Red Hat SummitChapter 22. DetectionService
22.1. DetectBuildTime
POST /v1/detect/build
DetectBuildTime checks if any images violate build time policies.
22.1.1. Description
22.1.2. Parameters
22.1.2.1. Body Parameter
| Name | Description | Required | Default | Pattern |
|---|---|---|---|---|
| body | X |
22.1.3. Return Type
22.1.4. Content Type
- application/json
22.1.5. Responses
| Code | Message | Datatype |
|---|---|---|
| 200 | A successful response. | |
| 0 | An unexpected error response. |
22.1.6. Samples
22.1.7. Common object reference
22.1.7.1. AlertDeploymentContainer
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| image | |||||
| name | String |
22.1.7.2. AlertEnforcement
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| action | UNSET_ENFORCEMENT, SCALE_TO_ZERO_ENFORCEMENT, UNSATISFIABLE_NODE_CONSTRAINT_ENFORCEMENT, KILL_POD_ENFORCEMENT, FAIL_BUILD_ENFORCEMENT, FAIL_KUBE_REQUEST_ENFORCEMENT, FAIL_DEPLOYMENT_CREATE_ENFORCEMENT, FAIL_DEPLOYMENT_UPDATE_ENFORCEMENT, | ||||
| message | String |
22.1.7.3. AlertProcessViolation
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| message | String | ||||
| processes | List of StorageProcessIndicator |
22.1.7.4. AlertResourceResourceType
| Enum Values |
|---|
| UNKNOWN |
| SECRETS |
| CONFIGMAPS |
| CLUSTER_ROLES |
| CLUSTER_ROLE_BINDINGS |
| NETWORK_POLICIES |
| SECURITY_CONTEXT_CONSTRAINTS |
| EGRESS_FIREWALLS |
22.1.7.5. AlertViolation
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| message | String | ||||
| keyValueAttrs | |||||
| networkFlowInfo | |||||
| type | GENERIC, K8S_EVENT, NETWORK_FLOW, NETWORK_POLICY, | ||||
| time | Date | Indicates violation time. This field differs from top-level field 'time' which represents last time the alert occurred in case of multiple occurrences of the policy alert. As of 55.0, this field is set only for kubernetes event violations, but may not be limited to it in future. | date-time |
22.1.7.6. AlertViolationType
| Enum Values |
|---|
| GENERIC |
| K8S_EVENT |
| NETWORK_FLOW |
| NETWORK_POLICY |
22.1.7.7. KeyValueAttrsKeyValueAttr
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| key | String | ||||
| value | String |
22.1.7.8. NetworkFlowInfoEntity
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| name | String | ||||
| entityType | UNKNOWN_TYPE, DEPLOYMENT, INTERNET, LISTEN_ENDPOINT, EXTERNAL_SOURCE, INTERNAL_ENTITIES, | ||||
| deploymentNamespace | String | ||||
| deploymentType | String | ||||
| port | Integer | int32 |
22.1.7.9. PolicyMitreAttackVectors
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| tactic | String | ||||
| techniques |
List of |
22.1.7.10. ProcessSignalLineageInfo
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| parentUid | Long | int64 | |||
| parentExecFilePath | String |
22.1.7.11. ProtobufAny
Any contains an arbitrary serialized protocol buffer message along with a URL that describes the type of the serialized message.
Protobuf library provides support to pack/unpack Any values in the form of utility functions or additional generated methods of the Any type.
Example 1: Pack and unpack a message in C++.
Foo foo = ...;
Any any;
any.PackFrom(foo);
...
if (any.UnpackTo(&foo)) {
...
}Example 2: Pack and unpack a message in Java.
Foo foo = ...;
Any any = Any.pack(foo);
...
if (any.is(Foo.class)) {
foo = any.unpack(Foo.class);
}
// or ...
if (any.isSameTypeAs(Foo.getDefaultInstance())) {
foo = any.unpack(Foo.getDefaultInstance());
}Example 3: Pack and unpack a message in Python.foo = Foo(...)
any = Any()
any.Pack(foo)
...
if any.Is(Foo.DESCRIPTOR):
any.Unpack(foo)
...Example 4: Pack and unpack a message in Gofoo := &pb.Foo{...}
any, err := anypb.New(foo)
if err != nil {
...
}
...
foo := &pb.Foo{}
if err := any.UnmarshalTo(foo); err != nil {
...
}The pack methods provided by protobuf library will by default use 'type.googleapis.com/full.type.name' as the type URL and the unpack methods only use the fully qualified type name after the last '/' in the type URL, for example "foo.bar.com/x/y.z" will yield type name "y.z".
22.1.7.11.1. JSON representation
The JSON representation of an Any value uses the regular representation of the deserialized, embedded message, with an additional field @type which contains the type URL. Example:
package google.profile;
message Person {
string first_name = 1;
string last_name = 2;
}{
"@type": "type.googleapis.com/google.profile.Person",
"firstName": <string>,
"lastName": <string>
}
If the embedded message type is well-known and has a custom JSON representation, that representation will be embedded adding a field value which holds the custom JSON in addition to the @type field. Example (for message [google.protobuf.Duration][]):
{
"@type": "type.googleapis.com/google.protobuf.Duration",
"value": "1.212s"
}| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| typeUrl | String |
A URL/resource name that uniquely identifies the type of the serialized protocol buffer message. This string must contain at least one \"/\" character. The last segment of the URL’s path must represent the fully qualified name of the type (as in | |||
| value | byte[] | Must be a valid serialized protocol buffer of the above specified type. | byte |
22.1.7.12. RuntimeError
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| error | String | ||||
| code | Integer | int32 | |||
| message | String | ||||
| details | List of ProtobufAny |
22.1.7.13. StorageAlert
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| id | String | ||||
| policy | |||||
| lifecycleStage | DEPLOY, BUILD, RUNTIME, | ||||
| clusterId | String | ||||
| clusterName | String | ||||
| namespace | String | ||||
| namespaceId | String | ||||
| deployment | |||||
| image | |||||
| resource | |||||
| violations | List of AlertViolation | For run-time phase alert, a maximum of 40 violations are retained. | |||
| processViolation | |||||
| enforcement | |||||
| time | Date | date-time | |||
| firstOccurred | Date | date-time | |||
| resolvedAt | Date | The time at which the alert was resolved. Only set if ViolationState is RESOLVED. | date-time | ||
| state | ACTIVE, SNOOZED, RESOLVED, ATTEMPTED, | ||||
| snoozeTill | Date | date-time |
22.1.7.14. StorageAlertDeployment
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| id | String | ||||
| name | String | ||||
| type | String | ||||
| namespace | String | ||||
| namespaceId | String | ||||
| labels |
Map of | ||||
| clusterId | String | ||||
| clusterName | String | ||||
| containers | List of AlertDeploymentContainer | ||||
| annotations |
Map of | ||||
| inactive | Boolean |
22.1.7.15. StorageAlertResource
Represents an alert on a kubernetes resource other than a deployment (configmaps, secrets, etc.)| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| resourceType | UNKNOWN, SECRETS, CONFIGMAPS, CLUSTER_ROLES, CLUSTER_ROLE_BINDINGS, NETWORK_POLICIES, SECURITY_CONTEXT_CONSTRAINTS, EGRESS_FIREWALLS, | ||||
| name | String | ||||
| clusterId | String | ||||
| clusterName | String | ||||
| namespace | String | ||||
| namespaceId | String |
22.1.7.16. StorageBooleanOperator
| Enum Values |
|---|
| OR |
| AND |
22.1.7.17. StorageContainerImage
Next tag: 12| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| id | String | ||||
| name | |||||
| notPullable | Boolean | ||||
| isClusterLocal | Boolean |
22.1.7.18. StorageEnforcementAction
- FAIL_KUBE_REQUEST_ENFORCEMENT: FAIL_KUBE_REQUEST_ENFORCEMENT takes effect only if admission control webhook is enabled to listen on exec and port-forward events.
