scanner

Documentation

Index

• type Config
• type ParallelizationConfig
• type Scanner
  • func NewScanner(config Config) (*Scanner, error)
  • func (s *Scanner) ScanAllNamespaces(ctx context.Context, runUID string) error
  • func (s *Scanner) ScanClusterWideResources(ctx context.Context, runUID string) error
  • func (s *Scanner) ScanNamespace(ctx context.Context, nsName, runUID string) error
• type TLSConfig

Types

type Config

type Config struct {
	PoliciesClient    *policies.Client
	K8sClient         *k8s.Client
	PolicyReportStore *report.PolicyReportStore

	TLS             TLSConfig
	Parallelization ParallelizationConfig

	OutputScan   bool
	DisableStore bool
}

type ParallelizationConfig

type ParallelizationConfig struct {
	ParallelNamespacesAudits int
	ParallelResourcesAudits  int
	PoliciesAudits           int
}

type Scanner

type Scanner struct {
	// contains filtered or unexported fields
}

Scanner verifies that existing resources don't violate any of the policies.

func NewScanner

func NewScanner(
	config Config,
) (*Scanner, error)

NewScanner creates a new scanner If insecureClient is false, it will read the caCertFile and add it to the in-app cert trust store. This gets used by the httpClient when connection to PolicyServers endpoints.

func (*Scanner) ScanAllNamespaces

func (s *Scanner) ScanAllNamespaces(ctx context.Context, runUID string) error

ScanAllNamespaces scans resources for all namespaces, except the ones in the skipped list. Returns errors if there's any when fetching policies or resources, but only logs them if there's a problem auditing the resource of saving the Report or Result, so it can continue with the next audit, or next Result.

func (*Scanner) ScanClusterWideResources

func (s *Scanner) ScanClusterWideResources(ctx context.Context, runUID string) error

ScanClusterWideResources scans all cluster wide resources. Returns errors if there's any when fetching policies or resources, but only logs them if there's a problem auditing the resource of saving the Report or Result, so it can continue with the next audit, or next Result.

func (*Scanner) ScanNamespace

func (s *Scanner) ScanNamespace(ctx context.Context, nsName, runUID string) error

ScanNamespace scans resources for a given namespace. Returns errors if there's any when fetching policies or resources, but only logs them if there's a problem auditing the resource of saving the Report or Result, so it can continue with the next audit, or next Result.

type TLSConfig

type TLSConfig struct {
	Insecure       bool
	CAFile         string
	ClientCertFile string
	ClientKeyFile  string
}