From a04ff7b1488edbf151657c3f469d515210fe07bd Mon Sep 17 00:00:00 2001 From: Entlein Date: Mon, 27 Jul 2026 19:09:40 +0200 Subject: [PATCH 01/17] feat(user-managed): merge ug- ContainerProfile overlay; deprecate AP/NN merge Migrate the server-side user-managed overlay merge (buildMergedProfile) from the legacy ug- ApplicationProfile + NetworkNeighborhood pair to a single ug- ContainerProfile via a new mergeUserCPIntoCP (flat single-container union that mirrors the node-agent client-side merge). Provenance now stamps the ug- CP source key/RV. The AP/NN merge helpers and their provenance keys are marked deprecated. The AP/NN CRD *types* are deliberately left untouched so this change carries no generated-code (openapi/protobuf/deepcopy) impact; the type-level deprecation and the full x86 codegen regeneration belong to the eventual CRD-removal change. Tests migrated to feed a ug- ContainerProfile with equivalent merge assertions. Signed-off-by: entlein --- .../file/containerprofile_user_managed.go | 190 ++++++---- .../containerprofile_user_managed_test.go | 348 +++++++++--------- 2 files changed, 282 insertions(+), 256 deletions(-) diff --git a/pkg/registry/file/containerprofile_user_managed.go b/pkg/registry/file/containerprofile_user_managed.go index 5387aaf94..3b162bb40 100644 --- a/pkg/registry/file/containerprofile_user_managed.go +++ b/pkg/registry/file/containerprofile_user_managed.go @@ -29,16 +29,22 @@ const ( MergedProfileLabelKey = "kubescape.io/profile-kind" MergedProfileLabelValue = "merged" - // mergedSourceUserAPKey / mergedSourceUserNNKey record the storage keys of - // the ug- AP / NN that contributed to this merge. Absent annotation means - // no ug- of that kind was present at merge time. + // mergedSourceUserCPKey records the storage key of the ug- ContainerProfile + // that contributed to this merge. Absent annotation means no ug- CP was + // present at merge time. + mergedSourceUserCPKey = "kubescape.io/merged-source-ug-cp" + + // Deprecated: the ug- overlay is now a single ContainerProfile; use + // mergedSourceUserCPKey. mergedSourceUserAPKey / mergedSourceUserNNKey recorded + // the storage keys of the ug- AP / NN that contributed to the merge under the + // legacy AP+NN overlay model. Retained for backward-compatibility views. mergedSourceUserAPKey = "kubescape.io/merged-source-ug-ap" mergedSourceUserNNKey = "kubescape.io/merged-source-ug-nn" - // mergedSourceUserAPRVKey / mergedSourceUserNNRVKey / mergedSourceObservedRVKey - // snapshot the ResourceVersions of each input. They give matthyx a quick - // signal when debugging "is this merged stale vs the live ug- / observed?" - // without re-reading the source objects. + // mergedSourceUserCPRVKey / mergedSourceObservedRVKey snapshot the + // ResourceVersions of each input. They give a quick signal when debugging + // "is this merged stale vs the live ug- / observed?" without re-reading the + // source objects. // // These RVs are deliberately content-derived (they only change when an input // actually changes), so re-merging unchanged inputs reproduces the exact same @@ -47,8 +53,14 @@ const ( // GuaranteedUpdate no-op short-circuit and churning the merged CP's // ResourceVersion (and firing spurious watch events) every consolidation tick // even when nothing changed (kubescape/storage#315 review). - mergedSourceUserAPRVKey = "kubescape.io/merged-source-ug-ap-rv" - mergedSourceUserNNRVKey = "kubescape.io/merged-source-ug-nn-rv" + mergedSourceUserCPRVKey = "kubescape.io/merged-source-ug-cp-rv" + + // Deprecated: use mergedSourceUserCPRVKey. mergedSourceUserAPRVKey / + // mergedSourceUserNNRVKey snapshotted the ResourceVersions of the legacy ug- + // AP / NN inputs. Retained for backward-compatibility views. + mergedSourceUserAPRVKey = "kubescape.io/merged-source-ug-ap-rv" + mergedSourceUserNNRVKey = "kubescape.io/merged-source-ug-nn-rv" + mergedSourceObservedRVKey = "kubescape.io/merged-source-observed-rv" ) @@ -58,24 +70,24 @@ const ( var userManagedConnWarnOnce sync.Once // buildMergedProfile builds the effective ContainerProfile from observed plus -// the user-managed (ug-) ApplicationProfile / NetworkNeighborhood overlay. +// the user-managed (ug-) ContainerProfile overlay. // // Returns (merged, hasOverlay, err): -// - merged: a fresh DeepCopy of observed with ug- AP/NN merged in, stamped -// with provenance metadata. Never aliases observed. -// - hasOverlay: true if at least one of ug-AP or ug-NN matched the workload -// and contributed a container entry. When false, the caller treats the -// merged artifact as absent and should delete any prior merged on disk so -// ug- removals retract cleanly (kubescape/storage#315 review). -// - err: only returned for unexpected storage errors. NotFound on ug- objects -// is normal (most workloads have no exception) and produces hasOverlay=false -// with no error. +// - merged: a fresh DeepCopy of observed with the ug- ContainerProfile merged +// in, stamped with provenance metadata. Never aliases observed. +// - hasOverlay: true if a ug- ContainerProfile matched the workload and was +// merged in. When false, the caller treats the merged artifact as absent and +// should delete any prior merged on disk so ug- removals retract cleanly +// (kubescape/storage#315 review). +// - err: only returned for unexpected storage errors. NotFound on the ug- +// object is normal (most workloads have no exception) and produces +// hasOverlay=false with no error. // -// The merge is a pure function of (observed, ug-AP, ug-NN). Re-running it with -// the same inputs produces the same output, so idempotency is structural — no -// per-tick RV markers are needed on observed (the previous PR design carried -// kubescape.io/last-merged-ug-{ap,nn}-rv on observed, which had to be -// reconciled with retractions; rebuilding from scratch sidesteps the problem). +// The merge is a pure function of (observed, ug-CP). Re-running it with the same +// inputs produces the same output, so idempotency is structural — no per-tick RV +// markers are needed on observed (the previous PR design carried +// kubescape.io/last-merged-ug-*-rv on observed, which had to be reconciled with +// retractions; rebuilding from scratch sidesteps the problem). func (a *ContainerProfileProcessor) buildMergedProfile(ctx context.Context, observed *softwarecomposition.ContainerProfile, id armotypes.ProfileIdentifier) (*softwarecomposition.ContainerProfile, bool, error) { instanceIDStr, ok := observed.Annotations[helpers.InstanceIDMetadataKey] if !ok { @@ -101,54 +113,33 @@ func (a *ContainerProfileProcessor) buildMergedProfile(ctx context.Context, obse return nil, false, nil } - apID := id - apID.Name = helpers.UserApplicationProfilePrefix + workloadSlug - apKey := BuildContainerProfileKey(apID, "applicationprofiles") - nnID := id - nnID.Name = helpers.UserNetworkNeighborhoodPrefix + workloadSlug - nnKey := BuildContainerProfileKey(nnID, "networkneighborhoods") + // The ug- overlay is a single ContainerProfile keyed by the shared "ug-" + // prefix. A ContainerProfile spec is already flat/single-container, so there + // is no per-container lookup. + cpID := id + cpID.Name = helpers.UserApplicationProfilePrefix + workloadSlug + cpKey := BuildContainerProfileKey(cpID, "containerprofiles") // Start from a fresh copy of observed so the in-place merge cannot bleed // back into the caller's pointer or onto the canonical CP. merged := observed.DeepCopy() hasOverlay := false - apCtx, apCancel := context.WithTimeout(ctx, 5*time.Second) - defer apCancel() - var userAP softwarecomposition.ApplicationProfile - apPresent := false - if err := storageImpl.GetWithConn(apCtx, conn, apKey, storage.GetOptions{}, &userAP); err != nil { - if !storage.IsNotFound(err) { - logger.L().Debug("ContainerProfileProcessor.buildMergedProfile - failed to get user-managed AP", loggerhelpers.Error(err), loggerhelpers.String("key", apKey)) - } - } else { - apPresent = true - if findUserAPContainerByName(&userAP, containerName) != nil { - mergeUserAPIntoCP(merged, &userAP, containerName) - hasOverlay = true - } - } - - nnCtx, nnCancel := context.WithTimeout(ctx, 5*time.Second) - defer nnCancel() - var userNN softwarecomposition.NetworkNeighborhood - nnPresent := false - if err := storageImpl.GetWithConn(nnCtx, conn, nnKey, storage.GetOptions{}, &userNN); err != nil { + cpCtx, cpCancel := context.WithTimeout(ctx, 5*time.Second) + defer cpCancel() + var userCP softwarecomposition.ContainerProfile + cpPresent := false + if err := storageImpl.GetWithConn(cpCtx, conn, cpKey, storage.GetOptions{}, &userCP); err != nil { if !storage.IsNotFound(err) { - logger.L().Debug("ContainerProfileProcessor.buildMergedProfile - failed to get user-managed NN", loggerhelpers.Error(err), loggerhelpers.String("key", nnKey)) + logger.L().Debug("ContainerProfileProcessor.buildMergedProfile - failed to get user-managed CP", loggerhelpers.Error(err), loggerhelpers.String("key", cpKey)) } } else { - nnPresent = true - // NN's pod LabelSelector merges at the workload level even when no - // matching container is found — preserve that behavior so a - // container-name typo in the ug- still propagates the selector. - mergeUserNNIntoCP(merged, &userNN, containerName) - if findUserNNContainerByName(&userNN, containerName) != nil { - hasOverlay = true - } + cpPresent = true + mergeUserCPIntoCP(merged, &userCP) + hasOverlay = true } - if !hasOverlay && !apPresent && !nnPresent { + if !cpPresent { // No ug- input at all: caller should delete any stale merged artifact. return nil, false, nil } @@ -161,24 +152,10 @@ func (a *ContainerProfileProcessor) buildMergedProfile(ctx context.Context, obse if merged.Annotations == nil { merged.Annotations = map[string]string{} } - if apPresent { - merged.Annotations[mergedSourceUserAPKey] = apKey - merged.Annotations[mergedSourceUserAPRVKey] = userAP.ResourceVersion - } - if nnPresent { - merged.Annotations[mergedSourceUserNNKey] = nnKey - merged.Annotations[mergedSourceUserNNRVKey] = userNN.ResourceVersion - } + merged.Annotations[mergedSourceUserCPKey] = cpKey + merged.Annotations[mergedSourceUserCPRVKey] = userCP.ResourceVersion merged.Annotations[mergedSourceObservedRVKey] = observed.ResourceVersion - // If neither ug- contributed a container entry but at least one ug- exists - // (e.g. NN selector merged but no container matched, or ug-AP present with - // no matching container), still treat as "has overlay" so the merged - // artifact reflects the selector/presence. hasOverlay is true if any - // container-level merge fired; otherwise we fall back here: - if !hasOverlay { - hasOverlay = apPresent || nnPresent - } return merged, hasOverlay, nil } @@ -207,6 +184,56 @@ func (a *ContainerProfileProcessor) userManagedConn(ctx context.Context) (*Stora return impl.GetStorageImpl(), conn, true } +// mergeUserCPIntoCP unions userCP.Spec into cp.Spec. It is the single-object +// successor to the legacy mergeUserAPIntoCP + mergeUserNNIntoCP overlay: a +// ContainerProfile spec is already flat/single-container, so there is no +// per-container lookup. +// +// Field semantics mirror the legacy helpers: Capabilities / Execs / Opens / +// Syscalls / Endpoints are appended; Ingress / Egress are unioned by Identifier +// via mergeUserNetworkNeighbors (matching entries deep-merged); PolicyByRuleId +// entries are merged via mergePolicies on collision; and the embedded +// LabelSelector is field-merged (MatchLabels via overrideMerge with user keys +// winning, MatchExpressions via appendDedupSortedMatchExpressions). +// +// IdentifiedCallStacks is intentionally NOT merged — node-agent's projection.go +// (the reference implementation) does not project them either, so server- and +// client-side merges stay in sync. +func mergeUserCPIntoCP(cp *softwarecomposition.ContainerProfile, userCP *softwarecomposition.ContainerProfile) { + if userCP == nil { + return + } + // Defensive copy: userCP's slices/maps alias the caller's cached CRD object. + // DeepCopy isolates the merge from concurrent reads of that object. + u := userCP.DeepCopy() + + cp.Spec.Capabilities = append(cp.Spec.Capabilities, u.Spec.Capabilities...) + cp.Spec.Execs = append(cp.Spec.Execs, u.Spec.Execs...) + cp.Spec.Opens = append(cp.Spec.Opens, u.Spec.Opens...) + cp.Spec.Syscalls = append(cp.Spec.Syscalls, u.Spec.Syscalls...) + cp.Spec.Endpoints = append(cp.Spec.Endpoints, u.Spec.Endpoints...) + + if cp.Spec.PolicyByRuleId == nil && len(u.Spec.PolicyByRuleId) > 0 { + cp.Spec.PolicyByRuleId = make(map[string]softwarecomposition.RulePolicy, len(u.Spec.PolicyByRuleId)) + } + for k, v := range u.Spec.PolicyByRuleId { + if existing, ok := cp.Spec.PolicyByRuleId[k]; ok { + cp.Spec.PolicyByRuleId[k] = mergePolicies(existing, v) + } else { + cp.Spec.PolicyByRuleId[k] = v + } + } + + cp.Spec.Ingress = mergeUserNetworkNeighbors(cp.Spec.Ingress, u.Spec.Ingress) + cp.Spec.Egress = mergeUserNetworkNeighbors(cp.Spec.Egress, u.Spec.Egress) + + cp.Spec.LabelSelector.MatchLabels = overrideMerge(cp.Spec.LabelSelector.MatchLabels, u.Spec.LabelSelector.MatchLabels) + cp.Spec.LabelSelector.MatchExpressions = appendDedupSortedMatchExpressions(cp.Spec.LabelSelector.MatchExpressions, u.Spec.LabelSelector.MatchExpressions) +} + +// Deprecated: superseded by mergeUserCPIntoCP; the ug- overlay is now a single +// ContainerProfile. Retained for backward-compatibility views and tests. +// // mergeUserAPIntoCP locates the ApplicationProfileContainer in userAP whose // Name matches containerName and appends its fields onto cp.Spec. PolicyByRuleId // entries are merged via mergePolicies on collision (same union semantics as @@ -241,6 +268,9 @@ func mergeUserAPIntoCP(cp *softwarecomposition.ContainerProfile, userAP *softwar } } +// Deprecated: superseded by mergeUserCPIntoCP; the ug- overlay is now a single +// ContainerProfile. Retained for backward-compatibility views and tests. +// // mergeUserNNIntoCP merges the matching NetworkNeighborhoodContainer's // Ingress/Egress and the NN's pod LabelSelector into cp.Spec. Ingress/Egress // entries are unioned by Identifier; matching entries are deep-merged via @@ -340,6 +370,9 @@ func joinSorted(vs []string) string { return b.String() } +// Deprecated: superseded by mergeUserCPIntoCP; the ug- overlay is now a single +// ContainerProfile with no per-container lookup. Retained for the deprecated +// AP/NN merge helpers and their tests. func findUserAPContainerByName(userAP *softwarecomposition.ApplicationProfile, name string) *softwarecomposition.ApplicationProfileContainer { if userAP == nil { return nil @@ -362,6 +395,9 @@ func findUserAPContainerByName(userAP *softwarecomposition.ApplicationProfile, n return nil } +// Deprecated: superseded by mergeUserCPIntoCP; the ug- overlay is now a single +// ContainerProfile with no per-container lookup. Retained for the deprecated +// AP/NN merge helpers and their tests. func findUserNNContainerByName(userNN *softwarecomposition.NetworkNeighborhood, name string) *softwarecomposition.NetworkNeighborhoodContainer { if userNN == nil { return nil diff --git a/pkg/registry/file/containerprofile_user_managed_test.go b/pkg/registry/file/containerprofile_user_managed_test.go index 7298dcbe5..828b205f1 100644 --- a/pkg/registry/file/containerprofile_user_managed_test.go +++ b/pkg/registry/file/containerprofile_user_managed_test.go @@ -247,6 +247,16 @@ func e2eUgNNKey() string { }, "networkneighborhoods") } +// e2eUgCPKey is the key of the single user-managed (ug-) ContainerProfile +// overlay for the e2e workload. buildMergedProfile fetches this object under the +// "containerprofiles" kind, keyed by the shared "ug-" prefix + workload slug. +func e2eUgCPKey() string { + return BuildContainerProfileKey(armotypes.ProfileIdentifier{ + ProfileScope: armotypes.ProfileScope{HostType: armotypes.HostTypeKubernetes, Namespace: e2eNS}, + Name: e2eWorkloadUg, + }, "containerprofiles") +} + func e2eCPKey() string { return BuildContainerProfileKey(armotypes.ProfileIdentifier{ ProfileScope: armotypes.ProfileScope{HostType: armotypes.HostTypeKubernetes, Namespace: e2eNS}, @@ -382,6 +392,27 @@ func (h *e2eHarness) replaceUserAP(spec softwarecomposition.ApplicationProfileSp false, nil, tryUpdate, nil, "")) } +// replaceUserCP swaps the spec of an existing ug- ContainerProfile via +// GuaranteedUpdate so the versioner bumps the object's ResourceVersion (the CP +// analogue of replaceUserAP). This mirrors how a kube-apiserver-driven update +// lands in storage; a fresh Create after Delete would reset RV to 1, defeating +// the RV-marker assertions. +func (h *e2eHarness) replaceUserCP(spec softwarecomposition.ContainerProfileSpec) { + h.t.Helper() + prev := h.s.processor + h.s.processor = DefaultProcessor{} + defer func() { h.s.processor = prev }() + + tryUpdate := func(input runtime.Object, _ storage.ResponseMeta) (runtime.Object, *uint64, error) { + out := input.DeepCopyObject().(*softwarecomposition.ContainerProfile) + out.Spec = spec + return out, nil, nil + } + require.NoError(h.t, h.s.GuaranteedUpdateWithConn( + h.ctx, h.conn, e2eUgCPKey(), &softwarecomposition.ContainerProfile{}, + false, nil, tryUpdate, nil, "")) +} + func (h *e2eHarness) consolidate() { h.t.Helper() require.NoError(h.t, h.processor.ConsolidateTimeSeries(h.ctx)) @@ -460,26 +491,25 @@ func count(s []string, v string) int { return n } -// TestConsolidateMergesUserManagedAP exercises the full consolidation flow -// with a ug- ApplicationProfile pre-seeded into storage. -func TestConsolidateMergesUserManagedAP(t *testing.T) { +// TestConsolidateMergesUserManagedCP exercises the full consolidation flow +// with a single ug- ContainerProfile pre-seeded into storage. +func TestConsolidateMergesUserManagedCP(t *testing.T) { h := newE2EHarness(t) defer h.close() h.createCP("testdata/p1.json") - userAP := &softwarecomposition.ApplicationProfile{ + userCP := &softwarecomposition.ContainerProfile{ ObjectMeta: metav1.ObjectMeta{ Namespace: e2eNS, Name: e2eWorkloadUg, Annotations: map[string]string{helpersv1.ManagedByMetadataKey: helpersv1.ManagedByUserValue}, }, - Spec: softwarecomposition.ApplicationProfileSpec{ - Containers: []softwarecomposition.ApplicationProfileContainer{ - {Name: "coredns", Capabilities: []string{"USER_MANAGED_CAP"}, Syscalls: []string{"user_managed_syscall"}}, - }, + Spec: softwarecomposition.ContainerProfileSpec{ + Capabilities: []string{"USER_MANAGED_CAP"}, + Syscalls: []string{"user_managed_syscall"}, }, } - h.seedNonCP(e2eUgAPKey(), userAP) + h.seedNonCP(e2eUgCPKey(), userCP) h.consolidate() @@ -495,41 +525,36 @@ func TestConsolidateMergesUserManagedAP(t *testing.T) { assert.Contains(t, merged.Spec.Syscalls, "user_managed_syscall") assert.Equal(t, 1, count(merged.Spec.Capabilities, "USER_MANAGED_CAP")) assert.Equal(t, MergedProfileLabelValue, merged.Labels[MergedProfileLabelKey]) - assert.NotEmpty(t, merged.Annotations[mergedSourceUserAPKey]) + assert.NotEmpty(t, merged.Annotations[mergedSourceUserCPKey]) } -// TestConsolidateMergesUserManagedNN verifies a ug- -// NetworkNeighborhood is also merged into the consolidated CP, including -// container Ingress/Egress and the workload-level pod LabelSelector. -func TestConsolidateMergesUserManagedNN(t *testing.T) { +// TestConsolidateMergesUserManagedCPNetwork verifies a ug- +// ContainerProfile's network fields are merged into the consolidated CP, +// including Egress neighbors and the workload-level pod LabelSelector. +func TestConsolidateMergesUserManagedCPNetwork(t *testing.T) { h := newE2EHarness(t) defer h.close() h.createCP("testdata/p1.json") port443 := int32(443) - userNN := &softwarecomposition.NetworkNeighborhood{ + userCP := &softwarecomposition.ContainerProfile{ ObjectMeta: metav1.ObjectMeta{ Namespace: e2eNS, Name: e2eWorkloadUg, Annotations: map[string]string{helpersv1.ManagedByMetadataKey: helpersv1.ManagedByUserValue}, }, - Spec: softwarecomposition.NetworkNeighborhoodSpec{ + Spec: softwarecomposition.ContainerProfileSpec{ LabelSelector: metav1.LabelSelector{MatchLabels: map[string]string{"user-tier": "edge"}}, - Containers: []softwarecomposition.NetworkNeighborhoodContainer{ + Egress: []softwarecomposition.NetworkNeighbor{ { - Name: "coredns", - Egress: []softwarecomposition.NetworkNeighbor{ - { - Identifier: "user-egress-1", - DNSNames: []string{"user.example"}, - Ports: []softwarecomposition.NetworkPort{{Name: "tcp-443", Port: &port443}}, - }, - }, + Identifier: "user-egress-1", + DNSNames: []string{"user.example"}, + Ports: []softwarecomposition.NetworkPort{{Name: "tcp-443", Port: &port443}}, }, }, }, } - h.seedNonCP(e2eUgNNKey(), userNN) + h.seedNonCP(e2eUgCPKey(), userCP) h.consolidate() cp := h.requireMerged() @@ -544,13 +569,13 @@ func TestConsolidateMergesUserManagedNN(t *testing.T) { } assert.True(t, found, "expected user-managed egress neighbor in merged CP") assert.Equal(t, "edge", cp.Spec.LabelSelector.MatchLabels["user-tier"]) - assert.NotEmpty(t, cp.Annotations[mergedSourceUserNNKey]) + assert.NotEmpty(t, cp.Annotations[mergedSourceUserCPKey]) } // TestConsolidateUserManagedIdempotent verifies that re-merging unchanged // inputs does NOT rewrite the merged CP, while a real change does. // -// The merged CP is rebuilt from (observed, ug-AP, ug-NN) every tick. Because it +// The merged CP is rebuilt from (observed, ug-CP) every tick. Because it // is a DeepCopy of the observed CP it used to carry observed's ResourceVersion + // SyncChecksum (and a wall-clock "merged-at" annotation), so GuaranteedUpdate's // "same serialized contents" short-circuit never fired and the merged CP — plus @@ -571,15 +596,13 @@ func TestConsolidateUserManagedIdempotent(t *testing.T) { h.processor.DeleteThreshold = time.Second h.createCP("testdata/p1.json") - userAP := &softwarecomposition.ApplicationProfile{ + userCP := &softwarecomposition.ContainerProfile{ ObjectMeta: metav1.ObjectMeta{Namespace: e2eNS, Name: e2eWorkloadUg}, - Spec: softwarecomposition.ApplicationProfileSpec{ - Containers: []softwarecomposition.ApplicationProfileContainer{ - {Name: "coredns", Capabilities: []string{"USER_MANAGED_CAP"}}, - }, + Spec: softwarecomposition.ContainerProfileSpec{ + Capabilities: []string{"USER_MANAGED_CAP"}, }, } - h.seedNonCP(e2eUgAPKey(), userAP) + h.seedNonCP(e2eUgCPKey(), userCP) drainMergedWrites, stopWatch := h.watchMergedModifications() defer stopWatch() @@ -591,14 +614,14 @@ func TestConsolidateUserManagedIdempotent(t *testing.T) { require.Equal(t, 1, drainMergedWrites(), "first tick must create the merged CP") // Cross a wall-clock second boundary before the no-data tick. The merge must - // be a pure function of (observed, ug-AP, ug-NN) — independent of when it + // be a pure function of (observed, ug-CP) — independent of when it // runs — so a re-merge of identical inputs after time has advanced must still // be a no-op. This deterministically catches any reintroduced per-tick // timestamp (e.g. a "merged-at" annotation), which would otherwise only flake // the assertions below when a tick happened to straddle a second. time.Sleep(1100 * time.Millisecond) - // Second tick: no new time-series data and the ug- AP unchanged. + // Second tick: no new time-series data and the ug- CP unchanged. // Since the expired time series was cleared on the first tick, we inject a report // to trigger consolidation and verify that rebuilding with identical inputs is recognized // as unchanged and NOT rewritten (no watch event, stable ResourceVersion). @@ -611,25 +634,23 @@ func TestConsolidateUserManagedIdempotent(t *testing.T) { "unchanged inputs must keep the merged CP ResourceVersion stable") assert.Equal(t, first, second, "an unchanged tick must leave the merged CP byte-for-byte identical") assert.Equal(t, 1, count(second.Spec.Capabilities, "USER_MANAGED_CAP"), - "unchanged ug- AP must not duplicate merged entries") + "unchanged ug- CP must not duplicate merged entries") - // Third tick: edit the ug- AP. Now an input changed, so the merged CP must + // Third tick: edit the ug- CP. Now an input changed, so the merged CP must // be rewritten — its ResourceVersion advances and the new capability lands // (and the old one is retracted, since the merge is rebuilt from scratch). - h.replaceUserAP(softwarecomposition.ApplicationProfileSpec{ - Containers: []softwarecomposition.ApplicationProfileContainer{ - {Name: "coredns", Capabilities: []string{"USER_MANAGED_CAP_V2"}}, - }, + h.replaceUserCP(softwarecomposition.ContainerProfileSpec{ + Capabilities: []string{"USER_MANAGED_CAP_V2"}, }) h.writeTSEntryDirect("containerprofile", "kube-system", "replicaset-coredns-5d78c9869d-coredns-185f-129c", "4580f9fc-7563-41d8-bb60-e2eeca72f495", "c68b821c86194262b389d919d1355ee6", "2025-06-24 10:29:46.810421941 +0000 UTC m=+66.976503851", "ready", "partial", "0001-01-01 00:00:00 +0000 UTC", true) h.consolidate() third := h.requireMerged() assert.GreaterOrEqual(t, drainMergedWrites(), 1, - "a changed ug- AP must rewrite the merged CP (a