 in the curlix repo ("Phase 2").
|
Package k8stoken mints short-lived Kubernetes ServiceAccount tokens via the Kubernetes-native TokenRequest API (authentication/v1), the Kubernetes equivalent of AWS STS AssumeRole — see docs/design/kubernetes-access-broker.md §4/§7 in the curlix repo ("Phase 2"). |
|
transport
Package transport is the edge's egress-only call-home client.
|
Package transport is the edge's egress-only call-home client. |
|
Package edgeiam presigns an sts:GetCallerIdentity call with the edge's ambient AWS credentials (an ECS task role, in production) and exchanges it with the control plane for a short-lived enrollment token — no human-minted, single-use token needed.
|
Package edgeiam presigns an sts:GetCallerIdentity call with the edge's ambient AWS credentials (an ECS task role, in production) and exchanges it with the control plane for a short-lived enrollment token — no human-minted, single-use token needed. |
|
Package gateway is the relay-side Skybridge control plane.
|
Package gateway is the relay-side Skybridge control plane. |
|
genpb
|
|
|
Package labeller runs skybridge-labeller's periodic AI-based path-label scan job: for each configured table, discover its columns, sample values, classify them via internal/pathlabel/aiclassifier, and push any confident proposal to the control plane via internal/pathlabel/remotestore — all as label.SourceProposed, never redacting anything on its own.
|
Package labeller runs skybridge-labeller's periodic AI-based path-label scan job: for each configured table, discover its columns, sample values, classify them via internal/pathlabel/aiclassifier, and push any confident proposal to the control plane via internal/pathlabel/remotestore — all as label.SourceProposed, never redacting anything on its own. |
|
Package log builds the component-tagged, level-gated *slog.Logger every Skybridge binary and library package logs through.
|
Package log builds the component-tagged, level-gated *slog.Logger every Skybridge binary and library package logs through. |
|
Package mask applies PII redaction to result rows before they leave the egress network.
|
Package mask applies PII redaction to result rows before they leave the egress network. |
|
metrics
Package metrics buffers pure-metadata masking-outcome counts (never masked/raw values themselves) inside the customer's network and periodically flushes them to the Curlix control plane, so Ask Curlix / Administration dashboards can show "how much PII did we mask, of what type, on which connection" without the SaaS backend ever seeing a value.
|
Package metrics buffers pure-metadata masking-outcome counts (never masked/raw values themselves) inside the customer's network and periodically flushes them to the Curlix control plane, so Ask Curlix / Administration dashboards can show "how much PII did we mask, of what type, on which connection" without the SaaS backend ever seeing a value. |
|
pathlabel
|
|
|
aiclassifier
Package aiclassifier proposes label.Label values for table columns / document fields using both the field's name and a sample of its values, independent of live query traffic.
|
Package aiclassifier proposes label.Label values for table columns / document fields using both the field's name and a sample of its values, independent of live query traffic. |
|
docpath
Package docpath walks map[string]any/[]any document trees and produces index-erased, resolved-path leaves, for use by internal/mask's path-scoped overlay.
|
Package docpath walks map[string]any/[]any document trees and produces index-erased, resolved-path leaves, for use by internal/mask's path-scoped overlay. |
|
label
Package label defines the shape of a path-scoped label and a storage-agnostic Store interface, for use by internal/mask's path-scoped overlay.
|
Package label defines the shape of a path-scoped label and a storage-agnostic Store interface, for use by internal/mask's path-scoped overlay. |
|
mongosampler
Package mongosampler implements aiclassifier.Sampler over the mongo-driver client for MongoDB — the read-only, off-the-hot-path document sampling docs/AI_PATH_LABELLING_DESIGN.md §5.2 describes, the Mongo counterpart to internal/pathlabel/sqlsampler's SQL implementation.
|
Package mongosampler implements aiclassifier.Sampler over the mongo-driver client for MongoDB — the read-only, off-the-hot-path document sampling docs/AI_PATH_LABELLING_DESIGN.md §5.2 describes, the Mongo counterpart to internal/pathlabel/sqlsampler's SQL implementation. |
|
remotestore
Package remotestore implements label.Store by syncing with the Curlix control plane over plain HTTP, mirroring internal/agent/overlay_source.go's poll pattern: confirmed (manual/platform) labels are pulled into a local read cache on an interval, and locally-observed proposed labels are batched and flushed to the control plane on a separate interval.
