From 915c397d8b637db5c69098bbaf8554ba6859dfbf Mon Sep 17 00:00:00 2001 From: Ben Date: Wed, 7 Oct 2026 13:15:15 +0300 Subject: [PATCH] feat(kdr): add actor fields to RuntimeIncidentIngesterOnFinishedMessage Carry the Kubernetes user (name and groups) of admission incidents such as exec to pod, so notification channels (Slack, Teams, etc.) can show who triggered the incident. Signed-off-by: Ben --- pulsar/common/kdr/datastructures.go | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/pulsar/common/kdr/datastructures.go b/pulsar/common/kdr/datastructures.go index 36f110c..f691348 100644 --- a/pulsar/common/kdr/datastructures.go +++ b/pulsar/common/kdr/datastructures.go @@ -23,6 +23,10 @@ type RuntimeIncidentIngesterOnFinishedMessage struct { Response *RuntimeIncidentResponse `json:"response,omitempty"` PolicyGUIDToName map[string]string `json:"policyGUIDToName"` Classification string `json:"classification,omitempty"` + // UserName and UserGroups identify the Kubernetes user behind the incident + // (admission alerts only, e.g. exec to pod) + UserName string `json:"userName,omitempty"` + UserGroups []string `json:"userGroups,omitempty"` } type RuntimeIncidentResponse struct {