watch event must fire)") + "a changed ug- CP must rewrite the merged CP (a watch event must fire)") assert.NotEqual(t, second.ResourceVersion, third.ResourceVersion, - "a changed ug- AP must rewrite the merged CP (RV must advance)") + "a changed ug- CP must rewrite the merged CP (RV must advance)") assert.Contains(t, third.Spec.Capabilities, "USER_MANAGED_CAP_V2", - "merged CP must pick up the edited ug- AP capability") + "merged CP must pick up the edited ug- CP capability") assert.NotContains(t, third.Spec.Capabilities, "USER_MANAGED_CAP", "merge is rebuilt from scratch, so the superseded capability must be retracted") } @@ -706,7 +727,7 @@ func TestSaveContainerProfileIdempotent(t *testing.T) { } // TestConsolidateObservedIdempotentE2E drives the full consolidation pipeline -// and proves the symptom matthyx flagged is fixed end-to-end: a workload that is +// and proves the reported symptom is fixed end-to-end: a workload that is // still actively reporting (newData=true every tick) but whose observations have // stabilised must NOT bump the observed CP's ResourceVersion, and therefore must // NOT churn the derived merged CP — no spurious watch event reaches node-agent. @@ -722,15 +743,13 @@ func TestConsolidateObservedIdempotentE2E(t *testing.T) { defer h.close() h.processor.DeleteThreshold = time.Hour - userAP := &softwarecomposition.ApplicationProfile{ + userCP := &softwarecomposition.ContainerProfile{ ObjectMeta: metav1.ObjectMeta{Namespace: e2eNS, Name: e2eWorkloadUg}, - Spec: softwarecomposition.ApplicationProfileSpec{ - Containers: []softwarecomposition.ApplicationProfileContainer{ - {Name: "coredns", Capabilities: []string{"USER_MANAGED_CAP"}}, - }, + Spec: softwarecomposition.ContainerProfileSpec{ + Capabilities: []string{"USER_MANAGED_CAP"}, }, } - h.seedNonCP(e2eUgAPKey(), userAP) + h.seedNonCP(e2eUgCPKey(), userCP) drainMergedWrites, stopWatch := h.watchMergedModifications() defer stopWatch() @@ -799,7 +818,7 @@ func TestConsolidateObservedIdempotentE2E(t *testing.T) { "merged CP must still carry the ug- overlay after an observed change") } -// TestConsolidateUserManagedRVBump verifies that updating the ug- AP (bumping +// TestConsolidateUserManagedRVBump verifies that updating the ug- CP (bumping // its ResourceVersion) causes the next consolidation to apply the new content. // New entries appear, and the RV marker advances. func TestConsolidateUserManagedRVBump(t *testing.T) { @@ -807,28 +826,24 @@ func TestConsolidateUserManagedRVBump(t *testing.T) { defer h.close() h.createCP("testdata/p1.json") - userAP := &softwarecomposition.ApplicationProfile{ + userCP := &softwarecomposition.ContainerProfile{ ObjectMeta: metav1.ObjectMeta{Namespace: e2eNS, Name: e2eWorkloadUg}, - Spec: softwarecomposition.ApplicationProfileSpec{ - Containers: []softwarecomposition.ApplicationProfileContainer{ - {Name: "coredns", Capabilities: []string{"V1_CAP"}}, - }, + Spec: softwarecomposition.ContainerProfileSpec{ + Capabilities: []string{"V1_CAP"}, }, } - h.seedNonCP(e2eUgAPKey(), userAP) + h.seedNonCP(e2eUgCPKey(), userCP) h.consolidate() first := h.requireMerged() require.Contains(t, first.Spec.Capabilities, "V1_CAP") - rvAfterFirst := first.Annotations[mergedSourceUserAPRVKey] + rvAfterFirst := first.Annotations[mergedSourceUserCPRVKey] - // Bump ug- AP: replace with a new spec carrying a different capability. + // Bump ug- CP: replace with a new spec carrying a different capability. // Because the merged is rebuilt fresh from observed + ug- inputs, the new - // V2_CAP appears and V1_CAP is retracted (the maintainer's primary - // motivation for moving to a derived artifact). - h.replaceUserAP(softwarecomposition.ApplicationProfileSpec{ - Containers: []softwarecomposition.ApplicationProfileContainer{ - {Name: "coredns", Capabilities: []string{"V2_CAP"}}, - }, + // V2_CAP appears and V1_CAP is retracted (the primary motivation for moving + // to a derived artifact). + h.replaceUserCP(softwarecomposition.ContainerProfileSpec{ + Capabilities: []string{"V2_CAP"}, }) h.createCP("testdata/p2.json") @@ -838,13 +853,13 @@ func TestConsolidateUserManagedRVBump(t *testing.T) { assert.Contains(t, second.Spec.Capabilities, "V2_CAP", "new ug- entries must appear after RV bump") assert.NotContains(t, second.Spec.Capabilities, "V1_CAP", - "retraction: V1_CAP must not survive a ug- AP replacement") - assert.NotEqual(t, rvAfterFirst, second.Annotations[mergedSourceUserAPRVKey], - "merged source-AP-RV annotation must advance after ug- update") + "retraction: V1_CAP must not survive a ug- CP replacement") + assert.NotEqual(t, rvAfterFirst, second.Annotations[mergedSourceUserCPRVKey], + "merged source-CP-RV annotation must advance after ug- update") } // TestConsolidateNoUserManaged verifies the merge path is a no-op (no error, -// no marker annotations) when no ug- AP/NN exists for the workload. +// no marker annotations) when no ug- ContainerProfile exists for the workload. func TestConsolidateNoUserManaged(t *testing.T) { h := newE2EHarness(t) defer h.close() @@ -855,8 +870,7 @@ func TestConsolidateNoUserManaged(t *testing.T) { // Observed must exist and carry no merge metadata. observed := h.loadConsolidated() assert.NotContains(t, observed.Labels, MergedProfileLabelKey) - assert.NotContains(t, observed.Annotations, mergedSourceUserAPKey) - assert.NotContains(t, observed.Annotations, mergedSourceUserNNKey) + assert.NotContains(t, observed.Annotations, mergedSourceUserCPKey) // No merged artifact should have been written when no ug- input exists. _, ok := h.loadMerged() @@ -871,25 +885,23 @@ func TestConsolidateUserManagedPreservesStatus(t *testing.T) { defer h.close() h.createCP("testdata/p1.json") - userAP := &softwarecomposition.ApplicationProfile{ + userCP := &softwarecomposition.ContainerProfile{ ObjectMeta: metav1.ObjectMeta{Namespace: e2eNS, Name: e2eWorkloadUg}, - Spec: softwarecomposition.ApplicationProfileSpec{ - Containers: []softwarecomposition.ApplicationProfileContainer{ - // Set values that, if naively copied, would clobber base CP - // status/completion. The merge must ignore these and only - // touch Spec slices. - {Name: "coredns", Capabilities: []string{"X"}}, - }, + Spec: softwarecomposition.ContainerProfileSpec{ + // Set values that, if naively copied, would clobber base CP + // status/completion. The merge must ignore these and only + // touch Spec slices. + Capabilities: []string{"X"}, }, } // Adding annotations that look like base-CP status/completion to the ug- - // AP itself — these live on userAP.Annotations, never on its Spec, and + // CP itself — these live on userCP.Annotations, never on its Spec, and // must not bleed into the consolidated CP's annotations. - userAP.Annotations = map[string]string{ + userCP.Annotations = map[string]string{ helpersv1.StatusMetadataKey: "should-not-overwrite", helpersv1.CompletionMetadataKey: "should-not-overwrite", } - h.seedNonCP(e2eUgAPKey(), userAP) + h.seedNonCP(e2eUgCPKey(), userCP) h.consolidate() cp := h.requireMerged() @@ -922,49 +934,36 @@ func TestMergeUserNNIntoCP_LabelSelectorUserOverridesBase(t *testing.T) { assert.Equal(t, map[string]string{"app": "y", "keep": "me", "tier": "backend"}, cp.Spec.LabelSelector.MatchLabels) } -// TestConsolidateUserManagedNNRVBump mirrors TestConsolidateUserManagedRVBump -// for NetworkNeighborhood: bumping the ug- NN's ResourceVersion must cause the -// next consolidation to re-merge. -func TestConsolidateUserManagedNNRVBump(t *testing.T) { +// TestConsolidateUserManagedCPNetworkRVBump mirrors TestConsolidateUserManagedRVBump +// for the ug- ContainerProfile's network fields: bumping the ug- CP's +// ResourceVersion must cause the next consolidation to re-merge the egress set. +func TestConsolidateUserManagedCPNetworkRVBump(t *testing.T) { h := newE2EHarness(t) defer h.close() h.createCP("testdata/p1.json") - userNN := &softwarecomposition.NetworkNeighborhood{ + userCP := &softwarecomposition.ContainerProfile{ ObjectMeta: metav1.ObjectMeta{Namespace: e2eNS, Name: e2eWorkloadUg}, - Spec: softwarecomposition.NetworkNeighborhoodSpec{ - Containers: []softwarecomposition.NetworkNeighborhoodContainer{ - { - Name: "coredns", - Egress: []softwarecomposition.NetworkNeighbor{ - {Identifier: "v1-egress", DNSNames: []string{"v1.example"}}, - }, - }, + Spec: softwarecomposition.ContainerProfileSpec{ + Egress: []softwarecomposition.NetworkNeighbor{ + {Identifier: "v1-egress", DNSNames: []string{"v1.example"}}, }, }, } - h.seedNonCP(e2eUgNNKey(), userNN) + h.seedNonCP(e2eUgCPKey(), userCP) h.consolidate() first := h.requireMerged() require.True(t, hasNeighbor(first.Spec.Egress, "v1-egress"), "first tick: v1-egress should be merged") - rvAfterFirst := first.Annotations[mergedSourceUserNNRVKey] + rvAfterFirst := first.Annotations[mergedSourceUserCPRVKey] require.NotEmpty(t, rvAfterFirst) - // Bump the ug- NN: replace egress with a new identifier. - tryUpdate := func(input runtime.Object, _ storage.ResponseMeta) (runtime.Object, *uint64, error) { - out := input.DeepCopyObject().(*softwarecomposition.NetworkNeighborhood) - out.Spec.Containers[0].Egress = []softwarecomposition.NetworkNeighbor{ + // Bump the ug- CP: replace egress with a new identifier. + h.replaceUserCP(softwarecomposition.ContainerProfileSpec{ + Egress: []softwarecomposition.NetworkNeighbor{ {Identifier: "v2-egress", DNSNames: []string{"v2.example"}}, - } - return out, nil, nil - } - prev := h.s.processor - h.s.processor = DefaultProcessor{} - require.NoError(t, h.s.GuaranteedUpdateWithConn( - h.ctx, h.conn, e2eUgNNKey(), &softwarecomposition.NetworkNeighborhood{}, - false, nil, tryUpdate, nil, "")) - h.s.processor = prev + }, + }) h.createCP("testdata/p2.json") h.consolidate() @@ -973,9 +972,9 @@ func TestConsolidateUserManagedNNRVBump(t *testing.T) { assert.True(t, hasNeighbor(second.Spec.Egress, "v2-egress"), "second tick: v2-egress must appear after RV bump") assert.False(t, hasNeighbor(second.Spec.Egress, "v1-egress"), - "retraction: v1-egress must not survive a ug- NN replacement") - assert.NotEqual(t, rvAfterFirst, second.Annotations[mergedSourceUserNNRVKey], - "merged source-NN-RV annotation must advance after ug- NN update") + "retraction: v1-egress must not survive a ug- CP replacement") + assert.NotEqual(t, rvAfterFirst, second.Annotations[mergedSourceUserCPRVKey], + "merged source-CP-RV annotation must advance after ug- CP update") } func hasNeighbor(neighbors []softwarecomposition.NetworkNeighbor, identifier string) bool { @@ -988,10 +987,12 @@ func hasNeighbor(neighbors []softwarecomposition.NetworkNeighbor, identifier str } // TestConsolidateUserManagedFanOut exercises slug fan-out: a single -// ug- AP listing two containers must be merged into BOTH -// per-container CPs the consolidation flow produces. Uses the fixture -// workload "multiple-containers-deployment-d4b8dd5fd" which has separate -// per-container TS profiles for "server" and "nginx". +// ug- ContainerProfile must be merged into BOTH per-container CPs +// the consolidation flow produces for that workload. Uses the fixture workload +// "multiple-containers-deployment-d4b8dd5fd" which has separate per-container TS +// profiles for "server" and "nginx". The ug- overlay is now flat (single +// container), so the same overlay applies to every per-container CP of the +// workload rather than being split per container name. func TestConsolidateUserManagedFanOut(t *testing.T) { pool := NewTestPool(t.TempDir()) require.NotNil(t, pool) @@ -1042,26 +1043,24 @@ func TestConsolidateUserManagedFanOut(t *testing.T) { ugKey := BuildContainerProfileKey(armotypes.ProfileIdentifier{ ProfileScope: armotypes.ProfileScope{HostType: armotypes.HostTypeKubernetes, Namespace: ns}, Name: ugName, - }, "applicationprofiles") + }, "containerprofiles") - userAP := &softwarecomposition.ApplicationProfile{ + userCP := &softwarecomposition.ContainerProfile{ ObjectMeta: metav1.ObjectMeta{Namespace: ns, Name: ugName}, - Spec: softwarecomposition.ApplicationProfileSpec{ - Containers: []softwarecomposition.ApplicationProfileContainer{ - {Name: "server", Capabilities: []string{"FANOUT_SERVER"}}, - {Name: "nginx", Capabilities: []string{"FANOUT_NGINX"}}, - }, + Spec: softwarecomposition.ContainerProfileSpec{ + Capabilities: []string{"FANOUT_SHARED"}, }, } prev := s.processor s.processor = DefaultProcessor{} - require.NoError(t, s.Create(ctx, ugKey, userAP, nil, 0)) + require.NoError(t, s.Create(ctx, ugKey, userCP, nil, 0)) s.processor = prev require.NoError(t, processor.ConsolidateTimeSeries(ctx)) - // Both per-container CPs must carry the matching merge in the merged - // artifact (not on the observed CP — that one stays pure time-series). + // Both per-container CPs of the workload must carry the shared ug- overlay in + // the merged artifact (not on the observed CP — that one stays pure + // time-series). The overlay is flat, so it fans out to every per-container CP. loadCP := func(name string) softwarecomposition.ContainerProfile { var cp softwarecomposition.ContainerProfile observedKey := BuildContainerProfileKey(armotypes.ProfileIdentifier{ @@ -1075,40 +1074,38 @@ func TestConsolidateUserManagedFanOut(t *testing.T) { serverCP := loadCP("replicaset-multiple-containers-deployment-d4b8dd5fd-server-5cad-76b6") nginxCP := loadCP("replicaset-multiple-containers-deployment-d4b8dd5fd-nginx-42c9-63c3") - assert.Contains(t, serverCP.Spec.Capabilities, "FANOUT_SERVER", "server CP missed user-managed merge") - assert.NotContains(t, serverCP.Spec.Capabilities, "FANOUT_NGINX", "server CP should not receive nginx's user-managed entries") - assert.Contains(t, nginxCP.Spec.Capabilities, "FANOUT_NGINX", "nginx CP missed user-managed merge") - assert.NotContains(t, nginxCP.Spec.Capabilities, "FANOUT_SERVER", "nginx CP should not receive server's user-managed entries") + assert.Contains(t, serverCP.Spec.Capabilities, "FANOUT_SHARED", "server CP missed user-managed merge") + assert.Equal(t, 1, count(serverCP.Spec.Capabilities, "FANOUT_SHARED"), "server CP must not duplicate the overlay entry") + assert.Contains(t, nginxCP.Spec.Capabilities, "FANOUT_SHARED", "nginx CP missed user-managed merge") + assert.Equal(t, 1, count(nginxCP.Spec.Capabilities, "FANOUT_SHARED"), "nginx CP must not duplicate the overlay entry") } -// TestConsolidateRetractsMergedOnUgAPDelete is the central correctness test -// for the maintainer's stale-on-delete concern. After a successful merge, -// removing the ug- AP must cause the merged artifact to disappear so node- -// agent falls back to the observed CP — i.e., the user's permission grant is +// TestConsolidateRetractsMergedOnUgCPDelete is the central correctness test +// for the stale-on-delete concern. After a successful merge, removing the ug- +// ContainerProfile must cause the merged artifact to disappear so node-agent +// falls back to the observed CP — i.e., the user's permission grant is // retracted. -func TestConsolidateRetractsMergedOnUgAPDelete(t *testing.T) { +func TestConsolidateRetractsMergedOnUgCPDelete(t *testing.T) { h := newE2EHarness(t) defer h.close() h.createCP("testdata/p1.json") - userAP := &softwarecomposition.ApplicationProfile{ + userCP := &softwarecomposition.ContainerProfile{ ObjectMeta: metav1.ObjectMeta{Namespace: e2eNS, Name: e2eWorkloadUg}, - Spec: softwarecomposition.ApplicationProfileSpec{ - Containers: []softwarecomposition.ApplicationProfileContainer{ - {Name: "coredns", Capabilities: []string{"DOOMED_CAP"}}, - }, + Spec: softwarecomposition.ContainerProfileSpec{ + Capabilities: []string{"DOOMED_CAP"}, }, } - h.seedNonCP(e2eUgAPKey(), userAP) + h.seedNonCP(e2eUgCPKey(), userCP) h.consolidate() require.Contains(t, h.requireMerged().Spec.Capabilities, "DOOMED_CAP", - "first tick: merged should reflect ug- AP") + "first tick: merged should reflect ug- CP") - // Delete the ug- AP outside the consolidation path. + // Delete the ug- CP outside the consolidation path. prev := h.s.processor h.s.processor = DefaultProcessor{} - require.NoError(t, h.s.Delete(h.ctx, e2eUgAPKey(), &softwarecomposition.ApplicationProfile{}, + require.NoError(t, h.s.Delete(h.ctx, e2eUgCPKey(), &softwarecomposition.ContainerProfile{}, nil, storage.ValidateAllObjectFunc, nil, storage.DeleteOptions{})) h.s.processor = prev @@ -1117,7 +1114,7 @@ func TestConsolidateRetractsMergedOnUgAPDelete(t *testing.T) { h.consolidate() _, ok := h.loadMerged() - assert.False(t, ok, "merged artifact must be deleted after ug- AP is removed") + assert.False(t, ok, "merged artifact must be deleted after ug- CP is removed") // Observed must still exist and never have contained DOOMED_CAP. observed := h.loadConsolidated() @@ -1132,7 +1129,7 @@ func TestConsolidateRetractsMergedOnUgAPDelete(t *testing.T) { // // Scope note: a truly idle workload with zero hasData=1 TS rows isn't visited // by ConsolidateTimeSeries at all — that case requires a separate trigger -// (option a, watch-driven enqueue) and is out of scope here per matthyx's +// (option a, watch-driven enqueue) and is out of scope here per the review's // "option (c)" decision. This test covers the in-tick !newData case where // the consolidator still visits the workload. func TestConsolidateRefreshesMergedOnNoNewData(t *testing.T) { @@ -1146,19 +1143,17 @@ func TestConsolidateRefreshesMergedOnNoNewData(t *testing.T) { _, ok := h.loadMerged() require.False(t, ok, "preconditions: no merged before ug- is added") - // Add ug- AP, then re-run consolidation. The same workload may still be + // Add ug- CP, then re-run consolidation. The same workload may still be // visited because there's a (possibly stale) TS row queued by createCP; // even if processTimeSeries returns no new data, the merged refresh must // still execute. - userAP := &softwarecomposition.ApplicationProfile{ + userCP := &softwarecomposition.ContainerProfile{ ObjectMeta: metav1.ObjectMeta{Namespace: e2eNS, Name: e2eWorkloadUg}, - Spec: softwarecomposition.ApplicationProfileSpec{ - Containers: []softwarecomposition.ApplicationProfileContainer{ - {Name: "coredns", Capabilities: []string{"LATE_ADDITION"}}, - }, + Spec: softwarecomposition.ContainerProfileSpec{ + Capabilities: []string{"LATE_ADDITION"}, }, } - h.seedNonCP(e2eUgAPKey(), userAP) + h.seedNonCP(e2eUgCPKey(), userCP) // Inject a fresh TS row so the consolidator visits the workload. We're // proving that the merged refresh fires even when the merge itself @@ -1169,7 +1164,7 @@ func TestConsolidateRefreshesMergedOnNoNewData(t *testing.T) { merged := h.requireMerged() assert.Contains(t, merged.Spec.Capabilities, "LATE_ADDITION", - "merged refresh must propagate a late-added ug- AP") + "merged refresh must propagate a late-added ug- CP") } // TestRESTWrapper_MergedFirstFallback exercises the consumer-side read path: @@ -1280,8 +1275,8 @@ func (f fakeRunningFetcher) FetchResources(_ string) (ResourceMaps, error) { } // TestCleanupRetiresMergedOrphan proves the merged-CP kind is wired into the -// cleanup map (matthyx review, ask #1): a merged CP whose workload is no longer -// running is age-cleaned, while a merged CP for a running workload survives. +// cleanup map: a merged CP whose workload is no longer running is age-cleaned, +// while a merged CP for a running workload survives. // This covers the path where a workload is retired without going through the // REST Delete cascade that maintains the merged sibling. func TestCleanupRetiresMergedOrphan(t *testing.T) { @@ -1384,8 +1379,7 @@ func TestE2EScenario_Walkthrough(t *testing.T) { } else { t.Logf(" merged capabilities: %v", merged.Spec.Capabilities) t.Logf(" merged label: %s=%s", MergedProfileLabelKey, merged.Labels[MergedProfileLabelKey]) - t.Logf(" merged source ug-ap: %s (rv=%s)", merged.Annotations[mergedSourceUserAPKey], merged.Annotations[mergedSourceUserAPRVKey]) - t.Logf(" merged source ug-nn: %s (rv=%s)", merged.Annotations[mergedSourceUserNNKey], merged.Annotations[mergedSourceUserNNRVKey]) + t.Logf(" merged source ug-cp: %s (rv=%s)", merged.Annotations[mergedSourceUserCPKey], merged.Annotations[mergedSourceUserCPRVKey]) } viaREST, restErr := getViaREST() @@ -1399,7 +1393,7 @@ func TestE2EScenario_Walkthrough(t *testing.T) { t.Logf("") } - t.Log("Scenario: simulate node-agent reads across the ug- AP lifecycle") + t.Log("Scenario: simulate node-agent reads across the ug- CP lifecycle") t.Log("Workload slug:", e2eWorkloadSlug, " container CP name:", e2eContainerCPName) t.Log("") @@ -1408,41 +1402,37 @@ func TestE2EScenario_Walkthrough(t *testing.T) { h.consolidate() dumpState("Step 1: TS data only — no ug-") - // Step 2: operator creates a ug- AP granting an extra capability. - userAP := &softwarecomposition.ApplicationProfile{ + // Step 2: operator creates a ug- CP granting an extra capability. + userCP := &softwarecomposition.ContainerProfile{ ObjectMeta: metav1.ObjectMeta{Namespace: e2eNS, Name: e2eWorkloadUg}, - Spec: softwarecomposition.ApplicationProfileSpec{ - Containers: []softwarecomposition.ApplicationProfileContainer{ - {Name: "coredns", Capabilities: []string{"NET_ADMIN_FROM_UG"}}, - }, + Spec: softwarecomposition.ContainerProfileSpec{ + Capabilities: []string{"NET_ADMIN_FROM_UG"}, }, } - h.seedNonCP(e2eUgAPKey(), userAP) + h.seedNonCP(e2eUgCPKey(), userCP) h.createCP("testdata/p2.json") // fresh TS row so consolidator visits h.consolidate() - dumpState("Step 2: operator adds ug- AP granting NET_ADMIN_FROM_UG") + dumpState("Step 2: operator adds ug- CP granting NET_ADMIN_FROM_UG") - // Step 3: operator edits the ug- AP — replaces the capability list. The + // Step 3: operator edits the ug- CP — replaces the capability list. The // previous in-place merge couldn't retract; the new design must. - h.replaceUserAP(softwarecomposition.ApplicationProfileSpec{ - Containers: []softwarecomposition.ApplicationProfileContainer{ - {Name: "coredns", Capabilities: []string{"SYS_PTRACE_FROM_UG"}}, - }, + h.replaceUserCP(softwarecomposition.ContainerProfileSpec{ + Capabilities: []string{"SYS_PTRACE_FROM_UG"}, }) h.createCP("testdata/p1.json") h.consolidate() - dumpState("Step 3: operator edits ug- AP (NET_ADMIN_FROM_UG → SYS_PTRACE_FROM_UG)") + dumpState("Step 3: operator edits ug- CP (NET_ADMIN_FROM_UG → SYS_PTRACE_FROM_UG)") - // Step 4: operator deletes the ug- AP. The merged artifact must disappear + // Step 4: operator deletes the ug- CP. The merged artifact must disappear // and the REST wrapper must transparently fall back to observed. prev := h.s.processor h.s.processor = DefaultProcessor{} - require.NoError(t, h.s.Delete(h.ctx, e2eUgAPKey(), &softwarecomposition.ApplicationProfile{}, + require.NoError(t, h.s.Delete(h.ctx, e2eUgCPKey(), &softwarecomposition.ContainerProfile{}, nil, storage.ValidateAllObjectFunc, nil, storage.DeleteOptions{})) h.s.processor = prev h.createCP("testdata/p2.json") h.consolidate() - dumpState("Step 4: operator deletes ug- AP — retraction") + dumpState("Step 4: operator deletes ug- CP — retraction") } // TestConsolidatorReadsObservedOnly proves the consolidator's read path never From 7d85c72795805621c9d697ad2420ddc2e7853667 Mon Sep 17 00:00:00 2001 From: Entlein Date: Mon, 27 Jul 2026 22:38:28 +0200 Subject: [PATCH 02/17] feat: remove ApplicationProfile and NetworkNeighborhood CRDs Remove the ApplicationProfile and NetworkNeighborhood custom resources entirely: their API types, registration, aggregated-apiserver storage backends, processors, and REST strategy/etcd wiring are gone, and the generated code (deepcopy, clientset, listers, informers, applyconfiguration, openapi, protobuf) is regenerated without them. ContainerProfile is the sole runtime/user-facing profile resource. - GeneratedNetworkPolicy is reworked to source from ContainerProfile (it projects the CP into the internal NetworkNeighborhood shape used by the policy generator), so that feature is preserved. The NetworkNeighborhood Go struct is retained as an internal, non-served intermediate only. - The user-managed "ug-" overlay merge is ContainerProfile-only. - Deprecated AP/NN merge helpers removed; tests migrated to ContainerProfile or dropped where they covered removed CRD-specific behaviour. Signed-off-by: entlein --- pkg/apis/softwarecomposition/network_types.go | 23 +- pkg/apis/softwarecomposition/register.go | 4 - pkg/apis/softwarecomposition/types.go | 48 - pkg/apis/softwarecomposition/types_test.go | 12 +- .../v1beta1/generated.pb.go | 6857 +++++------------ .../v1beta1/generated.proto | 97 - .../v1beta1/generated.protomessage.pb.go | 362 - .../v1beta1/network_types.go | 34 - .../v1beta1/network_types_protobuf_test.go | 2 +- .../v1beta1/networkpolicy/v2/networkpolicy.go | 55 - .../networkpolicy/v2/networkpolicy_test.go | 132 - .../v2/testdata/known-servers.json | 24 - .../v2/testdata/nn-operator.json | 304 - .../v2/testdata/np-operator.json | 281 - .../networkpolicy/v2/testdata/np.new.json | 281 - .../softwarecomposition/v1beta1/register.go | 4 - pkg/apis/softwarecomposition/v1beta1/types.go | 58 - .../v1beta1/zz_generated.conversion.go | 374 - .../v1beta1/zz_generated.deepcopy.go | 309 - .../v1beta1/zz_generated.model_name.go | 45 - .../zz_generated.deepcopy.go | 236 - pkg/apiserver/apiserver.go | 21 +- pkg/config/config.go | 2 - pkg/config/config_test.go | 3 +- .../v1beta1/applicationprofile.go | 244 - .../v1beta1/applicationprofilecontainer.go | 159 - .../v1beta1/applicationprofilespec.go | 83 - .../v1beta1/networkneighborhood.go | 236 - .../v1beta1/networkneighborhoodcontainer.go | 67 - .../v1beta1/networkneighborhoodspec.go | 104 - pkg/generated/applyconfiguration/utils.go | 12 - .../v1beta1/applicationprofile.go | 78 - .../v1beta1/fake/fake_applicationprofile.go | 53 - .../v1beta1/fake/fake_networkneighborhood.go | 53 - .../fake/fake_softwarecomposition_client.go | 8 - .../v1beta1/generated_expansion.go | 4 - .../v1beta1/networkneighborhood.go | 74 - .../v1beta1/softwarecomposition_client.go | 10 - .../informers/externalversions/generic.go | 4 - .../v1beta1/applicationprofile.go | 102 - .../softwarecomposition/v1beta1/interface.go | 14 - .../v1beta1/networkneighborhood.go | 102 - .../v1beta1/applicationprofile.go | 70 - .../v1beta1/expansion_generated.go | 16 - .../v1beta1/networkneighborhood.go | 70 - pkg/generated/openapi/zz_generated.openapi.go | 586 -- .../file/applicationprofile_processor.go | 162 - ...rofile_processor_collapse_provider_test.go | 243 - .../file/applicationprofile_processor_test.go | 458 -- .../file/applicationprofile_storage.go | 129 - .../file/containerprofile_processor.go | 48 +- .../file/containerprofile_processor_test.go | 42 +- pkg/registry/file/containerprofile_storage.go | 113 - .../containerprofile_storage_interface.go | 8 - .../file/containerprofile_user_managed.go | 124 - .../containerprofile_user_managed_test.go | 249 - .../tests/compare_exec_args_test.go | 5 +- .../tests/coverage_test.go | 4 +- .../tests/execargs_wildcard_ap_test.go | 64 +- pkg/registry/file/generatednetworkpolicy.go | 62 +- .../file/generatednetworkpolicy_test.go | 22 +- .../file/networkneighborhood_ipcollapse.go | 31 + .../file/networkneighborhood_processor.go | 143 - .../networkneighborhood_processor_test.go | 170 - .../file/networkneighborhood_storage.go | 120 - pkg/registry/file/storage_test.go | 15 +- .../file/testdata/expectedFilesToDelete.json | 10 - .../applicationprofile/etcd.go | 56 - .../applicationprofile/strategy.go | 145 - .../applicationprofile/strategy_test.go | 264 - .../collapseconfiguration/strategy_test.go | 4 +- .../networkneighborhood/etcd.go | 56 - .../networkneighborhood/strategy.go | 217 - .../networkneighborhood/strategy_test.go | 502 -- 74 files changed, 2295 insertions(+), 12888 deletions(-) delete mode 100644 pkg/apis/softwarecomposition/v1beta1/generated.protomessage.pb.go delete mode 100644 pkg/apis/softwarecomposition/v1beta1/networkpolicy/v2/networkpolicy.go delete mode 100644 pkg/apis/softwarecomposition/v1beta1/networkpolicy/v2/networkpolicy_test.go delete mode 100644 pkg/apis/softwarecomposition/v1beta1/networkpolicy/v2/testdata/known-servers.json delete mode 100644 pkg/apis/softwarecomposition/v1beta1/networkpolicy/v2/testdata/nn-operator.json delete mode 100644 pkg/apis/softwarecomposition/v1beta1/networkpolicy/v2/testdata/np-operator.json delete mode 100644 pkg/apis/softwarecomposition/v1beta1/networkpolicy/v2/testdata/np.new.json delete mode 100644 pkg/generated/applyconfiguration/softwarecomposition/v1beta1/applicationprofile.go delete mode 100644 pkg/generated/applyconfiguration/softwarecomposition/v1beta1/applicationprofilecontainer.go delete mode 100644 pkg/generated/applyconfiguration/softwarecomposition/v1beta1/applicationprofilespec.go delete mode 100644 pkg/generated/applyconfiguration/softwarecomposition/v1beta1/networkneighborhood.go delete mode 100644 pkg/generated/applyconfiguration/softwarecomposition/v1beta1/networkneighborhoodcontainer.go delete mode 100644 pkg/generated/applyconfiguration/softwarecomposition/v1beta1/networkneighborhoodspec.go delete mode 100644 pkg/generated/clientset/versioned/typed/softwarecomposition/v1beta1/applicationprofile.go delete mode 100644 pkg/generated/clientset/versioned/typed/softwarecomposition/v1beta1/fake/fake_applicationprofile.go delete mode 100644 pkg/generated/clientset/versioned/typed/softwarecomposition/v1beta1/fake/fake_networkneighborhood.go delete mode 100644 pkg/generated/clientset/versioned/typed/softwarecomposition/v1beta1/networkneighborhood.go delete mode 100644 pkg/generated/informers/externalversions/softwarecomposition/v1beta1/applicationprofile.go delete mode 100644 pkg/generated/informers/externalversions/softwarecomposition/v1beta1/networkneighborhood.go delete mode 100644 pkg/generated/listers/softwarecomposition/v1beta1/applicationprofile.go delete mode 100644 pkg/generated/listers/softwarecomposition/v1beta1/networkneighborhood.go delete mode 100644 pkg/registry/file/applicationprofile_processor.go delete mode 100644 pkg/registry/file/applicationprofile_processor_collapse_provider_test.go delete mode 100644 pkg/registry/file/applicationprofile_processor_test.go delete mode 100644 pkg/registry/file/applicationprofile_storage.go delete mode 100644 pkg/registry/file/networkneighborhood_processor.go delete mode 100644 pkg/registry/file/networkneighborhood_processor_test.go delete mode 100644 pkg/registry/file/networkneighborhood_storage.go delete mode 100644 pkg/registry/softwarecomposition/applicationprofile/etcd.go delete mode 100644 pkg/registry/softwarecomposition/applicationprofile/strategy.go delete mode 100644 pkg/registry/softwarecomposition/applicationprofile/strategy_test.go delete mode 100644 pkg/registry/softwarecomposition/networkneighborhood/etcd.go delete mode 100644 pkg/registry/softwarecomposition/networkneighborhood/strategy.go delete mode 100644 pkg/registry/softwarecomposition/networkneighborhood/strategy_test.go diff --git a/pkg/apis/softwarecomposition/network_types.go b/pkg/apis/softwarecomposition/network_types.go index 1b4778652..fd698dc0d 100644 --- a/pkg/apis/softwarecomposition/network_types.go +++ b/pkg/apis/softwarecomposition/network_types.go @@ -18,29 +18,14 @@ const ( CommunicationTypeEgress CommunicationType = "external" ) -// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object - -// NetworkNeighborhoodList is a list of NetworkNeighborhoods. -type NetworkNeighborhoodList struct { - metav1.TypeMeta - metav1.ListMeta - - Items []NetworkNeighborhood -} - -// +genclient -// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object - -// NetworkNeighborhood represents a list of network communications for a specific workload. +// NetworkNeighborhood is an in-process, non-CRD intermediate used only to feed +// the GeneratedNetworkPolicy generation. It is projected from ContainerProfile +// data at request time and is never stored or served as an API object. type NetworkNeighborhood struct { metav1.TypeMeta metav1.ObjectMeta - // +k8s:conversion-gen=false - Parts map[string]string - // +k8s:conversion-gen=false - SchemaVersion int64 - Spec NetworkNeighborhoodSpec + Spec NetworkNeighborhoodSpec } type NetworkNeighborhoodSpec struct { diff --git a/pkg/apis/softwarecomposition/register.go b/pkg/apis/softwarecomposition/register.go index 32f6e4495..ba1ac217a 100644 --- a/pkg/apis/softwarecomposition/register.go +++ b/pkg/apis/softwarecomposition/register.go @@ -65,12 +65,8 @@ func addKnownTypes(scheme *runtime.Scheme) error { &ConfigurationScanSummaryList{}, &VulnerabilitySummary{}, &VulnerabilitySummaryList{}, - &ApplicationProfile{}, - &ApplicationProfileList{}, &ContainerProfile{}, &ContainerProfileList{}, - &NetworkNeighborhood{}, - &NetworkNeighborhoodList{}, &OpenVulnerabilityExchangeContainer{}, &OpenVulnerabilityExchangeContainerList{}, &GeneratedNetworkPolicyList{}, diff --git a/pkg/apis/softwarecomposition/types.go b/pkg/apis/softwarecomposition/types.go index 7a237b90a..73cb5b3bb 100644 --- a/pkg/apis/softwarecomposition/types.go +++ b/pkg/apis/softwarecomposition/types.go @@ -208,42 +208,6 @@ func (v *VulnerabilitySummary) Merge(vulnManifestSumm *VulnerabilityManifestSumm v.Spec.WorkloadVulnerabilitiesObj = append(v.Spec.WorkloadVulnerabilitiesObj, workloadVulnerabilitiesObj) } -// +genclient -// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object - -type ApplicationProfile struct { - metav1.TypeMeta - metav1.ObjectMeta - - // +k8s:conversion-gen=false - Parts map[string]string - // +k8s:conversion-gen=false - SchemaVersion int64 - Spec ApplicationProfileSpec - Status ApplicationProfileStatus -} - -type ApplicationProfileSpec struct { - Architectures []string - Containers []ApplicationProfileContainer - InitContainers []ApplicationProfileContainer - EphemeralContainers []ApplicationProfileContainer -} - -type ApplicationProfileContainer struct { - Name string - Capabilities []string - Execs []ExecCalls - Opens []OpenCalls - Syscalls []string - SeccompProfile SingleSeccompProfile - Endpoints []HTTPEndpoint - ImageID string - ImageTag string - PolicyByRuleId map[string]RulePolicy - IdentifiedCallStacks []IdentifiedCallStack -} - type RulePolicy struct { AllowedProcesses []string AllowedContainer bool @@ -317,18 +281,6 @@ type CallStack struct { Root CallStackNode } -type ApplicationProfileStatus struct { -} - -// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object - -type ApplicationProfileList struct { - metav1.TypeMeta - metav1.ListMeta - - Items []ApplicationProfile -} - // +genclient // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object diff --git a/pkg/apis/softwarecomposition/types_test.go b/pkg/apis/softwarecomposition/types_test.go index 01201a8dc..b72fab163 100644 --- a/pkg/apis/softwarecomposition/types_test.go +++ b/pkg/apis/softwarecomposition/types_test.go @@ -394,17 +394,17 @@ func TestHTTPEndpoint_String(t *testing.T) { } } -func TestApplicationProfileContainer_PolicyValidation(t *testing.T) { +func TestContainerProfile_PolicyValidation(t *testing.T) { tests := []struct { name string - container ApplicationProfileContainer + container ContainerProfileSpec wantPolicy RulePolicy policyRuleID string wantExists bool }{ { name: "Empty container", - container: ApplicationProfileContainer{ + container: ContainerProfileSpec{ PolicyByRuleId: map[string]RulePolicy{}, }, policyRuleID: "rule1", @@ -412,8 +412,7 @@ func TestApplicationProfileContainer_PolicyValidation(t *testing.T) { }, { name: "Container with policies", - container: ApplicationProfileContainer{ - Name: "nginx", + container: ContainerProfileSpec{ Capabilities: []string{"NET_BIND_SERVICE", "CHOWN"}, ImageID: "sha256:abc123", ImageTag: "1.21-alpine", @@ -437,8 +436,7 @@ func TestApplicationProfileContainer_PolicyValidation(t *testing.T) { }, { name: "Non-existent rule", - container: ApplicationProfileContainer{ - Name: "nginx", + container: ContainerProfileSpec{ PolicyByRuleId: map[string]RulePolicy{ "rule1": { AllowedProcesses: []string{"nginx"}, diff --git a/pkg/apis/softwarecomposition/v1beta1/generated.pb.go b/pkg/apis/softwarecomposition/v1beta1/generated.pb.go index d52aafa2a..12000860d 100644 --- a/pkg/apis/softwarecomposition/v1beta1/generated.pb.go +++ b/pkg/apis/softwarecomposition/v1beta1/generated.pb.go @@ -42,16 +42,6 @@ import ( func (m *Advisory) Reset() { *m = Advisory{} } -func (m *ApplicationProfile) Reset() { *m = ApplicationProfile{} } - -func (m *ApplicationProfileContainer) Reset() { *m = ApplicationProfileContainer{} } - -func (m *ApplicationProfileList) Reset() { *m = ApplicationProfileList{} } - -func (m *ApplicationProfileSpec) Reset() { *m = ApplicationProfileSpec{} } - -func (m *ApplicationProfileStatus) Reset() { *m = ApplicationProfileStatus{} } - func (m *Arg) Reset() { *m = Arg{} } func (m *CPE) Reset() { *m = CPE{} } @@ -196,14 +186,6 @@ func (m *Metadata) Reset() { *m = Metadata{} } func (m *NetworkNeighbor) Reset() { *m = NetworkNeighbor{} } -func (m *NetworkNeighborhood) Reset() { *m = NetworkNeighborhood{} } - -func (m *NetworkNeighborhoodContainer) Reset() { *m = NetworkNeighborhoodContainer{} } - -func (m *NetworkNeighborhoodList) Reset() { *m = NetworkNeighborhoodList{} } - -func (m *NetworkNeighborhoodSpec) Reset() { *m = NetworkNeighborhoodSpec{} } - func (m *NetworkPolicy) Reset() { *m = NetworkPolicy{} } func (m *NetworkPolicyEgressRule) Reset() { *m = NetworkPolicyEgressRule{} } @@ -419,7 +401,7 @@ func (m *Advisory) MarshalToSizedBuffer(dAtA []byte) (int, error) { return len(dAtA) - i, nil } -func (m *ApplicationProfile) Marshal() (dAtA []byte, err error) { +func (m *Arg) Marshal() (dAtA []byte, err error) { size := m.Size() dAtA = make([]byte, size) n, err := m.MarshalToSizedBuffer(dAtA[:size]) @@ -429,38 +411,88 @@ func (m *ApplicationProfile) Marshal() (dAtA []byte, err error) { return dAtA[:n], nil } -func (m *ApplicationProfile) MarshalTo(dAtA []byte) (int, error) { +func (m *Arg) MarshalTo(dAtA []byte) (int, error) { size := m.Size() return m.MarshalToSizedBuffer(dAtA[:size]) } -func (m *ApplicationProfile) MarshalToSizedBuffer(dAtA []byte) (int, error) { +func (m *Arg) MarshalToSizedBuffer(dAtA []byte) (int, error) { i := len(dAtA) _ = i var l int _ = l - { - size, err := m.Status.MarshalToSizedBuffer(dAtA[:i]) - if err != nil { - return 0, err - } - i -= size - i = encodeVarintGenerated(dAtA, i, uint64(size)) - } + i -= len(m.Op) + copy(dAtA[i:], m.Op) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.Op))) i-- - dAtA[i] = 0x1a - { - size, err := m.Spec.MarshalToSizedBuffer(dAtA[:i]) - if err != nil { - return 0, err - } - i -= size - i = encodeVarintGenerated(dAtA, i, uint64(size)) + dAtA[i] = 0x22 + i = encodeVarintGenerated(dAtA, i, uint64(m.ValueTwo)) + i-- + dAtA[i] = 0x18 + i = encodeVarintGenerated(dAtA, i, uint64(m.Value)) + i-- + dAtA[i] = 0x10 + i = encodeVarintGenerated(dAtA, i, uint64(m.Index)) + i-- + dAtA[i] = 0x8 + return len(dAtA) - i, nil +} + +func (m *CPE) Marshal() (dAtA []byte, err error) { + size := m.Size() + dAtA = make([]byte, size) + n, err := m.MarshalToSizedBuffer(dAtA[:size]) + if err != nil { + return nil, err } + return dAtA[:n], nil +} + +func (m *CPE) MarshalTo(dAtA []byte) (int, error) { + size := m.Size() + return m.MarshalToSizedBuffer(dAtA[:size]) +} + +func (m *CPE) MarshalToSizedBuffer(dAtA []byte) (int, error) { + i := len(dAtA) + _ = i + var l int + _ = l + i -= len(m.Source) + copy(dAtA[i:], m.Source) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.Source))) i-- dAtA[i] = 0x12 + i -= len(m.Value) + copy(dAtA[i:], m.Value) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.Value))) + i-- + dAtA[i] = 0xa + return len(dAtA) - i, nil +} + +func (m *CallStack) Marshal() (dAtA []byte, err error) { + size := m.Size() + dAtA = make([]byte, size) + n, err := m.MarshalToSizedBuffer(dAtA[:size]) + if err != nil { + return nil, err + } + return dAtA[:n], nil +} + +func (m *CallStack) MarshalTo(dAtA []byte) (int, error) { + size := m.Size() + return m.MarshalToSizedBuffer(dAtA[:size]) +} + +func (m *CallStack) MarshalToSizedBuffer(dAtA []byte) (int, error) { + i := len(dAtA) + _ = i + var l int + _ = l { - size, err := m.ObjectMeta.MarshalToSizedBuffer(dAtA[:i]) + size, err := m.Root.MarshalToSizedBuffer(dAtA[:i]) if err != nil { return 0, err } @@ -472,7 +504,7 @@ func (m *ApplicationProfile) MarshalToSizedBuffer(dAtA []byte) (int, error) { return len(dAtA) - i, nil } -func (m *ApplicationProfileContainer) Marshal() (dAtA []byte, err error) { +func (m *CallStackNode) Marshal() (dAtA []byte, err error) { size := m.Size() dAtA = make([]byte, size) n, err := m.MarshalToSizedBuffer(dAtA[:size]) @@ -482,85 +514,18 @@ func (m *ApplicationProfileContainer) Marshal() (dAtA []byte, err error) { return dAtA[:n], nil } -func (m *ApplicationProfileContainer) MarshalTo(dAtA []byte) (int, error) { +func (m *CallStackNode) MarshalTo(dAtA []byte) (int, error) { size := m.Size() return m.MarshalToSizedBuffer(dAtA[:size]) } -func (m *ApplicationProfileContainer) MarshalToSizedBuffer(dAtA []byte) (int, error) { +func (m *CallStackNode) MarshalToSizedBuffer(dAtA []byte) (int, error) { i := len(dAtA) _ = i var l int _ = l - if len(m.IdentifiedCallStacks) > 0 { - for iNdEx := len(m.IdentifiedCallStacks) - 1; iNdEx >= 0; iNdEx-- { - { - size, err := m.IdentifiedCallStacks[iNdEx].MarshalToSizedBuffer(dAtA[:i]) - if err != nil { - return 0, err - } - i -= size - i = encodeVarintGenerated(dAtA, i, uint64(size)) - } - i-- - dAtA[i] = 0x5a - } - } - if len(m.PolicyByRuleId) > 0 { - keysForPolicyByRuleId := make([]string, 0, len(m.PolicyByRuleId)) - for k := range m.PolicyByRuleId { - keysForPolicyByRuleId = append(keysForPolicyByRuleId, string(k)) - } - sort.Strings(keysForPolicyByRuleId) - for iNdEx := len(keysForPolicyByRuleId) - 1; iNdEx >= 0; iNdEx-- { - v := m.PolicyByRuleId[string(keysForPolicyByRuleId[iNdEx])] - baseI := i - { - size, err := (&v).MarshalToSizedBuffer(dAtA[:i]) - if err != nil { - return 0, err - } - i -= size - i = encodeVarintGenerated(dAtA, i, uint64(size)) - } - i-- - dAtA[i] = 0x12 - i -= len(keysForPolicyByRuleId[iNdEx]) - copy(dAtA[i:], keysForPolicyByRuleId[iNdEx]) - i = encodeVarintGenerated(dAtA, i, uint64(len(keysForPolicyByRuleId[iNdEx]))) - i-- - dAtA[i] = 0xa - i = encodeVarintGenerated(dAtA, i, uint64(baseI-i)) - i-- - dAtA[i] = 0x52 - } - } - i -= len(m.ImageTag) - copy(dAtA[i:], m.ImageTag) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.ImageTag))) - i-- - dAtA[i] = 0x4a - i -= len(m.ImageID) - copy(dAtA[i:], m.ImageID) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.ImageID))) - i-- - dAtA[i] = 0x42 - if len(m.Endpoints) > 0 { - for iNdEx := len(m.Endpoints) - 1; iNdEx >= 0; iNdEx-- { - { - size, err := m.Endpoints[iNdEx].MarshalToSizedBuffer(dAtA[:i]) - if err != nil { - return 0, err - } - i -= size - i = encodeVarintGenerated(dAtA, i, uint64(size)) - } - i-- - dAtA[i] = 0x3a - } - } { - size, err := m.SeccompProfile.MarshalToSizedBuffer(dAtA[:i]) + size, err := m.Frame.MarshalToSizedBuffer(dAtA[:i]) if err != nil { return 0, err } @@ -568,34 +533,11 @@ func (m *ApplicationProfileContainer) MarshalToSizedBuffer(dAtA []byte) (int, er i = encodeVarintGenerated(dAtA, i, uint64(size)) } i-- - dAtA[i] = 0x32 - if len(m.Syscalls) > 0 { - for iNdEx := len(m.Syscalls) - 1; iNdEx >= 0; iNdEx-- { - i -= len(m.Syscalls[iNdEx]) - copy(dAtA[i:], m.Syscalls[iNdEx]) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.Syscalls[iNdEx]))) - i-- - dAtA[i] = 0x2a - } - } - if len(m.Opens) > 0 { - for iNdEx := len(m.Opens) - 1; iNdEx >= 0; iNdEx-- { - { - size, err := m.Opens[iNdEx].MarshalToSizedBuffer(dAtA[:i]) - if err != nil { - return 0, err - } - i -= size - i = encodeVarintGenerated(dAtA, i, uint64(size)) - } - i-- - dAtA[i] = 0x22 - } - } - if len(m.Execs) > 0 { - for iNdEx := len(m.Execs) - 1; iNdEx >= 0; iNdEx-- { + dAtA[i] = 0x12 + if len(m.Children) > 0 { + for iNdEx := len(m.Children) - 1; iNdEx >= 0; iNdEx-- { { - size, err := m.Execs[iNdEx].MarshalToSizedBuffer(dAtA[:i]) + size, err := m.Children[iNdEx].MarshalToSizedBuffer(dAtA[:i]) if err != nil { return 0, err } @@ -603,27 +545,13 @@ func (m *ApplicationProfileContainer) MarshalToSizedBuffer(dAtA []byte) (int, er i = encodeVarintGenerated(dAtA, i, uint64(size)) } i-- - dAtA[i] = 0x1a - } - } - if len(m.Capabilities) > 0 { - for iNdEx := len(m.Capabilities) - 1; iNdEx >= 0; iNdEx-- { - i -= len(m.Capabilities[iNdEx]) - copy(dAtA[i:], m.Capabilities[iNdEx]) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.Capabilities[iNdEx]))) - i-- - dAtA[i] = 0x12 + dAtA[i] = 0xa } } - i -= len(m.Name) - copy(dAtA[i:], m.Name) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.Name))) - i-- - dAtA[i] = 0xa return len(dAtA) - i, nil } -func (m *ApplicationProfileList) Marshal() (dAtA []byte, err error) { +func (m *CollapseConfigEntry) Marshal() (dAtA []byte, err error) { size := m.Size() dAtA = make([]byte, size) n, err := m.MarshalToSizedBuffer(dAtA[:size]) @@ -633,44 +561,28 @@ func (m *ApplicationProfileList) Marshal() (dAtA []byte, err error) { return dAtA[:n], nil } -func (m *ApplicationProfileList) MarshalTo(dAtA []byte) (int, error) { +func (m *CollapseConfigEntry) MarshalTo(dAtA []byte) (int, error) { size := m.Size() return m.MarshalToSizedBuffer(dAtA[:size]) } -func (m *ApplicationProfileList) MarshalToSizedBuffer(dAtA []byte) (int, error) { +func (m *CollapseConfigEntry) MarshalToSizedBuffer(dAtA []byte) (int, error) { i := len(dAtA) _ = i var l int _ = l - if len(m.Items) > 0 { - for iNdEx := len(m.Items) - 1; iNdEx >= 0; iNdEx-- { - { - size, err := m.Items[iNdEx].MarshalToSizedBuffer(dAtA[:i]) - if err != nil { - return 0, err - } - i -= size - i = encodeVarintGenerated(dAtA, i, uint64(size)) - } - i-- - dAtA[i] = 0x12 - } - } - { - size, err := m.ListMeta.MarshalToSizedBuffer(dAtA[:i]) - if err != nil { - return 0, err - } - i -= size - i = encodeVarintGenerated(dAtA, i, uint64(size)) - } + i = encodeVarintGenerated(dAtA, i, uint64(m.Threshold)) + i-- + dAtA[i] = 0x10 + i -= len(m.Prefix) + copy(dAtA[i:], m.Prefix) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.Prefix))) i-- dAtA[i] = 0xa return len(dAtA) - i, nil } -func (m *ApplicationProfileSpec) Marshal() (dAtA []byte, err error) { +func (m *CollapseConfiguration) Marshal() (dAtA []byte, err error) { size := m.Size() dAtA = make([]byte, size) n, err := m.MarshalToSizedBuffer(dAtA[:size]) @@ -680,71 +592,40 @@ func (m *ApplicationProfileSpec) Marshal() (dAtA []byte, err error) { return dAtA[:n], nil } -func (m *ApplicationProfileSpec) MarshalTo(dAtA []byte) (int, error) { +func (m *CollapseConfiguration) MarshalTo(dAtA []byte) (int, error) { size := m.Size() return m.MarshalToSizedBuffer(dAtA[:size]) } -func (m *ApplicationProfileSpec) MarshalToSizedBuffer(dAtA []byte) (int, error) { +func (m *CollapseConfiguration) MarshalToSizedBuffer(dAtA []byte) (int, error) { i := len(dAtA) _ = i var l int _ = l - if len(m.EphemeralContainers) > 0 { - for iNdEx := len(m.EphemeralContainers) - 1; iNdEx >= 0; iNdEx-- { - { - size, err := m.EphemeralContainers[iNdEx].MarshalToSizedBuffer(dAtA[:i]) - if err != nil { - return 0, err - } - i -= size - i = encodeVarintGenerated(dAtA, i, uint64(size)) - } - i-- - dAtA[i] = 0x22 - } - } - if len(m.InitContainers) > 0 { - for iNdEx := len(m.InitContainers) - 1; iNdEx >= 0; iNdEx-- { - { - size, err := m.InitContainers[iNdEx].MarshalToSizedBuffer(dAtA[:i]) - if err != nil { - return 0, err - } - i -= size - i = encodeVarintGenerated(dAtA, i, uint64(size)) - } - i-- - dAtA[i] = 0x1a - } - } - if len(m.Containers) > 0 { - for iNdEx := len(m.Containers) - 1; iNdEx >= 0; iNdEx-- { - { - size, err := m.Containers[iNdEx].MarshalToSizedBuffer(dAtA[:i]) - if err != nil { - return 0, err - } - i -= size - i = encodeVarintGenerated(dAtA, i, uint64(size)) - } - i-- - dAtA[i] = 0x12 + { + size, err := m.Spec.MarshalToSizedBuffer(dAtA[:i]) + if err != nil { + return 0, err } + i -= size + i = encodeVarintGenerated(dAtA, i, uint64(size)) } - if len(m.Architectures) > 0 { - for iNdEx := len(m.Architectures) - 1; iNdEx >= 0; iNdEx-- { - i -= len(m.Architectures[iNdEx]) - copy(dAtA[i:], m.Architectures[iNdEx]) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.Architectures[iNdEx]))) - i-- - dAtA[i] = 0xa + i-- + dAtA[i] = 0x12 + { + size, err := m.ObjectMeta.MarshalToSizedBuffer(dAtA[:i]) + if err != nil { + return 0, err } + i -= size + i = encodeVarintGenerated(dAtA, i, uint64(size)) } + i-- + dAtA[i] = 0xa return len(dAtA) - i, nil } -func (m *ApplicationProfileStatus) Marshal() (dAtA []byte, err error) { +func (m *CollapseConfigurationList) Marshal() (dAtA []byte, err error) { size := m.Size() dAtA = make([]byte, size) n, err := m.MarshalToSizedBuffer(dAtA[:size]) @@ -754,20 +635,44 @@ func (m *ApplicationProfileStatus) Marshal() (dAtA []byte, err error) { return dAtA[:n], nil } -func (m *ApplicationProfileStatus) MarshalTo(dAtA []byte) (int, error) { +func (m *CollapseConfigurationList) MarshalTo(dAtA []byte) (int, error) { size := m.Size() return m.MarshalToSizedBuffer(dAtA[:size]) } -func (m *ApplicationProfileStatus) MarshalToSizedBuffer(dAtA []byte) (int, error) { +func (m *CollapseConfigurationList) MarshalToSizedBuffer(dAtA []byte) (int, error) { i := len(dAtA) _ = i var l int _ = l + if len(m.Items) > 0 { + for iNdEx := len(m.Items) - 1; iNdEx >= 0; iNdEx-- { + { + size, err := m.Items[iNdEx].MarshalToSizedBuffer(dAtA[:i]) + if err != nil { + return 0, err + } + i -= size + i = encodeVarintGenerated(dAtA, i, uint64(size)) + } + i-- + dAtA[i] = 0x12 + } + } + { + size, err := m.ListMeta.MarshalToSizedBuffer(dAtA[:i]) + if err != nil { + return 0, err + } + i -= size + i = encodeVarintGenerated(dAtA, i, uint64(size)) + } + i-- + dAtA[i] = 0xa return len(dAtA) - i, nil } -func (m *Arg) Marshal() (dAtA []byte, err error) { +func (m *CollapseConfigurationSpec) Marshal() (dAtA []byte, err error) { size := m.Size() dAtA = make([]byte, size) n, err := m.MarshalToSizedBuffer(dAtA[:size]) @@ -777,34 +682,46 @@ func (m *Arg) Marshal() (dAtA []byte, err error) { return dAtA[:n], nil } -func (m *Arg) MarshalTo(dAtA []byte) (int, error) { +func (m *CollapseConfigurationSpec) MarshalTo(dAtA []byte) (int, error) { size := m.Size() return m.MarshalToSizedBuffer(dAtA[:size]) } -func (m *Arg) MarshalToSizedBuffer(dAtA []byte) (int, error) { +func (m *CollapseConfigurationSpec) MarshalToSizedBuffer(dAtA []byte) (int, error) { i := len(dAtA) _ = i var l int _ = l - i -= len(m.Op) - copy(dAtA[i:], m.Op) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.Op))) + i = encodeVarintGenerated(dAtA, i, uint64(m.NetworkCIDRFloorBits)) i-- - dAtA[i] = 0x22 - i = encodeVarintGenerated(dAtA, i, uint64(m.ValueTwo)) + dAtA[i] = 0x28 + i = encodeVarintGenerated(dAtA, i, uint64(m.NetworkIPGroupThreshold)) i-- - dAtA[i] = 0x18 - i = encodeVarintGenerated(dAtA, i, uint64(m.Value)) + dAtA[i] = 0x20 + if len(m.CollapseConfigs) > 0 { + for iNdEx := len(m.CollapseConfigs) - 1; iNdEx >= 0; iNdEx-- { + { + size, err := m.CollapseConfigs[iNdEx].MarshalToSizedBuffer(dAtA[:i]) + if err != nil { + return 0, err + } + i -= size + i = encodeVarintGenerated(dAtA, i, uint64(size)) + } + i-- + dAtA[i] = 0x1a + } + } + i = encodeVarintGenerated(dAtA, i, uint64(m.EndpointDynamicThreshold)) i-- dAtA[i] = 0x10 - i = encodeVarintGenerated(dAtA, i, uint64(m.Index)) + i = encodeVarintGenerated(dAtA, i, uint64(m.OpenDynamicThreshold)) i-- dAtA[i] = 0x8 return len(dAtA) - i, nil } -func (m *CPE) Marshal() (dAtA []byte, err error) { +func (m *Component) Marshal() (dAtA []byte, err error) { size := m.Size() dAtA = make([]byte, size) n, err := m.MarshalToSizedBuffer(dAtA[:size]) @@ -814,30 +731,78 @@ func (m *CPE) Marshal() (dAtA []byte, err error) { return dAtA[:n], nil } -func (m *CPE) MarshalTo(dAtA []byte) (int, error) { +func (m *Component) MarshalTo(dAtA []byte) (int, error) { size := m.Size() return m.MarshalToSizedBuffer(dAtA[:size]) } -func (m *CPE) MarshalToSizedBuffer(dAtA []byte) (int, error) { +func (m *Component) MarshalToSizedBuffer(dAtA []byte) (int, error) { i := len(dAtA) _ = i var l int _ = l - i -= len(m.Source) - copy(dAtA[i:], m.Source) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.Source))) + i -= len(m.Supplier) + copy(dAtA[i:], m.Supplier) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.Supplier))) i-- - dAtA[i] = 0x12 - i -= len(m.Value) - copy(dAtA[i:], m.Value) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.Value))) + dAtA[i] = 0x22 + if len(m.Identifiers) > 0 { + keysForIdentifiers := make([]string, 0, len(m.Identifiers)) + for k := range m.Identifiers { + keysForIdentifiers = append(keysForIdentifiers, string(k)) + } + sort.Strings(keysForIdentifiers) + for iNdEx := len(keysForIdentifiers) - 1; iNdEx >= 0; iNdEx-- { + v := m.Identifiers[IdentifierType(keysForIdentifiers[iNdEx])] + baseI := i + i -= len(v) + copy(dAtA[i:], v) + i = encodeVarintGenerated(dAtA, i, uint64(len(v))) + i-- + dAtA[i] = 0x12 + i -= len(keysForIdentifiers[iNdEx]) + copy(dAtA[i:], keysForIdentifiers[iNdEx]) + i = encodeVarintGenerated(dAtA, i, uint64(len(keysForIdentifiers[iNdEx]))) + i-- + dAtA[i] = 0xa + i = encodeVarintGenerated(dAtA, i, uint64(baseI-i)) + i-- + dAtA[i] = 0x1a + } + } + if len(m.Hashes) > 0 { + keysForHashes := make([]string, 0, len(m.Hashes)) + for k := range m.Hashes { + keysForHashes = append(keysForHashes, string(k)) + } + sort.Strings(keysForHashes) + for iNdEx := len(keysForHashes) - 1; iNdEx >= 0; iNdEx-- { + v := m.Hashes[Algorithm(keysForHashes[iNdEx])] + baseI := i + i -= len(v) + copy(dAtA[i:], v) + i = encodeVarintGenerated(dAtA, i, uint64(len(v))) + i-- + dAtA[i] = 0x12 + i -= len(keysForHashes[iNdEx]) + copy(dAtA[i:], keysForHashes[iNdEx]) + i = encodeVarintGenerated(dAtA, i, uint64(len(keysForHashes[iNdEx]))) + i-- + dAtA[i] = 0xa + i = encodeVarintGenerated(dAtA, i, uint64(baseI-i)) + i-- + dAtA[i] = 0x12 + } + } + i -= len(m.ID) + copy(dAtA[i:], m.ID) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.ID))) i-- dAtA[i] = 0xa return len(dAtA) - i, nil } -func (m *CallStack) Marshal() (dAtA []byte, err error) { +func (m *Condition) Marshal() (dAtA []byte, err error) { size := m.Size() dAtA = make([]byte, size) n, err := m.MarshalToSizedBuffer(dAtA[:size]) @@ -847,18 +812,28 @@ func (m *CallStack) Marshal() (dAtA []byte, err error) { return dAtA[:n], nil } -func (m *CallStack) MarshalTo(dAtA []byte) (int, error) { +func (m *Condition) MarshalTo(dAtA []byte) (int, error) { size := m.Size() return m.MarshalToSizedBuffer(dAtA[:size]) } -func (m *CallStack) MarshalToSizedBuffer(dAtA []byte) (int, error) { +func (m *Condition) MarshalToSizedBuffer(dAtA []byte) (int, error) { i := len(dAtA) _ = i var l int _ = l + i -= len(m.Message) + copy(dAtA[i:], m.Message) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.Message))) + i-- + dAtA[i] = 0x2a + i -= len(m.Reason) + copy(dAtA[i:], m.Reason) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.Reason))) + i-- + dAtA[i] = 0x22 { - size, err := m.Root.MarshalToSizedBuffer(dAtA[:i]) + size, err := m.LastTransitionTime.MarshalToSizedBuffer(dAtA[:i]) if err != nil { return 0, err } @@ -866,11 +841,21 @@ func (m *CallStack) MarshalToSizedBuffer(dAtA []byte) (int, error) { i = encodeVarintGenerated(dAtA, i, uint64(size)) } i-- + dAtA[i] = 0x1a + i -= len(m.Status) + copy(dAtA[i:], m.Status) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.Status))) + i-- + dAtA[i] = 0x12 + i -= len(m.Type) + copy(dAtA[i:], m.Type) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.Type))) + i-- dAtA[i] = 0xa return len(dAtA) - i, nil } -func (m *CallStackNode) Marshal() (dAtA []byte, err error) { +func (m *ConditionedStatus) Marshal() (dAtA []byte, err error) { size := m.Size() dAtA = make([]byte, size) n, err := m.MarshalToSizedBuffer(dAtA[:size]) @@ -880,30 +865,20 @@ func (m *CallStackNode) Marshal() (dAtA []byte, err error) { return dAtA[:n], nil } -func (m *CallStackNode) MarshalTo(dAtA []byte) (int, error) { +func (m *ConditionedStatus) MarshalTo(dAtA []byte) (int, error) { size := m.Size() return m.MarshalToSizedBuffer(dAtA[:size]) } -func (m *CallStackNode) MarshalToSizedBuffer(dAtA []byte) (int, error) { +func (m *ConditionedStatus) MarshalToSizedBuffer(dAtA []byte) (int, error) { i := len(dAtA) _ = i var l int _ = l - { - size, err := m.Frame.MarshalToSizedBuffer(dAtA[:i]) - if err != nil { - return 0, err - } - i -= size - i = encodeVarintGenerated(dAtA, i, uint64(size)) - } - i-- - dAtA[i] = 0x12 - if len(m.Children) > 0 { - for iNdEx := len(m.Children) - 1; iNdEx >= 0; iNdEx-- { + if len(m.Conditions) > 0 { + for iNdEx := len(m.Conditions) - 1; iNdEx >= 0; iNdEx-- { { - size, err := m.Children[iNdEx].MarshalToSizedBuffer(dAtA[:i]) + size, err := m.Conditions[iNdEx].MarshalToSizedBuffer(dAtA[:i]) if err != nil { return 0, err } @@ -917,7 +892,7 @@ func (m *CallStackNode) MarshalToSizedBuffer(dAtA []byte) (int, error) { return len(dAtA) - i, nil } -func (m *CollapseConfigEntry) Marshal() (dAtA []byte, err error) { +func (m *ConfigurationScanSummary) Marshal() (dAtA []byte, err error) { size := m.Size() dAtA = make([]byte, size) n, err := m.MarshalToSizedBuffer(dAtA[:size]) @@ -927,55 +902,24 @@ func (m *CollapseConfigEntry) Marshal() (dAtA []byte, err error) { return dAtA[:n], nil } -func (m *CollapseConfigEntry) MarshalTo(dAtA []byte) (int, error) { +func (m *ConfigurationScanSummary) MarshalTo(dAtA []byte) (int, error) { size := m.Size() return m.MarshalToSizedBuffer(dAtA[:size]) } -func (m *CollapseConfigEntry) MarshalToSizedBuffer(dAtA []byte) (int, error) { +func (m *ConfigurationScanSummary) MarshalToSizedBuffer(dAtA []byte) (int, error) { i := len(dAtA) _ = i var l int _ = l - i = encodeVarintGenerated(dAtA, i, uint64(m.Threshold)) - i-- - dAtA[i] = 0x10 - i -= len(m.Prefix) - copy(dAtA[i:], m.Prefix) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.Prefix))) - i-- - dAtA[i] = 0xa - return len(dAtA) - i, nil -} - -func (m *CollapseConfiguration) Marshal() (dAtA []byte, err error) { - size := m.Size() - dAtA = make([]byte, size) - n, err := m.MarshalToSizedBuffer(dAtA[:size]) - if err != nil { - return nil, err - } - return dAtA[:n], nil -} - -func (m *CollapseConfiguration) MarshalTo(dAtA []byte) (int, error) { - size := m.Size() - return m.MarshalToSizedBuffer(dAtA[:size]) -} - -func (m *CollapseConfiguration) MarshalToSizedBuffer(dAtA []byte) (int, error) { - i := len(dAtA) - _ = i - var l int - _ = l - { - size, err := m.Spec.MarshalToSizedBuffer(dAtA[:i]) - if err != nil { - return 0, err - } - i -= size - i = encodeVarintGenerated(dAtA, i, uint64(size)) - } + { + size, err := m.Spec.MarshalToSizedBuffer(dAtA[:i]) + if err != nil { + return 0, err + } + i -= size + i = encodeVarintGenerated(dAtA, i, uint64(size)) + } i-- dAtA[i] = 0x12 { @@ -991,7 +935,7 @@ func (m *CollapseConfiguration) MarshalToSizedBuffer(dAtA []byte) (int, error) { return len(dAtA) - i, nil } -func (m *CollapseConfigurationList) Marshal() (dAtA []byte, err error) { +func (m *ConfigurationScanSummaryList) Marshal() (dAtA []byte, err error) { size := m.Size() dAtA = make([]byte, size) n, err := m.MarshalToSizedBuffer(dAtA[:size]) @@ -1001,12 +945,12 @@ func (m *CollapseConfigurationList) Marshal() (dAtA []byte, err error) { return dAtA[:n], nil } -func (m *CollapseConfigurationList) MarshalTo(dAtA []byte) (int, error) { +func (m *ConfigurationScanSummaryList) MarshalTo(dAtA []byte) (int, error) { size := m.Size() return m.MarshalToSizedBuffer(dAtA[:size]) } -func (m *CollapseConfigurationList) MarshalToSizedBuffer(dAtA []byte) (int, error) { +func (m *ConfigurationScanSummaryList) MarshalToSizedBuffer(dAtA []byte) (int, error) { i := len(dAtA) _ = i var l int @@ -1038,7 +982,7 @@ func (m *CollapseConfigurationList) MarshalToSizedBuffer(dAtA []byte) (int, erro return len(dAtA) - i, nil } -func (m *CollapseConfigurationSpec) Marshal() (dAtA []byte, err error) { +func (m *ConfigurationScanSummarySpec) Marshal() (dAtA []byte, err error) { size := m.Size() dAtA = make([]byte, size) n, err := m.MarshalToSizedBuffer(dAtA[:size]) @@ -1048,26 +992,20 @@ func (m *CollapseConfigurationSpec) Marshal() (dAtA []byte, err error) { return dAtA[:n], nil } -func (m *CollapseConfigurationSpec) MarshalTo(dAtA []byte) (int, error) { +func (m *ConfigurationScanSummarySpec) MarshalTo(dAtA []byte) (int, error) { size := m.Size() return m.MarshalToSizedBuffer(dAtA[:size]) } -func (m *CollapseConfigurationSpec) MarshalToSizedBuffer(dAtA []byte) (int, error) { +func (m *ConfigurationScanSummarySpec) MarshalToSizedBuffer(dAtA []byte) (int, error) { i := len(dAtA) _ = i var l int _ = l - i = encodeVarintGenerated(dAtA, i, uint64(m.NetworkCIDRFloorBits)) - i-- - dAtA[i] = 0x28 - i = encodeVarintGenerated(dAtA, i, uint64(m.NetworkIPGroupThreshold)) - i-- - dAtA[i] = 0x20 - if len(m.CollapseConfigs) > 0 { - for iNdEx := len(m.CollapseConfigs) - 1; iNdEx >= 0; iNdEx-- { + if len(m.WorkloadConfigurationScanSummaryIdentifiers) > 0 { + for iNdEx := len(m.WorkloadConfigurationScanSummaryIdentifiers) - 1; iNdEx >= 0; iNdEx-- { { - size, err := m.CollapseConfigs[iNdEx].MarshalToSizedBuffer(dAtA[:i]) + size, err := m.WorkloadConfigurationScanSummaryIdentifiers[iNdEx].MarshalToSizedBuffer(dAtA[:i]) if err != nil { return 0, err } @@ -1075,100 +1013,23 @@ func (m *CollapseConfigurationSpec) MarshalToSizedBuffer(dAtA []byte) (int, erro i = encodeVarintGenerated(dAtA, i, uint64(size)) } i-- - dAtA[i] = 0x1a - } - } - i = encodeVarintGenerated(dAtA, i, uint64(m.EndpointDynamicThreshold)) - i-- - dAtA[i] = 0x10 - i = encodeVarintGenerated(dAtA, i, uint64(m.OpenDynamicThreshold)) - i-- - dAtA[i] = 0x8 - return len(dAtA) - i, nil -} - -func (m *Component) Marshal() (dAtA []byte, err error) { - size := m.Size() - dAtA = make([]byte, size) - n, err := m.MarshalToSizedBuffer(dAtA[:size]) - if err != nil { - return nil, err - } - return dAtA[:n], nil -} - -func (m *Component) MarshalTo(dAtA []byte) (int, error) { - size := m.Size() - return m.MarshalToSizedBuffer(dAtA[:size]) -} - -func (m *Component) MarshalToSizedBuffer(dAtA []byte) (int, error) { - i := len(dAtA) - _ = i - var l int - _ = l - i -= len(m.Supplier) - copy(dAtA[i:], m.Supplier) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.Supplier))) - i-- - dAtA[i] = 0x22 - if len(m.Identifiers) > 0 { - keysForIdentifiers := make([]string, 0, len(m.Identifiers)) - for k := range m.Identifiers { - keysForIdentifiers = append(keysForIdentifiers, string(k)) - } - sort.Strings(keysForIdentifiers) - for iNdEx := len(keysForIdentifiers) - 1; iNdEx >= 0; iNdEx-- { - v := m.Identifiers[IdentifierType(keysForIdentifiers[iNdEx])] - baseI := i - i -= len(v) - copy(dAtA[i:], v) - i = encodeVarintGenerated(dAtA, i, uint64(len(v))) - i-- dAtA[i] = 0x12 - i -= len(keysForIdentifiers[iNdEx]) - copy(dAtA[i:], keysForIdentifiers[iNdEx]) - i = encodeVarintGenerated(dAtA, i, uint64(len(keysForIdentifiers[iNdEx]))) - i-- - dAtA[i] = 0xa - i = encodeVarintGenerated(dAtA, i, uint64(baseI-i)) - i-- - dAtA[i] = 0x1a } } - if len(m.Hashes) > 0 { - keysForHashes := make([]string, 0, len(m.Hashes)) - for k := range m.Hashes { - keysForHashes = append(keysForHashes, string(k)) - } - sort.Strings(keysForHashes) - for iNdEx := len(keysForHashes) - 1; iNdEx >= 0; iNdEx-- { - v := m.Hashes[Algorithm(keysForHashes[iNdEx])] - baseI := i - i -= len(v) - copy(dAtA[i:], v) - i = encodeVarintGenerated(dAtA, i, uint64(len(v))) - i-- - dAtA[i] = 0x12 - i -= len(keysForHashes[iNdEx]) - copy(dAtA[i:], keysForHashes[iNdEx]) - i = encodeVarintGenerated(dAtA, i, uint64(len(keysForHashes[iNdEx]))) - i-- - dAtA[i] = 0xa - i = encodeVarintGenerated(dAtA, i, uint64(baseI-i)) - i-- - dAtA[i] = 0x12 + { + size, err := m.Severities.MarshalToSizedBuffer(dAtA[:i]) + if err != nil { + return 0, err } + i -= size + i = encodeVarintGenerated(dAtA, i, uint64(size)) } - i -= len(m.ID) - copy(dAtA[i:], m.ID) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.ID))) i-- dAtA[i] = 0xa return len(dAtA) - i, nil } -func (m *Condition) Marshal() (dAtA []byte, err error) { +func (m *ContainerProfile) Marshal() (dAtA []byte, err error) { size := m.Size() dAtA = make([]byte, size) n, err := m.MarshalToSizedBuffer(dAtA[:size]) @@ -1178,28 +1039,18 @@ func (m *Condition) Marshal() (dAtA []byte, err error) { return dAtA[:n], nil } -func (m *Condition) MarshalTo(dAtA []byte) (int, error) { +func (m *ContainerProfile) MarshalTo(dAtA []byte) (int, error) { size := m.Size() return m.MarshalToSizedBuffer(dAtA[:size]) } -func (m *Condition) MarshalToSizedBuffer(dAtA []byte) (int, error) { +func (m *ContainerProfile) MarshalToSizedBuffer(dAtA []byte) (int, error) { i := len(dAtA) _ = i var l int _ = l - i -= len(m.Message) - copy(dAtA[i:], m.Message) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.Message))) - i-- - dAtA[i] = 0x2a - i -= len(m.Reason) - copy(dAtA[i:], m.Reason) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.Reason))) - i-- - dAtA[i] = 0x22 { - size, err := m.LastTransitionTime.MarshalToSizedBuffer(dAtA[:i]) + size, err := m.Status.MarshalToSizedBuffer(dAtA[:i]) if err != nil { return 0, err } @@ -1208,76 +1059,6 @@ func (m *Condition) MarshalToSizedBuffer(dAtA []byte) (int, error) { } i-- dAtA[i] = 0x1a - i -= len(m.Status) - copy(dAtA[i:], m.Status) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.Status))) - i-- - dAtA[i] = 0x12 - i -= len(m.Type) - copy(dAtA[i:], m.Type) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.Type))) - i-- - dAtA[i] = 0xa - return len(dAtA) - i, nil -} - -func (m *ConditionedStatus) Marshal() (dAtA []byte, err error) { - size := m.Size() - dAtA = make([]byte, size) - n, err := m.MarshalToSizedBuffer(dAtA[:size]) - if err != nil { - return nil, err - } - return dAtA[:n], nil -} - -func (m *ConditionedStatus) MarshalTo(dAtA []byte) (int, error) { - size := m.Size() - return m.MarshalToSizedBuffer(dAtA[:size]) -} - -func (m *ConditionedStatus) MarshalToSizedBuffer(dAtA []byte) (int, error) { - i := len(dAtA) - _ = i - var l int - _ = l - if len(m.Conditions) > 0 { - for iNdEx := len(m.Conditions) - 1; iNdEx >= 0; iNdEx-- { - { - size, err := m.Conditions[iNdEx].MarshalToSizedBuffer(dAtA[:i]) - if err != nil { - return 0, err - } - i -= size - i = encodeVarintGenerated(dAtA, i, uint64(size)) - } - i-- - dAtA[i] = 0xa - } - } - return len(dAtA) - i, nil -} - -func (m *ConfigurationScanSummary) Marshal() (dAtA []byte, err error) { - size := m.Size() - dAtA = make([]byte, size) - n, err := m.MarshalToSizedBuffer(dAtA[:size]) - if err != nil { - return nil, err - } - return dAtA[:n], nil -} - -func (m *ConfigurationScanSummary) MarshalTo(dAtA []byte) (int, error) { - size := m.Size() - return m.MarshalToSizedBuffer(dAtA[:size]) -} - -func (m *ConfigurationScanSummary) MarshalToSizedBuffer(dAtA []byte) (int, error) { - i := len(dAtA) - _ = i - var l int - _ = l { size, err := m.Spec.MarshalToSizedBuffer(dAtA[:i]) if err != nil { @@ -1301,7 +1082,7 @@ func (m *ConfigurationScanSummary) MarshalToSizedBuffer(dAtA []byte) (int, error return len(dAtA) - i, nil } -func (m *ConfigurationScanSummaryList) Marshal() (dAtA []byte, err error) { +func (m *ContainerProfileList) Marshal() (dAtA []byte, err error) { size := m.Size() dAtA = make([]byte, size) n, err := m.MarshalToSizedBuffer(dAtA[:size]) @@ -1311,12 +1092,12 @@ func (m *ConfigurationScanSummaryList) Marshal() (dAtA []byte, err error) { return dAtA[:n], nil } -func (m *ConfigurationScanSummaryList) MarshalTo(dAtA []byte) (int, error) { +func (m *ContainerProfileList) MarshalTo(dAtA []byte) (int, error) { size := m.Size() return m.MarshalToSizedBuffer(dAtA[:size]) } -func (m *ConfigurationScanSummaryList) MarshalToSizedBuffer(dAtA []byte) (int, error) { +func (m *ContainerProfileList) MarshalToSizedBuffer(dAtA []byte) (int, error) { i := len(dAtA) _ = i var l int @@ -1348,7 +1129,7 @@ func (m *ConfigurationScanSummaryList) MarshalToSizedBuffer(dAtA []byte) (int, e return len(dAtA) - i, nil } -func (m *ConfigurationScanSummarySpec) Marshal() (dAtA []byte, err error) { +func (m *ContainerProfileSpec) Marshal() (dAtA []byte, err error) { size := m.Size() dAtA = make([]byte, size) n, err := m.MarshalToSizedBuffer(dAtA[:size]) @@ -1358,20 +1139,20 @@ func (m *ConfigurationScanSummarySpec) Marshal() (dAtA []byte, err error) { return dAtA[:n], nil } -func (m *ConfigurationScanSummarySpec) MarshalTo(dAtA []byte) (int, error) { +func (m *ContainerProfileSpec) MarshalTo(dAtA []byte) (int, error) { size := m.Size() return m.MarshalToSizedBuffer(dAtA[:size]) } -func (m *ConfigurationScanSummarySpec) MarshalToSizedBuffer(dAtA []byte) (int, error) { +func (m *ContainerProfileSpec) MarshalToSizedBuffer(dAtA []byte) (int, error) { i := len(dAtA) _ = i var l int _ = l - if len(m.WorkloadConfigurationScanSummaryIdentifiers) > 0 { - for iNdEx := len(m.WorkloadConfigurationScanSummaryIdentifiers) - 1; iNdEx >= 0; iNdEx-- { + if len(m.Egress) > 0 { + for iNdEx := len(m.Egress) - 1; iNdEx >= 0; iNdEx-- { { - size, err := m.WorkloadConfigurationScanSummaryIdentifiers[iNdEx].MarshalToSizedBuffer(dAtA[:i]) + size, err := m.Egress[iNdEx].MarshalToSizedBuffer(dAtA[:i]) if err != nil { return 0, err } @@ -1379,156 +1160,9 @@ func (m *ConfigurationScanSummarySpec) MarshalToSizedBuffer(dAtA []byte) (int, e i = encodeVarintGenerated(dAtA, i, uint64(size)) } i-- - dAtA[i] = 0x12 - } - } - { - size, err := m.Severities.MarshalToSizedBuffer(dAtA[:i]) - if err != nil { - return 0, err - } - i -= size - i = encodeVarintGenerated(dAtA, i, uint64(size)) - } - i-- - dAtA[i] = 0xa - return len(dAtA) - i, nil -} - -func (m *ContainerProfile) Marshal() (dAtA []byte, err error) { - size := m.Size() - dAtA = make([]byte, size) - n, err := m.MarshalToSizedBuffer(dAtA[:size]) - if err != nil { - return nil, err - } - return dAtA[:n], nil -} - -func (m *ContainerProfile) MarshalTo(dAtA []byte) (int, error) { - size := m.Size() - return m.MarshalToSizedBuffer(dAtA[:size]) -} - -func (m *ContainerProfile) MarshalToSizedBuffer(dAtA []byte) (int, error) { - i := len(dAtA) - _ = i - var l int - _ = l - { - size, err := m.Status.MarshalToSizedBuffer(dAtA[:i]) - if err != nil { - return 0, err - } - i -= size - i = encodeVarintGenerated(dAtA, i, uint64(size)) - } - i-- - dAtA[i] = 0x1a - { - size, err := m.Spec.MarshalToSizedBuffer(dAtA[:i]) - if err != nil { - return 0, err - } - i -= size - i = encodeVarintGenerated(dAtA, i, uint64(size)) - } - i-- - dAtA[i] = 0x12 - { - size, err := m.ObjectMeta.MarshalToSizedBuffer(dAtA[:i]) - if err != nil { - return 0, err - } - i -= size - i = encodeVarintGenerated(dAtA, i, uint64(size)) - } - i-- - dAtA[i] = 0xa - return len(dAtA) - i, nil -} - -func (m *ContainerProfileList) Marshal() (dAtA []byte, err error) { - size := m.Size() - dAtA = make([]byte, size) - n, err := m.MarshalToSizedBuffer(dAtA[:size]) - if err != nil { - return nil, err - } - return dAtA[:n], nil -} - -func (m *ContainerProfileList) MarshalTo(dAtA []byte) (int, error) { - size := m.Size() - return m.MarshalToSizedBuffer(dAtA[:size]) -} - -func (m *ContainerProfileList) MarshalToSizedBuffer(dAtA []byte) (int, error) { - i := len(dAtA) - _ = i - var l int - _ = l - if len(m.Items) > 0 { - for iNdEx := len(m.Items) - 1; iNdEx >= 0; iNdEx-- { - { - size, err := m.Items[iNdEx].MarshalToSizedBuffer(dAtA[:i]) - if err != nil { - return 0, err - } - i -= size - i = encodeVarintGenerated(dAtA, i, uint64(size)) - } - i-- - dAtA[i] = 0x12 - } - } - { - size, err := m.ListMeta.MarshalToSizedBuffer(dAtA[:i]) - if err != nil { - return 0, err - } - i -= size - i = encodeVarintGenerated(dAtA, i, uint64(size)) - } - i-- - dAtA[i] = 0xa - return len(dAtA) - i, nil -} - -func (m *ContainerProfileSpec) Marshal() (dAtA []byte, err error) { - size := m.Size() - dAtA = make([]byte, size) - n, err := m.MarshalToSizedBuffer(dAtA[:size]) - if err != nil { - return nil, err - } - return dAtA[:n], nil -} - -func (m *ContainerProfileSpec) MarshalTo(dAtA []byte) (int, error) { - size := m.Size() - return m.MarshalToSizedBuffer(dAtA[:size]) -} - -func (m *ContainerProfileSpec) MarshalToSizedBuffer(dAtA []byte) (int, error) { - i := len(dAtA) - _ = i - var l int - _ = l - if len(m.Egress) > 0 { - for iNdEx := len(m.Egress) - 1; iNdEx >= 0; iNdEx-- { - { - size, err := m.Egress[iNdEx].MarshalToSizedBuffer(dAtA[:i]) - if err != nil { - return 0, err - } - i -= size - i = encodeVarintGenerated(dAtA, i, uint64(size)) - } - i-- - dAtA[i] = 0x6 - i-- - dAtA[i] = 0xba + dAtA[i] = 0x6 + i-- + dAtA[i] = 0xba } } if len(m.Ingress) > 0 { @@ -4464,7 +4098,7 @@ func (m *NetworkNeighbor) MarshalToSizedBuffer(dAtA []byte) (int, error) { return len(dAtA) - i, nil } -func (m *NetworkNeighborhood) Marshal() (dAtA []byte, err error) { +func (m *NetworkPolicy) Marshal() (dAtA []byte, err error) { size := m.Size() dAtA = make([]byte, size) n, err := m.MarshalToSizedBuffer(dAtA[:size]) @@ -4474,12 +4108,12 @@ func (m *NetworkNeighborhood) Marshal() (dAtA []byte, err error) { return dAtA[:n], nil } -func (m *NetworkNeighborhood) MarshalTo(dAtA []byte) (int, error) { +func (m *NetworkPolicy) MarshalTo(dAtA []byte) (int, error) { size := m.Size() return m.MarshalToSizedBuffer(dAtA[:size]) } -func (m *NetworkNeighborhood) MarshalToSizedBuffer(dAtA []byte) (int, error) { +func (m *NetworkPolicy) MarshalToSizedBuffer(dAtA []byte) (int, error) { i := len(dAtA) _ = i var l int @@ -4493,7 +4127,7 @@ func (m *NetworkNeighborhood) MarshalToSizedBuffer(dAtA []byte) (int, error) { i = encodeVarintGenerated(dAtA, i, uint64(size)) } i-- - dAtA[i] = 0x12 + dAtA[i] = 0x22 { size, err := m.ObjectMeta.MarshalToSizedBuffer(dAtA[:i]) if err != nil { @@ -4503,11 +4137,21 @@ func (m *NetworkNeighborhood) MarshalToSizedBuffer(dAtA []byte) (int, error) { i = encodeVarintGenerated(dAtA, i, uint64(size)) } i-- + dAtA[i] = 0x1a + i -= len(m.APIVersion) + copy(dAtA[i:], m.APIVersion) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.APIVersion))) + i-- + dAtA[i] = 0x12 + i -= len(m.Kind) + copy(dAtA[i:], m.Kind) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.Kind))) + i-- dAtA[i] = 0xa return len(dAtA) - i, nil } -func (m *NetworkNeighborhoodContainer) Marshal() (dAtA []byte, err error) { +func (m *NetworkPolicyEgressRule) Marshal() (dAtA []byte, err error) { size := m.Size() dAtA = make([]byte, size) n, err := m.MarshalToSizedBuffer(dAtA[:size]) @@ -4517,20 +4161,20 @@ func (m *NetworkNeighborhoodContainer) Marshal() (dAtA []byte, err error) { return dAtA[:n], nil } -func (m *NetworkNeighborhoodContainer) MarshalTo(dAtA []byte) (int, error) { +func (m *NetworkPolicyEgressRule) MarshalTo(dAtA []byte) (int, error) { size := m.Size() return m.MarshalToSizedBuffer(dAtA[:size]) } -func (m *NetworkNeighborhoodContainer) MarshalToSizedBuffer(dAtA []byte) (int, error) { +func (m *NetworkPolicyEgressRule) MarshalToSizedBuffer(dAtA []byte) (int, error) { i := len(dAtA) _ = i var l int _ = l - if len(m.Egress) > 0 { - for iNdEx := len(m.Egress) - 1; iNdEx >= 0; iNdEx-- { + if len(m.To) > 0 { + for iNdEx := len(m.To) - 1; iNdEx >= 0; iNdEx-- { { - size, err := m.Egress[iNdEx].MarshalToSizedBuffer(dAtA[:i]) + size, err := m.To[iNdEx].MarshalToSizedBuffer(dAtA[:i]) if err != nil { return 0, err } @@ -4538,13 +4182,50 @@ func (m *NetworkNeighborhoodContainer) MarshalToSizedBuffer(dAtA []byte) (int, e i = encodeVarintGenerated(dAtA, i, uint64(size)) } i-- - dAtA[i] = 0x1a + dAtA[i] = 0x12 } } - if len(m.Ingress) > 0 { - for iNdEx := len(m.Ingress) - 1; iNdEx >= 0; iNdEx-- { + if len(m.Ports) > 0 { + for iNdEx := len(m.Ports) - 1; iNdEx >= 0; iNdEx-- { { - size, err := m.Ingress[iNdEx].MarshalToSizedBuffer(dAtA[:i]) + size, err := m.Ports[iNdEx].MarshalToSizedBuffer(dAtA[:i]) + if err != nil { + return 0, err + } + i -= size + i = encodeVarintGenerated(dAtA, i, uint64(size)) + } + i-- + dAtA[i] = 0xa + } + } + return len(dAtA) - i, nil +} + +func (m *NetworkPolicyIngressRule) Marshal() (dAtA []byte, err error) { + size := m.Size() + dAtA = make([]byte, size) + n, err := m.MarshalToSizedBuffer(dAtA[:size]) + if err != nil { + return nil, err + } + return dAtA[:n], nil +} + +func (m *NetworkPolicyIngressRule) MarshalTo(dAtA []byte) (int, error) { + size := m.Size() + return m.MarshalToSizedBuffer(dAtA[:size]) +} + +func (m *NetworkPolicyIngressRule) MarshalToSizedBuffer(dAtA []byte) (int, error) { + i := len(dAtA) + _ = i + var l int + _ = l + if len(m.From) > 0 { + for iNdEx := len(m.From) - 1; iNdEx >= 0; iNdEx-- { + { + size, err := m.From[iNdEx].MarshalToSizedBuffer(dAtA[:i]) if err != nil { return 0, err } @@ -4555,15 +4236,24 @@ func (m *NetworkNeighborhoodContainer) MarshalToSizedBuffer(dAtA []byte) (int, e dAtA[i] = 0x12 } } - i -= len(m.Name) - copy(dAtA[i:], m.Name) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.Name))) - i-- - dAtA[i] = 0xa + if len(m.Ports) > 0 { + for iNdEx := len(m.Ports) - 1; iNdEx >= 0; iNdEx-- { + { + size, err := m.Ports[iNdEx].MarshalToSizedBuffer(dAtA[:i]) + if err != nil { + return 0, err + } + i -= size + i = encodeVarintGenerated(dAtA, i, uint64(size)) + } + i-- + dAtA[i] = 0xa + } + } return len(dAtA) - i, nil } -func (m *NetworkNeighborhoodList) Marshal() (dAtA []byte, err error) { +func (m *NetworkPolicyList) Marshal() (dAtA []byte, err error) { size := m.Size() dAtA = make([]byte, size) n, err := m.MarshalToSizedBuffer(dAtA[:size]) @@ -4573,12 +4263,12 @@ func (m *NetworkNeighborhoodList) Marshal() (dAtA []byte, err error) { return dAtA[:n], nil } -func (m *NetworkNeighborhoodList) MarshalTo(dAtA []byte) (int, error) { +func (m *NetworkPolicyList) MarshalTo(dAtA []byte) (int, error) { size := m.Size() return m.MarshalToSizedBuffer(dAtA[:size]) } -func (m *NetworkNeighborhoodList) MarshalToSizedBuffer(dAtA []byte) (int, error) { +func (m *NetworkPolicyList) MarshalToSizedBuffer(dAtA []byte) (int, error) { i := len(dAtA) _ = i var l int @@ -4610,7 +4300,7 @@ func (m *NetworkNeighborhoodList) MarshalToSizedBuffer(dAtA []byte) (int, error) return len(dAtA) - i, nil } -func (m *NetworkNeighborhoodSpec) Marshal() (dAtA []byte, err error) { +func (m *NetworkPolicyPeer) Marshal() (dAtA []byte, err error) { size := m.Size() dAtA = make([]byte, size) n, err := m.MarshalToSizedBuffer(dAtA[:size]) @@ -4620,72 +4310,56 @@ func (m *NetworkNeighborhoodSpec) Marshal() (dAtA []byte, err error) { return dAtA[:n], nil } -func (m *NetworkNeighborhoodSpec) MarshalTo(dAtA []byte) (int, error) { +func (m *NetworkPolicyPeer) MarshalTo(dAtA []byte) (int, error) { size := m.Size() return m.MarshalToSizedBuffer(dAtA[:size]) } -func (m *NetworkNeighborhoodSpec) MarshalToSizedBuffer(dAtA []byte) (int, error) { +func (m *NetworkPolicyPeer) MarshalToSizedBuffer(dAtA []byte) (int, error) { i := len(dAtA) _ = i var l int _ = l - if len(m.EphemeralContainers) > 0 { - for iNdEx := len(m.EphemeralContainers) - 1; iNdEx >= 0; iNdEx-- { - { - size, err := m.EphemeralContainers[iNdEx].MarshalToSizedBuffer(dAtA[:i]) - if err != nil { - return 0, err - } - i -= size - i = encodeVarintGenerated(dAtA, i, uint64(size)) + if m.IPBlock != nil { + { + size, err := m.IPBlock.MarshalToSizedBuffer(dAtA[:i]) + if err != nil { + return 0, err } - i-- - dAtA[i] = 0x32 + i -= size + i = encodeVarintGenerated(dAtA, i, uint64(size)) } + i-- + dAtA[i] = 0x1a } - if len(m.InitContainers) > 0 { - for iNdEx := len(m.InitContainers) - 1; iNdEx >= 0; iNdEx-- { - { - size, err := m.InitContainers[iNdEx].MarshalToSizedBuffer(dAtA[:i]) - if err != nil { - return 0, err - } - i -= size - i = encodeVarintGenerated(dAtA, i, uint64(size)) + if m.NamespaceSelector != nil { + { + size, err := m.NamespaceSelector.MarshalToSizedBuffer(dAtA[:i]) + if err != nil { + return 0, err } - i-- - dAtA[i] = 0x2a + i -= size + i = encodeVarintGenerated(dAtA, i, uint64(size)) } + i-- + dAtA[i] = 0x12 } - if len(m.Containers) > 0 { - for iNdEx := len(m.Containers) - 1; iNdEx >= 0; iNdEx-- { - { - size, err := m.Containers[iNdEx].MarshalToSizedBuffer(dAtA[:i]) - if err != nil { - return 0, err - } - i -= size - i = encodeVarintGenerated(dAtA, i, uint64(size)) + if m.PodSelector != nil { + { + size, err := m.PodSelector.MarshalToSizedBuffer(dAtA[:i]) + if err != nil { + return 0, err } - i-- - dAtA[i] = 0x22 - } - } - { - size, err := m.LabelSelector.MarshalToSizedBuffer(dAtA[:i]) - if err != nil { - return 0, err + i -= size + i = encodeVarintGenerated(dAtA, i, uint64(size)) } - i -= size - i = encodeVarintGenerated(dAtA, i, uint64(size)) + i-- + dAtA[i] = 0xa } - i-- - dAtA[i] = 0x1a return len(dAtA) - i, nil } -func (m *NetworkPolicy) Marshal() (dAtA []byte, err error) { +func (m *NetworkPolicyPort) Marshal() (dAtA []byte, err error) { size := m.Size() dAtA = make([]byte, size) n, err := m.MarshalToSizedBuffer(dAtA[:size]) @@ -4695,50 +4369,37 @@ func (m *NetworkPolicy) Marshal() (dAtA []byte, err error) { return dAtA[:n], nil } -func (m *NetworkPolicy) MarshalTo(dAtA []byte) (int, error) { +func (m *NetworkPolicyPort) MarshalTo(dAtA []byte) (int, error) { size := m.Size() return m.MarshalToSizedBuffer(dAtA[:size]) } -func (m *NetworkPolicy) MarshalToSizedBuffer(dAtA []byte) (int, error) { +func (m *NetworkPolicyPort) MarshalToSizedBuffer(dAtA []byte) (int, error) { i := len(dAtA) _ = i var l int _ = l - { - size, err := m.Spec.MarshalToSizedBuffer(dAtA[:i]) - if err != nil { - return 0, err - } - i -= size - i = encodeVarintGenerated(dAtA, i, uint64(size)) + if m.EndPort != nil { + i = encodeVarintGenerated(dAtA, i, uint64(*m.EndPort)) + i-- + dAtA[i] = 0x18 } - i-- - dAtA[i] = 0x22 - { - size, err := m.ObjectMeta.MarshalToSizedBuffer(dAtA[:i]) - if err != nil { - return 0, err - } - i -= size - i = encodeVarintGenerated(dAtA, i, uint64(size)) + if m.Port != nil { + i = encodeVarintGenerated(dAtA, i, uint64(*m.Port)) + i-- + dAtA[i] = 0x10 + } + if m.Protocol != nil { + i -= len(*m.Protocol) + copy(dAtA[i:], *m.Protocol) + i = encodeVarintGenerated(dAtA, i, uint64(len(*m.Protocol))) + i-- + dAtA[i] = 0xa } - i-- - dAtA[i] = 0x1a - i -= len(m.APIVersion) - copy(dAtA[i:], m.APIVersion) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.APIVersion))) - i-- - dAtA[i] = 0x12 - i -= len(m.Kind) - copy(dAtA[i:], m.Kind) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.Kind))) - i-- - dAtA[i] = 0xa return len(dAtA) - i, nil } -func (m *NetworkPolicyEgressRule) Marshal() (dAtA []byte, err error) { +func (m *NetworkPolicySpec) Marshal() (dAtA []byte, err error) { size := m.Size() dAtA = make([]byte, size) n, err := m.MarshalToSizedBuffer(dAtA[:size]) @@ -4748,20 +4409,29 @@ func (m *NetworkPolicyEgressRule) Marshal() (dAtA []byte, err error) { return dAtA[:n], nil } -func (m *NetworkPolicyEgressRule) MarshalTo(dAtA []byte) (int, error) { +func (m *NetworkPolicySpec) MarshalTo(dAtA []byte) (int, error) { size := m.Size() return m.MarshalToSizedBuffer(dAtA[:size]) } -func (m *NetworkPolicyEgressRule) MarshalToSizedBuffer(dAtA []byte) (int, error) { +func (m *NetworkPolicySpec) MarshalToSizedBuffer(dAtA []byte) (int, error) { i := len(dAtA) _ = i var l int _ = l - if len(m.To) > 0 { - for iNdEx := len(m.To) - 1; iNdEx >= 0; iNdEx-- { + if len(m.PolicyTypes) > 0 { + for iNdEx := len(m.PolicyTypes) - 1; iNdEx >= 0; iNdEx-- { + i -= len(m.PolicyTypes[iNdEx]) + copy(dAtA[i:], m.PolicyTypes[iNdEx]) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.PolicyTypes[iNdEx]))) + i-- + dAtA[i] = 0x22 + } + } + if len(m.Egress) > 0 { + for iNdEx := len(m.Egress) - 1; iNdEx >= 0; iNdEx-- { { - size, err := m.To[iNdEx].MarshalToSizedBuffer(dAtA[:i]) + size, err := m.Egress[iNdEx].MarshalToSizedBuffer(dAtA[:i]) if err != nil { return 0, err } @@ -4769,13 +4439,13 @@ func (m *NetworkPolicyEgressRule) MarshalToSizedBuffer(dAtA []byte) (int, error) i = encodeVarintGenerated(dAtA, i, uint64(size)) } i-- - dAtA[i] = 0x12 + dAtA[i] = 0x1a } } - if len(m.Ports) > 0 { - for iNdEx := len(m.Ports) - 1; iNdEx >= 0; iNdEx-- { + if len(m.Ingress) > 0 { + for iNdEx := len(m.Ingress) - 1; iNdEx >= 0; iNdEx-- { { - size, err := m.Ports[iNdEx].MarshalToSizedBuffer(dAtA[:i]) + size, err := m.Ingress[iNdEx].MarshalToSizedBuffer(dAtA[:i]) if err != nil { return 0, err } @@ -4783,13 +4453,23 @@ func (m *NetworkPolicyEgressRule) MarshalToSizedBuffer(dAtA []byte) (int, error) i = encodeVarintGenerated(dAtA, i, uint64(size)) } i-- - dAtA[i] = 0xa + dAtA[i] = 0x12 } } + { + size, err := m.PodSelector.MarshalToSizedBuffer(dAtA[:i]) + if err != nil { + return 0, err + } + i -= size + i = encodeVarintGenerated(dAtA, i, uint64(size)) + } + i-- + dAtA[i] = 0xa return len(dAtA) - i, nil } -func (m *NetworkPolicyIngressRule) Marshal() (dAtA []byte, err error) { +func (m *NetworkPolicyStatus) Marshal() (dAtA []byte, err error) { size := m.Size() dAtA = make([]byte, size) n, err := m.MarshalToSizedBuffer(dAtA[:size]) @@ -4799,34 +4479,20 @@ func (m *NetworkPolicyIngressRule) Marshal() (dAtA []byte, err error) { return dAtA[:n], nil } -func (m *NetworkPolicyIngressRule) MarshalTo(dAtA []byte) (int, error) { +func (m *NetworkPolicyStatus) MarshalTo(dAtA []byte) (int, error) { size := m.Size() return m.MarshalToSizedBuffer(dAtA[:size]) } -func (m *NetworkPolicyIngressRule) MarshalToSizedBuffer(dAtA []byte) (int, error) { +func (m *NetworkPolicyStatus) MarshalToSizedBuffer(dAtA []byte) (int, error) { i := len(dAtA) _ = i var l int _ = l - if len(m.From) > 0 { - for iNdEx := len(m.From) - 1; iNdEx >= 0; iNdEx-- { - { - size, err := m.From[iNdEx].MarshalToSizedBuffer(dAtA[:i]) - if err != nil { - return 0, err - } - i -= size - i = encodeVarintGenerated(dAtA, i, uint64(size)) - } - i-- - dAtA[i] = 0x12 - } - } - if len(m.Ports) > 0 { - for iNdEx := len(m.Ports) - 1; iNdEx >= 0; iNdEx-- { + if len(m.Conditions) > 0 { + for iNdEx := len(m.Conditions) - 1; iNdEx >= 0; iNdEx-- { { - size, err := m.Ports[iNdEx].MarshalToSizedBuffer(dAtA[:i]) + size, err := m.Conditions[iNdEx].MarshalToSizedBuffer(dAtA[:i]) if err != nil { return 0, err } @@ -4840,7 +4506,7 @@ func (m *NetworkPolicyIngressRule) MarshalToSizedBuffer(dAtA []byte) (int, error return len(dAtA) - i, nil } -func (m *NetworkPolicyList) Marshal() (dAtA []byte, err error) { +func (m *NetworkPort) Marshal() (dAtA []byte, err error) { size := m.Size() dAtA = make([]byte, size) n, err := m.MarshalToSizedBuffer(dAtA[:size]) @@ -4850,44 +4516,72 @@ func (m *NetworkPolicyList) Marshal() (dAtA []byte, err error) { return dAtA[:n], nil } -func (m *NetworkPolicyList) MarshalTo(dAtA []byte) (int, error) { +func (m *NetworkPort) MarshalTo(dAtA []byte) (int, error) { size := m.Size() return m.MarshalToSizedBuffer(dAtA[:size]) } -func (m *NetworkPolicyList) MarshalToSizedBuffer(dAtA []byte) (int, error) { +func (m *NetworkPort) MarshalToSizedBuffer(dAtA []byte) (int, error) { i := len(dAtA) _ = i var l int _ = l - if len(m.Items) > 0 { - for iNdEx := len(m.Items) - 1; iNdEx >= 0; iNdEx-- { - { - size, err := m.Items[iNdEx].MarshalToSizedBuffer(dAtA[:i]) - if err != nil { - return 0, err - } - i -= size - i = encodeVarintGenerated(dAtA, i, uint64(size)) - } + if m.Port != nil { + i = encodeVarintGenerated(dAtA, i, uint64(*m.Port)) + i-- + dAtA[i] = 0x18 + } + i -= len(m.Protocol) + copy(dAtA[i:], m.Protocol) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.Protocol))) + i-- + dAtA[i] = 0x12 + i -= len(m.Name) + copy(dAtA[i:], m.Name) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.Name))) + i-- + dAtA[i] = 0xa + return len(dAtA) - i, nil +} + +func (m *OpenCalls) Marshal() (dAtA []byte, err error) { + size := m.Size() + dAtA = make([]byte, size) + n, err := m.MarshalToSizedBuffer(dAtA[:size]) + if err != nil { + return nil, err + } + return dAtA[:n], nil +} + +func (m *OpenCalls) MarshalTo(dAtA []byte) (int, error) { + size := m.Size() + return m.MarshalToSizedBuffer(dAtA[:size]) +} + +func (m *OpenCalls) MarshalToSizedBuffer(dAtA []byte) (int, error) { + i := len(dAtA) + _ = i + var l int + _ = l + if len(m.Flags) > 0 { + for iNdEx := len(m.Flags) - 1; iNdEx >= 0; iNdEx-- { + i -= len(m.Flags[iNdEx]) + copy(dAtA[i:], m.Flags[iNdEx]) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.Flags[iNdEx]))) i-- dAtA[i] = 0x12 } } - { - size, err := m.ListMeta.MarshalToSizedBuffer(dAtA[:i]) - if err != nil { - return 0, err - } - i -= size - i = encodeVarintGenerated(dAtA, i, uint64(size)) - } + i -= len(m.Path) + copy(dAtA[i:], m.Path) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.Path))) i-- dAtA[i] = 0xa return len(dAtA) - i, nil } -func (m *NetworkPolicyPeer) Marshal() (dAtA []byte, err error) { +func (m *OpenVulnerabilityExchangeContainer) Marshal() (dAtA []byte, err error) { size := m.Size() dAtA = make([]byte, size) n, err := m.MarshalToSizedBuffer(dAtA[:size]) @@ -4897,56 +4591,40 @@ func (m *NetworkPolicyPeer) Marshal() (dAtA []byte, err error) { return dAtA[:n], nil } -func (m *NetworkPolicyPeer) MarshalTo(dAtA []byte) (int, error) { +func (m *OpenVulnerabilityExchangeContainer) MarshalTo(dAtA []byte) (int, error) { size := m.Size() return m.MarshalToSizedBuffer(dAtA[:size]) } -func (m *NetworkPolicyPeer) MarshalToSizedBuffer(dAtA []byte) (int, error) { +func (m *OpenVulnerabilityExchangeContainer) MarshalToSizedBuffer(dAtA []byte) (int, error) { i := len(dAtA) _ = i var l int _ = l - if m.IPBlock != nil { - { - size, err := m.IPBlock.MarshalToSizedBuffer(dAtA[:i]) - if err != nil { - return 0, err - } - i -= size - i = encodeVarintGenerated(dAtA, i, uint64(size)) - } - i-- - dAtA[i] = 0x1a - } - if m.NamespaceSelector != nil { - { - size, err := m.NamespaceSelector.MarshalToSizedBuffer(dAtA[:i]) - if err != nil { - return 0, err - } - i -= size - i = encodeVarintGenerated(dAtA, i, uint64(size)) + { + size, err := m.Spec.MarshalToSizedBuffer(dAtA[:i]) + if err != nil { + return 0, err } - i-- - dAtA[i] = 0x12 + i -= size + i = encodeVarintGenerated(dAtA, i, uint64(size)) } - if m.PodSelector != nil { - { - size, err := m.PodSelector.MarshalToSizedBuffer(dAtA[:i]) - if err != nil { - return 0, err - } - i -= size - i = encodeVarintGenerated(dAtA, i, uint64(size)) + i-- + dAtA[i] = 0x12 + { + size, err := m.ObjectMeta.MarshalToSizedBuffer(dAtA[:i]) + if err != nil { + return 0, err } - i-- - dAtA[i] = 0xa + i -= size + i = encodeVarintGenerated(dAtA, i, uint64(size)) } + i-- + dAtA[i] = 0xa return len(dAtA) - i, nil } -func (m *NetworkPolicyPort) Marshal() (dAtA []byte, err error) { +func (m *OpenVulnerabilityExchangeContainerList) Marshal() (dAtA []byte, err error) { size := m.Size() dAtA = make([]byte, size) n, err := m.MarshalToSizedBuffer(dAtA[:size]) @@ -4956,37 +4634,44 @@ func (m *NetworkPolicyPort) Marshal() (dAtA []byte, err error) { return dAtA[:n], nil } -func (m *NetworkPolicyPort) MarshalTo(dAtA []byte) (int, error) { +func (m *OpenVulnerabilityExchangeContainerList) MarshalTo(dAtA []byte) (int, error) { size := m.Size() return m.MarshalToSizedBuffer(dAtA[:size]) } -func (m *NetworkPolicyPort) MarshalToSizedBuffer(dAtA []byte) (int, error) { +func (m *OpenVulnerabilityExchangeContainerList) MarshalToSizedBuffer(dAtA []byte) (int, error) { i := len(dAtA) _ = i var l int _ = l - if m.EndPort != nil { - i = encodeVarintGenerated(dAtA, i, uint64(*m.EndPort)) - i-- - dAtA[i] = 0x18 - } - if m.Port != nil { - i = encodeVarintGenerated(dAtA, i, uint64(*m.Port)) - i-- - dAtA[i] = 0x10 + if len(m.Items) > 0 { + for iNdEx := len(m.Items) - 1; iNdEx >= 0; iNdEx-- { + { + size, err := m.Items[iNdEx].MarshalToSizedBuffer(dAtA[:i]) + if err != nil { + return 0, err + } + i -= size + i = encodeVarintGenerated(dAtA, i, uint64(size)) + } + i-- + dAtA[i] = 0x12 + } } - if m.Protocol != nil { - i -= len(*m.Protocol) - copy(dAtA[i:], *m.Protocol) - i = encodeVarintGenerated(dAtA, i, uint64(len(*m.Protocol))) - i-- - dAtA[i] = 0xa + { + size, err := m.ListMeta.MarshalToSizedBuffer(dAtA[:i]) + if err != nil { + return 0, err + } + i -= size + i = encodeVarintGenerated(dAtA, i, uint64(size)) } + i-- + dAtA[i] = 0xa return len(dAtA) - i, nil } -func (m *NetworkPolicySpec) Marshal() (dAtA []byte, err error) { +func (m *PackageBasicData) Marshal() (dAtA []byte, err error) { size := m.Size() dAtA = make([]byte, size) n, err := m.MarshalToSizedBuffer(dAtA[:size]) @@ -4996,29 +4681,44 @@ func (m *NetworkPolicySpec) Marshal() (dAtA []byte, err error) { return dAtA[:n], nil } -func (m *NetworkPolicySpec) MarshalTo(dAtA []byte) (int, error) { +func (m *PackageBasicData) MarshalTo(dAtA []byte) (int, error) { size := m.Size() return m.MarshalToSizedBuffer(dAtA[:size]) } -func (m *NetworkPolicySpec) MarshalToSizedBuffer(dAtA []byte) (int, error) { +func (m *PackageBasicData) MarshalToSizedBuffer(dAtA []byte) (int, error) { i := len(dAtA) _ = i var l int _ = l - if len(m.PolicyTypes) > 0 { - for iNdEx := len(m.PolicyTypes) - 1; iNdEx >= 0; iNdEx-- { - i -= len(m.PolicyTypes[iNdEx]) - copy(dAtA[i:], m.PolicyTypes[iNdEx]) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.PolicyTypes[iNdEx]))) + i -= len(m.PURL) + copy(dAtA[i:], m.PURL) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.PURL))) + i-- + dAtA[i] = 0x52 + if len(m.CPEs) > 0 { + for iNdEx := len(m.CPEs) - 1; iNdEx >= 0; iNdEx-- { + { + size, err := m.CPEs[iNdEx].MarshalToSizedBuffer(dAtA[:i]) + if err != nil { + return 0, err + } + i -= size + i = encodeVarintGenerated(dAtA, i, uint64(size)) + } i-- - dAtA[i] = 0x22 + dAtA[i] = 0x4a } } - if len(m.Egress) > 0 { - for iNdEx := len(m.Egress) - 1; iNdEx >= 0; iNdEx-- { + i -= len(m.Language) + copy(dAtA[i:], m.Language) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.Language))) + i-- + dAtA[i] = 0x42 + if len(m.Licenses) > 0 { + for iNdEx := len(m.Licenses) - 1; iNdEx >= 0; iNdEx-- { { - size, err := m.Egress[iNdEx].MarshalToSizedBuffer(dAtA[:i]) + size, err := m.Licenses[iNdEx].MarshalToSizedBuffer(dAtA[:i]) if err != nil { return 0, err } @@ -5026,13 +4726,13 @@ func (m *NetworkPolicySpec) MarshalToSizedBuffer(dAtA []byte) (int, error) { i = encodeVarintGenerated(dAtA, i, uint64(size)) } i-- - dAtA[i] = 0x1a + dAtA[i] = 0x3a } } - if len(m.Ingress) > 0 { - for iNdEx := len(m.Ingress) - 1; iNdEx >= 0; iNdEx-- { + if len(m.Locations) > 0 { + for iNdEx := len(m.Locations) - 1; iNdEx >= 0; iNdEx-- { { - size, err := m.Ingress[iNdEx].MarshalToSizedBuffer(dAtA[:i]) + size, err := m.Locations[iNdEx].MarshalToSizedBuffer(dAtA[:i]) if err != nil { return 0, err } @@ -5040,23 +4740,38 @@ func (m *NetworkPolicySpec) MarshalToSizedBuffer(dAtA []byte) (int, error) { i = encodeVarintGenerated(dAtA, i, uint64(size)) } i-- - dAtA[i] = 0x12 - } - } - { - size, err := m.PodSelector.MarshalToSizedBuffer(dAtA[:i]) - if err != nil { - return 0, err + dAtA[i] = 0x32 } - i -= size - i = encodeVarintGenerated(dAtA, i, uint64(size)) } + i -= len(m.FoundBy) + copy(dAtA[i:], m.FoundBy) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.FoundBy))) + i-- + dAtA[i] = 0x2a + i -= len(m.Type) + copy(dAtA[i:], m.Type) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.Type))) + i-- + dAtA[i] = 0x22 + i -= len(m.Version) + copy(dAtA[i:], m.Version) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.Version))) + i-- + dAtA[i] = 0x1a + i -= len(m.Name) + copy(dAtA[i:], m.Name) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.Name))) + i-- + dAtA[i] = 0x12 + i -= len(m.ID) + copy(dAtA[i:], m.ID) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.ID))) i-- dAtA[i] = 0xa return len(dAtA) - i, nil } -func (m *NetworkPolicyStatus) Marshal() (dAtA []byte, err error) { +func (m *PackageBasicDataV01011) Marshal() (dAtA []byte, err error) { size := m.Size() dAtA = make([]byte, size) n, err := m.MarshalToSizedBuffer(dAtA[:size]) @@ -5066,20 +4781,39 @@ func (m *NetworkPolicyStatus) Marshal() (dAtA []byte, err error) { return dAtA[:n], nil } -func (m *NetworkPolicyStatus) MarshalTo(dAtA []byte) (int, error) { +func (m *PackageBasicDataV01011) MarshalTo(dAtA []byte) (int, error) { size := m.Size() return m.MarshalToSizedBuffer(dAtA[:size]) } -func (m *NetworkPolicyStatus) MarshalToSizedBuffer(dAtA []byte) (int, error) { +func (m *PackageBasicDataV01011) MarshalToSizedBuffer(dAtA []byte) (int, error) { i := len(dAtA) _ = i var l int _ = l - if len(m.Conditions) > 0 { - for iNdEx := len(m.Conditions) - 1; iNdEx >= 0; iNdEx-- { + i -= len(m.PURL) + copy(dAtA[i:], m.PURL) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.PURL))) + i-- + dAtA[i] = 0x52 + if len(m.CPEs) > 0 { + for iNdEx := len(m.CPEs) - 1; iNdEx >= 0; iNdEx-- { + i -= len(m.CPEs[iNdEx]) + copy(dAtA[i:], m.CPEs[iNdEx]) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.CPEs[iNdEx]))) + i-- + dAtA[i] = 0x4a + } + } + i -= len(m.Language) + copy(dAtA[i:], m.Language) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.Language))) + i-- + dAtA[i] = 0x42 + if len(m.Licenses) > 0 { + for iNdEx := len(m.Licenses) - 1; iNdEx >= 0; iNdEx-- { { - size, err := m.Conditions[iNdEx].MarshalToSizedBuffer(dAtA[:i]) + size, err := m.Licenses[iNdEx].MarshalToSizedBuffer(dAtA[:i]) if err != nil { return 0, err } @@ -5087,13 +4821,52 @@ func (m *NetworkPolicyStatus) MarshalToSizedBuffer(dAtA []byte) (int, error) { i = encodeVarintGenerated(dAtA, i, uint64(size)) } i-- - dAtA[i] = 0xa + dAtA[i] = 0x3a + } + } + if len(m.Locations) > 0 { + for iNdEx := len(m.Locations) - 1; iNdEx >= 0; iNdEx-- { + { + size, err := m.Locations[iNdEx].MarshalToSizedBuffer(dAtA[:i]) + if err != nil { + return 0, err + } + i -= size + i = encodeVarintGenerated(dAtA, i, uint64(size)) + } + i-- + dAtA[i] = 0x32 } } + i -= len(m.FoundBy) + copy(dAtA[i:], m.FoundBy) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.FoundBy))) + i-- + dAtA[i] = 0x2a + i -= len(m.Type) + copy(dAtA[i:], m.Type) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.Type))) + i-- + dAtA[i] = 0x22 + i -= len(m.Version) + copy(dAtA[i:], m.Version) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.Version))) + i-- + dAtA[i] = 0x1a + i -= len(m.Name) + copy(dAtA[i:], m.Name) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.Name))) + i-- + dAtA[i] = 0x12 + i -= len(m.ID) + copy(dAtA[i:], m.ID) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.ID))) + i-- + dAtA[i] = 0xa return len(dAtA) - i, nil } -func (m *NetworkPort) Marshal() (dAtA []byte, err error) { +func (m *PackageCustomData) Marshal() (dAtA []byte, err error) { size := m.Size() dAtA = make([]byte, size) n, err := m.MarshalToSizedBuffer(dAtA[:size]) @@ -5103,35 +4876,32 @@ func (m *NetworkPort) Marshal() (dAtA []byte, err error) { return dAtA[:n], nil } -func (m *NetworkPort) MarshalTo(dAtA []byte) (int, error) { +func (m *PackageCustomData) MarshalTo(dAtA []byte) (int, error) { size := m.Size() return m.MarshalToSizedBuffer(dAtA[:size]) } -func (m *NetworkPort) MarshalToSizedBuffer(dAtA []byte) (int, error) { +func (m *PackageCustomData) MarshalToSizedBuffer(dAtA []byte) (int, error) { i := len(dAtA) _ = i var l int _ = l - if m.Port != nil { - i = encodeVarintGenerated(dAtA, i, uint64(*m.Port)) + if m.Metadata != nil { + i -= len(m.Metadata) + copy(dAtA[i:], m.Metadata) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.Metadata))) i-- - dAtA[i] = 0x18 + dAtA[i] = 0x12 } - i -= len(m.Protocol) - copy(dAtA[i:], m.Protocol) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.Protocol))) - i-- - dAtA[i] = 0x12 - i -= len(m.Name) - copy(dAtA[i:], m.Name) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.Name))) + i -= len(m.MetadataType) + copy(dAtA[i:], m.MetadataType) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.MetadataType))) i-- dAtA[i] = 0xa return len(dAtA) - i, nil } -func (m *OpenCalls) Marshal() (dAtA []byte, err error) { +func (m *PolicyRef) Marshal() (dAtA []byte, err error) { size := m.Size() dAtA = make([]byte, size) n, err := m.MarshalToSizedBuffer(dAtA[:size]) @@ -5141,34 +4911,45 @@ func (m *OpenCalls) Marshal() (dAtA []byte, err error) { return dAtA[:n], nil } -func (m *OpenCalls) MarshalTo(dAtA []byte) (int, error) { +func (m *PolicyRef) MarshalTo(dAtA []byte) (int, error) { size := m.Size() return m.MarshalToSizedBuffer(dAtA[:size]) } -func (m *OpenCalls) MarshalToSizedBuffer(dAtA []byte) (int, error) { +func (m *PolicyRef) MarshalToSizedBuffer(dAtA []byte) (int, error) { i := len(dAtA) _ = i var l int _ = l - if