- FAIL_DEPLOYMENT_CREATE_ENFORCEMENT: FAIL_DEPLOYMENT_CREATE_ENFORCEMENT takes effect only if admission control webhook is configured to enforce on object creates.
- FAIL_DEPLOYMENT_UPDATE_ENFORCEMENT: FAIL_DEPLOYMENT_UPDATE_ENFORCEMENT takes effect only if admission control webhook is configured to enforce on object updates.
| Enum Values |
|---|
| UNSET_ENFORCEMENT |
| SCALE_TO_ZERO_ENFORCEMENT |
| UNSATISFIABLE_NODE_CONSTRAINT_ENFORCEMENT |
| KILL_POD_ENFORCEMENT |
| FAIL_BUILD_ENFORCEMENT |
| FAIL_KUBE_REQUEST_ENFORCEMENT |
| FAIL_DEPLOYMENT_CREATE_ENFORCEMENT |
| FAIL_DEPLOYMENT_UPDATE_ENFORCEMENT |
22.1.7.19. StorageEventSource
| Enum Values |
|---|
| NOT_APPLICABLE |
| DEPLOYMENT_EVENT |
| AUDIT_LOG_EVENT |
22.1.7.20. StorageExclusion
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| name | String | ||||
| deployment | |||||
| image | |||||
| expiration | Date | date-time |
22.1.7.21. StorageExclusionDeployment
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| name | String | ||||
| scope |
22.1.7.22. StorageExclusionImage
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| name | String |
22.1.7.23. StorageImageName
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| registry | String | ||||
| remote | String | ||||
| tag | String | ||||
| fullName | String |
22.1.7.24. StorageL4Protocol
| Enum Values |
|---|
| L4_PROTOCOL_UNKNOWN |
| L4_PROTOCOL_TCP |
| L4_PROTOCOL_UDP |
| L4_PROTOCOL_ICMP |
| L4_PROTOCOL_RAW |
| L4_PROTOCOL_SCTP |
| L4_PROTOCOL_ANY |
22.1.7.25. StorageLifecycleStage
| Enum Values |
|---|
| DEPLOY |
| BUILD |
| RUNTIME |
22.1.7.26. StorageNetworkEntityInfoType
- INTERNAL_ENTITIES: INTERNAL_ENTITIES is for grouping all internal entities under a single network graph node
| Enum Values |
|---|
| UNKNOWN_TYPE |
| DEPLOYMENT |
| INTERNET |
| LISTEN_ENDPOINT |
| EXTERNAL_SOURCE |
| INTERNAL_ENTITIES |
22.1.7.27. StoragePolicy
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| id | String | ||||
| name | String | ||||
| description | String | ||||
| rationale | String | ||||
| remediation | String | ||||
| disabled | Boolean | ||||
| categories |
List of | ||||
| lifecycleStages | List of StorageLifecycleStage | ||||
| eventSource | NOT_APPLICABLE, DEPLOYMENT_EVENT, AUDIT_LOG_EVENT, | ||||
| exclusions | List of StorageExclusion | ||||
| scope | List of StorageScope | ||||
| severity | UNSET_SEVERITY, LOW_SEVERITY, MEDIUM_SEVERITY, HIGH_SEVERITY, CRITICAL_SEVERITY, | ||||
| enforcementActions | List of StorageEnforcementAction | FAIL_DEPLOYMENT_CREATE_ENFORCEMENT takes effect only if admission control webhook is configured to enforce on object creates/updates. FAIL_KUBE_REQUEST_ENFORCEMENT takes effect only if admission control webhook is enabled to listen on exec and port-forward events. FAIL_DEPLOYMENT_UPDATE_ENFORCEMENT takes effect only if admission control webhook is configured to enforce on object updates. | |||
| notifiers |
List of | ||||
| lastUpdated | Date | date-time | |||
| SORTName | String | For internal use only. | |||
| SORTLifecycleStage | String | For internal use only. | |||
| SORTEnforcement | Boolean | For internal use only. | |||
| policyVersion | String | ||||
| policySections | List of StoragePolicySection | ||||
| mitreAttackVectors | List of PolicyMitreAttackVectors | ||||
| criteriaLocked | Boolean | Read-only field. If true, the policy’s criteria fields are rendered read-only. | |||
| mitreVectorsLocked | Boolean | Read-only field. If true, the policy’s MITRE ATT&CK fields are rendered read-only. | |||
| isDefault | Boolean | Read-only field. Indicates the policy is a default policy if true and a custom policy if false. |
22.1.7.28. StoragePolicyGroup
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| fieldName | String | ||||
| booleanOperator | OR, AND, | ||||
| negate | Boolean | ||||
| values | List of StoragePolicyValue |
22.1.7.29. StoragePolicySection
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| sectionName | String | ||||
| policyGroups | List of StoragePolicyGroup |
22.1.7.30. StoragePolicyValue
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| value | String |
22.1.7.31. StorageProcessIndicator
Next available tag: 13| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| id | String | ||||
| deploymentId | String | ||||
| containerName | String | ||||
| podId | String | ||||
| podUid | String | ||||
| signal | |||||
| clusterId | String | ||||
| namespace | String | ||||
| containerStartTime | Date | date-time | |||
| imageId | String |
22.1.7.32. StorageProcessSignal
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| id | String | A unique UUID for identifying the message We have this here instead of at the top level because we want to have each message to be self contained. | |||
| containerId | String | ||||
| time | Date | date-time | |||
| name | String | ||||
| args | String | ||||
| execFilePath | String | ||||
| pid | Long | int64 | |||
| uid | Long | int64 | |||
| gid | Long | int64 | |||
| lineage |
List of | ||||
| scraped | Boolean | ||||
| lineageInfo | List of ProcessSignalLineageInfo |
22.1.7.33. StorageScope
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| cluster | String | ||||
| namespace | String | ||||
| label |
22.1.7.34. StorageScopeLabel
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| key | String | ||||
| value | String |
22.1.7.35. StorageSeverity
| Enum Values |
|---|
| UNSET_SEVERITY |
| LOW_SEVERITY |
| MEDIUM_SEVERITY |
| HIGH_SEVERITY |
| CRITICAL_SEVERITY |
22.1.7.36. StorageViolationState
| Enum Values |
|---|
| ACTIVE |
| SNOOZED |
| RESOLVED |
| ATTEMPTED |
22.1.7.37. V1BuildDetectionRequest
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| image | |||||
| imageName | String | ||||
| noExternalMetadata | Boolean | ||||
| sendNotifications | Boolean | ||||
| force | Boolean | ||||
| policyCategories |
List of | ||||
| cluster | String | Cluster to delegate scan to, may be the cluster’s name or ID. |
22.1.7.38. V1BuildDetectionResponse
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| alerts | List of StorageAlert |
22.1.7.39. ViolationKeyValueAttrs
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| attrs | List of KeyValueAttrsKeyValueAttr |
22.1.7.40. ViolationNetworkFlowInfo
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| protocol | L4_PROTOCOL_UNKNOWN, L4_PROTOCOL_TCP, L4_PROTOCOL_UDP, L4_PROTOCOL_ICMP, L4_PROTOCOL_RAW, L4_PROTOCOL_SCTP, L4_PROTOCOL_ANY, | ||||
| source | |||||
| destination |
22.2. DetectDeployTime
POST /v1/detect/deploy
DetectDeployTime checks if any deployments violate deploy time policies.
