collector

Documentation

Index

• Constants
• Variables
• func ConvertInterfaceToPod(obj interface{}) (*v1.Pod, error)
• type ApplicationProfile
• type ApplicationProfileSpec
• type CapabilitiesCalls
• type CollectorManager
  • func StartCollectorManager(config *CollectorManagerConfig) (*CollectorManager, error)
  • func (cm *CollectorManager) CollectContainerEvents(id *ContainerId)
  • func (cm *CollectorManager) ContainerStarted(id *ContainerId, attach bool)
  • func (cm *CollectorManager) ContainerStopped(id *ContainerId)
  • func (cm *CollectorManager) FinalizeApplicationProfile(id *ContainerId)
  • func (cm *CollectorManager) MarkPodNotRecording(pod, namespace string)
  • func (cm *CollectorManager) MarkPodRecording(pod, namespace string, attach bool)
  • func (cm *CollectorManager) OnContainerActivityEvent(event *tracing.ContainerActivityEvent)
  • func (cm *CollectorManager) StartFinalizerWatcher()
  • func (cm *CollectorManager) StopCollectorManager() error
  • func (cm *CollectorManager) StopFinalizerWatcher()
• type CollectorManagerConfig
• type ContainerId
• type ContainerProfile
• type ContainerState
• type DnsCalls
• type ExecCalls
  • func (a ExecCalls) Equals(b ExecCalls) bool
• type NetworkActivity
• type NetworkCalls
• type OpenCalls
• type PodProfileFinalizerState
• type TotalEvents

Constants

const (
	RecordStrategyAlways          = "always"
	RecordStrategyOnlyIfNotExists = "only-if-not-exists"
	MaxOpenEvents                 = 10000 // Per container profile.
	MaxNetworkEvents              = 10000 // Per container profile.
)

const (
	// ApplicationProfileKind is the kind of ApplicationProfile
	ApplicationProfileKind string = "ApplicationProfile"
	// ApplicationProfileGroup is the group of ApplicationProfile
	ApplicationProfileGroup string = "kubescape.io"
	// ApplicationProfileVersion is the version of ApplicationProfile
	ApplicationProfileVersion string = "v1"
	// ApplicationProfilePlural is the plural of ApplicationProfile
	ApplicationProfilePlural string = "applicationprofiles"
	// ApplicationProfileApiVersion is the api version of ApplicationProfile
	ApplicationProfileApiVersion string = ApplicationProfileGroup + "/" + ApplicationProfileVersion
)

Variables

var AppProfileGvr schema.GroupVersionResource = schema.GroupVersionResource{
	Group:    ApplicationProfileGroup,
	Version:  ApplicationProfileVersion,
	Resource: ApplicationProfilePlural,
}

Functions

func ConvertInterfaceToPod

func ConvertInterfaceToPod(obj interface{}) (*v1.Pod, error)

Types

type ApplicationProfile

type ApplicationProfile struct {
	v1.TypeMeta   `json:",inline"`
	v1.ObjectMeta `json:"metadata,omitempty"`
	// Specification of the desired behavior of the ApplicationProfile.
	Spec ApplicationProfileSpec `json:"spec,omitempty"`
}

type ApplicationProfileSpec

type ApplicationProfileSpec struct {
	Containers []ContainerProfile `json:"containers" yaml:"containers"`
}

type CapabilitiesCalls

type CapabilitiesCalls struct {
	Capabilities []string `json:"caps" yaml:"caps"`
	Syscall      string   `json:"syscall" yaml:"syscall"`
}

type CollectorManager

type CollectorManager struct {
	// contains filtered or unexported fields
}

func StartCollectorManager

func StartCollectorManager(config *CollectorManagerConfig) (*CollectorManager, error)

func (*CollectorManager) CollectContainerEvents

func (cm *CollectorManager) CollectContainerEvents(id *ContainerId)

func (*CollectorManager) ContainerStarted

func (cm *CollectorManager) ContainerStarted(id *ContainerId, attach bool)

func (*CollectorManager) ContainerStopped

func (cm *CollectorManager) ContainerStopped(id *ContainerId)