len(m.Flags) > 0 { - for iNdEx := len(m.Flags) - 1; iNdEx >= 0; iNdEx-- { - i -= len(m.Flags[iNdEx]) - copy(dAtA[i:], m.Flags[iNdEx]) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.Flags[iNdEx]))) - i-- - dAtA[i] = 0x12 - } - } - i -= len(m.Path) - copy(dAtA[i:], m.Path) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.Path))) + i -= len(m.Server) + copy(dAtA[i:], m.Server) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.Server))) + i-- + dAtA[i] = 0x2a + i -= len(m.Name) + copy(dAtA[i:], m.Name) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.Name))) + i-- + dAtA[i] = 0x22 + i -= len(m.DNS) + copy(dAtA[i:], m.DNS) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.DNS))) + i-- + dAtA[i] = 0x1a + i -= len(m.OriginalIP) + copy(dAtA[i:], m.OriginalIP) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.OriginalIP))) + i-- + dAtA[i] = 0x12 + i -= len(m.IPBlock) + copy(dAtA[i:], m.IPBlock) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.IPBlock))) i-- dAtA[i] = 0xa return len(dAtA) - i, nil } -func (m *OpenVulnerabilityExchangeContainer) Marshal() (dAtA []byte, err error) { +func (m *Product) Marshal() (dAtA []byte, err error) { size := m.Size() dAtA = make([]byte, size) n, err := m.MarshalToSizedBuffer(dAtA[:size]) @@ -5178,28 +4959,32 @@ func (m *OpenVulnerabilityExchangeContainer) Marshal() (dAtA []byte, err error) return dAtA[:n], nil } -func (m *OpenVulnerabilityExchangeContainer) MarshalTo(dAtA []byte) (int, error) { +func (m *Product) MarshalTo(dAtA []byte) (int, error) { size := m.Size() return m.MarshalToSizedBuffer(dAtA[:size]) } -func (m *OpenVulnerabilityExchangeContainer) MarshalToSizedBuffer(dAtA []byte) (int, error) { +func (m *Product) MarshalToSizedBuffer(dAtA []byte) (int, error) { i := len(dAtA) _ = i var l int _ = l - { - size, err := m.Spec.MarshalToSizedBuffer(dAtA[:i]) - if err != nil { - return 0, err + if len(m.Subcomponents) > 0 { + for iNdEx := len(m.Subcomponents) - 1; iNdEx >= 0; iNdEx-- { + { + size, err := m.Subcomponents[iNdEx].MarshalToSizedBuffer(dAtA[:i]) + if err != nil { + return 0, err + } + i -= size + i = encodeVarintGenerated(dAtA, i, uint64(size)) + } + i-- + dAtA[i] = 0x12 } - i -= size - i = encodeVarintGenerated(dAtA, i, uint64(size)) } - i-- - dAtA[i] = 0x12 { - size, err := m.ObjectMeta.MarshalToSizedBuffer(dAtA[:i]) + size, err := m.Component.MarshalToSizedBuffer(dAtA[:i]) if err != nil { return 0, err } @@ -5211,7 +4996,7 @@ func (m *OpenVulnerabilityExchangeContainer) MarshalToSizedBuffer(dAtA []byte) ( return len(dAtA) - i, nil } -func (m *OpenVulnerabilityExchangeContainerList) Marshal() (dAtA []byte, err error) { +func (m *ReportMeta) Marshal() (dAtA []byte, err error) { size := m.Size() dAtA = make([]byte, size) n, err := m.MarshalToSizedBuffer(dAtA[:size]) @@ -5221,32 +5006,18 @@ func (m *OpenVulnerabilityExchangeContainerList) Marshal() (dAtA []byte, err err return dAtA[:n], nil } -func (m *OpenVulnerabilityExchangeContainerList) MarshalTo(dAtA []byte) (int, error) { +func (m *ReportMeta) MarshalTo(dAtA []byte) (int, error) { size := m.Size() return m.MarshalToSizedBuffer(dAtA[:size]) } -func (m *OpenVulnerabilityExchangeContainerList) MarshalToSizedBuffer(dAtA []byte) (int, error) { +func (m *ReportMeta) MarshalToSizedBuffer(dAtA []byte) (int, error) { i := len(dAtA) _ = i var l int _ = l - if len(m.Items) > 0 { - for iNdEx := len(m.Items) - 1; iNdEx >= 0; iNdEx-- { - { - size, err := m.Items[iNdEx].MarshalToSizedBuffer(dAtA[:i]) - if err != nil { - return 0, err - } - i -= size - i = encodeVarintGenerated(dAtA, i, uint64(size)) - } - i-- - dAtA[i] = 0x12 - } - } { - size, err := m.ListMeta.MarshalToSizedBuffer(dAtA[:i]) + size, err := m.CreatedAt.MarshalToSizedBuffer(dAtA[:i]) if err != nil { return 0, err } @@ -5258,7 +5029,7 @@ func (m *OpenVulnerabilityExchangeContainerList) MarshalToSizedBuffer(dAtA []byt return len(dAtA) - i, nil } -func (m *PackageBasicData) Marshal() (dAtA []byte, err error) { +func (m *RulePath) Marshal() (dAtA []byte, err error) { size := m.Size() dAtA = make([]byte, size) n, err := m.MarshalToSizedBuffer(dAtA[:size]) @@ -5268,97 +5039,40 @@ func (m *PackageBasicData) Marshal() (dAtA []byte, err error) { return dAtA[:n], nil } -func (m *PackageBasicData) MarshalTo(dAtA []byte) (int, error) { +func (m *RulePath) MarshalTo(dAtA []byte) (int, error) { size := m.Size() return m.MarshalToSizedBuffer(dAtA[:size]) } -func (m *PackageBasicData) MarshalToSizedBuffer(dAtA []byte) (int, error) { +func (m *RulePath) MarshalToSizedBuffer(dAtA []byte) (int, error) { i := len(dAtA) _ = i var l int _ = l - i -= len(m.PURL) - copy(dAtA[i:], m.PURL) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.PURL))) - i-- - dAtA[i] = 0x52 - if len(m.CPEs) > 0 { - for iNdEx := len(m.CPEs) - 1; iNdEx >= 0; iNdEx-- { - { - size, err := m.CPEs[iNdEx].MarshalToSizedBuffer(dAtA[:i]) - if err != nil { - return 0, err - } - i -= size - i = encodeVarintGenerated(dAtA, i, uint64(size)) - } - i-- - dAtA[i] = 0x4a - } - } - i -= len(m.Language) - copy(dAtA[i:], m.Language) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.Language))) - i-- - dAtA[i] = 0x42 - if len(m.Licenses) > 0 { - for iNdEx := len(m.Licenses) - 1; iNdEx >= 0; iNdEx-- { - { - size, err := m.Licenses[iNdEx].MarshalToSizedBuffer(dAtA[:i]) - if err != nil { - return 0, err - } - i -= size - i = encodeVarintGenerated(dAtA, i, uint64(size)) - } - i-- - dAtA[i] = 0x3a - } - } - if len(m.Locations) > 0 { - for iNdEx := len(m.Locations) - 1; iNdEx >= 0; iNdEx-- { - { - size, err := m.Locations[iNdEx].MarshalToSizedBuffer(dAtA[:i]) - if err != nil { - return 0, err - } - i -= size - i = encodeVarintGenerated(dAtA, i, uint64(size)) - } - i-- - dAtA[i] = 0x32 - } - } - i -= len(m.FoundBy) - copy(dAtA[i:], m.FoundBy) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.FoundBy))) - i-- - dAtA[i] = 0x2a - i -= len(m.Type) - copy(dAtA[i:], m.Type) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.Type))) + i -= len(m.FixCommand) + copy(dAtA[i:], m.FixCommand) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.FixCommand))) i-- dAtA[i] = 0x22 - i -= len(m.Version) - copy(dAtA[i:], m.Version) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.Version))) + i -= len(m.FixPathValue) + copy(dAtA[i:], m.FixPathValue) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.FixPathValue))) i-- dAtA[i] = 0x1a - i -= len(m.Name) - copy(dAtA[i:], m.Name) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.Name))) + i -= len(m.FixPath) + copy(dAtA[i:], m.FixPath) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.FixPath))) i-- dAtA[i] = 0x12 - i -= len(m.ID) - copy(dAtA[i:], m.ID) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.ID))) + i -= len(m.FailedPath) + copy(dAtA[i:], m.FailedPath) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.FailedPath))) i-- dAtA[i] = 0xa return len(dAtA) - i, nil } -func (m *PackageBasicDataV01011) Marshal() (dAtA []byte, err error) { +func (m *RulePolicy) Marshal() (dAtA []byte, err error) { size := m.Size() dAtA = make([]byte, size) n, err := m.MarshalToSizedBuffer(dAtA[:size]) @@ -5368,92 +5082,70 @@ func (m *PackageBasicDataV01011) Marshal() (dAtA []byte, err error) { return dAtA[:n], nil } -func (m *PackageBasicDataV01011) MarshalTo(dAtA []byte) (int, error) { +func (m *RulePolicy) MarshalTo(dAtA []byte) (int, error) { size := m.Size() return m.MarshalToSizedBuffer(dAtA[:size]) } -func (m *PackageBasicDataV01011) MarshalToSizedBuffer(dAtA []byte) (int, error) { +func (m *RulePolicy) MarshalToSizedBuffer(dAtA []byte) (int, error) { i := len(dAtA) _ = i var l int _ = l - i -= len(m.PURL) - copy(dAtA[i:], m.PURL) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.PURL))) i-- - dAtA[i] = 0x52 - if len(m.CPEs) > 0 { - for iNdEx := len(m.CPEs) - 1; iNdEx >= 0; iNdEx-- { - i -= len(m.CPEs[iNdEx]) - copy(dAtA[i:], m.CPEs[iNdEx]) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.CPEs[iNdEx]))) - i-- - dAtA[i] = 0x4a - } + if m.AllowedContainer { + dAtA[i] = 1 + } else { + dAtA[i] = 0 } - i -= len(m.Language) - copy(dAtA[i:], m.Language) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.Language))) i-- - dAtA[i] = 0x42 - if len(m.Licenses) > 0 { - for iNdEx := len(m.Licenses) - 1; iNdEx >= 0; iNdEx-- { - { - size, err := m.Licenses[iNdEx].MarshalToSizedBuffer(dAtA[:i]) - if err != nil { - return 0, err - } - i -= size - i = encodeVarintGenerated(dAtA, i, uint64(size)) - } + dAtA[i] = 0x10 + if len(m.AllowedProcesses) > 0 { + for iNdEx := len(m.AllowedProcesses) - 1; iNdEx >= 0; iNdEx-- { + i -= len(m.AllowedProcesses[iNdEx]) + copy(dAtA[i:], m.AllowedProcesses[iNdEx]) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.AllowedProcesses[iNdEx]))) i-- - dAtA[i] = 0x3a + dAtA[i] = 0xa } } - if len(m.Locations) > 0 { - for iNdEx := len(m.Locations) - 1; iNdEx >= 0; iNdEx-- { - { - size, err := m.Locations[iNdEx].MarshalToSizedBuffer(dAtA[:i]) - if err != nil { - return 0, err - } - i -= size - i = encodeVarintGenerated(dAtA, i, uint64(size)) - } - i-- - dAtA[i] = 0x32 - } + return len(dAtA) - i, nil +} + +func (m *RuleStatus) Marshal() (dAtA []byte, err error) { + size := m.Size() + dAtA = make([]byte, size) + n, err := m.MarshalToSizedBuffer(dAtA[:size]) + if err != nil { + return nil, err } - i -= len(m.FoundBy) - copy(dAtA[i:], m.FoundBy) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.FoundBy))) - i-- - dAtA[i] = 0x2a - i -= len(m.Type) - copy(dAtA[i:], m.Type) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.Type))) - i-- - dAtA[i] = 0x22 - i -= len(m.Version) - copy(dAtA[i:], m.Version) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.Version))) - i-- - dAtA[i] = 0x1a - i -= len(m.Name) - copy(dAtA[i:], m.Name) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.Name))) + return dAtA[:n], nil +} + +func (m *RuleStatus) MarshalTo(dAtA []byte) (int, error) { + size := m.Size() + return m.MarshalToSizedBuffer(dAtA[:size]) +} + +func (m *RuleStatus) MarshalToSizedBuffer(dAtA []byte) (int, error) { + i := len(dAtA) + _ = i + var l int + _ = l + i -= len(m.SubStatus) + copy(dAtA[i:], m.SubStatus) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.SubStatus))) i-- dAtA[i] = 0x12 - i -= len(m.ID) - copy(dAtA[i:], m.ID) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.ID))) + i -= len(m.Status) + copy(dAtA[i:], m.Status) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.Status))) i-- dAtA[i] = 0xa return len(dAtA) - i, nil } -func (m *PackageCustomData) Marshal() (dAtA []byte, err error) { +func (m *SBOMSyft) Marshal() (dAtA []byte, err error) { size := m.Size() dAtA = make([]byte, size) n, err := m.MarshalToSizedBuffer(dAtA[:size]) @@ -5463,32 +5155,50 @@ func (m *PackageCustomData) Marshal() (dAtA []byte, err error) { return dAtA[:n], nil } -func (m *PackageCustomData) MarshalTo(dAtA []byte) (int, error) { +func (m *SBOMSyft) MarshalTo(dAtA []byte) (int, error) { size := m.Size() return m.MarshalToSizedBuffer(dAtA[:size]) } -func (m *PackageCustomData) MarshalToSizedBuffer(dAtA []byte) (int, error) { +func (m *SBOMSyft) MarshalToSizedBuffer(dAtA []byte) (int, error) { i := len(dAtA) _ = i var l int _ = l - if m.Metadata != nil { - i -= len(m.Metadata) - copy(dAtA[i:], m.Metadata) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.Metadata))) - i-- - dAtA[i] = 0x12 + { + size, err := m.Status.MarshalToSizedBuffer(dAtA[:i]) + if err != nil { + return 0, err + } + i -= size + i = encodeVarintGenerated(dAtA, i, uint64(size)) + } + i-- + dAtA[i] = 0x1a + { + size, err := m.Spec.MarshalToSizedBuffer(dAtA[:i]) + if err != nil { + return 0, err + } + i -= size + i = encodeVarintGenerated(dAtA, i, uint64(size)) + } + i-- + dAtA[i] = 0x12 + { + size, err := m.ObjectMeta.MarshalToSizedBuffer(dAtA[:i]) + if err != nil { + return 0, err + } + i -= size + i = encodeVarintGenerated(dAtA, i, uint64(size)) } - i -= len(m.MetadataType) - copy(dAtA[i:], m.MetadataType) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.MetadataType))) i-- dAtA[i] = 0xa return len(dAtA) - i, nil } -func (m *PolicyRef) Marshal() (dAtA []byte, err error) { +func (m *SBOMSyftFiltered) Marshal() (dAtA []byte, err error) { size := m.Size() dAtA = make([]byte, size) n, err := m.MarshalToSizedBuffer(dAtA[:size]) @@ -5498,45 +5208,50 @@ func (m *PolicyRef) Marshal() (dAtA []byte, err error) { return dAtA[:n], nil } -func (m *PolicyRef) MarshalTo(dAtA []byte) (int, error) { +func (m *SBOMSyftFiltered) MarshalTo(dAtA []byte) (int, error) { size := m.Size() return m.MarshalToSizedBuffer(dAtA[:size]) } -func (m *PolicyRef) MarshalToSizedBuffer(dAtA []byte) (int, error) { +func (m *SBOMSyftFiltered) MarshalToSizedBuffer(dAtA []byte) (int, error) { i := len(dAtA) _ = i var l int _ = l - i -= len(m.Server) - copy(dAtA[i:], m.Server) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.Server))) - i-- - dAtA[i] = 0x2a - i -= len(m.Name) - copy(dAtA[i:], m.Name) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.Name))) - i-- - dAtA[i] = 0x22 - i -= len(m.DNS) - copy(dAtA[i:], m.DNS) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.DNS))) + { + size, err := m.Status.MarshalToSizedBuffer(dAtA[:i]) + if err != nil { + return 0, err + } + i -= size + i = encodeVarintGenerated(dAtA, i, uint64(size)) + } i-- dAtA[i] = 0x1a - i -= len(m.OriginalIP) - copy(dAtA[i:], m.OriginalIP) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.OriginalIP))) + { + size, err := m.Spec.MarshalToSizedBuffer(dAtA[:i]) + if err != nil { + return 0, err + } + i -= size + i = encodeVarintGenerated(dAtA, i, uint64(size)) + } i-- dAtA[i] = 0x12 - i -= len(m.IPBlock) - copy(dAtA[i:], m.IPBlock) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.IPBlock))) + { + size, err := m.ObjectMeta.MarshalToSizedBuffer(dAtA[:i]) + if err != nil { + return 0, err + } + i -= size + i = encodeVarintGenerated(dAtA, i, uint64(size)) + } i-- dAtA[i] = 0xa return len(dAtA) - i, nil } -func (m *Product) Marshal() (dAtA []byte, err error) { +func (m *SBOMSyftFilteredList) Marshal() (dAtA []byte, err error) { size := m.Size() dAtA = make([]byte, size) n, err := m.MarshalToSizedBuffer(dAtA[:size]) @@ -5546,20 +5261,20 @@ func (m *Product) Marshal() (dAtA []byte, err error) { return dAtA[:n], nil } -func (m *Product) MarshalTo(dAtA []byte) (int, error) { +func (m *SBOMSyftFilteredList) MarshalTo(dAtA []byte) (int, error) { size := m.Size() return m.MarshalToSizedBuffer(dAtA[:size]) } -func (m *Product) MarshalToSizedBuffer(dAtA []byte) (int, error) { +func (m *SBOMSyftFilteredList) MarshalToSizedBuffer(dAtA []byte) (int, error) { i := len(dAtA) _ = i var l int _ = l - if len(m.Subcomponents) > 0 { - for iNdEx := len(m.Subcomponents) - 1; iNdEx >= 0; iNdEx-- { + if len(m.Items) > 0 { + for iNdEx := len(m.Items) - 1; iNdEx >= 0; iNdEx-- { { - size, err := m.Subcomponents[iNdEx].MarshalToSizedBuffer(dAtA[:i]) + size, err := m.Items[iNdEx].MarshalToSizedBuffer(dAtA[:i]) if err != nil { return 0, err } @@ -5571,7 +5286,7 @@ func (m *Product) MarshalToSizedBuffer(dAtA []byte) (int, error) { } } { - size, err := m.Component.MarshalToSizedBuffer(dAtA[:i]) + size, err := m.ListMeta.MarshalToSizedBuffer(dAtA[:i]) if err != nil { return 0, err } @@ -5583,7 +5298,7 @@ func (m *Product) MarshalToSizedBuffer(dAtA []byte) (int, error) { return len(dAtA) - i, nil } -func (m *ReportMeta) Marshal() (dAtA []byte, err error) { +func (m *SBOMSyftList) Marshal() (dAtA []byte, err error) { size := m.Size() dAtA = make([]byte, size) n, err := m.MarshalToSizedBuffer(dAtA[:size]) @@ -5593,18 +5308,32 @@ func (m *ReportMeta) Marshal() (dAtA []byte, err error) { return dAtA[:n], nil } -func (m *ReportMeta) MarshalTo(dAtA []byte) (int, error) { +func (m *SBOMSyftList) MarshalTo(dAtA []byte) (int, error) { size := m.Size() return m.MarshalToSizedBuffer(dAtA[:size]) } -func (m *ReportMeta) MarshalToSizedBuffer(dAtA []byte) (int, error) { +func (m *SBOMSyftList) MarshalToSizedBuffer(dAtA []byte) (int, error) { i := len(dAtA) _ = i var l int _ = l + if len(m.Items) > 0 { + for iNdEx := len(m.Items) - 1; iNdEx >= 0; iNdEx-- { + { + size, err := m.Items[iNdEx].MarshalToSizedBuffer(dAtA[:i]) + if err != nil { + return 0, err + } + i -= size + i = encodeVarintGenerated(dAtA, i, uint64(size)) + } + i-- + dAtA[i] = 0x12 + } + } { - size, err := m.CreatedAt.MarshalToSizedBuffer(dAtA[:i]) + size, err := m.ListMeta.MarshalToSizedBuffer(dAtA[:i]) if err != nil { return 0, err } @@ -5616,7 +5345,7 @@ func (m *ReportMeta) MarshalToSizedBuffer(dAtA []byte) (int, error) { return len(dAtA) - i, nil } -func (m *RulePath) Marshal() (dAtA []byte, err error) { +func (m *SBOMSyftSpec) Marshal() (dAtA []byte, err error) { size := m.Size() dAtA = make([]byte, size) n, err := m.MarshalToSizedBuffer(dAtA[:size]) @@ -5626,40 +5355,40 @@ func (m *RulePath) Marshal() (dAtA []byte, err error) { return dAtA[:n], nil } -func (m *RulePath) MarshalTo(dAtA []byte) (int, error) { +func (m *SBOMSyftSpec) MarshalTo(dAtA []byte) (int, error) { size := m.Size() return m.MarshalToSizedBuffer(dAtA[:size]) } -func (m *RulePath) MarshalToSizedBuffer(dAtA []byte) (int, error) { +func (m *SBOMSyftSpec) MarshalToSizedBuffer(dAtA []byte) (int, error) { i := len(dAtA) _ = i var l int _ = l - i -= len(m.FixCommand) - copy(dAtA[i:], m.FixCommand) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.FixCommand))) - i-- - dAtA[i] = 0x22 - i -= len(m.FixPathValue) - copy(dAtA[i:], m.FixPathValue) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.FixPathValue))) - i-- - dAtA[i] = 0x1a - i -= len(m.FixPath) - copy(dAtA[i:], m.FixPath) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.FixPath))) + { + size, err := m.Syft.MarshalToSizedBuffer(dAtA[:i]) + if err != nil { + return 0, err + } + i -= size + i = encodeVarintGenerated(dAtA, i, uint64(size)) + } i-- dAtA[i] = 0x12 - i -= len(m.FailedPath) - copy(dAtA[i:], m.FailedPath) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.FailedPath))) + { + size, err := m.Metadata.MarshalToSizedBuffer(dAtA[:i]) + if err != nil { + return 0, err + } + i -= size + i = encodeVarintGenerated(dAtA, i, uint64(size)) + } i-- dAtA[i] = 0xa return len(dAtA) - i, nil } -func (m *RulePolicy) Marshal() (dAtA []byte, err error) { +func (m *SBOMSyftStatus) Marshal() (dAtA []byte, err error) { size := m.Size() dAtA = make([]byte, size) n, err := m.MarshalToSizedBuffer(dAtA[:size]) @@ -5669,37 +5398,20 @@ func (m *RulePolicy) Marshal() (dAtA []byte, err error) { return dAtA[:n], nil } -func (m *RulePolicy) MarshalTo(dAtA []byte) (int, error) { +func (m *SBOMSyftStatus) MarshalTo(dAtA []byte) (int, error) { size := m.Size() return m.MarshalToSizedBuffer(dAtA[:size]) } -func (m *RulePolicy) MarshalToSizedBuffer(dAtA []byte) (int, error) { +func (m *SBOMSyftStatus) MarshalToSizedBuffer(dAtA []byte) (int, error) { i := len(dAtA) _ = i var l int _ = l - i-- - if m.AllowedContainer { - dAtA[i] = 1 - } else { - dAtA[i] = 0 - } - i-- - dAtA[i] = 0x10 - if len(m.AllowedProcesses) > 0 { - for iNdEx := len(m.AllowedProcesses) - 1; iNdEx >= 0; iNdEx-- { - i -= len(m.AllowedProcesses[iNdEx]) - copy(dAtA[i:], m.AllowedProcesses[iNdEx]) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.AllowedProcesses[iNdEx]))) - i-- - dAtA[i] = 0xa - } - } return len(dAtA) - i, nil } -func (m *RuleStatus) Marshal() (dAtA []byte, err error) { +func (m *SPDXMeta) Marshal() (dAtA []byte, err error) { size := m.Size() dAtA = make([]byte, size) n, err := m.MarshalToSizedBuffer(dAtA[:size]) @@ -5709,30 +5421,40 @@ func (m *RuleStatus) Marshal() (dAtA []byte, err error) { return dAtA[:n], nil } -func (m *RuleStatus) MarshalTo(dAtA []byte) (int, error) { +func (m *SPDXMeta) MarshalTo(dAtA []byte) (int, error) { size := m.Size() return m.MarshalToSizedBuffer(dAtA[:size]) } -func (m *RuleStatus) MarshalToSizedBuffer(dAtA []byte) (int, error) { +func (m *SPDXMeta) MarshalToSizedBuffer(dAtA []byte) (int, error) { i := len(dAtA) _ = i var l int _ = l - i -= len(m.SubStatus) - copy(dAtA[i:], m.SubStatus) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.SubStatus))) + { + size, err := m.Report.MarshalToSizedBuffer(dAtA[:i]) + if err != nil { + return 0, err + } + i -= size + i = encodeVarintGenerated(dAtA, i, uint64(size)) + } i-- dAtA[i] = 0x12 - i -= len(m.Status) - copy(dAtA[i:], m.Status) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.Status))) + { + size, err := m.Tool.MarshalToSizedBuffer(dAtA[:i]) + if err != nil { + return 0, err + } + i -= size + i = encodeVarintGenerated(dAtA, i, uint64(size)) + } i-- dAtA[i] = 0xa return len(dAtA) - i, nil } -func (m *SBOMSyft) Marshal() (dAtA []byte, err error) { +func (m *ScannedControl) Marshal() (dAtA []byte, err error) { size := m.Size() dAtA = make([]byte, size) n, err := m.MarshalToSizedBuffer(dAtA[:size]) @@ -5742,38 +5464,32 @@ func (m *SBOMSyft) Marshal() (dAtA []byte, err error) { return dAtA[:n], nil } -func (m *SBOMSyft) MarshalTo(dAtA []byte) (int, error) { +func (m *ScannedControl) MarshalTo(dAtA []byte) (int, error) { size := m.Size() return m.MarshalToSizedBuffer(dAtA[:size]) } -func (m *SBOMSyft) MarshalToSizedBuffer(dAtA []byte) (int, error) { +func (m *ScannedControl) MarshalToSizedBuffer(dAtA []byte) (int, error) { i := len(dAtA) _ = i var l int _ = l - { - size, err := m.Status.MarshalToSizedBuffer(dAtA[:i]) - if err != nil { - return 0, err - } - i -= size - i = encodeVarintGenerated(dAtA, i, uint64(size)) - } - i-- - dAtA[i] = 0x1a - { - size, err := m.Spec.MarshalToSizedBuffer(dAtA[:i]) - if err != nil { - return 0, err + if len(m.Rules) > 0 { + for iNdEx := len(m.Rules) - 1; iNdEx >= 0; iNdEx-- { + { + size, err := m.Rules[iNdEx].MarshalToSizedBuffer(dAtA[:i]) + if err != nil { + return 0, err + } + i -= size + i = encodeVarintGenerated(dAtA, i, uint64(size)) + } + i-- + dAtA[i] = 0x2a } - i -= size - i = encodeVarintGenerated(dAtA, i, uint64(size)) } - i-- - dAtA[i] = 0x12 { - size, err := m.ObjectMeta.MarshalToSizedBuffer(dAtA[:i]) + size, err := m.Status.MarshalToSizedBuffer(dAtA[:i]) if err != nil { return 0, err } @@ -5781,32 +5497,9 @@ func (m *SBOMSyft) MarshalToSizedBuffer(dAtA []byte) (int, error) { i = encodeVarintGenerated(dAtA, i, uint64(size)) } i-- - dAtA[i] = 0xa - return len(dAtA) - i, nil -} - -func (m *SBOMSyftFiltered) Marshal() (dAtA []byte, err error) { - size := m.Size() - dAtA = make([]byte, size) - n, err := m.MarshalToSizedBuffer(dAtA[:size]) - if err != nil { - return nil, err - } - return dAtA[:n], nil -} - -func (m *SBOMSyftFiltered) MarshalTo(dAtA []byte) (int, error) { - size := m.Size() - return m.MarshalToSizedBuffer(dAtA[:size]) -} - -func (m *SBOMSyftFiltered) MarshalToSizedBuffer(dAtA []byte) (int, error) { - i := len(dAtA) - _ = i - var l int - _ = l + dAtA[i] = 0x22 { - size, err := m.Status.MarshalToSizedBuffer(dAtA[:i]) + size, err := m.Severity.MarshalToSizedBuffer(dAtA[:i]) if err != nil { return 0, err } @@ -5815,30 +5508,20 @@ func (m *SBOMSyftFiltered) MarshalToSizedBuffer(dAtA []byte) (int, error) { } i-- dAtA[i] = 0x1a - { - size, err := m.Spec.MarshalToSizedBuffer(dAtA[:i]) - if err != nil { - return 0, err - } - i -= size - i = encodeVarintGenerated(dAtA, i, uint64(size)) - } + i -= len(m.Name) + copy(dAtA[i:], m.Name) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.Name))) i-- dAtA[i] = 0x12 - { - size, err := m.ObjectMeta.MarshalToSizedBuffer(dAtA[:i]) - if err != nil { - return 0, err - } - i -= size - i = encodeVarintGenerated(dAtA, i, uint64(size)) - } + i -= len(m.ControlID) + copy(dAtA[i:], m.ControlID) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.ControlID))) i-- dAtA[i] = 0xa return len(dAtA) - i, nil } -func (m *SBOMSyftFilteredList) Marshal() (dAtA []byte, err error) { +func (m *ScannedControlRule) Marshal() (dAtA []byte, err error) { size := m.Size() dAtA = make([]byte, size) n, err := m.MarshalToSizedBuffer(dAtA[:size]) @@ -5848,20 +5531,38 @@ func (m *SBOMSyftFilteredList) Marshal() (dAtA []byte, err error) { return dAtA[:n], nil } -func (m *SBOMSyftFilteredList) MarshalTo(dAtA []byte) (int, error) { +func (m *ScannedControlRule) MarshalTo(dAtA []byte) (int, error) { size := m.Size() return m.MarshalToSizedBuffer(dAtA[:size]) } -func (m *SBOMSyftFilteredList) MarshalToSizedBuffer(dAtA []byte) (int, error) { +func (m *ScannedControlRule) MarshalToSizedBuffer(dAtA []byte) (int, error) { i := len(dAtA) _ = i var l int _ = l - if len(m.Items) > 0 { - for iNdEx := len(m.Items) - 1; iNdEx >= 0; iNdEx-- { + if len(m.RelatedResourcesIDs) > 0 { + for iNdEx := len(m.RelatedResourcesIDs) - 1; iNdEx >= 0; iNdEx-- { + i -= len(m.RelatedResourcesIDs[iNdEx]) + copy(dAtA[i:], m.RelatedResourcesIDs[iNdEx]) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.RelatedResourcesIDs[iNdEx]))) + i-- + dAtA[i] = 0x32 + } + } + if len(m.AppliedIgnoreRules) > 0 { + for iNdEx := len(m.AppliedIgnoreRules) - 1; iNdEx >= 0; iNdEx-- { + i -= len(m.AppliedIgnoreRules[iNdEx]) + copy(dAtA[i:], m.AppliedIgnoreRules[iNdEx]) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.AppliedIgnoreRules[iNdEx]))) + i-- + dAtA[i] = 0x2a + } + } + if