22.2.1. Description
22.2.2. Parameters
22.2.2.1. Body Parameter
| Name | Description | Required | Default | Pattern |
|---|---|---|---|---|
| body | X |
22.2.3. Return Type
22.2.4. Content Type
- application/json
22.2.5. Responses
| Code | Message | Datatype |
|---|---|---|
| 200 | A successful response. | |
| 0 | An unexpected error response. |
22.2.6. Samples
22.2.7. Common object reference
22.2.7.1. AlertDeploymentContainer
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| image | |||||
| name | String |
22.2.7.2. AlertEnforcement
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| action | UNSET_ENFORCEMENT, SCALE_TO_ZERO_ENFORCEMENT, UNSATISFIABLE_NODE_CONSTRAINT_ENFORCEMENT, KILL_POD_ENFORCEMENT, FAIL_BUILD_ENFORCEMENT, FAIL_KUBE_REQUEST_ENFORCEMENT, FAIL_DEPLOYMENT_CREATE_ENFORCEMENT, FAIL_DEPLOYMENT_UPDATE_ENFORCEMENT, | ||||
| message | String |
22.2.7.3. AlertProcessViolation
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| message | String | ||||
| processes | List of StorageProcessIndicator |
22.2.7.4. AlertResourceResourceType
| Enum Values |
|---|
| UNKNOWN |
| SECRETS |
| CONFIGMAPS |
| CLUSTER_ROLES |
| CLUSTER_ROLE_BINDINGS |
| NETWORK_POLICIES |
| SECURITY_CONTEXT_CONSTRAINTS |
| EGRESS_FIREWALLS |
22.2.7.5. AlertViolation
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| message | String | ||||
| keyValueAttrs | |||||
| networkFlowInfo | |||||
| type | GENERIC, K8S_EVENT, NETWORK_FLOW, NETWORK_POLICY, | ||||
| time | Date | Indicates violation time. This field differs from top-level field 'time' which represents last time the alert occurred in case of multiple occurrences of the policy alert. As of 55.0, this field is set only for kubernetes event violations, but may not be limited to it in future. | date-time |
22.2.7.6. AlertViolationType
| Enum Values |
|---|
| GENERIC |
| K8S_EVENT |
| NETWORK_FLOW |
| NETWORK_POLICY |
22.2.7.7. ContainerConfigEnvironmentConfig
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| key | String | ||||
| value | String | ||||
| envVarSource | UNSET, RAW, SECRET_KEY, CONFIG_MAP_KEY, FIELD, RESOURCE_FIELD, UNKNOWN, |
22.2.7.8. DeployDetectionResponseRun
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| name | String | ||||
| type | String | ||||
| alerts | List of StorageAlert |
22.2.7.9. EnvironmentConfigEnvVarSource
For any update to EnvVarSource, please also update 'ui/src/messages/common.js'| Enum Values |
|---|
| UNSET |
| RAW |
| SECRET_KEY |
| CONFIG_MAP_KEY |
| FIELD |
| RESOURCE_FIELD |
| UNKNOWN |
22.2.7.10. KeyValueAttrsKeyValueAttr
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| key | String | ||||
| value | String |
22.2.7.11. NetworkFlowInfoEntity
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| name | String | ||||
| entityType | UNKNOWN_TYPE, DEPLOYMENT, INTERNET, LISTEN_ENDPOINT, EXTERNAL_SOURCE, INTERNAL_ENTITIES, | ||||
| deploymentNamespace | String | ||||
| deploymentType | String | ||||
| port | Integer | int32 |
22.2.7.12. PolicyMitreAttackVectors
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| tactic | String | ||||
| techniques |
List of |
22.2.7.13. PortConfigExposureInfo
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| level | UNSET, EXTERNAL, NODE, INTERNAL, HOST, ROUTE, | ||||
| serviceName | String | ||||
| serviceId | String | ||||
| serviceClusterIp | String | ||||
| servicePort | Integer | int32 | |||
| nodePort | Integer | int32 | |||
| externalIps |
List of | ||||
| externalHostnames |
List of |
22.2.7.14. PortConfigExposureLevel
| Enum Values |
|---|
| UNSET |
| EXTERNAL |
| NODE |
| INTERNAL |
| HOST |
| ROUTE |
22.2.7.15. ProcessSignalLineageInfo
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| parentUid | Long | int64 | |||
| parentExecFilePath | String |
22.2.7.16. ProtobufAny
Any contains an arbitrary serialized protocol buffer message along with a URL that describes the type of the serialized message.
Protobuf library provides support to pack/unpack Any values in the form of utility functions or additional generated methods of the Any type.
Example 1: Pack and unpack a message in C++.
Foo foo = ...;
Any any;
any.PackFrom(foo);
...
if (any.UnpackTo(&foo)) {
...
}Example 2: Pack and unpack a message in Java.
Foo foo = ...;
Any any = Any.pack(foo);
...
if (any.is(Foo.class)) {
foo = any.unpack(Foo.class);
}
// or ...
if (any.isSameTypeAs(Foo.getDefaultInstance())) {
foo = any.unpack(Foo.getDefaultInstance());
}Example 3: Pack and unpack a message in Python.foo = Foo(...)
any = Any()
any.Pack(foo)
...
if any.Is(Foo.DESCRIPTOR):
any.Unpack(foo)
...Example 4: Pack and unpack a message in Gofoo := &pb.Foo{...}
any, err := anypb.New(foo)
if err != nil {
...
}
...
foo := &pb.Foo{}
if err := any.UnmarshalTo(foo); err != nil {
...
}The pack methods provided by protobuf library will by default use 'type.googleapis.com/full.type.name' as the type URL and the unpack methods only use the fully qualified type name after the last '/' in the type URL, for example "foo.bar.com/x/y.z" will yield type name "y.z".