|
Package remotestore implements label.Store by syncing with the Curlix control plane over plain HTTP, mirroring internal/agent/overlay_source.go's poll pattern: confirmed (manual/platform) labels are pulled into a local read cache on an interval, and locally-observed proposed labels are batched and flushed to the control plane on a separate interval. |
|
sqlsampler
Package sqlsampler implements aiclassifier.Sampler over database/sql for Postgres, MySQL, and Snowflake (Snowflake needs no dedicated logic here — its SQL dialect already matches Postgres's double-quoted identifiers and its driver falls back to "?" placeholders the same way MySQL's does, so New's existing driver switch covers it without a third case) — the read-only, off-the-hot-path row sampling docs/AI_PATH_LABELLING_DESIGN.md §5.2 describes.
|
Package sqlsampler implements aiclassifier.Sampler over database/sql for Postgres, MySQL, and Snowflake (Snowflake needs no dedicated logic here — its SQL dialect already matches Postgres's double-quoted identifiers and its driver falls back to "?" placeholders the same way MySQL's does, so New's existing driver switch covers it without a third case) — the read-only, off-the-hot-path row sampling docs/AI_PATH_LABELLING_DESIGN.md §5.2 describes. |
|
trafficsampler
Package trafficsampler supplies aiclassifier.Sampler samples from live wire-proxy/dbquery traffic that is already flowing through the agent/edge process, instead of a scan job dialing a second, dedicated read-only DSN against the source database.
|
Package trafficsampler supplies aiclassifier.Sampler samples from live wire-proxy/dbquery traffic that is already flowing through the agent/edge process, instead of a scan job dialing a second, dedicated read-only DSN against the source database. |
|
Package spire provides JWT-SVID loading from a SPIRE workload API socket.
|
Package spire provides JWT-SVID loading from a SPIRE workload API socket. |
|
Package tunnel is the egress-only data-plane transport between a Skybridge agent and the relay gateway.
|
Package tunnel is the egress-only data-plane transport between a Skybridge agent and the relay gateway. |
|
Package wire holds the native database wire-protocol engines.
|
Package wire holds the native database wire-protocol engines. |
|
k8sapi
Package k8sapi implements the Kubernetes API server's HTTPS/REST surface as a masking proxy engine, mirroring the shape of internal/wire/postgres|mysql|mongo (client connects to the agent; the agent dials the real upstream — here, the cluster API server — and masks server->client payloads before they leave the customer network).
|
Package k8sapi implements the Kubernetes API server's HTTPS/REST surface as a masking proxy engine, mirroring the shape of internal/wire/postgres|mysql|mongo (client connects to the agent; the agent dials the real upstream — here, the cluster API server — and masks server->client payloads before they leave the customer network). |
|
mongo
Upstream-auth origination for Mongo credential injection — the counterpart to clientauth.go.
|
Upstream-auth origination for Mongo credential injection — the counterpart to clientauth.go. |
|
mysql
Credential handoff (design "skybridge-go-wire-proxy" §7 phase 3) for MySQL.
|
Credential handoff (design "skybridge-go-wire-proxy" §7 phase 3) for MySQL. |
|
postgres
Credential handoff (design "skybridge-go-wire-proxy" §7 phase 3) for Postgres.
|
Credential handoff (design "skybridge-go-wire-proxy" §7 phase 3) for Postgres. |
|
scram
Package scram implements the client role of SCRAM-SHA-1 and SCRAM-SHA-256 (RFC 5802), the message algebra only — no wire framing.
|
Package scram implements the client role of SCRAM-SHA-1 and SCRAM-SHA-256 (RFC 5802), the message algebra only — no wire framing. |
|
Package wiremtls implements mTLS identity for the Skybridge wire gateway↔agent tunnel.
|
Package wiremtls implements mTLS identity for the Skybridge wire gateway↔agent tunnel. |
Click to show internal directories.
Click to hide internal directories.