pkg/upgradereadiness/types.go
Rama main · réplica de lectura del repositorio original.
package upgradereadiness
import (
appsv1 "k8s.io/api/apps/v1"
batchv1 "k8s.io/api/batch/v1"
corev1 "k8s.io/api/core/v1"
discoveryv1 "k8s.io/api/discovery/v1"
policyv1 "k8s.io/api/policy/v1"
storagev1 "k8s.io/api/storage/v1"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
)
type APIMetricsFailure string
const (
APIMetricsForbidden APIMetricsFailure = "forbidden"
APIMetricsTooLarge APIMetricsFailure = "too_large"
APIMetricsUnreadable APIMetricsFailure = "unreadable"
APIMetricsResponseLimit = 256 << 20
APIMetricsLineLimit = 64 << 10
)
type Verdict string
const (
VerdictBlocked Verdict = "blocked"
VerdictWarning Verdict = "warning"
VerdictReview Verdict = "review"
VerdictNoKnownBlockers Verdict = "no_known_blockers"
VerdictUnknown Verdict = "unknown"
)
type CheckStatus string
const (
CheckPassed CheckStatus = "passed"
CheckBlocked CheckStatus = "blocked"
CheckWarning CheckStatus = "warning"
CheckReview CheckStatus = "review"
CheckUnknown CheckStatus = "unknown"
CheckNotApplicable CheckStatus = "not_applicable"
)
type Level string
const (
LevelBlocker Level = "blocker"
LevelWarning Level = "warning"
LevelReview Level = "review"
)
type Input struct {
// Namespaces is nil for a cluster-wide scan and populated when live
// namespaced evidence was filtered by an RBAC or configured cache ceiling.
Namespaces []string
// CacheScopedKinds records informer kinds whose cached live evidence covers
// only the listed namespaces. It is separate from Namespaces because mixed
// per-kind RBAC scopes cannot be represented by one global filter.
CacheScopedKinds map[string][]string
Pods []*corev1.Pod
Deployments []*appsv1.Deployment
ReplicaSets []*appsv1.ReplicaSet
StatefulSets []*appsv1.StatefulSet
DaemonSets []*appsv1.DaemonSet
Jobs []*batchv1.Job
CronJobs []*batchv1.CronJob
Services []*corev1.Service
ConfigMaps []*corev1.ConfigMap
// WebhookServices contains the explicitly collected Service backends
// referenced by admission and CRD conversion webhooks. It must not be
// inferred from Services, whose informer may have a different RBAC scope.
WebhookServices []*corev1.Service
PersistentVolumeClaims []*corev1.PersistentVolumeClaim
PersistentVolumes []*corev1.PersistentVolume
Nodes []*corev1.Node
Events []*corev1.Event
PodDisruptionBudgets []*policyv1.PodDisruptionBudget
EndpointSlices []*discoveryv1.EndpointSlice
CSIDrivers []*storagev1.CSIDriver
SchedulingV1Alpha2Objects []*unstructured.Unstructured
SchedulingV1Alpha2Installed bool
SchedulingV1Alpha2DiscoveryAvailable bool
SchedulingV1Alpha2UnavailableKinds []string
// AdmissionWebhookConfigurations, CustomResourceDefinitions, and
// APIServices are nil
// when their cluster-scoped sources could not be read. Empty, non-nil
// slices mean the sources were inspected and contained no objects.
AdmissionWebhookConfigurations []*unstructured.Unstructured
// AdmissionWebhookUnavailableKinds records configuration
// kinds that could not be listed while preserving evidence from readable
// kinds.
AdmissionWebhookUnavailableKinds []string
// AdmissionWebhookDeniedKinds is the subset of unavailable webhook
// configuration kinds whose list request was denied.
AdmissionWebhookDeniedKinds []string
CustomResourceDefinitions []*unstructured.Unstructured
APIServices []*unstructured.Unstructured
// NodeProxyForbidden records that authorization or an observed request
// denied access to kubelet metrics or effective configuration.
NodeProxyForbidden bool
// NodeRuntimeEvidence is nil when kubelet metrics and configuration could not be inspected.
NodeRuntimeEvidence []NodeRuntimeEvidence
// SourceObjects are live typed objects whose kubectl last-applied annotation
// can preserve the apiVersion originally submitted to the API server.
SourceObjects []metav1.Object
// SourceObjectUnavailableKinds records direct source-object list failures.
// Successful kinds remain usable while checks expose the coverage gap.