22.2.7.16.1. JSON representation
The JSON representation of an Any value uses the regular representation of the deserialized, embedded message, with an additional field @type which contains the type URL. Example:
package google.profile;
message Person {
string first_name = 1;
string last_name = 2;
}{
"@type": "type.googleapis.com/google.profile.Person",
"firstName": <string>,
"lastName": <string>
}
If the embedded message type is well-known and has a custom JSON representation, that representation will be embedded adding a field value which holds the custom JSON in addition to the @type field. Example (for message [google.protobuf.Duration][]):
{
"@type": "type.googleapis.com/google.protobuf.Duration",
"value": "1.212s"
}| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| typeUrl | String |
A URL/resource name that uniquely identifies the type of the serialized protocol buffer message. This string must contain at least one \"/\" character. The last segment of the URL’s path must represent the fully qualified name of the type (as in | |||
| value | byte[] | Must be a valid serialized protocol buffer of the above specified type. | byte |
22.2.7.17. RuntimeError
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| error | String | ||||
| code | Integer | int32 | |||
| message | String | ||||
| details | List of ProtobufAny |
22.2.7.18. SeccompProfileProfileType
| Enum Values |
|---|
| UNCONFINED |
| RUNTIME_DEFAULT |
| LOCALHOST |
22.2.7.19. SecurityContextSELinux
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| user | String | ||||
| role | String | ||||
| type | String | ||||
| level | String |
22.2.7.20. SecurityContextSeccompProfile
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| type | UNCONFINED, RUNTIME_DEFAULT, LOCALHOST, | ||||
| localhostProfile | String |
22.2.7.21. StorageAlert
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| id | String | ||||
| policy | |||||
| lifecycleStage | DEPLOY, BUILD, RUNTIME, | ||||
| clusterId | String | ||||
| clusterName | String | ||||
| namespace | String | ||||
| namespaceId | String | ||||
| deployment | |||||
| image | |||||
| resource | |||||
| violations | List of AlertViolation | For run-time phase alert, a maximum of 40 violations are retained. | |||
| processViolation | |||||
| enforcement | |||||
| time | Date | date-time | |||
| firstOccurred | Date | date-time | |||
| resolvedAt | Date | The time at which the alert was resolved. Only set if ViolationState is RESOLVED. | date-time | ||
| state | ACTIVE, SNOOZED, RESOLVED, ATTEMPTED, | ||||
| snoozeTill | Date | date-time |
22.2.7.22. StorageAlertDeployment
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| id | String | ||||
| name | String | ||||
| type | String | ||||
| namespace | String | ||||
| namespaceId | String | ||||
| labels |
Map of | ||||
| clusterId | String | ||||
| clusterName | String | ||||
| containers | List of AlertDeploymentContainer | ||||
| annotations |
Map of | ||||
| inactive | Boolean |
22.2.7.23. StorageAlertResource
Represents an alert on a kubernetes resource other than a deployment (configmaps, secrets, etc.)| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| resourceType | UNKNOWN, SECRETS, CONFIGMAPS, CLUSTER_ROLES, CLUSTER_ROLE_BINDINGS, NETWORK_POLICIES, SECURITY_CONTEXT_CONSTRAINTS, EGRESS_FIREWALLS, | ||||
| name | String | ||||
| clusterId | String | ||||
| clusterName | String | ||||
| namespace | String | ||||
| namespaceId | String |
22.2.7.24. StorageBooleanOperator
| Enum Values |
|---|
| OR |
| AND |
22.2.7.25. StorageContainer
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| id | String | ||||
| config | |||||
| image | |||||
| securityContext | |||||
| volumes | List of StorageVolume | ||||
| ports | List of StoragePortConfig | ||||
| secrets | List of StorageEmbeddedSecret | ||||
| resources | |||||
| name | String | ||||
| livenessProbe | |||||
| readinessProbe |
22.2.7.26. StorageContainerConfig
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| env | List of ContainerConfigEnvironmentConfig | ||||
| command |
List of | ||||
| args |
List of | ||||
| directory | String | ||||
| user | String | ||||
| uid | String | int64 | |||
| appArmorProfile | String |
22.2.7.27. StorageContainerImage
Next tag: 12| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| id | String | ||||
| name | |||||
| notPullable | Boolean | ||||
| isClusterLocal | Boolean |
22.2.7.28. StorageDeployment
Next available tag: 35| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| id | String | ||||
| name | String | ||||
| hash | String | uint64 | |||
| type | String | ||||
| namespace | String | ||||
| namespaceId | String | ||||
| orchestratorComponent | Boolean | ||||
| replicas | String | int64 | |||
| labels |
Map of | ||||
| podLabels |
Map of | ||||
| labelSelector | |||||
| created | Date | date-time | |||
| clusterId | String | ||||
| clusterName | String | ||||
| containers | List of StorageContainer | ||||
| annotations |
Map of | ||||
| priority | String | int64 | |||
| inactive | Boolean | ||||
| imagePullSecrets |
List of | ||||
| serviceAccount | String | ||||
| serviceAccountPermissionLevel | UNSET, NONE, DEFAULT, ELEVATED_IN_NAMESPACE, ELEVATED_CLUSTER_WIDE, CLUSTER_ADMIN, | ||||
| automountServiceAccountToken | Boolean | ||||
| hostNetwork | Boolean | ||||
| hostPid | Boolean | ||||
| hostIpc | Boolean | ||||
| runtimeClass | String | ||||
| tolerations | List of StorageToleration | ||||
| ports | List of StoragePortConfig | ||||
| stateTimestamp | String | int64 | |||
| riskScore | Float | float |
22.2.7.29. StorageEmbeddedSecret
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| name | String | ||||
| path | String |
22.2.7.30. StorageEnforcementAction
- FAIL_KUBE_REQUEST_ENFORCEMENT: FAIL_KUBE_REQUEST_ENFORCEMENT takes effect only if admission control webhook is enabled to listen on exec and port-forward events.
- FAIL_DEPLOYMENT_CREATE_ENFORCEMENT: FAIL_DEPLOYMENT_CREATE_ENFORCEMENT takes effect only if admission control webhook is configured to enforce on object creates.