len(m.Paths) > 0 { + for iNdEx := len(m.Paths) - 1; iNdEx >= 0; iNdEx-- { { - size, err := m.Items[iNdEx].MarshalToSizedBuffer(dAtA[:i]) + size, err := m.Paths[iNdEx].MarshalToSizedBuffer(dAtA[:i]) if err != nil { return 0, err } @@ -5869,11 +5570,37 @@ func (m *SBOMSyftFilteredList) MarshalToSizedBuffer(dAtA []byte) (int, error) { i = encodeVarintGenerated(dAtA, i, uint64(size)) } i-- - dAtA[i] = 0x12 + dAtA[i] = 0x22 + } + } + if len(m.ControlConfigurations) > 0 { + keysForControlConfigurations := make([]string, 0, len(m.ControlConfigurations)) + for k := range m.ControlConfigurations { + keysForControlConfigurations = append(keysForControlConfigurations, string(k)) + } + sort.Strings(keysForControlConfigurations) + for iNdEx := len(keysForControlConfigurations) - 1; iNdEx >= 0; iNdEx-- { + v := m.ControlConfigurations[string(keysForControlConfigurations[iNdEx])] + baseI := i + if v != nil { + i -= len(v) + copy(dAtA[i:], v) + i = encodeVarintGenerated(dAtA, i, uint64(len(v))) + i-- + dAtA[i] = 0x12 + } + i -= len(keysForControlConfigurations[iNdEx]) + copy(dAtA[i:], keysForControlConfigurations[iNdEx]) + i = encodeVarintGenerated(dAtA, i, uint64(len(keysForControlConfigurations[iNdEx]))) + i-- + dAtA[i] = 0xa + i = encodeVarintGenerated(dAtA, i, uint64(baseI-i)) + i-- + dAtA[i] = 0x1a } } { - size, err := m.ListMeta.MarshalToSizedBuffer(dAtA[:i]) + size, err := m.Status.MarshalToSizedBuffer(dAtA[:i]) if err != nil { return 0, err } @@ -5881,11 +5608,16 @@ func (m *SBOMSyftFilteredList) MarshalToSizedBuffer(dAtA []byte) (int, error) { i = encodeVarintGenerated(dAtA, i, uint64(size)) } i-- + dAtA[i] = 0x12 + i -= len(m.Name) + copy(dAtA[i:], m.Name) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.Name))) + i-- dAtA[i] = 0xa return len(dAtA) - i, nil } -func (m *SBOMSyftList) Marshal() (dAtA []byte, err error) { +func (m *ScannedControlStatus) Marshal() (dAtA []byte, err error) { size := m.Size() dAtA = make([]byte, size) n, err := m.MarshalToSizedBuffer(dAtA[:size]) @@ -5895,44 +5627,35 @@ func (m *SBOMSyftList) Marshal() (dAtA []byte, err error) { return dAtA[:n], nil } -func (m *SBOMSyftList) MarshalTo(dAtA []byte) (int, error) { +func (m *ScannedControlStatus) MarshalTo(dAtA []byte) (int, error) { size := m.Size() return m.MarshalToSizedBuffer(dAtA[:size]) } -func (m *SBOMSyftList) MarshalToSizedBuffer(dAtA []byte) (int, error) { +func (m *ScannedControlStatus) MarshalToSizedBuffer(dAtA []byte) (int, error) { i := len(dAtA) _ = i var l int _ = l - if len(m.Items) > 0 { - for iNdEx := len(m.Items) - 1; iNdEx >= 0; iNdEx-- { - { - size, err := m.Items[iNdEx].MarshalToSizedBuffer(dAtA[:i]) - if err != nil { - return 0, err - } - i -= size - i = encodeVarintGenerated(dAtA, i, uint64(size)) - } - i-- - dAtA[i] = 0x12 - } - } - { - size, err := m.ListMeta.MarshalToSizedBuffer(dAtA[:i]) - if err != nil { - return 0, err - } - i -= size - i = encodeVarintGenerated(dAtA, i, uint64(size)) - } + i -= len(m.Info) + copy(dAtA[i:], m.Info) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.Info))) + i-- + dAtA[i] = 0x1a + i -= len(m.SubStatus) + copy(dAtA[i:], m.SubStatus) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.SubStatus))) + i-- + dAtA[i] = 0x12 + i -= len(m.Status) + copy(dAtA[i:], m.Status) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.Status))) i-- dAtA[i] = 0xa return len(dAtA) - i, nil } -func (m *SBOMSyftSpec) Marshal() (dAtA []byte, err error) { +func (m *ScannedControlSummary) Marshal() (dAtA []byte, err error) { size := m.Size() dAtA = make([]byte, size) n, err := m.MarshalToSizedBuffer(dAtA[:size]) @@ -5942,18 +5665,18 @@ func (m *SBOMSyftSpec) Marshal() (dAtA []byte, err error) { return dAtA[:n], nil } -func (m *SBOMSyftSpec) MarshalTo(dAtA []byte) (int, error) { +func (m *ScannedControlSummary) MarshalTo(dAtA []byte) (int, error) { size := m.Size() return m.MarshalToSizedBuffer(dAtA[:size]) } -func (m *SBOMSyftSpec) MarshalToSizedBuffer(dAtA []byte) (int, error) { +func (m *ScannedControlSummary) MarshalToSizedBuffer(dAtA []byte) (int, error) { i := len(dAtA) _ = i var l int _ = l { - size, err := m.Syft.MarshalToSizedBuffer(dAtA[:i]) + size, err := m.Status.MarshalToSizedBuffer(dAtA[:i]) if err != nil { return 0, err } @@ -5961,9 +5684,9 @@ func (m *SBOMSyftSpec) MarshalToSizedBuffer(dAtA []byte) (int, error) { i = encodeVarintGenerated(dAtA, i, uint64(size)) } i-- - dAtA[i] = 0x12 + dAtA[i] = 0x1a { - size, err := m.Metadata.MarshalToSizedBuffer(dAtA[:i]) + size, err := m.Severity.MarshalToSizedBuffer(dAtA[:i]) if err != nil { return 0, err } @@ -5971,11 +5694,16 @@ func (m *SBOMSyftSpec) MarshalToSizedBuffer(dAtA []byte) (int, error) { i = encodeVarintGenerated(dAtA, i, uint64(size)) } i-- + dAtA[i] = 0x12 + i -= len(m.ControlID) + copy(dAtA[i:], m.ControlID) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.ControlID))) + i-- dAtA[i] = 0xa return len(dAtA) - i, nil } -func (m *SBOMSyftStatus) Marshal() (dAtA []byte, err error) { +func (m *Schema) Marshal() (dAtA []byte, err error) { size := m.Size() dAtA = make([]byte, size) n, err := m.MarshalToSizedBuffer(dAtA[:size]) @@ -5985,20 +5713,30 @@ func (m *SBOMSyftStatus) Marshal() (dAtA []byte, err error) { return dAtA[:n], nil } -func (m *SBOMSyftStatus) MarshalTo(dAtA []byte) (int, error) { +func (m *Schema) MarshalTo(dAtA []byte) (int, error) { size := m.Size() return m.MarshalToSizedBuffer(dAtA[:size]) } -func (m *SBOMSyftStatus) MarshalToSizedBuffer(dAtA []byte) (int, error) { +func (m *Schema) MarshalToSizedBuffer(dAtA []byte) (int, error) { i := len(dAtA) _ = i var l int _ = l + i -= len(m.URL) + copy(dAtA[i:], m.URL) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.URL))) + i-- + dAtA[i] = 0x12 + i -= len(m.Version) + copy(dAtA[i:], m.Version) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.Version))) + i-- + dAtA[i] = 0xa return len(dAtA) - i, nil } -func (m *SPDXMeta) Marshal() (dAtA []byte, err error) { +func (m *SeccompProfile) Marshal() (dAtA []byte, err error) { size := m.Size() dAtA = make([]byte, size) n, err := m.MarshalToSizedBuffer(dAtA[:size]) @@ -6008,18 +5746,28 @@ func (m *SPDXMeta) Marshal() (dAtA []byte, err error) { return dAtA[:n], nil } -func (m *SPDXMeta) MarshalTo(dAtA []byte) (int, error) { +func (m *SeccompProfile) MarshalTo(dAtA []byte) (int, error) { size := m.Size() return m.MarshalToSizedBuffer(dAtA[:size]) } -func (m *SPDXMeta) MarshalToSizedBuffer(dAtA []byte) (int, error) { +func (m *SeccompProfile) MarshalToSizedBuffer(dAtA []byte) (int, error) { i := len(dAtA) _ = i var l int _ = l { - size, err := m.Report.MarshalToSizedBuffer(dAtA[:i]) + size, err := m.Status.MarshalToSizedBuffer(dAtA[:i]) + if err != nil { + return 0, err + } + i -= size + i = encodeVarintGenerated(dAtA, i, uint64(size)) + } + i-- + dAtA[i] = 0x1a + { + size, err := m.Spec.MarshalToSizedBuffer(dAtA[:i]) if err != nil { return 0, err } @@ -6029,7 +5777,7 @@ func (m *SPDXMeta) MarshalToSizedBuffer(dAtA []byte) (int, error) { i-- dAtA[i] = 0x12 { - size, err := m.Tool.MarshalToSizedBuffer(dAtA[:i]) + size, err := m.ObjectMeta.MarshalToSizedBuffer(dAtA[:i]) if err != nil { return 0, err } @@ -6041,7 +5789,7 @@ func (m *SPDXMeta) MarshalToSizedBuffer(dAtA []byte) (int, error) { return len(dAtA) - i, nil } -func (m *ScannedControl) Marshal() (dAtA []byte, err error) { +func (m *SeccompProfileList) Marshal() (dAtA []byte, err error) { size := m.Size() dAtA = make([]byte, size) n, err := m.MarshalToSizedBuffer(dAtA[:size]) @@ -6051,20 +5799,20 @@ func (m *ScannedControl) Marshal() (dAtA []byte, err error) { return dAtA[:n], nil } -func (m *ScannedControl) MarshalTo(dAtA []byte) (int, error) { +func (m *SeccompProfileList) MarshalTo(dAtA []byte) (int, error) { size := m.Size() return m.MarshalToSizedBuffer(dAtA[:size]) } -func (m *ScannedControl) MarshalToSizedBuffer(dAtA []byte) (int, error) { +func (m *SeccompProfileList) MarshalToSizedBuffer(dAtA []byte) (int, error) { i := len(dAtA) _ = i var l int _ = l - if len(m.Rules) > 0 { - for iNdEx := len(m.Rules) - 1; iNdEx >= 0; iNdEx-- { + if len(m.Items) > 0 { + for iNdEx := len(m.Items) - 1; iNdEx >= 0; iNdEx-- { { - size, err := m.Rules[iNdEx].MarshalToSizedBuffer(dAtA[:i]) + size, err := m.Items[iNdEx].MarshalToSizedBuffer(dAtA[:i]) if err != nil { return 0, err } @@ -6072,11 +5820,11 @@ func (m *ScannedControl) MarshalToSizedBuffer(dAtA []byte) (int, error) { i = encodeVarintGenerated(dAtA, i, uint64(size)) } i-- - dAtA[i] = 0x2a + dAtA[i] = 0x12 } } { - size, err := m.Status.MarshalToSizedBuffer(dAtA[:i]) + size, err := m.ListMeta.MarshalToSizedBuffer(dAtA[:i]) if err != nil { return 0, err } @@ -6084,31 +5832,11 @@ func (m *ScannedControl) MarshalToSizedBuffer(dAtA []byte) (int, error) { i = encodeVarintGenerated(dAtA, i, uint64(size)) } i-- - dAtA[i] = 0x22 - { - size, err := m.Severity.MarshalToSizedBuffer(dAtA[:i]) - if err != nil { - return 0, err - } - i -= size - i = encodeVarintGenerated(dAtA, i, uint64(size)) - } - i-- - dAtA[i] = 0x1a - i -= len(m.Name) - copy(dAtA[i:], m.Name) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.Name))) - i-- - dAtA[i] = 0x12 - i -= len(m.ControlID) - copy(dAtA[i:], m.ControlID) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.ControlID))) - i-- dAtA[i] = 0xa return len(dAtA) - i, nil } -func (m *ScannedControlRule) Marshal() (dAtA []byte, err error) { +func (m *SeccompProfileSpec) Marshal() (dAtA []byte, err error) { size := m.Size() dAtA = make([]byte, size) n, err := m.MarshalToSizedBuffer(dAtA[:size]) @@ -6118,38 +5846,48 @@ func (m *ScannedControlRule) Marshal() (dAtA []byte, err error) { return dAtA[:n], nil } -func (m *ScannedControlRule) MarshalTo(dAtA []byte) (int, error) { +func (m *SeccompProfileSpec) MarshalTo(dAtA []byte) (int, error) { size := m.Size() return m.MarshalToSizedBuffer(dAtA[:size]) } -func (m *ScannedControlRule) MarshalToSizedBuffer(dAtA []byte) (int, error) { +func (m *SeccompProfileSpec) MarshalToSizedBuffer(dAtA []byte) (int, error) { i := len(dAtA) _ = i var l int _ = l - if len(m.RelatedResourcesIDs) > 0 { - for iNdEx := len(m.RelatedResourcesIDs) - 1; iNdEx >= 0; iNdEx-- { - i -= len(m.RelatedResourcesIDs[iNdEx]) - copy(dAtA[i:], m.RelatedResourcesIDs[iNdEx]) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.RelatedResourcesIDs[iNdEx]))) + if len(m.EphemeralContainers) > 0 { + for iNdEx := len(m.EphemeralContainers) - 1; iNdEx >= 0; iNdEx-- { + { + size, err := m.EphemeralContainers[iNdEx].MarshalToSizedBuffer(dAtA[:i]) + if err != nil { + return 0, err + } + i -= size + i = encodeVarintGenerated(dAtA, i, uint64(size)) + } i-- - dAtA[i] = 0x32 + dAtA[i] = 0x1a } } - if len(m.AppliedIgnoreRules) > 0 { - for iNdEx := len(m.AppliedIgnoreRules) - 1; iNdEx >= 0; iNdEx-- { - i -= len(m.AppliedIgnoreRules[iNdEx]) - copy(dAtA[i:], m.AppliedIgnoreRules[iNdEx]) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.AppliedIgnoreRules[iNdEx]))) + if len(m.InitContainers) > 0 { + for iNdEx := len(m.InitContainers) - 1; iNdEx >= 0; iNdEx-- { + { + size, err := m.InitContainers[iNdEx].MarshalToSizedBuffer(dAtA[:i]) + if err != nil { + return 0, err + } + i -= size + i = encodeVarintGenerated(dAtA, i, uint64(size)) + } i-- - dAtA[i] = 0x2a + dAtA[i] = 0x12 } } - if len(m.Paths) > 0 { - for iNdEx := len(m.Paths) - 1; iNdEx >= 0; iNdEx-- { + if len(m.Containers) > 0 { + for iNdEx := len(m.Containers) - 1; iNdEx >= 0; iNdEx-- { { - size, err := m.Paths[iNdEx].MarshalToSizedBuffer(dAtA[:i]) + size, err := m.Containers[iNdEx].MarshalToSizedBuffer(dAtA[:i]) if err != nil { return 0, err } @@ -6157,54 +5895,65 @@ func (m *ScannedControlRule) MarshalToSizedBuffer(dAtA []byte) (int, error) { i = encodeVarintGenerated(dAtA, i, uint64(size)) } i-- - dAtA[i] = 0x22 + dAtA[i] = 0xa } } - if len(m.ControlConfigurations) > 0 { - keysForControlConfigurations := make([]string, 0, len(m.ControlConfigurations)) - for k := range m.ControlConfigurations { - keysForControlConfigurations = append(keysForControlConfigurations, string(k)) + return len(dAtA) - i, nil +} + +func (m *SeccompProfileStatus) Marshal() (dAtA []byte, err error) { + size := m.Size() + dAtA = make([]byte, size) + n, err := m.MarshalToSizedBuffer(dAtA[:size]) + if err != nil { + return nil, err + } + return dAtA[:n], nil +} + +func (m *SeccompProfileStatus) MarshalTo(dAtA []byte) (int, error) { + size := m.Size() + return m.MarshalToSizedBuffer(dAtA[:size]) +} + +func (m *SeccompProfileStatus) MarshalToSizedBuffer(dAtA []byte) (int, error) { + i := len(dAtA) + _ = i + var l int + _ = l + if len(m.Containers) > 0 { + keysForContainers := make([]string, 0, len(m.Containers)) + for k := range m.Containers { + keysForContainers = append(keysForContainers, string(k)) } - sort.Strings(keysForControlConfigurations) - for iNdEx := len(keysForControlConfigurations) - 1; iNdEx >= 0; iNdEx-- { - v := m.ControlConfigurations[string(keysForControlConfigurations[iNdEx])] + sort.Strings(keysForContainers) + for iNdEx := len(keysForContainers) - 1; iNdEx >= 0; iNdEx-- { + v := m.Containers[string(keysForContainers[iNdEx])] baseI := i - if v != nil { - i -= len(v) - copy(dAtA[i:], v) - i = encodeVarintGenerated(dAtA, i, uint64(len(v))) - i-- - dAtA[i] = 0x12 + { + size, err := (&v).MarshalToSizedBuffer(dAtA[:i]) + if err != nil { + return 0, err + } + i -= size + i = encodeVarintGenerated(dAtA, i, uint64(size)) } - i -= len(keysForControlConfigurations[iNdEx]) - copy(dAtA[i:], keysForControlConfigurations[iNdEx]) - i = encodeVarintGenerated(dAtA, i, uint64(len(keysForControlConfigurations[iNdEx]))) + i-- + dAtA[i] = 0x12 + i -= len(keysForContainers[iNdEx]) + copy(dAtA[i:], keysForContainers[iNdEx]) + i = encodeVarintGenerated(dAtA, i, uint64(len(keysForContainers[iNdEx]))) i-- dAtA[i] = 0xa i = encodeVarintGenerated(dAtA, i, uint64(baseI-i)) i-- - dAtA[i] = 0x1a - } - } - { - size, err := m.Status.MarshalToSizedBuffer(dAtA[:i]) - if err != nil { - return 0, err + dAtA[i] = 0xa } - i -= size - i = encodeVarintGenerated(dAtA, i, uint64(size)) } - i-- - dAtA[i] = 0x12 - i -= len(m.Name) - copy(dAtA[i:], m.Name) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.Name))) - i-- - dAtA[i] = 0xa return len(dAtA) - i, nil } -func (m *ScannedControlStatus) Marshal() (dAtA []byte, err error) { +func (m *ServiceBackendPort) Marshal() (dAtA []byte, err error) { size := m.Size() dAtA = make([]byte, size) n, err := m.MarshalToSizedBuffer(dAtA[:size]) @@ -6214,35 +5963,28 @@ func (m *ScannedControlStatus) Marshal() (dAtA []byte, err error) { return dAtA[:n], nil } -func (m *ScannedControlStatus) MarshalTo(dAtA []byte) (int, error) { +func (m *ServiceBackendPort) MarshalTo(dAtA []byte) (int, error) { size := m.Size() return m.MarshalToSizedBuffer(dAtA[:size]) } -func (m *ScannedControlStatus) MarshalToSizedBuffer(dAtA []byte) (int, error) { +func (m *ServiceBackendPort) MarshalToSizedBuffer(dAtA []byte) (int, error) { i := len(dAtA) _ = i var l int _ = l - i -= len(m.Info) - copy(dAtA[i:], m.Info) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.Info))) - i-- - dAtA[i] = 0x1a - i -= len(m.SubStatus) - copy(dAtA[i:], m.SubStatus) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.SubStatus))) + i = encodeVarintGenerated(dAtA, i, uint64(m.Number)) i-- - dAtA[i] = 0x12 - i -= len(m.Status) - copy(dAtA[i:], m.Status) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.Status))) + dAtA[i] = 0x10 + i -= len(m.Name) + copy(dAtA[i:], m.Name) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.Name))) i-- dAtA[i] = 0xa return len(dAtA) - i, nil } -func (m *ScannedControlSummary) Marshal() (dAtA []byte, err error) { +func (m *SeveritySummary) Marshal() (dAtA []byte, err error) { size := m.Size() dAtA = make([]byte, size) n, err := m.MarshalToSizedBuffer(dAtA[:size]) @@ -6252,18 +5994,48 @@ func (m *ScannedControlSummary) Marshal() (dAtA []byte, err error) { return dAtA[:n], nil } -func (m *ScannedControlSummary) MarshalTo(dAtA []byte) (int, error) { +func (m *SeveritySummary) MarshalTo(dAtA []byte) (int, error) { size := m.Size() return m.MarshalToSizedBuffer(dAtA[:size]) } -func (m *ScannedControlSummary) MarshalToSizedBuffer(dAtA []byte) (int, error) { +func (m *SeveritySummary) MarshalToSizedBuffer(dAtA []byte) (int, error) { i := len(dAtA) _ = i var l int _ = l { - size, err := m.Status.MarshalToSizedBuffer(dAtA[:i]) + size, err := m.Unknown.MarshalToSizedBuffer(dAtA[:i]) + if err != nil { + return 0, err + } + i -= size + i = encodeVarintGenerated(dAtA, i, uint64(size)) + } + i-- + dAtA[i] = 0x32 + { + size, err := m.Negligible.MarshalToSizedBuffer(dAtA[:i]) + if err != nil { + return 0, err + } + i -= size + i = encodeVarintGenerated(dAtA, i, uint64(size)) + } + i-- + dAtA[i] = 0x2a + { + size, err := m.Low.MarshalToSizedBuffer(dAtA[:i]) + if err != nil { + return 0, err + } + i -= size + i = encodeVarintGenerated(dAtA, i, uint64(size)) + } + i-- + dAtA[i] = 0x22 + { + size, err := m.Medium.MarshalToSizedBuffer(dAtA[:i]) if err != nil { return 0, err } @@ -6273,7 +6045,7 @@ func (m *ScannedControlSummary) MarshalToSizedBuffer(dAtA []byte) (int, error) { i-- dAtA[i] = 0x1a { - size, err := m.Severity.MarshalToSizedBuffer(dAtA[:i]) + size, err := m.High.MarshalToSizedBuffer(dAtA[:i]) if err != nil { return 0, err } @@ -6282,15 +6054,20 @@ func (m *ScannedControlSummary) MarshalToSizedBuffer(dAtA []byte) (int, error) { } i-- dAtA[i] = 0x12 - i -= len(m.ControlID) - copy(dAtA[i:], m.ControlID) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.ControlID))) + { + size, err := m.Critical.MarshalToSizedBuffer(dAtA[:i]) + if err != nil { + return 0, err + } + i -= size + i = encodeVarintGenerated(dAtA, i, uint64(size)) + } i-- dAtA[i] = 0xa return len(dAtA) - i, nil } -func (m *Schema) Marshal() (dAtA []byte, err error) { +func (m *SingleSeccompProfile) Marshal() (dAtA []byte, err error) { size := m.Size() dAtA = make([]byte, size) n, err := m.MarshalToSizedBuffer(dAtA[:size]) @@ -6300,30 +6077,40 @@ func (m *Schema) Marshal() (dAtA []byte, err error) { return dAtA[:n], nil } -func (m *Schema) MarshalTo(dAtA []byte) (int, error) { +func (m *SingleSeccompProfile) MarshalTo(dAtA []byte) (int, error) { size := m.Size() return m.MarshalToSizedBuffer(dAtA[:size]) } -func (m *Schema) MarshalToSizedBuffer(dAtA []byte) (int, error) { +func (m *SingleSeccompProfile) MarshalToSizedBuffer(dAtA []byte) (int, error) { i := len(dAtA) _ = i var l int _ = l - i -= len(m.URL) - copy(dAtA[i:], m.URL) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.URL))) + { + size, err := m.Spec.MarshalToSizedBuffer(dAtA[:i]) + if err != nil { + return 0, err + } + i -= size + i = encodeVarintGenerated(dAtA, i, uint64(size)) + } + i-- + dAtA[i] = 0x1a + i -= len(m.Path) + copy(dAtA[i:], m.Path) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.Path))) i-- dAtA[i] = 0x12 - i -= len(m.Version) - copy(dAtA[i:], m.Version) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.Version))) + i -= len(m.Name) + copy(dAtA[i:], m.Name) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.Name))) i-- dAtA[i] = 0xa return len(dAtA) - i, nil } -func (m *SeccompProfile) Marshal() (dAtA []byte, err error) { +func (m *SingleSeccompProfileSpec) Marshal() (dAtA []byte, err error) { size := m.Size() dAtA = make([]byte, size) n, err := m.MarshalToSizedBuffer(dAtA[:size]) @@ -6333,38 +6120,70 @@ func (m *SeccompProfile) Marshal() (dAtA []byte, err error) { return dAtA[:n], nil } -func (m *SeccompProfile) MarshalTo(dAtA []byte) (int, error) { +func (m *SingleSeccompProfileSpec) MarshalTo(dAtA []byte) (int, error) { size := m.Size() return m.MarshalToSizedBuffer(dAtA[:size]) } -func (m *SeccompProfile) MarshalToSizedBuffer(dAtA []byte) (int, error) { +func (m *SingleSeccompProfileSpec) MarshalToSizedBuffer(dAtA []byte) (int, error) { i := len(dAtA) _ = i var l int _ = l - { - size, err := m.Status.MarshalToSizedBuffer(dAtA[:i]) - if err != nil { - return 0, err - } - i -= size - i = encodeVarintGenerated(dAtA, i, uint64(size)) + if len(m.Flags) > 0 { + for iNdEx := len(m.Flags) - 1; iNdEx >= 0; iNdEx-- { + i -= len(m.Flags[iNdEx]) + copy(dAtA[i:], m.Flags[iNdEx]) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.Flags[iNdEx]))) + i-- + dAtA[i] = 0x42 + } + } + if len(m.Syscalls) > 0 { + for iNdEx := len(m.Syscalls) - 1; iNdEx >= 0; iNdEx-- { + { + size, err := m.Syscalls[iNdEx].MarshalToSizedBuffer(dAtA[:i]) + if err != nil { + return 0, err + } + i -= size + i = encodeVarintGenerated(dAtA, i, uint64(size)) + } + i-- + dAtA[i] = 0x3a + } } + i -= len(m.ListenerMetadata) + copy(dAtA[i:], m.ListenerMetadata) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.ListenerMetadata))) i-- - dAtA[i] = 0x1a - { - size, err := m.Spec.MarshalToSizedBuffer(dAtA[:i]) - if err != nil { - return 0, err + dAtA[i] = 0x32 + i -= len(m.ListenerPath) + copy(dAtA[i:], m.ListenerPath) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.ListenerPath))) + i-- + dAtA[i] = 0x2a + if len(m.Architectures) > 0 { + for iNdEx := len(m.Architectures) - 1; iNdEx >= 0; iNdEx-- { + i -= len(m.Architectures[iNdEx]) + copy(dAtA[i:], m.Architectures[iNdEx]) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.Architectures[iNdEx]))) + i-- + dAtA[i] = 0x22 } - i -= size - i = encodeVarintGenerated(dAtA, i, uint64(size)) } + i -= len(m.DefaultAction) + copy(dAtA[i:], m.DefaultAction) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.DefaultAction))) + i-- + dAtA[i] = 0x1a + i -= len(m.BaseProfileName) + copy(dAtA[i:], m.BaseProfileName) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.BaseProfileName))) i-- dAtA[i] = 0x12 { - size, err := m.ObjectMeta.MarshalToSizedBuffer(dAtA[:i]) + size, err := m.SpecBase.MarshalToSizedBuffer(dAtA[:i]) if err != nil { return 0, err } @@ -6376,7 +6195,7 @@ func (m *SeccompProfile) MarshalToSizedBuffer(dAtA []byte) (int, error) { return len(dAtA) - i, nil } -func (m *SeccompProfileList) Marshal() (dAtA []byte, err error) { +func (m *SingleSeccompProfileStatus) Marshal() (dAtA []byte, err error) { size := m.Size() dAtA = make([]byte, size) n, err := m.MarshalToSizedBuffer(dAtA[:size]) @@ -6386,32 +6205,37 @@ func (m *SeccompProfileList) Marshal() (dAtA []byte, err error) { return dAtA[:n], nil } -func (m *SeccompProfileList) MarshalTo(dAtA []byte) (int, error) { +func (m *SingleSeccompProfileStatus) MarshalTo(dAtA []byte) (int, error) { size := m.Size() return m.MarshalToSizedBuffer(dAtA[:size]) } -func (m *SeccompProfileList) MarshalToSizedBuffer(dAtA []byte) (int, error) { +func (m *SingleSeccompProfileStatus) MarshalToSizedBuffer(dAtA []byte) (int, error) { i := len(dAtA) _ = i var l int _ = l - if len(m.Items) > 0 { - for iNdEx := len(m.Items) - 1; iNdEx >= 0; iNdEx-- { - { - size, err := m.Items[iNdEx].MarshalToSizedBuffer(dAtA[:i]) - if err != nil { - return 0, err - } - i -= size - i = encodeVarintGenerated(dAtA, i, uint64(size)) - } + i -= len(m.LocalhostProfile) + copy(dAtA[i:], m.LocalhostProfile) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.LocalhostProfile))) + i-- + dAtA[i] = 0x22 + if len(m.ActiveWorkloads) > 0 { + for iNdEx := len(m.ActiveWorkloads) - 1; iNdEx >= 0; iNdEx-- { + i -= len(m.ActiveWorkloads[iNdEx]) + copy(dAtA[i:], m.ActiveWorkloads[iNdEx]) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.ActiveWorkloads[iNdEx]))) i-- - dAtA[i] = 0x12 + dAtA[i] = 0x1a } } + i -= len(m.Path) + copy(dAtA[i:], m.Path) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.Path))) + i-- + dAtA[i] = 0x12 { - size, err := m.ListMeta.MarshalToSizedBuffer(dAtA[:i]) + size, err := m.StatusBase.MarshalToSizedBuffer(dAtA[:i]) if err != nil { return 0, err } @@ -6423,7 +6247,7 @@ func (m *SeccompProfileList) MarshalToSizedBuffer(dAtA []byte) (int, error) { return len(dAtA) - i, nil } -func (m *SeccompProfileSpec) Marshal() (dAtA []byte, err error) { +func (m *Source) Marshal() (dAtA []byte, err error) { size := m.Size() dAtA = make([]byte, size) n, err := m.MarshalToSizedBuffer(dAtA[:size]) @@ -6433,62 +6257,32 @@ func (m *SeccompProfileSpec) Marshal() (dAtA []byte, err error) { return dAtA[:n], nil } -func (m *SeccompProfileSpec) MarshalTo(dAtA []byte) (int, error) { +func (m *Source) MarshalTo(dAtA []byte) (int, error) { size := m.Size() return m.MarshalToSizedBuffer(dAtA[:size]) } -func (m *SeccompProfileSpec) MarshalToSizedBuffer(dAtA []byte) (int, error) { +func (m *Source) MarshalToSizedBuffer(dAtA []byte) (int, error) { i := len(dAtA) _ = i var l int _ = l - if len(m.EphemeralContainers) > 0 { - for iNdEx := len(m.EphemeralContainers) - 1; iNdEx >= 0; iNdEx-- { - { - size, err := m.EphemeralContainers[iNdEx].MarshalToSizedBuffer(dAtA[:i]) - if err != nil { - return 0, err - } - i -= size - i = encodeVarintGenerated(dAtA, i, uint64(size)) - } - i-- - dAtA[i] = 0x1a - } - } - if len(m.InitContainers) > 0 { - for iNdEx := len(m.InitContainers) - 1; iNdEx >= 0; iNdEx-- { - { - size, err := m.InitContainers[iNdEx].MarshalToSizedBuffer(dAtA[:i]) - if err != nil { - return 0, err - } - i -= size - i = encodeVarintGenerated(dAtA, i, uint64(size)) - } - i-- - dAtA[i] = 