-
Notifications
You must be signed in to change notification settings - Fork 2.3k
/
continuous_validation_logging.proto
182 lines (141 loc) · 5.46 KB
/
continuous_validation_logging.proto
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
// Copyright 2024 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
syntax = "proto3";
package google.cloud.binaryauthorization.v1beta1;
import "google/protobuf/timestamp.proto";
option cc_enable_arenas = true;
option csharp_namespace = "Google.Cloud.BinaryAuthorization.V1Beta1";
option go_package = "cloud.google.com/go/binaryauthorization/apiv1beta1/binaryauthorizationpb;binaryauthorizationpb";
option java_multiple_files = true;
option java_outer_classname = "ContinuousValidationLoggingProto";
option java_package = "com.google.cloud.binaryauthorization.v1beta1";
option php_namespace = "Google\\Cloud\\BinaryAuthorization\\V1beta1";
option ruby_package = "Google::Cloud::BinaryAuthorization::V1beta1";
// Represents an auditing event from Continuous Validation.
message ContinuousValidationEvent {
// An auditing event for one Pod.
message ContinuousValidationPodEvent {
// Audit time policy conformance verdict.
enum PolicyConformanceVerdict {
// We should always have a verdict. This is an error.
POLICY_CONFORMANCE_VERDICT_UNSPECIFIED = 0;
// The pod violates the policy.
VIOLATES_POLICY = 1;
}
// Container image with auditing details.
message ImageDetails {
// The container type.
enum ContainerType {
// The container type should always be specified. This is an error.
CONTAINER_TYPE_UNSPECIFIED = 0;
// A regular deployment.
CONTAINER = 1;
// Init container defined as specified at
// https://kubernetes.io/docs/concepts/workloads/pods/init-containers/
INIT_CONTAINER = 2;
// Ephemeral container defined as specified at
// https://kubernetes.io/docs/concepts/workloads/pods/ephemeral-containers/
EPHEMERAL_CONTAINER = 3;
}
// Result of the audit.
enum AuditResult {
// Unspecified result. This is an error.
AUDIT_RESULT_UNSPECIFIED = 0;
// Image is allowed.
ALLOW = 1;
// Image is denied.
DENY = 2;
}
message CheckResult {
// A scope specifier for check sets.
message CheckSetScope {
oneof scope {
// Matches a single Kubernetes service account, e.g.
// 'my-namespace:my-service-account'.
// `kubernetes_service_account` scope is always more specific than
// `kubernetes_namespace` scope for the same namespace.
string kubernetes_service_account = 1;
// Matches all Kubernetes service accounts in the provided
// namespace, unless a more specific `kubernetes_service_account`
// scope already matched.
string kubernetes_namespace = 2;
}
}
// Result of evaluating one check.
enum CheckVerdict {
// We should always have a verdict. This is an error.
CHECK_VERDICT_UNSPECIFIED = 0;
// The check was successfully evaluated and the image did not satisfy
// the check.
NON_CONFORMANT = 1;
}
// The index of the check set.
string check_set_index = 1;
// The name of the check set.
string check_set_name = 2;
// The scope of the check set.
CheckSetScope check_set_scope = 3;
// The index of the check.
string check_index = 4;
// The name of the check.
string check_name = 5;
// The type of the check.
string check_type = 6;
// The verdict of this check.
CheckVerdict verdict = 7;
// User-friendly explanation of this check result.
string explanation = 8;
}
// The name of the image.
string image = 1;
// The name of the container.
string container_name = 5;
// The container type that this image belongs to.
ContainerType container_type = 6;
// The result of the audit for this image.
AuditResult result = 2;
// Description of the above result.
string description = 3;
// List of check results.
repeated CheckResult check_results = 4;
}
// The k8s namespace of the Pod.
string pod_namespace = 7;
// The name of the Pod.
string pod = 1;
// The name of the policy.
string policy_name = 8;
// Deploy time of the Pod from k8s.
google.protobuf.Timestamp deploy_time = 2;
// Termination time of the Pod from k8s, or nothing if still running.
google.protobuf.Timestamp end_time = 3;
// Auditing verdict for this Pod.
PolicyConformanceVerdict verdict = 4;
// List of images with auditing details.
repeated ImageDetails images = 5;
}
// An event describing a user-actionable configuration issue that prevents CV
// from auditing.
message ConfigErrorEvent {
// A description of the issue.
string description = 1;
}
// Type of CV event.
oneof event_type {
// Pod event.
ContinuousValidationPodEvent pod_event = 1;
// Config error event.
ConfigErrorEvent config_error_event = 4;
}
}