- FAIL_DEPLOYMENT_UPDATE_ENFORCEMENT: FAIL_DEPLOYMENT_UPDATE_ENFORCEMENT takes effect only if admission control webhook is configured to enforce on object updates.
| Enum Values |
|---|
| UNSET_ENFORCEMENT |
| SCALE_TO_ZERO_ENFORCEMENT |
| UNSATISFIABLE_NODE_CONSTRAINT_ENFORCEMENT |
| KILL_POD_ENFORCEMENT |
| FAIL_BUILD_ENFORCEMENT |
| FAIL_KUBE_REQUEST_ENFORCEMENT |
| FAIL_DEPLOYMENT_CREATE_ENFORCEMENT |
| FAIL_DEPLOYMENT_UPDATE_ENFORCEMENT |
22.2.7.31. StorageEventSource
| Enum Values |
|---|
| NOT_APPLICABLE |
| DEPLOYMENT_EVENT |
| AUDIT_LOG_EVENT |
22.2.7.32. StorageExclusion
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| name | String | ||||
| deployment | |||||
| image | |||||
| expiration | Date | date-time |
22.2.7.33. StorageExclusionDeployment
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| name | String | ||||
| scope |
22.2.7.34. StorageExclusionImage
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| name | String |
22.2.7.35. StorageImageName
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| registry | String | ||||
| remote | String | ||||
| tag | String | ||||
| fullName | String |
22.2.7.36. StorageL4Protocol
| Enum Values |
|---|
| L4_PROTOCOL_UNKNOWN |
| L4_PROTOCOL_TCP |
| L4_PROTOCOL_UDP |
| L4_PROTOCOL_ICMP |
| L4_PROTOCOL_RAW |
| L4_PROTOCOL_SCTP |
| L4_PROTOCOL_ANY |
22.2.7.37. StorageLabelSelector
Label selector components are joined with logical AND, see https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/Next available tag: 3
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| matchLabels |
Map of | This is actually a oneof, but we can’t make it one due to backwards compatibility constraints. | |||
| requirements | List of StorageLabelSelectorRequirement |
22.2.7.38. StorageLabelSelectorOperator
| Enum Values |
|---|
| UNKNOWN |
| IN |
| NOT_IN |
| EXISTS |
| NOT_EXISTS |
22.2.7.39. StorageLabelSelectorRequirement
Next available tag: 4| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| key | String | ||||
| op | UNKNOWN, IN, NOT_IN, EXISTS, NOT_EXISTS, | ||||
| values |
List of |
22.2.7.40. StorageLifecycleStage
| Enum Values |
|---|
| DEPLOY |
| BUILD |
| RUNTIME |
22.2.7.41. StorageLivenessProbe
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| defined | Boolean |
22.2.7.42. StorageNetworkEntityInfoType
- INTERNAL_ENTITIES: INTERNAL_ENTITIES is for grouping all internal entities under a single network graph node
| Enum Values |
|---|
| UNKNOWN_TYPE |
| DEPLOYMENT |
| INTERNET |
| LISTEN_ENDPOINT |
| EXTERNAL_SOURCE |
| INTERNAL_ENTITIES |
22.2.7.43. StoragePermissionLevel
For any update to PermissionLevel, also update: - pkg/searchbasedpolicies/builders/k8s_rbac.go - ui/src/messages/common.js| Enum Values |
|---|
| UNSET |
| NONE |
| DEFAULT |
| ELEVATED_IN_NAMESPACE |
| ELEVATED_CLUSTER_WIDE |
| CLUSTER_ADMIN |
22.2.7.44. StoragePolicy
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| id | String | ||||
| name | String | ||||
| description | String | ||||
| rationale | String | ||||
| remediation | String | ||||
| disabled | Boolean | ||||
| categories |
List of | ||||
| lifecycleStages | List of StorageLifecycleStage | ||||
| eventSource | NOT_APPLICABLE, DEPLOYMENT_EVENT, AUDIT_LOG_EVENT, | ||||
| exclusions | List of StorageExclusion | ||||
| scope | List of StorageScope | ||||
| severity | UNSET_SEVERITY, LOW_SEVERITY, MEDIUM_SEVERITY, HIGH_SEVERITY, CRITICAL_SEVERITY, | ||||
| enforcementActions | List of StorageEnforcementAction | FAIL_DEPLOYMENT_CREATE_ENFORCEMENT takes effect only if admission control webhook is configured to enforce on object creates/updates. FAIL_KUBE_REQUEST_ENFORCEMENT takes effect only if admission control webhook is enabled to listen on exec and port-forward events. FAIL_DEPLOYMENT_UPDATE_ENFORCEMENT takes effect only if admission control webhook is configured to enforce on object updates. | |||
| notifiers |
List of | ||||
| lastUpdated | Date | date-time | |||
| SORTName | String | For internal use only. | |||
| SORTLifecycleStage | String | For internal use only. | |||
| SORTEnforcement | Boolean | For internal use only. | |||
| policyVersion | String | ||||
| policySections | List of StoragePolicySection | ||||
| mitreAttackVectors | List of PolicyMitreAttackVectors | ||||
| criteriaLocked | Boolean | Read-only field. If true, the policy’s criteria fields are rendered read-only. | |||
| mitreVectorsLocked | Boolean | Read-only field. If true, the policy’s MITRE ATT&CK fields are rendered read-only. | |||
| isDefault | Boolean | Read-only field. Indicates the policy is a default policy if true and a custom policy if false. |
22.2.7.45. StoragePolicyGroup
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| fieldName | String | ||||
| booleanOperator | OR, AND, | ||||
| negate | Boolean | ||||
| values | List of StoragePolicyValue |
22.2.7.46. StoragePolicySection
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| sectionName | String | ||||
| policyGroups | List of StoragePolicyGroup |
22.2.7.47. StoragePolicyValue
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| value | String |
22.2.7.48. StoragePortConfig
Next Available Tag: 6| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| name | String | ||||
| containerPort | Integer | int32 | |||
| protocol | String | ||||
| exposure | UNSET, EXTERNAL, NODE, INTERNAL, HOST, ROUTE, | ||||
| exposedPort | Integer | int32 | |||
| exposureInfos | List of PortConfigExposureInfo |
22.2.7.49. StorageProcessIndicator
Next available tag: 13| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| id | String | ||||
| deploymentId | String | ||||
| containerName | String | ||||
| podId | String | ||||
| podUid | String | ||||
| signal | |||||
| clusterId | String | ||||
| namespace | String | ||||
| containerStartTime | Date | date-time | |||
| imageId | String |
22.2.7.50. StorageProcessSignal
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| id | String | A unique UUID for identifying the message We have this here instead of at the top level because we want to have each message to be self contained. | |||
| containerId | String | ||||
| time | Date | date-time | |||
| name | String | ||||
| args | String | ||||
| execFilePath | String | ||||
| pid | Long | int64 | |||
| uid | Long | int64 | |||
| gid | Long | int64 | |||
| lineage |
List of | ||||
| scraped | Boolean | ||||
| lineageInfo | List of ProcessSignalLineageInfo |
22.2.7.51. StorageReadinessProbe
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| defined | Boolean |
22.2.7.52. StorageResources