func (*CollectorManager) FinalizeApplicationProfile

func (cm *CollectorManager) FinalizeApplicationProfile(id *ContainerId)

func (*CollectorManager) MarkPodNotRecording

func (cm *CollectorManager) MarkPodNotRecording(pod, namespace string)

func (*CollectorManager) MarkPodRecording

func (cm *CollectorManager) MarkPodRecording(pod, namespace string, attach bool)

func (*CollectorManager) OnContainerActivityEvent

func (cm *CollectorManager) OnContainerActivityEvent(event *tracing.ContainerActivityEvent)

func (*CollectorManager) StartFinalizerWatcher

func (cm *CollectorManager) StartFinalizerWatcher()

func (*CollectorManager) StopCollectorManager

func (cm *CollectorManager) StopCollectorManager() error

func (*CollectorManager) StopFinalizerWatcher

func (cm *CollectorManager) StopFinalizerWatcher()

type CollectorManagerConfig

type CollectorManagerConfig struct {
	// Event sink object
	EventSink *eventsink.EventSink
	// Interval in seconds for collecting data from containers
	Interval uint64
	// Finalize application profiles time
	FinalizeTime uint64
	// Kubernetes configuration
	K8sConfig *rest.Config
	// Tracer object
	Tracer tracing.ITracer
	// Record strategy
	RecordStrategy string
	// Node name
	NodeName string
}

type ContainerId

type ContainerId struct {
	Namespace string
	PodName   string
	Container string
	// Low level identifiers
	ContainerID string
	NsMntId     uint64
	Pid         uint32
}

type ContainerProfile

type ContainerProfile struct {
	Name            string              `json:"name" yaml:"name"`
	Execs           []ExecCalls         `json:"execs" yaml:"execs"`
	Opens           []OpenCalls         `json:"opens" yaml:"opens"`
	NetworkActivity NetworkActivity     `json:"networkActivity" yaml:"networkActivity"`
	Capabilities    []CapabilitiesCalls `json:"capabilities" yaml:"capabilities"`
	Dns             []DnsCalls          `json:"dns" yaml:"dns"`
	SysCalls        []string            `json:"syscalls" yaml:"syscalls"`
}

type ContainerState

type ContainerState struct {
	// contains filtered or unexported fields
}

type DnsCalls

type DnsCalls struct {
	DnsName   string   `json:"dnsName" yaml:"dnsName"`
	Addresses []string `json:"addresses" yaml:"addresses"`
}

type ExecCalls

type ExecCalls struct {
	Path string   `json:"path" yaml:"path"`
	Args []string `json:"args" yaml:"args"`
	Envs []string `json:"envs" yaml:"envs"`
}

func (ExecCalls) Equals

func (a ExecCalls) Equals(b ExecCalls) bool

type NetworkActivity

type NetworkActivity struct {
	Incoming []NetworkCalls `json:"incoming" yaml:"incoming"`
	Outgoing []NetworkCalls `json:"outgoing" yaml:"outgoing"`
}

type NetworkCalls

type NetworkCalls struct {
	Protocol    string `json:"protocol" yaml:"protocol"`
	Port        uint16 `json:"port" yaml:"port"`
	DstEndpoint string `json:"dstEndpoint" yaml:"dstEndpoint"`
}

type OpenCalls

type OpenCalls struct {
	Path  string   `json:"path" yaml:"path"`
	Flags []string `json:"flags" yaml:"flags"`
}

type PodProfileFinalizerState

type PodProfileFinalizerState struct {
	// Pod name
	PodName string
	// Pod namespace
	Namespace string
	// Timer
	FinalizationTimer *time.Timer
	// Recording state
	Recording bool
}

type TotalEvents

type TotalEvents struct {
	ExecEvents         []*tracing.ExecveEvent
	OpenEvents         []*tracing.OpenEvent
	SyscallEvents      []string
	CapabilitiesEvents []*tracing.CapabilitiesEvent
	DnsEvents          []*tracing.DnsEvent
	NetworkEvents      []*tracing.NetworkEvent
}