Documentation
¶
Overview ¶
Package surveyors holds Draugr's built-in surveyors.
Index ¶
Constants ¶
const ProposeExposureKey = "proposeExposure"
ProposeExposureKey is the scope config key that turns exposure inference off. Absent — the common case — means propose.
A key rather than a field on SurveyScope: it is one surveyor's behavior, and the scope is the channel the CLI already uses to tell a surveyor how to do its job.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type AzureDevOpsRepos ¶ added in v0.91.0
type AzureDevOpsRepos struct {
// contains filtered or unexported fields
}
AzureDevOpsRepos discovers the Git repositories in an Azure DevOps organization or project and returns them as Saga components (one per repository).
func NewAzureDevOpsRepos ¶ added in v0.91.0
func NewAzureDevOpsRepos() *AzureDevOpsRepos
NewAzureDevOpsRepos returns the azure-devops-repos surveyor targeting dev.azure.com.
func (AzureDevOpsRepos) Info ¶ added in v0.91.0
func (AzureDevOpsRepos) Info() plugin.SurveyorInfo
Info identifies the surveyor.
func (AzureDevOpsRepos) Survey ¶ added in v0.91.0
func (a AzureDevOpsRepos) Survey(ctx context.Context, scope plugin.SurveyScope) (saga.Fragment, error)
Survey lists the organization's repositories.
scope.Ref is "org" or "org/project". Both are useful and they answer different questions: an organization holds many projects, and surveying one project describes one team's surface while surveying the organization describes the estate. Azure DevOps makes the project segment optional for exactly this reason, so Draugr passes the choice through rather than making it.
An auth token is read from scope.Config["token"], then $AZURE_DEVOPS_EXT_PAT (what the az CLI uses), then $AZURE_DEVOPS_TOKEN.
type GitHubOrgRepos ¶
type GitHubOrgRepos struct {
// contains filtered or unexported fields
}
GitHubOrgRepos discovers the repositories in a GitHub organization and returns them as Saga components (one per repository).
func NewGitHubOrgRepos ¶
func NewGitHubOrgRepos() *GitHubOrgRepos
NewGitHubOrgRepos returns the github-org-repos surveyor targeting github.com.
func (GitHubOrgRepos) Info ¶
func (GitHubOrgRepos) Info() plugin.SurveyorInfo
Info identifies the surveyor.
func (GitHubOrgRepos) Survey ¶
func (g GitHubOrgRepos) Survey(ctx context.Context, scope plugin.SurveyScope) (saga.Fragment, error)
Survey lists the org's repositories. The org is taken from scope.Ref; an auth token is read from scope.Config["token"] or the GITHUB_TOKEN environment variable.
type GitLabGroupProjects ¶ added in v0.86.0
type GitLabGroupProjects struct {
// contains filtered or unexported fields
}
GitLabGroupProjects discovers the projects in a GitLab group and returns them as Saga components (one per project).
func NewGitLabGroupProjects ¶ added in v0.86.0
func NewGitLabGroupProjects() *GitLabGroupProjects
NewGitLabGroupProjects returns the gitlab-group-projects surveyor targeting gitlab.com.
func (GitLabGroupProjects) Info ¶ added in v0.86.0
func (GitLabGroupProjects) Info() plugin.SurveyorInfo
Info identifies the surveyor.
func (GitLabGroupProjects) Survey ¶ added in v0.86.0
func (g GitLabGroupProjects) Survey(ctx context.Context, scope plugin.SurveyScope) (saga.Fragment, error)
Survey lists the group's projects. The group is taken from scope.Ref; an auth token is read from scope.Config["token"] or the GITLAB_TOKEN environment variable.
type K8sCluster ¶ added in v0.49.0
type K8sCluster struct {
// contains filtered or unexported fields
}
K8sCluster discovers the cluster itself, as something to audit rather than something to run workloads on.
Separate from K8sImages rather than folded into it, though both read the same cluster through the same credentials. A surveyor named for images that also emitted an infrastructure component would surprise anyone reading `survey k8s images` in a script, and a generated descriptor is only worth trusting if the command that produced it predicts its contents.
They also produce genuinely different things. The images are the application; the cluster is what it runs on. Those differ in criticality often enough that forcing them into one component would mean asserting a single classification over both.
func NewK8sCluster ¶ added in v0.49.0
func NewK8sCluster() *K8sCluster
NewK8sCluster returns the k8s-cluster surveyor using the ambient kubeconfig.
func (K8sCluster) Info ¶ added in v0.49.0
func (K8sCluster) Info() plugin.SurveyorInfo
Info identifies the surveyor.
func (K8sCluster) Survey ¶ added in v0.49.0
func (k K8sCluster) Survey(ctx context.Context, scope plugin.SurveyScope) (saga.Fragment, error)
Survey returns the cluster as an infrastructure component.
The cluster is reached before it is described. Emitting a component for a cluster that cannot be contacted would write a descriptor whose first scan fails, and the descriptor is the thing people trust afterwards — better to fail here, where the operator is watching, than at the scan of a cluster they believed had been checked. The reachability probe is client-go's discovery ServerVersion, which predates context and takes none — the context-aware alternative goes through the discovery REST client, which is nil on the fake clientset and so cannot be tested. The context is still used, for the namespace check.
type K8sImages ¶
type K8sImages struct {
// contains filtered or unexported fields
}
K8sImages discovers the unique container images running in a Kubernetes cluster or namespace and returns them as a Saga component.
func NewK8sImages ¶
func NewK8sImages() *K8sImages
NewK8sImages returns the k8s-images surveyor using the ambient kubeconfig.
func (K8sImages) Survey ¶
Survey lists pods in the scope's namespace (Ref; empty means every namespace) and returns one component per namespace, whose images are the unique container images running in it.
A namespace is the unit, whether or not one was named. Collapsing a whole cluster into a single component loses the two things that make the result usable: a namespace is what a team owns, so it is what a finding has to be attributed to, and exposure is a property of a namespace's topology — one Ingress anywhere would otherwise mark every image in the cluster as public. `--namespace a,b` already produces a component each; no namespace means all of them, not one of them.
Source Files