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| cpuCoresRequest | Float | float | |||
| cpuCoresLimit | Float | float | |||
| memoryMbRequest | Float | float | |||
| memoryMbLimit | Float | float |
22.2.7.53. StorageScope
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| cluster | String | ||||
| namespace | String | ||||
| label |
22.2.7.54. StorageScopeLabel
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| key | String | ||||
| value | String |
22.2.7.55. StorageSecurityContext
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| privileged | Boolean | ||||
| selinux | |||||
| dropCapabilities |
List of | ||||
| addCapabilities |
List of | ||||
| readOnlyRootFilesystem | Boolean | ||||
| seccompProfile | |||||
| allowPrivilegeEscalation | Boolean |
22.2.7.56. StorageSeverity
| Enum Values |
|---|
| UNSET_SEVERITY |
| LOW_SEVERITY |
| MEDIUM_SEVERITY |
| HIGH_SEVERITY |
| CRITICAL_SEVERITY |
22.2.7.57. StorageTaintEffect
| Enum Values |
|---|
| UNKNOWN_TAINT_EFFECT |
| NO_SCHEDULE_TAINT_EFFECT |
| PREFER_NO_SCHEDULE_TAINT_EFFECT |
| NO_EXECUTE_TAINT_EFFECT |
22.2.7.58. StorageToleration
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| key | String | ||||
| operator | TOLERATION_OPERATION_UNKNOWN, TOLERATION_OPERATOR_EXISTS, TOLERATION_OPERATOR_EQUAL, | ||||
| value | String | ||||
| taintEffect | UNKNOWN_TAINT_EFFECT, NO_SCHEDULE_TAINT_EFFECT, PREFER_NO_SCHEDULE_TAINT_EFFECT, NO_EXECUTE_TAINT_EFFECT, |
22.2.7.59. StorageTolerationOperator
| Enum Values |
|---|
| TOLERATION_OPERATION_UNKNOWN |
| TOLERATION_OPERATOR_EXISTS |
| TOLERATION_OPERATOR_EQUAL |
22.2.7.60. StorageViolationState
| Enum Values |
|---|
| ACTIVE |
| SNOOZED |
| RESOLVED |
| ATTEMPTED |
22.2.7.61. StorageVolume
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| name | String | ||||
| source | String | ||||
| destination | String | ||||
| readOnly | Boolean | ||||
| type | String | ||||
| mountPropagation | NONE, HOST_TO_CONTAINER, BIDIRECTIONAL, |
22.2.7.62. V1DeployDetectionRemark
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| name | String | ||||
| permissionLevel | String | ||||
| appliedNetworkPolicies |
List of |
22.2.7.63. V1DeployDetectionRequest
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| deployment | |||||
| noExternalMetadata | Boolean | ||||
| enforcementOnly | Boolean | ||||
| clusterId | String |
22.2.7.64. V1DeployDetectionResponse
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| runs | List of DeployDetectionResponseRun | ||||
| ignoredObjectRefs |
List of | The reference will be in the format: namespace/name[<group>/<version>, Kind=<kind>]. | |||
| remarks | List of V1DeployDetectionRemark |
22.2.7.65. ViolationKeyValueAttrs
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| attrs | List of KeyValueAttrsKeyValueAttr |
22.2.7.66. ViolationNetworkFlowInfo
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| protocol | L4_PROTOCOL_UNKNOWN, L4_PROTOCOL_TCP, L4_PROTOCOL_UDP, L4_PROTOCOL_ICMP, L4_PROTOCOL_RAW, L4_PROTOCOL_SCTP, L4_PROTOCOL_ANY, | ||||
| source | |||||
| destination |
22.2.7.67. VolumeMountPropagation
| Enum Values |
|---|
| NONE |
| HOST_TO_CONTAINER |
| BIDIRECTIONAL |
22.3. DetectDeployTimeFromYAML
POST /v1/detect/deploy/yaml
DetectDeployTimeFromYAML checks if the given deployment yaml violates any deploy time policies.
22.3.1. Description
22.3.2. Parameters
22.3.2.1. Body Parameter
| Name | Description | Required | Default | Pattern |
|---|---|---|---|---|
| body | X |
22.3.3. Return Type
22.3.4. Content Type
- application/json
22.3.5. Responses
| Code | Message | Datatype |
|---|---|---|
| 200 | A successful response. | |
| 0 | An unexpected error response. |
22.3.6. Samples
22.3.7. Common object reference
22.3.7.1. AlertDeploymentContainer
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| image | |||||
| name | String |
22.3.7.2. AlertEnforcement
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| action | UNSET_ENFORCEMENT, SCALE_TO_ZERO_ENFORCEMENT, UNSATISFIABLE_NODE_CONSTRAINT_ENFORCEMENT, KILL_POD_ENFORCEMENT, FAIL_BUILD_ENFORCEMENT, FAIL_KUBE_REQUEST_ENFORCEMENT, FAIL_DEPLOYMENT_CREATE_ENFORCEMENT, FAIL_DEPLOYMENT_UPDATE_ENFORCEMENT, | ||||
| message | String |
22.3.7.3. AlertProcessViolation
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| message | String | ||||
| processes | List of StorageProcessIndicator |
22.3.7.4. AlertResourceResourceType
| Enum Values |
|---|
| UNKNOWN |
| SECRETS |
| CONFIGMAPS |
| CLUSTER_ROLES |
| CLUSTER_ROLE_BINDINGS |
| NETWORK_POLICIES |
| SECURITY_CONTEXT_CONSTRAINTS |
| EGRESS_FIREWALLS |
22.3.7.5. AlertViolation
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| message | String | ||||
| keyValueAttrs | |||||
| networkFlowInfo | |||||
| type | GENERIC, K8S_EVENT, NETWORK_FLOW, NETWORK_POLICY, | ||||
| time | Date | Indicates violation time. This field differs from top-level field 'time' which represents last time the alert occurred in case of multiple occurrences of the policy alert. As of 55.0, this field is set only for kubernetes event violations, but may not be limited to it in future. | date-time |
22.3.7.6. AlertViolationType
| Enum Values |
|---|
| GENERIC |
| K8S_EVENT |
| NETWORK_FLOW |
| NETWORK_POLICY |
22.3.7.7. DeployDetectionResponseRun
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| name | String | ||||
| type | String | ||||
| alerts | List of StorageAlert |
22.3.7.8. KeyValueAttrsKeyValueAttr
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| key | String | ||||
| value | String |
22.3.7.9. NetworkFlowInfoEntity
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| name | String | ||||
| entityType | UNKNOWN_TYPE, DEPLOYMENT, INTERNET, LISTEN_ENDPOINT, EXTERNAL_SOURCE, INTERNAL_ENTITIES, | ||||
| deploymentNamespace | String | ||||
| deploymentType | String | ||||
| port | Integer | int32 |
22.3.7.10. PolicyMitreAttackVectors
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| tactic | String | ||||
| techniques |
List of |
22.3.7.11. ProcessSignalLineageInfo
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| parentUid | Long | int64 | |||
| parentExecFilePath | String |
22.3.7.12. ProtobufAny
Any contains an arbitrary serialized protocol buffer message along with a URL that describes the type of the serialized message.
Protobuf library provides support to pack/unpack Any values in the form of utility functions or additional generated methods of the Any type.
Example 1: Pack and unpack a message in C++.
Foo foo = ...;
Any any;
any.PackFrom(foo);
...
if (any.UnpackTo(&foo)) {
...
}Example 2: Pack and unpack a message in Java.
