vulnerabilityreport

type BySeverity ¶

type BySeverity struct{ Vulnerabilities }

BySeverity implements sort.Interface by providing Less and using the Vulnerabilities.Len and Vulnerabilities.Swap methods of the embedded Vulnerabilities value.

func (s BySeverity) Less(i, j int) bool

type LessFunc ¶

type LessFunc func(p1, p2 *v1alpha1.VulnerabilityReport) bool

type Plugin ¶

type Plugin interface {

	// Init is a callback to initialize this plugin, e.g. ensure the default
	// configuration.
	Init(ctx starboard.PluginContext) error

	// GetScanJobSpec describes the pod that will be created by Starboard when
	// it schedules a Kubernetes job to scan the workload with the specified
	// descriptor.
	// The second argument maps container names to Docker registry credentials,
	// which can be passed to the scanner as environment variables with values
	// set from returned secrets.
	GetScanJobSpec(ctx starboard.PluginContext, workload client.Object, credentials map[string]docker.Auth) (
		corev1.PodSpec, []*corev1.Secret, error)

	// ParseVulnerabilityReportData is a callback to parse and convert logs of
	// the pod controlled by the scan job to v1alpha1.VulnerabilityScanResult.
	ParseVulnerabilityReportData(ctx starboard.PluginContext, imageRef string, logsReader io.ReadCloser) (
		v1alpha1.VulnerabilityReportData, error)
}

Plugin defines the interface between Starboard and static vulnerability scanners.

type ReadWriter ¶

type ReadWriter interface {
	Reader
	Writer
}

func NewReadWriter(client client.Client) ReadWriter

type Reader ¶

type Reader interface {
	FindByOwner(context.Context, kube.ObjectRef) ([]v1alpha1.VulnerabilityReport, error)
	FindByOwnerInHierarchy(ctx context.Context, object kube.ObjectRef) ([]v1alpha1.VulnerabilityReport, error)
}

Reader is the interface that wraps methods for finding v1alpha1.VulnerabilityReport objects.

FindByOwner returns the slice of v1alpha1.VulnerabilityReport instances owned by the given kube.ObjectRef or an empty slice if the reports are not found.

FindByOwnerInHierarchy is similar to FindByOwner except it tries to lookup v1alpha1.VulnerabilityReport objects owned by related Kubernetes objects. For example, if the given owner is a Deployment, but reports are owned by the active ReplicaSet (current revision) this method will return the reports.

type ReportBuilder ¶

type ReportBuilder struct {
	// contains filtered or unexported fields
}

func NewReportBuilder(scheme *runtime.Scheme) *ReportBuilder

func (b *ReportBuilder) Container(name string) *ReportBuilder

func (b *ReportBuilder) Controller(controller client.Object) *ReportBuilder

func (b *ReportBuilder) Data(data v1alpha1.VulnerabilityReportData) *ReportBuilder

func (b *ReportBuilder) Get() (v1alpha1.VulnerabilityReport, error)

func (b *ReportBuilder) PodSpecHash(hash string) *ReportBuilder

func (b *ReportBuilder) ReportTTL(ttl *time.Duration) *ReportBuilder

type ScanJobBuilder ¶

type ScanJobBuilder struct {
	// contains filtered or unexported fields
}

func NewScanJobBuilder() *ScanJobBuilder

func (s *ScanJobBuilder) Get() (*batchv1.Job, []*corev1.Secret, error)

func (s *ScanJobBuilder) WithAnnotations(annotations map[string]string) *ScanJobBuilder

func (s *ScanJobBuilder) WithCredentials(credentials map[string]docker.Auth) *ScanJobBuilder

func (s *ScanJobBuilder) WithObject(object client.Object) *ScanJobBuilder

func (s *ScanJobBuilder) WithPlugin(plugin Plugin) *ScanJobBuilder

func (s *ScanJobBuilder) WithPluginContext(pluginContext starboard.PluginContext) *ScanJobBuilder

func (s *ScanJobBuilder) WithPodTemplateLabels(podTemplateLabels labels.Set) *ScanJobBuilder

func (s *ScanJobBuilder) WithTimeout(timeout time.Duration) *ScanJobBuilder

func (s *ScanJobBuilder) WithTolerations(tolerations []corev1.Toleration) *ScanJobBuilder

type Vulnerabilities ¶

type Vulnerabilities []v1alpha1.Vulnerability

func (s Vulnerabilities) Len() int

func (s Vulnerabilities) Swap(i, j int)

type WorkloadController ¶

type WorkloadController struct {
	logr.Logger
	etc.Config
	client.Client
	kube.ObjectResolver
	controller.LimitChecker
	kube.LogsReader
	kube.SecretsReader
	Plugin
	starboard.PluginContext
	ReadWriter
	starboard.ConfigData
}

WorkloadController watches Kubernetes workloads and generates v1alpha1.VulnerabilityReport instances using vulnerability scanner that that implements the Plugin interface.

func (r *WorkloadController) SetupWithManager(mgr ctrl.Manager) error

type Writer ¶

type Writer interface {
	Write(context.Context, []v1alpha1.VulnerabilityReport) error
}

Writer is the interface that wraps the basic Write method.

Write creates or updates the given slice of v1alpha1.VulnerabilityReport instances.