policyreport

Documentation

Overview

Package policyreport converts Fleetsweeper findings into PolicyReport CRs using the wgpolicyk8s.io/v1alpha2 schema, the CNCF-standard format consumed by Kyverno, Trivy Operator, Falco Sidekick, and the Policy Reporter UI. Emitting this format lets existing policy-report dashboards ingest Fleetsweeper findings without any custom adapter.

As with the FleetDriftReport emitter, this package writes only to the local filesystem. What an operator does with the YAML next (commit, kubectl apply, ship to a separate cluster) is their choice.

Index

• Constants
• func Write(reports []PolicyReport, dir string) error
• type Metadata
• type PolicyReport
  • func ReportsFor(r *report.Report, scanID, namespace string) []PolicyReport
• type ResourceRef
• type Result
• type Summary
• type Timestamp

Constants

const APIVersion = "wgpolicyk8s.io/v1alpha2"

APIVersion is the v1alpha2 PolicyReport API group/version. Stable across PolicyReporter, Kyverno, and Trivy adopters as of 2024.

const Kind = "PolicyReport"

Kind is the PolicyReport CRD kind.

const Source = "fleetsweeper"

Source identifies Fleetsweeper as the producer of the report results so dashboards can filter or group by tool.

Functions

func Write

func Write(reports []PolicyReport, dir string) error

Write marshals reports to YAML, one file per cluster, into dir.

Types

type Metadata

type Metadata struct {
	// Name is unique within the namespace.
	Name string `json:"name"`
	// Namespace places the report; required for the Namespaced PolicyReport CRD.
	Namespace string `json:"namespace"`
	// Labels are propagated for selector-based queries.
	Labels map[string]string `json:"labels,omitempty"`
}

Metadata is the standard ObjectMeta projection. Namespace is required: the upstream PolicyReport CRD is Namespaced.

type PolicyReport

type PolicyReport struct {
	// APIVersion identifies the resource group/version.
	APIVersion string `json:"apiVersion"`
	// Kind identifies the resource type.
	Kind string `json:"kind"`
	// Metadata holds the standard ObjectMeta projection relevant for GitOps.
	Metadata Metadata `json:"metadata"`
	// Summary holds per-result counts for quick dashboards.
	Summary Summary `json:"summary"`
	// Results is the list of policy results in this report.
	Results []Result `json:"results,omitempty"`
}

PolicyReport is the on-disk shape of a wgpolicyk8s.io/v1alpha2 PolicyReport resource. Only the fields Fleetsweeper populates are modeled; the upstream CRD has more optional fields, but additive omission is forward-compatible.

func ReportsFor

func ReportsFor(r *report.Report, scanID, namespace string) []PolicyReport

ReportsFor builds one PolicyReport per cluster from r. The namespace argument is required by the upstream CRD; pass the operator's preferred namespace (typically "fleetsweeper" or "policy-reporter"). Fleet-scoped findings are duplicated onto every cluster report so reconcilers do not need to special- case an aggregate.

type ResourceRef

type ResourceRef struct {
	// APIVersion is the object's apiVersion when known.
	APIVersion string `json:"apiVersion,omitempty"`
	// Kind is the object's kind when known.
	Kind string `json:"kind,omitempty"`
	// Namespace is the object's namespace when known.
	Namespace string `json:"namespace,omitempty"`
	// Name is the object's name. Always set.
	Name string `json:"name"`
}

ResourceRef points at a single Kubernetes object the result concerns. We fill what we can from the finding's Affected list; ambiguous entries are rendered with just a Name.

type Result

type Result struct {
	// Source identifies the policy engine that produced the result.
	Source string `json:"source"`
	// Policy is the policy or rule family the result applies to.
	Policy string `json:"policy"`
	// Rule is the specific check within Policy.
	Rule string `json:"rule,omitempty"`
	// Category groups related results in the UI.
	Category string `json:"category,omitempty"`
	// Severity is critical, high, medium, low, or info.
	Severity string `json:"severity"`
	// Result is one of pass, fail, warn, error, skip.
	Result string `json:"result"`
	// Message is the human-readable explanation.
	Message string `json:"message"`
	// Timestamp is when the finding was produced.
	Timestamp Timestamp `json:"timestamp"`
	// Resources references the affected Kubernetes resources, if known.
	Resources []ResourceRef `json:"resources,omitempty"`
	// Properties carries arbitrary key/value metadata, including the
	// Fleetsweeper remediation hint when one is available.
	Properties map[string]string `json:"properties,omitempty"`
}

Result is one finding rendered as a v1alpha2 PolicyReport result entry.

type Summary

type Summary struct {
	// Pass is the count of result=pass entries.
	Pass int `json:"pass"`
	// Fail is the count of result=fail entries.
	Fail int `json:"fail"`
	// Warn is the count of result=warn entries.
	Warn int `json:"warn"`
	// Error is the count of result=error entries.
	Error int `json:"error"`
	// Skip is the count of result=skip entries.
	Skip int `json:"skip"`
}

Summary mirrors the v1alpha2 summary block. We do not currently emit "pass" results, so Pass is always 0; we expose the field anyway so the shape matches what tooling expects.

type Timestamp

type Timestamp struct {
	// Seconds is the Unix epoch second.
	Seconds int64 `json:"seconds"`
	// Nanos is the nanosecond offset within Seconds.
	Nanos int32 `json:"nanos"`
}

Timestamp is the v1alpha2 timestamp object (seconds + nanos), distinct from a plain RFC3339 string.