Foo foo = ...;
Any any = Any.pack(foo);
...
if (any.is(Foo.class)) {
foo = any.unpack(Foo.class);
}
// or ...
if (any.isSameTypeAs(Foo.getDefaultInstance())) {
foo = any.unpack(Foo.getDefaultInstance());
}Example 3: Pack and unpack a message in Python.foo = Foo(...)
any = Any()
any.Pack(foo)
...
if any.Is(Foo.DESCRIPTOR):
any.Unpack(foo)
...Example 4: Pack and unpack a message in Gofoo := &pb.Foo{...}
any, err := anypb.New(foo)
if err != nil {
...
}
...
foo := &pb.Foo{}
if err := any.UnmarshalTo(foo); err != nil {
...
}The pack methods provided by protobuf library will by default use 'type.googleapis.com/full.type.name' as the type URL and the unpack methods only use the fully qualified type name after the last '/' in the type URL, for example "foo.bar.com/x/y.z" will yield type name "y.z".
22.3.7.12.1. JSON representation
The JSON representation of an Any value uses the regular representation of the deserialized, embedded message, with an additional field @type which contains the type URL. Example:
package google.profile;
message Person {
string first_name = 1;
string last_name = 2;
}{
"@type": "type.googleapis.com/google.profile.Person",
"firstName": <string>,
"lastName": <string>
}
If the embedded message type is well-known and has a custom JSON representation, that representation will be embedded adding a field value which holds the custom JSON in addition to the @type field. Example (for message [google.protobuf.Duration][]):
{
"@type": "type.googleapis.com/google.protobuf.Duration",
"value": "1.212s"
}| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| typeUrl | String |
A URL/resource name that uniquely identifies the type of the serialized protocol buffer message. This string must contain at least one \"/\" character. The last segment of the URL’s path must represent the fully qualified name of the type (as in | |||
| value | byte[] | Must be a valid serialized protocol buffer of the above specified type. | byte |
22.3.7.13. RuntimeError
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| error | String | ||||
| code | Integer | int32 | |||
| message | String | ||||
| details | List of ProtobufAny |
22.3.7.14. StorageAlert
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| id | String | ||||
| policy | |||||
| lifecycleStage | DEPLOY, BUILD, RUNTIME, | ||||
| clusterId | String | ||||
| clusterName | String | ||||
| namespace | String | ||||
| namespaceId | String | ||||
| deployment | |||||
| image | |||||
| resource | |||||
| violations | List of AlertViolation | For run-time phase alert, a maximum of 40 violations are retained. | |||
| processViolation | |||||
| enforcement | |||||
| time | Date | date-time | |||
| firstOccurred | Date | date-time | |||
| resolvedAt | Date | The time at which the alert was resolved. Only set if ViolationState is RESOLVED. | date-time | ||
| state | ACTIVE, SNOOZED, RESOLVED, ATTEMPTED, | ||||
| snoozeTill | Date | date-time |
22.3.7.15. StorageAlertDeployment
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| id | String | ||||
| name | String | ||||
| type | String | ||||
| namespace | String | ||||
| namespaceId | String | ||||
| labels |
Map of | ||||
| clusterId | String | ||||
| clusterName | String | ||||
| containers | List of AlertDeploymentContainer | ||||
| annotations |
Map of | ||||
| inactive | Boolean |
22.3.7.16. StorageAlertResource
Represents an alert on a kubernetes resource other than a deployment (configmaps, secrets, etc.)| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| resourceType | UNKNOWN, SECRETS, CONFIGMAPS, CLUSTER_ROLES, CLUSTER_ROLE_BINDINGS, NETWORK_POLICIES, SECURITY_CONTEXT_CONSTRAINTS, EGRESS_FIREWALLS, | ||||
| name | String | ||||
| clusterId | String | ||||
| clusterName | String | ||||
| namespace | String | ||||
| namespaceId | String |
22.3.7.17. StorageBooleanOperator
| Enum Values |
|---|
| OR |
| AND |
22.3.7.18. StorageContainerImage
Next tag: 12| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| id | String | ||||
| name | |||||
| notPullable | Boolean | ||||
| isClusterLocal | Boolean |
22.3.7.19. StorageEnforcementAction
- FAIL_KUBE_REQUEST_ENFORCEMENT: FAIL_KUBE_REQUEST_ENFORCEMENT takes effect only if admission control webhook is enabled to listen on exec and port-forward events.
- FAIL_DEPLOYMENT_CREATE_ENFORCEMENT: FAIL_DEPLOYMENT_CREATE_ENFORCEMENT takes effect only if admission control webhook is configured to enforce on object creates.
- FAIL_DEPLOYMENT_UPDATE_ENFORCEMENT: FAIL_DEPLOYMENT_UPDATE_ENFORCEMENT takes effect only if admission control webhook is configured to enforce on object updates.
| Enum Values |
|---|
| UNSET_ENFORCEMENT |
| SCALE_TO_ZERO_ENFORCEMENT |
| UNSATISFIABLE_NODE_CONSTRAINT_ENFORCEMENT |
| KILL_POD_ENFORCEMENT |
| FAIL_BUILD_ENFORCEMENT |
| FAIL_KUBE_REQUEST_ENFORCEMENT |
| FAIL_DEPLOYMENT_CREATE_ENFORCEMENT |
| FAIL_DEPLOYMENT_UPDATE_ENFORCEMENT |
22.3.7.20. StorageEventSource
| Enum Values |
|---|
| NOT_APPLICABLE |
| DEPLOYMENT_EVENT |
| AUDIT_LOG_EVENT |
22.3.7.21. StorageExclusion
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| name | String | ||||
| deployment | |||||
| image | |||||
| expiration | Date | date-time |
22.3.7.22. StorageExclusionDeployment
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| name | String | ||||
| scope |
22.3.7.23. StorageExclusionImage
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| name | String |
22.3.7.24. StorageImageName
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| registry | String | ||||
| remote | String | ||||
| tag | String | ||||
| fullName | String |
22.3.7.25. StorageL4Protocol
| Enum Values |
|---|
| L4_PROTOCOL_UNKNOWN |
| L4_PROTOCOL_TCP |
| L4_PROTOCOL_UDP |
| L4_PROTOCOL_ICMP |
| L4_PROTOCOL_RAW |
| L4_PROTOCOL_SCTP |
| L4_PROTOCOL_ANY |
22.3.7.26. StorageLifecycleStage
| Enum Values |
|---|
| DEPLOY |
| BUILD |
| RUNTIME |
22.3.7.27. StorageNetworkEntityInfoType
- INTERNAL_ENTITIES: INTERNAL_ENTITIES is for grouping all internal entities under a single network graph node
| Enum Values |
|---|
| UNKNOWN_TYPE |
| DEPLOYMENT |
| INTERNET |
| LISTEN_ENDPOINT |
| EXTERNAL_SOURCE |
| INTERNAL_ENTITIES |
