audit

Documentation

Index

• func AddToManager(m manager.Manager, deps *Dependencies) error
• type CacheLister
  • func NewAuditCacheLister(auditCache client.Reader, lister WatchIterator) *CacheLister
  • func (l *CacheLister) ListObjects(ctx context.Context) ([]unstructured.Unstructured, error)
• type Dependencies
• type LimitQueue
  • func (lq *LimitQueue) Len() int
  • func (lq *LimitQueue) Peek() *StatusViolation
  • func (lq *LimitQueue) Pop() *StatusViolation
  • func (lq *LimitQueue) Push(x *StatusViolation)
• type Manager
  • func New(mgr manager.Manager, deps *Dependencies) (*Manager, error)
  • func (am *Manager) Start(ctx context.Context) error
• type Result
  • func ToResults(obj *unstructured.Unstructured, resp *types.Responses) []Result
• type SVQueue
  • func (svq SVQueue) Len() int
  • func (svq SVQueue) Less(i, j int) bool
  • func (svq *SVQueue) Pop() any
  • func (svq *SVQueue) Push(x any)
  • func (svq SVQueue) Swap(i, j int)
• type StatusViolation
• type WatchIterator

Functions

func AddToManager

func AddToManager(m manager.Manager, deps *Dependencies) error

AddToManager adds audit manager to the Manager.

Types

type CacheLister

type CacheLister struct {
	// contains filtered or unexported fields
}

CacheLister lists objects from the audit controller's cache.

func NewAuditCacheLister

func NewAuditCacheLister(auditCache client.Reader, lister WatchIterator) *CacheLister

NewAuditCacheLister instantiates a new AuditCache which will read objects in watched from auditCache.

func (*CacheLister) ListObjects

func (l *CacheLister) ListObjects(ctx context.Context) ([]unstructured.Unstructured, error)

ListObjects lists all objects from the audit cache.

type Dependencies

type Dependencies struct {
	Client          *constraintclient.Client
	ProcessExcluder *process.Excluder
	CacheLister     *CacheLister
	ExpansionSystem *expansion.System
	ExportSystem    *export.System
	GetPod          func(context.Context) (*corev1.Pod, error)
}

type LimitQueue

type LimitQueue struct {
	// contains filtered or unexported fields
}

LimitQueue implements logic to ensure priority queue len <= limit in order to provide performance guarantees on heap methods.

func (*LimitQueue) Len

func (lq *LimitQueue) Len() int

func (*LimitQueue) Peek

func (lq *LimitQueue) Peek() *StatusViolation

func (*LimitQueue) Pop

func (lq *LimitQueue) Pop() *StatusViolation

func (*LimitQueue) Push

func (lq *LimitQueue) Push(x *StatusViolation)

type Manager

type Manager struct {
	// contains filtered or unexported fields
}

Manager allows us to audit resources periodically.

func New

func New(mgr manager.Manager, deps *Dependencies) (*Manager, error)

New creates a new manager for audit.

func (*Manager) Start

func (am *Manager) Start(ctx context.Context) error

Start implements controller.Controller.

type Result

type Result struct {
	*types.Result
	// contains filtered or unexported fields
}

func ToResults

func ToResults(obj *unstructured.Unstructured, resp *types.Responses) []Result

type SVQueue

type SVQueue []*StatusViolation

A max PriorityQueue implements heap.Interface and holds StatusViolation.

func (SVQueue) Len

func (svq SVQueue) Len() int

func (SVQueue) Less

func (svq SVQueue) Less(i, j int) bool

Implements sort.Interface based on the group, version, kind, namespace, name, message and enforcement action fields. For Pop to give us the highest priority, use greater than here.

func (*SVQueue) Pop

func (svq *SVQueue) Pop() any

func (*SVQueue) Push

func (svq *SVQueue) Push(x any)

func (SVQueue) Swap

func (svq SVQueue) Swap(i, j int)

type StatusViolation

type StatusViolation struct {
	Group              string   `json:"group"`
	Version            string   `json:"version"`
	Kind               string   `json:"kind"`
	Name               string   `json:"name"`
	Namespace          string   `json:"namespace,omitempty"`
	Message            string   `json:"message"`
	EnforcementAction  string   `json:"enforcementAction"`
	EnforcementActions []string `json:"enforcementActions,omitempty"`
}

StatusViolation represents each violation under status.

type WatchIterator

type WatchIterator interface {
	DoForEach(listFunc func(gvk schema.GroupVersionKind) error) error
}

wraps DoForEach from a watch.Set.