vulnerabilities

Documentation

Overview

Package vulnerabilities reads aquasecurity.github.io/v1alpha1 VulnerabilityReport custom resources produced by the Trivy Operator and aggregates their severity counts into a per-cluster baseline. Fleetsweeper does not run Trivy itself; this scanner is an integration layer that turns existing Trivy data into drift signals.

Index

• Constants
• func NewScanner() scanner.Scanner
• type Data
• type VulnerableImage

Constants

const Name = "vulnerabilities"

Name is the registry key for this scanner.

Functions

func NewScanner

func NewScanner() scanner.Scanner

NewScanner returns a scanner that reads VulnerabilityReport custom resources and aggregates them. Safe to register unconditionally; a missing Trivy CRD yields StateUnavailable while any other list failure propagates a wrapped ErrScan instead of a clean, zero-vulnerability result.

Types

type Data

type Data struct {
	// Available is true when the Trivy CRD was discoverable. When false the
	// other fields are all zero and operators can interpret that as "Trivy
	// not installed" rather than "zero vulnerabilities."
	Available bool `json:"available"`
	// Reports is the number of VulnerabilityReport CRs seen.
	Reports int `json:"reports"`
	// Critical is the fleet-wide count of CRITICAL findings.
	Critical int `json:"critical"`
	// High is the count of HIGH findings.
	High int `json:"high"`
	// Medium is the count of MEDIUM findings.
	Medium int `json:"medium"`
	// Low is the count of LOW findings.
	Low int `json:"low"`
	// Unknown is the count of findings with an unrecognized severity.
	Unknown int `json:"unknown"`
	// TopImages lists the worst offenders by total findings.
	TopImages []VulnerableImage `json:"top_images"`
}

Data holds vulnerability aggregates for one cluster. Counts are summed across every VulnerabilityReport visible in the cluster regardless of namespace; per-namespace breakdowns can be added later if needed.

type VulnerableImage

type VulnerableImage struct {
	// Namespace is the namespace the report lives in.
	Namespace string `json:"namespace"`
	// Workload is the originating workload's name (deployment, statefulset, ...).
	Workload string `json:"workload"`
	// Image is the container image reference.
	Image string `json:"image"`
	// Critical is the count of CRITICAL severity findings.
	Critical int `json:"critical"`
	// High is the count of HIGH severity findings.
	High int `json:"high"`
	// Medium is the count of MEDIUM severity findings.
	Medium int `json:"medium"`
	// Low is the count of LOW severity findings.
	Low int `json:"low"`
}

VulnerableImage captures the top contributors to a cluster's CVE total. The dashboard surfaces this list so operators can target the worst images first.