SourceObjectUnavailableKinds []string
// ManifestResources come from rendered Helm release manifests. Unlike live
// objects, they preserve the apiVersion that a future reconcile will submit.
ManifestResources []ManifestResource
// HelmUnavailableNamespaces names namespaces whose stored release
// manifests could not be read while other namespaces were inspected.
HelmUnavailableNamespaces []string
// HelmScopedNamespaces records a Secret-RBAC ceiling narrower than the
// workload scan scope.
HelmScopedNamespaces []string
ManifestParseErrors int
// DeprecatedAPIRequests is nil when /metrics could not be read. An empty,
// non-nil slice means the sampled API server process had no active series.
DeprecatedAPIRequests []DeprecatedAPIRequest
// DeprecatedAPIMetricsWindow is the observed API server process lifetime,
// formatted for display by the collector that read the metrics endpoint.
DeprecatedAPIMetricsWindow string
DeprecatedAPIMetricsFailure APIMetricsFailure
// PrometheusRules is nil when the CRD exists but Radar could not inspect it.
// An empty slice with PrometheusRulesInstalled=false means not applicable.
PrometheusRules []*unstructured.Unstructured
PrometheusRulesInstalled bool
PrometheusRulesDiscoveryAvailable bool
PrometheusRuleUnavailableNamespaces []string
Platform string
}
type ManifestResource struct {
APIVersion string
Kind string
Namespace string
Name string
Source string
SourceNamespace string
SourceName string
Object *unstructured.Unstructured
}
// NodeRuntimeEvidence preserves upgrade-related kubelet metrics and effective
// configuration sampled from one node. Availability is distinct from zero values.
type NodeRuntimeEvidence struct {
NodeName string
MetricsAvailable bool
CgroupVersion int
CgroupVersionAvailable bool
CRILosingSupportVersion string
CRILosingSupportAvailable bool
ConfigAvailable bool
EventRecordQPS int32
EventRecordQPSAvailable bool
FeatureGates map[string]bool
SELinuxMismatchWarnings float64
SELinuxMismatchErrors float64
}
type DeprecatedAPIRequest struct {
Group string
Version string
Resource string
Subresource string
RemovedRelease string
Requests float64
}
type ResourceRef struct {
Group string `json:"group,omitempty"`
Kind string `json:"kind"`
Namespace string `json:"namespace"`
Name string `json:"name"`
}
type Evidence struct {
Source string `json:"source"`
Path string `json:"path"`
Detail string `json:"detail,omitempty"`
}
type Reference struct {
Title string `json:"title"`
URL string `json:"url"`
}
type Finding struct {
RuleID string `json:"ruleID"`
Title string `json:"title"`
Level Level `json:"level"`
Resource *ResourceRef `json:"resource,omitempty"`
ManagedBy *ResourceRef `json:"managedBy,omitempty"`
Evidence Evidence `json:"evidence"`
AppliesFrom string `json:"appliesFrom,omitempty"`
Impact string `json:"impact"`
Remediation string `json:"remediation"`
References []Reference `json:"references"`
}
type Check struct {
ID string `json:"id"`
Category string `json:"category"`
Title string `json:"title"`
Status CheckStatus `json:"status"`
Summary string `json:"summary"`
EvidenceNote string `json:"evidenceNote,omitempty"`
Caveat string `json:"caveat,omitempty"`
Scope string `json:"scope"`
Inspected int `json:"inspected,omitempty"`
AppliesFrom string `json:"appliesFrom,omitempty"`
Findings []Finding `json:"findings"`
References []Reference `json:"references,omitempty"`
}
type Summary struct {
Blocked int `json:"blocked"`
Warnings int `json:"warnings"`
Reviews int `json:"reviews"`
Passed int `json:"passed"`
Unknown int `json:"unknown"`
NotApplicable int `json:"notApplicable"`
Findings int `json:"findings"`
}
type Coverage struct {
Source string `json:"source"`
State string `json:"state"`
UnavailableKinds []string `json:"unavailableKinds,omitempty"`
ScopedNamespaces []string `json:"scopedNamespaces,omitempty"`
ScopedKinds map[string][]string `json:"scopedKinds,omitempty"`
}
type ScanResults struct {
CurrentVersion string `json:"currentVersion"`
TargetVersion string `json:"targetVersion"`
ReviewedThrough string `json:"reviewedThrough"`
Verdict Verdict `json:"verdict"`
Summary Summary `json:"summary"`
Checks []Check `json:"checks"`
Coverage Coverage `json:"coverage"`
}