22.3.7.28. StoragePolicy
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| id | String | ||||
| name | String | ||||
| description | String | ||||
| rationale | String | ||||
| remediation | String | ||||
| disabled | Boolean | ||||
| categories |
List of | ||||
| lifecycleStages | List of StorageLifecycleStage | ||||
| eventSource | NOT_APPLICABLE, DEPLOYMENT_EVENT, AUDIT_LOG_EVENT, | ||||
| exclusions | List of StorageExclusion | ||||
| scope | List of StorageScope | ||||
| severity | UNSET_SEVERITY, LOW_SEVERITY, MEDIUM_SEVERITY, HIGH_SEVERITY, CRITICAL_SEVERITY, | ||||
| enforcementActions | List of StorageEnforcementAction | FAIL_DEPLOYMENT_CREATE_ENFORCEMENT takes effect only if admission control webhook is configured to enforce on object creates/updates. FAIL_KUBE_REQUEST_ENFORCEMENT takes effect only if admission control webhook is enabled to listen on exec and port-forward events. FAIL_DEPLOYMENT_UPDATE_ENFORCEMENT takes effect only if admission control webhook is configured to enforce on object updates. | |||
| notifiers |
List of | ||||
| lastUpdated | Date | date-time | |||
| SORTName | String | For internal use only. | |||
| SORTLifecycleStage | String | For internal use only. | |||
| SORTEnforcement | Boolean | For internal use only. | |||
| policyVersion | String | ||||
| policySections | List of StoragePolicySection | ||||
| mitreAttackVectors | List of PolicyMitreAttackVectors | ||||
| criteriaLocked | Boolean | Read-only field. If true, the policy’s criteria fields are rendered read-only. | |||
| mitreVectorsLocked | Boolean | Read-only field. If true, the policy’s MITRE ATT&CK fields are rendered read-only. | |||
| isDefault | Boolean | Read-only field. Indicates the policy is a default policy if true and a custom policy if false. |
22.3.7.29. StoragePolicyGroup
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| fieldName | String | ||||
| booleanOperator | OR, AND, | ||||
| negate | Boolean | ||||
| values | List of StoragePolicyValue |
22.3.7.30. StoragePolicySection
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| sectionName | String | ||||
| policyGroups | List of StoragePolicyGroup |
22.3.7.31. StoragePolicyValue
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| value | String |
22.3.7.32. StorageProcessIndicator
Next available tag: 13| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| id | String | ||||
| deploymentId | String | ||||
| containerName | String | ||||
| podId | String | ||||
| podUid | String | ||||
| signal | |||||
| clusterId | String | ||||
| namespace | String | ||||
| containerStartTime | Date | date-time | |||
| imageId | String |
22.3.7.33. StorageProcessSignal
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| id | String | A unique UUID for identifying the message We have this here instead of at the top level because we want to have each message to be self contained. | |||
| containerId | String | ||||
| time | Date | date-time | |||
| name | String | ||||
| args | String | ||||
| execFilePath | String | ||||
| pid | Long | int64 | |||
| uid | Long | int64 | |||
| gid | Long | int64 | |||
| lineage |
List of | ||||
| scraped | Boolean | ||||
| lineageInfo | List of ProcessSignalLineageInfo |
22.3.7.34. StorageScope
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| cluster | String | ||||
| namespace | String | ||||
| label |
22.3.7.35. StorageScopeLabel
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| key | String | ||||
| value | String |
22.3.7.36. StorageSeverity
| Enum Values |
|---|
| UNSET_SEVERITY |
| LOW_SEVERITY |
| MEDIUM_SEVERITY |
| HIGH_SEVERITY |
| CRITICAL_SEVERITY |
22.3.7.37. StorageViolationState
| Enum Values |
|---|
| ACTIVE |
| SNOOZED |
| RESOLVED |
| ATTEMPTED |
22.3.7.38. V1DeployDetectionRemark
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| name | String | ||||
| permissionLevel | String | ||||
| appliedNetworkPolicies |
List of |
22.3.7.39. V1DeployDetectionResponse
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| runs | List of DeployDetectionResponseRun | ||||
| ignoredObjectRefs |
List of | The reference will be in the format: namespace/name[<group>/<version>, Kind=<kind>]. | |||
| remarks | List of V1DeployDetectionRemark |
22.3.7.40. V1DeployYAMLDetectionRequest
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| yaml | String | ||||
| noExternalMetadata | Boolean | ||||
| enforcementOnly | Boolean | ||||
| force | Boolean | ||||
| policyCategories |
List of | ||||
| cluster | String | Cluster to delegate scan to, may be the cluster’s name or ID. | |||
| namespace | String |
22.3.7.41. ViolationKeyValueAttrs
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| attrs | List of KeyValueAttrsKeyValueAttr |
22.3.7.42. ViolationNetworkFlowInfo
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
| protocol | L4_PROTOCOL_UNKNOWN, L4_PROTOCOL_TCP, L4_PROTOCOL_UDP, L4_PROTOCOL_ICMP, L4_PROTOCOL_RAW, L4_PROTOCOL_SCTP, L4_PROTOCOL_ANY, | ||||
| source | |||||
| destination |
'%20d='M201.5%20305.5c-13.8%200-24.9-11.1-24.9-24.6%200-13.8%2011.1-24.9%2024.9-24.9%2013.6%200%2024.6%2011.1%2024.6%2024.9%200%2013.6-11.1%2024.6-24.6%2024.6zM504%20256c0%20137-111%20248-248%20248S8%20393%208%20256%20119%208%20256%208s248%20111%20248%20248zm-132.3-41.2c-9.4%200-17.7%203.9-23.8%2010-22.4-15.5-52.6-25.5-86.1-26.6l17.4-78.3%2055.4%2012.5c0%2013.6%2011.1%2024.6%2024.6%2024.6%2013.8%200%2024.9-11.3%2024.9-24.9s-11.1-24.9-24.9-24.9c-9.7%200-18%205.8-22.1%2013.8l-61.2-13.6c-3-.8-6.1%201.4-6.9%204.4l-19.1%2086.4c-33.2%201.4-63.1%2011.3-85.5%2026.8-6.1-6.4-14.7-10.2-24.1-10.2-34.9%200-46.3%2046.9-14.4%2062.8-1.1%205-1.7%2010.2-1.7%2015.5%200%2052.6%2059.2%2095.2%20132%2095.2%2073.1%200%20132.3-42.6%20132.3-95.2%200-5.3-.6-10.8-1.9-15.8%2031.3-16%2019.8-62.5-14.9-62.5zM302.8%20331c-18.2%2018.2-76.1%2017.9-93.6%200-2.2-2.2-6.1-2.2-8.3%200-2.5%202.5-2.5%206.4%200%208.6%2022.8%2022.8%2087.3%2022.8%20110.2%200%202.5-2.2%202.5-6.1%200-8.6-2.2-2.2-6.1-2.2-8.3%200zm7.7-75c-13.6%200-24.6%2011.1-24.6%2024.9%200%2013.6%2011.1%2024.6%2024.6%2024.6%2013.8%200%2024.9-11.1%2024.9-24.6%200-13.8-11-24.9-24.9-24.9z'/%3e%3c/svg%3e){kind=small}