0x12 - } - } - if len(m.Containers) > 0 { - for iNdEx := len(m.Containers) - 1; iNdEx >= 0; iNdEx-- { - { - size, err := m.Containers[iNdEx].MarshalToSizedBuffer(dAtA[:i]) - if err != nil { - return 0, err - } - i -= size - i = encodeVarintGenerated(dAtA, i, uint64(size)) - } - i-- - dAtA[i] = 0xa - } + if m.Target != nil { + i -= len(m.Target) + copy(dAtA[i:], m.Target) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.Target))) + i-- + dAtA[i] = 0x12 } + i -= len(m.Type) + copy(dAtA[i:], m.Type) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.Type))) + i-- + dAtA[i] = 0xa return len(dAtA) - i, nil } -func (m *SeccompProfileStatus) Marshal() (dAtA []byte, err error) { +func (m *SpecBase) Marshal() (dAtA []byte, err error) { size := m.Size() dAtA = make([]byte, size) n, err := m.MarshalToSizedBuffer(dAtA[:size]) @@ -6498,49 +6292,28 @@ func (m *SeccompProfileStatus) Marshal() (dAtA []byte, err error) { return dAtA[:n], nil } -func (m *SeccompProfileStatus) MarshalTo(dAtA []byte) (int, error) { +func (m *SpecBase) MarshalTo(dAtA []byte) (int, error) { size := m.Size() return m.MarshalToSizedBuffer(dAtA[:size]) } -func (m *SeccompProfileStatus) MarshalToSizedBuffer(dAtA []byte) (int, error) { +func (m *SpecBase) MarshalToSizedBuffer(dAtA []byte) (int, error) { i := len(dAtA) _ = i var l int _ = l - if len(m.Containers) > 0 { - keysForContainers := make([]string, 0, len(m.Containers)) - for k := range m.Containers { - keysForContainers = append(keysForContainers, string(k)) - } - sort.Strings(keysForContainers) - for iNdEx := len(keysForContainers) - 1; iNdEx >= 0; iNdEx-- { - v := m.Containers[string(keysForContainers[iNdEx])] - baseI := i - { - size, err := (&v).MarshalToSizedBuffer(dAtA[:i]) - if err != nil { - return 0, err - } - i -= size - i = encodeVarintGenerated(dAtA, i, uint64(size)) - } - i-- - dAtA[i] = 0x12 - i -= len(keysForContainers[iNdEx]) - copy(dAtA[i:], keysForContainers[iNdEx]) - i = encodeVarintGenerated(dAtA, i, uint64(len(keysForContainers[iNdEx]))) - i-- - dAtA[i] = 0xa - i = encodeVarintGenerated(dAtA, i, uint64(baseI-i)) - i-- - dAtA[i] = 0xa - } + i-- + if m.Disabled { + dAtA[i] = 1 + } else { + dAtA[i] = 0 } + i-- + dAtA[i] = 0x8 return len(dAtA) - i, nil } -func (m *ServiceBackendPort) Marshal() (dAtA []byte, err error) { +func (m *StackFrame) Marshal() (dAtA []byte, err error) { size := m.Size() dAtA = make([]byte, size) n, err := m.MarshalToSizedBuffer(dAtA[:size]) @@ -6550,28 +6323,33 @@ func (m *ServiceBackendPort) Marshal() (dAtA []byte, err error) { return dAtA[:n], nil } -func (m *ServiceBackendPort) MarshalTo(dAtA []byte) (int, error) { +func (m *StackFrame) MarshalTo(dAtA []byte) (int, error) { size := m.Size() return m.MarshalToSizedBuffer(dAtA[:size]) } -func (m *ServiceBackendPort) MarshalToSizedBuffer(dAtA []byte) (int, error) { +func (m *StackFrame) MarshalToSizedBuffer(dAtA []byte) (int, error) { i := len(dAtA) _ = i var l int _ = l - i = encodeVarintGenerated(dAtA, i, uint64(m.Number)) + i = encodeVarintGenerated(dAtA, i, uint64(m.FrameType)) i-- - dAtA[i] = 0x10 - i -= len(m.Name) - copy(dAtA[i:], m.Name) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.Name))) + dAtA[i] = 0x18 + i -= len(m.Lineno) + copy(dAtA[i:], m.Lineno) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.Lineno))) + i-- + dAtA[i] = 0x12 + i -= len(m.FileID) + copy(dAtA[i:], m.FileID) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.FileID))) i-- dAtA[i] = 0xa return len(dAtA) - i, nil } -func (m *SeveritySummary) Marshal() (dAtA []byte, err error) { +func (m *Statement) Marshal() (dAtA []byte, err error) { size := m.Size() dAtA = make([]byte, size) n, err := m.MarshalToSizedBuffer(dAtA[:size]) @@ -6581,58 +6359,72 @@ func (m *SeveritySummary) Marshal() (dAtA []byte, err error) { return dAtA[:n], nil } -func (m *SeveritySummary) MarshalTo(dAtA []byte) (int, error) { +func (m *Statement) MarshalTo(dAtA []byte) (int, error) { size := m.Size() return m.MarshalToSizedBuffer(dAtA[:size]) } -func (m *SeveritySummary) MarshalToSizedBuffer(dAtA []byte) (int, error) { +func (m *Statement) MarshalToSizedBuffer(dAtA []byte) (int, error) { i := len(dAtA) _ = i var l int _ = l - { - size, err := m.Unknown.MarshalToSizedBuffer(dAtA[:i]) - if err != nil { - return 0, err - } - i -= size - i = encodeVarintGenerated(dAtA, i, uint64(size)) - } + i -= len(m.ActionStatementTimestamp) + copy(dAtA[i:], m.ActionStatementTimestamp) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.ActionStatementTimestamp))) i-- - dAtA[i] = 0x32 - { - size, err := m.Negligible.MarshalToSizedBuffer(dAtA[:i]) - if err != nil { - return 0, err - } - i -= size - i = encodeVarintGenerated(dAtA, i, uint64(size)) - } + dAtA[i] = 0x5a + i -= len(m.ActionStatement) + copy(dAtA[i:], m.ActionStatement) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.ActionStatement))) i-- - dAtA[i] = 0x2a - { - size, err := m.Low.MarshalToSizedBuffer(dAtA[:i]) - if err != nil { - return 0, err - } - i -= size - i = encodeVarintGenerated(dAtA, i, uint64(size)) - } + dAtA[i] = 0x52 + i -= len(m.ImpactStatement) + copy(dAtA[i:], m.ImpactStatement) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.ImpactStatement))) i-- - dAtA[i] = 0x22 - { - size, err := m.Medium.MarshalToSizedBuffer(dAtA[:i]) - if err != nil { - return 0, err + dAtA[i] = 0x4a + i -= len(m.Justification) + copy(dAtA[i:], m.Justification) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.Justification))) + i-- + dAtA[i] = 0x42 + i -= len(m.StatusNotes) + copy(dAtA[i:], m.StatusNotes) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.StatusNotes))) + i-- + dAtA[i] = 0x3a + i -= len(m.Status) + copy(dAtA[i:], m.Status) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.Status))) + i-- + dAtA[i] = 0x32 + if len(m.Products) > 0 { + for iNdEx := len(m.Products) - 1; iNdEx >= 0; iNdEx-- { + { + size, err := m.Products[iNdEx].MarshalToSizedBuffer(dAtA[:i]) + if err != nil { + return 0, err + } + i -= size + i = encodeVarintGenerated(dAtA, i, uint64(size)) + } + i-- + dAtA[i] = 0x2a } - i -= size - i = encodeVarintGenerated(dAtA, i, uint64(size)) } + i -= len(m.LastUpdated) + copy(dAtA[i:], m.LastUpdated) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.LastUpdated))) + i-- + dAtA[i] = 0x22 + i -= len(m.Timestamp) + copy(dAtA[i:], m.Timestamp) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.Timestamp))) i-- dAtA[i] = 0x1a { - size, err := m.High.MarshalToSizedBuffer(dAtA[:i]) + size, err := m.Vulnerability.MarshalToSizedBuffer(dAtA[:i]) if err != nil { return 0, err } @@ -6641,20 +6433,15 @@ func (m *SeveritySummary) MarshalToSizedBuffer(dAtA []byte) (int, error) { } i-- dAtA[i] = 0x12 - { - size, err := m.Critical.MarshalToSizedBuffer(dAtA[:i]) - if err != nil { - return 0, err - } - i -= size - i = encodeVarintGenerated(dAtA, i, uint64(size)) - } + i -= len(m.ID) + copy(dAtA[i:], m.ID) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.ID))) i-- dAtA[i] = 0xa return len(dAtA) - i, nil } -func (m *SingleSeccompProfile) Marshal() (dAtA []byte, err error) { +func (m *StatusBase) Marshal() (dAtA []byte, err error) { size := m.Size() dAtA = make([]byte, size) n, err := m.MarshalToSizedBuffer(dAtA[:size]) @@ -6664,18 +6451,23 @@ func (m *SingleSeccompProfile) Marshal() (dAtA []byte, err error) { return dAtA[:n], nil } -func (m *SingleSeccompProfile) MarshalTo(dAtA []byte) (int, error) { +func (m *StatusBase) MarshalTo(dAtA []byte) (int, error) { size := m.Size() return m.MarshalToSizedBuffer(dAtA[:size]) } -func (m *SingleSeccompProfile) MarshalToSizedBuffer(dAtA []byte) (int, error) { +func (m *StatusBase) MarshalToSizedBuffer(dAtA []byte) (int, error) { i := len(dAtA) _ = i var l int _ = l + i -= len(m.Status) + copy(dAtA[i:], m.Status) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.Status))) + i-- + dAtA[i] = 0x12 { - size, err := m.Spec.MarshalToSizedBuffer(dAtA[:i]) + size, err := m.ConditionedStatus.MarshalToSizedBuffer(dAtA[:i]) if err != nil { return 0, err } @@ -6683,21 +6475,11 @@ func (m *SingleSeccompProfile) MarshalToSizedBuffer(dAtA []byte) (int, error) { i = encodeVarintGenerated(dAtA, i, uint64(size)) } i-- - dAtA[i] = 0x1a - i -= len(m.Path) - copy(dAtA[i:], m.Path) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.Path))) - i-- - dAtA[i] = 0x12 - i -= len(m.Name) - copy(dAtA[i:], m.Name) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.Name))) - i-- dAtA[i] = 0xa return len(dAtA) - i, nil } -func (m *SingleSeccompProfileSpec) Marshal() (dAtA []byte, err error) { +func (m *Subcomponent) Marshal() (dAtA []byte, err error) { size := m.Size() dAtA = make([]byte, size) n, err := m.MarshalToSizedBuffer(dAtA[:size]) @@ -6707,70 +6489,18 @@ func (m *SingleSeccompProfileSpec) Marshal() (dAtA []byte, err error) { return dAtA[:n], nil } -func (m *SingleSeccompProfileSpec) MarshalTo(dAtA []byte) (int, error) { +func (m *Subcomponent) MarshalTo(dAtA []byte) (int, error) { size := m.Size() return m.MarshalToSizedBuffer(dAtA[:size]) } -func (m *SingleSeccompProfileSpec) MarshalToSizedBuffer(dAtA []byte) (int, error) { +func (m *Subcomponent) MarshalToSizedBuffer(dAtA []byte) (int, error) { i := len(dAtA) _ = i var l int _ = l - if len(m.Flags) > 0 { - for iNdEx := len(m.Flags) - 1; iNdEx >= 0; iNdEx-- { - i -= len(m.Flags[iNdEx]) - copy(dAtA[i:], m.Flags[iNdEx]) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.Flags[iNdEx]))) - i-- - dAtA[i] = 0x42 - } - } - if len(m.Syscalls) > 0 { - for iNdEx := len(m.Syscalls) - 1; iNdEx >= 0; iNdEx-- { - { - size, err := m.Syscalls[iNdEx].MarshalToSizedBuffer(dAtA[:i]) - if err != nil { - return 0, err - } - i -= size - i = encodeVarintGenerated(dAtA, i, uint64(size)) - } - i-- - dAtA[i] = 0x3a - } - } - i -= len(m.ListenerMetadata) - copy(dAtA[i:], m.ListenerMetadata) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.ListenerMetadata))) - i-- - dAtA[i] = 0x32 - i -= len(m.ListenerPath) - copy(dAtA[i:], m.ListenerPath) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.ListenerPath))) - i-- - dAtA[i] = 0x2a - if len(m.Architectures) > 0 { - for iNdEx := len(m.Architectures) - 1; iNdEx >= 0; iNdEx-- { - i -= len(m.Architectures[iNdEx]) - copy(dAtA[i:], m.Architectures[iNdEx]) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.Architectures[iNdEx]))) - i-- - dAtA[i] = 0x22 - } - } - i -= len(m.DefaultAction) - copy(dAtA[i:], m.DefaultAction) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.DefaultAction))) - i-- - dAtA[i] = 0x1a - i -= len(m.BaseProfileName) - copy(dAtA[i:], m.BaseProfileName) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.BaseProfileName))) - i-- - dAtA[i] = 0x12 { - size, err := m.SpecBase.MarshalToSizedBuffer(dAtA[:i]) + size, err := m.Component.MarshalToSizedBuffer(dAtA[:i]) if err != nil { return 0, err } @@ -6782,7 +6512,7 @@ func (m *SingleSeccompProfileSpec) MarshalToSizedBuffer(dAtA []byte) (int, error return len(dAtA) - i, nil } -func (m *SingleSeccompProfileStatus) Marshal() (dAtA []byte, err error) { +func (m *SyftCoordinates) Marshal() (dAtA []byte, err error) { size := m.Size() dAtA = make([]byte, size) n, err := m.MarshalToSizedBuffer(dAtA[:size]) @@ -6792,49 +6522,30 @@ func (m *SingleSeccompProfileStatus) Marshal() (dAtA []byte, err error) { return dAtA[:n], nil } -func (m *SingleSeccompProfileStatus) MarshalTo(dAtA []byte) (int, error) { +func (m *SyftCoordinates) MarshalTo(dAtA []byte) (int, error) { size := m.Size() return m.MarshalToSizedBuffer(dAtA[:size]) } -func (m *SingleSeccompProfileStatus) MarshalToSizedBuffer(dAtA []byte) (int, error) { +func (m *SyftCoordinates) MarshalToSizedBuffer(dAtA []byte) (int, error) { i := len(dAtA) _ = i var l int _ = l - i -= len(m.LocalhostProfile) - copy(dAtA[i:], m.LocalhostProfile) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.LocalhostProfile))) - i-- - dAtA[i] = 0x22 - if len(m.ActiveWorkloads) > 0 { - for iNdEx := len(m.ActiveWorkloads) - 1; iNdEx >= 0; iNdEx-- { - i -= len(m.ActiveWorkloads[iNdEx]) - copy(dAtA[i:], m.ActiveWorkloads[iNdEx]) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.ActiveWorkloads[iNdEx]))) - i-- - dAtA[i] = 0x1a - } - } - i -= len(m.Path) - copy(dAtA[i:], m.Path) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.Path))) + i -= len(m.FileSystemID) + copy(dAtA[i:], m.FileSystemID) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.FileSystemID))) i-- dAtA[i] = 0x12 - { - size, err := m.StatusBase.MarshalToSizedBuffer(dAtA[:i]) - if err != nil { - return 0, err - } - i -= size - i = encodeVarintGenerated(dAtA, i, uint64(size)) - } + i -= len(m.RealPath) + copy(dAtA[i:], m.RealPath) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.RealPath))) i-- dAtA[i] = 0xa return len(dAtA) - i, nil } -func (m *Source) Marshal() (dAtA []byte, err error) { +func (m *SyftDescriptor) Marshal() (dAtA []byte, err error) { size := m.Size() dAtA = make([]byte, size) n, err := m.MarshalToSizedBuffer(dAtA[:size]) @@ -6844,32 +6555,37 @@ func (m *Source) Marshal() (dAtA []byte, err error) { return dAtA[:n], nil } -func (m *Source) MarshalTo(dAtA []byte) (int, error) { +func (m *SyftDescriptor) MarshalTo(dAtA []byte) (int, error) { size := m.Size() return m.MarshalToSizedBuffer(dAtA[:size]) } -func (m *Source) MarshalToSizedBuffer(dAtA []byte) (int, error) { +func (m *SyftDescriptor) MarshalToSizedBuffer(dAtA []byte) (int, error) { i := len(dAtA) _ = i var l int _ = l - if m.Target != nil { - i -= len(m.Target) - copy(dAtA[i:], m.Target) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.Target))) + if m.Configuration != nil { + i -= len(m.Configuration) + copy(dAtA[i:], m.Configuration) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.Configuration))) i-- - dAtA[i] = 0x12 + dAtA[i] = 0x1a } - i -= len(m.Type) - copy(dAtA[i:], m.Type) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.Type))) + i -= len(m.Version) + copy(dAtA[i:], m.Version) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.Version))) + i-- + dAtA[i] = 0x12 + i -= len(m.Name) + copy(dAtA[i:], m.Name) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.Name))) i-- dAtA[i] = 0xa return len(dAtA) - i, nil } -func (m *SpecBase) Marshal() (dAtA []byte, err error) { +func (m *SyftDocument) Marshal() (dAtA []byte, err error) { size := m.Size() dAtA = make([]byte, size) n, err := m.MarshalToSizedBuffer(dAtA[:size]) @@ -6879,64 +6595,102 @@ func (m *SpecBase) Marshal() (dAtA []byte, err error) { return dAtA[:n], nil } -func (m *SpecBase) MarshalTo(dAtA []byte) (int, error) { +func (m *SyftDocument) MarshalTo(dAtA []byte) (int, error) { size := m.Size() return m.MarshalToSizedBuffer(dAtA[:size]) } -func (m *SpecBase) MarshalToSizedBuffer(dAtA []byte) (int, error) { +func (m *SyftDocument) MarshalToSizedBuffer(dAtA []byte) (int, error) { i := len(dAtA) _ = i var l int _ = l - i-- - if m.Disabled { - dAtA[i] = 1 - } else { - dAtA[i] = 0 + { + size, err := m.Schema.MarshalToSizedBuffer(dAtA[:i]) + if err != nil { + return 0, err + } + i -= size + i = encodeVarintGenerated(dAtA, i, uint64(size)) } i-- - dAtA[i] = 0x8 - return len(dAtA) - i, nil -} - -func (m *StackFrame) Marshal() (dAtA []byte, err error) { - size := m.Size() - dAtA = make([]byte, size) - n, err := m.MarshalToSizedBuffer(dAtA[:size]) - if err != nil { - return nil, err + dAtA[i] = 0x3a + { + size, err := m.SyftDescriptor.MarshalToSizedBuffer(dAtA[:i]) + if err != nil { + return 0, err + } + i -= size + i = encodeVarintGenerated(dAtA, i, uint64(size)) } - return dAtA[:n], nil -} - -func (m *StackFrame) MarshalTo(dAtA []byte) (int, error) { - size := m.Size() - return m.MarshalToSizedBuffer(dAtA[:size]) -} - -func (m *StackFrame) MarshalToSizedBuffer(dAtA []byte) (int, error) { - i := len(dAtA) - _ = i - var l int - _ = l - i = encodeVarintGenerated(dAtA, i, uint64(m.FrameType)) - i-- - dAtA[i] = 0x18 - i -= len(m.Lineno) - copy(dAtA[i:], m.Lineno) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.Lineno))) i-- - dAtA[i] = 0x12 - i -= len(m.FileID) - copy(dAtA[i:], m.FileID) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.FileID))) + dAtA[i] = 0x32 + { + size, err := m.Distro.MarshalToSizedBuffer(dAtA[:i]) + if err != nil { + return 0, err + } + i -= size + i = encodeVarintGenerated(dAtA, i, uint64(size)) + } i-- - dAtA[i] = 0xa + dAtA[i] = 0x2a + { + size, err := m.SyftSource.MarshalToSizedBuffer(dAtA[:i]) + if err != nil { + return 0, err + } + i -= size + i = encodeVarintGenerated(dAtA, i, uint64(size)) + } + i-- + dAtA[i] = 0x22 + if len(m.Files) > 0 { + for iNdEx := len(m.Files) - 1; iNdEx >= 0; iNdEx-- { + { + size, err := m.Files[iNdEx].MarshalToSizedBuffer(dAtA[:i]) + if err != nil { + return 0, err + } + i -= size + i = encodeVarintGenerated(dAtA, i, uint64(size)) + } + i-- + dAtA[i] = 0x1a + } + } + if len(m.ArtifactRelationships) > 0 { + for iNdEx := len(m.ArtifactRelationships) - 1; iNdEx >= 0; iNdEx-- { + { + size, err := m.ArtifactRelationships[iNdEx].MarshalToSizedBuffer(dAtA[:i]) + if err != nil { + return 0, err + } + i -= size + i = encodeVarintGenerated(dAtA, i, uint64(size)) + } + i-- + dAtA[i] = 0x12 + } + } + if len(m.Artifacts) > 0 { + for iNdEx := len(m.Artifacts) - 1; iNdEx >= 0; iNdEx-- { + { + size, err := m.Artifacts[iNdEx].MarshalToSizedBuffer(dAtA[:i]) + if err != nil { + return 0, err + } + i -= size + i = encodeVarintGenerated(dAtA, i, uint64(size)) + } + i-- + dAtA[i] = 0xa + } + } return len(dAtA) - i, nil } -func (m *Statement) Marshal() (dAtA []byte, err error) { +func (m *SyftFile) Marshal() (dAtA []byte, err error) { size := m.Size() dAtA = make([]byte, size) n, err := m.MarshalToSizedBuffer(dAtA[:size]) @@ -6946,50 +6700,46 @@ func (m *Statement) Marshal() (dAtA []byte, err error) { return dAtA[:n], nil } -func (m *Statement) MarshalTo(dAtA []byte) (int, error) { +func (m *SyftFile) MarshalTo(dAtA []byte) (int, error) { size := m.Size() return m.MarshalToSizedBuffer(dAtA[:size]) } -func (m *Statement) MarshalToSizedBuffer(dAtA []byte) (int, error) { +func (m *SyftFile) MarshalToSizedBuffer(dAtA []byte) (int, error) { i := len(dAtA) _ = i var l int _ = l - i -= len(m.ActionStatementTimestamp) - copy(dAtA[i:], m.ActionStatementTimestamp) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.ActionStatementTimestamp))) - i-- - dAtA[i] = 0x5a - i -= len(m.ActionStatement) - copy(dAtA[i:], m.ActionStatement) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.ActionStatement))) - i-- - dAtA[i] = 0x52 - i -= len(m.ImpactStatement) - copy(dAtA[i:], m.ImpactStatement) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.ImpactStatement))) - i-- - dAtA[i] = 0x4a - i -= len(m.Justification) - copy(dAtA[i:], m.Justification) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.Justification))) - i-- - dAtA[i] = 0x42 - i -= len(m.StatusNotes) - copy(dAtA[i:], m.StatusNotes) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.StatusNotes))) - i-- - dAtA[i] = 0x3a - i -= len(m.Status) - copy(dAtA[i:], m.Status) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.Status))) - i-- - dAtA[i] = 0x32 - if len(m.Products) > 0 { - for iNdEx := len(m.Products) - 1; iNdEx >= 0; iNdEx-- { + if m.Executable != nil { + { + size, err := m.Executable.MarshalToSizedBuffer(dAtA[:i]) + if err != nil { + return 0, err + } + i -= size + i = encodeVarintGenerated(dAtA, i, uint64(size)) + } + i-- + dAtA[i] = 0x3a + } + if len(m.Licenses) > 0 { + for iNdEx := len(m.Licenses) - 1; iNdEx >= 0; iNdEx-- { { - size, err := m.Products[iNdEx].MarshalToSizedBuffer(dAtA[:i]) + size, err := m.Licenses[iNdEx].MarshalToSizedBuffer(dAtA[:i]) + if err != nil { + return 0, err + } + i -= size + i = encodeVarintGenerated(dAtA, i, uint64(size)) + } + i-- + dAtA[i] = 0x32 + } + } + if len(m.Digests) > 0 { + for iNdEx := len(m.Digests) - 1; iNdEx >= 0; iNdEx-- { + { + size, err := m.Digests[iNdEx].MarshalToSizedBuffer(dAtA[:i]) if err != nil { return 0, err } @@ -7000,18 +6750,25 @@ func (m *Statement) MarshalToSizedBuffer(dAtA []byte) (int, error) { dAtA[i] = 0x2a } } - i -= len(m.LastUpdated) - copy(dAtA[i:], m.LastUpdated) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.LastUpdated))) + i -= len(m.Contents) + copy(dAtA[i:], m.Contents) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.Contents))) i-- dAtA[i] = 0x22 - i -= len(m.Timestamp) - copy(dAtA[i:], m.Timestamp) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.Timestamp))) - i-- - dAtA[i] = 0x1a + if m.Metadata != nil { + { + size, err := m.Metadata.MarshalToSizedBuffer(dAtA[:i]) + if err != nil { + return 0, err + } + i -= size + i = encodeVarintGenerated(dAtA, i, uint64(size)) + } + i-- + dAtA[i] = 0x1a + } { - size, err := m.Vulnerability.MarshalToSizedBuffer(dAtA[:i]) + size, err := m.Location.MarshalToSizedBuffer(dAtA[:i]) if err != nil { return 0, err } @@ -7028,7 +6785,7 @@ func (m *Statement) MarshalToSizedBuffer(dAtA []byte) (int, error) { return len(dAtA) - i, nil } -func (m *StatusBase) Marshal() (dAtA []byte, err error) { +func (m *SyftPackage) Marshal() (dAtA []byte, err error) { size := m.Size() dAtA = make([]byte, size) n, err := m.MarshalToSizedBuffer(dAtA[:size]) @@ -7038,23 +6795,28 @@ func (m *StatusBase) Marshal() (dAtA []byte, err error) { return dAtA[:n], nil } -func (m *StatusBase) MarshalTo(dAtA []byte) (int, error) { +func (m *SyftPackage) MarshalTo(dAtA []byte) (int, error) { size := m.Size() return m.MarshalToSizedBuffer(dAtA[:size]) } -func (m *StatusBase) MarshalToSizedBuffer(dAtA []byte) (int, error) { +func (m *SyftPackage) MarshalToSizedBuffer(dAtA []byte) (int, error) { i := len(dAtA) _ = i var l int _ = l - i -= len(m.Status) - copy(dAtA[i:], m.Status) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.Status))) + { + size, err := m.PackageCustomData.MarshalToSizedBuffer(dAtA[:i]) + if err != nil { + return 0, err + } + i -= size + i = encodeVarintGenerated(dAtA, i, uint64(size)) + } i-- dAtA[i] = 0x12 { - size, err := m.ConditionedStatus.MarshalToSizedBuffer(dAtA[:i]) + size, err := m.PackageBasicData.MarshalToSizedBuffer(dAtA[:i]) if err != nil { return 0, err } @@ -7066,7 +6828,7 @@ func (m *StatusBase) MarshalToSizedBuffer(dAtA []byte) (int, error) { return len(dAtA) - i, nil } -func (m *Subcomponent) Marshal() (dAtA []byte, err error) { +func (m *SyftRelationship) Marshal() (dAtA []byte, err error) { size := m.Size() dAtA = make([]byte, size) n, err := m.MarshalToSizedBuffer(dAtA[:size]) @@ -7076,30 +6838,42 @@ func (m *Subcomponent) Marshal() (dAtA []byte, err error) { return dAtA[:n], nil } -func (m *Subcomponent) MarshalTo(dAtA []byte) (int, error) { +func (m *SyftRelationship) MarshalTo(dAtA []byte) (int, error) { size := m.Size() return m.MarshalToSizedBuffer(dAtA[:size]) } -func (m *Subcomponent) MarshalToSizedBuffer(dAtA []byte) (int, error) { +func (m *SyftRelationship) MarshalToSizedBuffer(dAtA []byte) (int, error) { i := len(dAtA) _ = i var l int _ = l - { - size, err := m.Component.MarshalToSizedBuffer(dAtA[:i]) - if err != nil { - return 0, err - } - i -= size - i = encodeVarintGenerated(dAtA, i, uint64(size)) + if m.Metadata != nil { + i -= len(m.Metadata) + copy(dAtA[i:], m.Metadata) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.Metadata))) + i-- + dAtA[i] = 0x22 } + i -= len(m.Type) + copy(dAtA[i:], m.Type) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.Type))) + i-- + dAtA[i] = 0x1a + i -= len(m.Child) + copy(dAtA[i:], m.Child) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.Child))) + i-- + dAtA[i] = 0x12 + i -= len(m.Parent) + copy(dAtA[i:], m.Parent) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.Parent))) i-- dAtA[i] = 0xa return len(dAtA) - i, nil } -func (m *SyftCoordinates) Marshal() (dAtA []byte, err error) { +func (m *SyftSource) Marshal() (dAtA []byte, err error) { size := m.Size() dAtA = make([]byte, size) n, err := m.MarshalToSizedBuffer(dAtA[:size]) @@ -7109,30 +6883,47 @@ func (m *SyftCoordinates) Marshal() (dAtA []byte, err error) { return dAtA[:n], nil } -func (m *SyftCoordinates) MarshalTo(dAtA []byte) (int, error) { +func (m *SyftSource) MarshalTo(dAtA []byte) (int, error) { size := m.Size() return m.MarshalToSizedBuffer(dAtA[:size]) } -func (m *SyftCoordinates) MarshalToSizedBuffer(dAtA []byte) (int, error) { +func (m *SyftSource) MarshalToSizedBuffer(dAtA []byte) (int, error) { i := len(dAtA) _ = i var l int _ = l - i -= len(m.FileSystemID) - copy(dAtA[i:], m.FileSystemID) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.FileSystemID))) + if m.Metadata != nil { + i -= len(m.Metadata) + copy(dAtA[i:], m.Metadata) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.Metadata))) + i-- + dAtA[i] = 0x2a + } + i -= len(m.Type) + copy(dAtA[i:], m.Type) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.Type))) + i-- + dAtA[i] = 0x22 + i -= len(m.Version) + copy(dAtA[i:], m.Version) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.Version))) + i-- + dAtA[i] = 0x1a + i -= len(m.Name) + copy(dAtA[i:], m.Name) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.Name))) i-- dAtA[i] = 0x12 - i -= len(m.RealPath) - copy(dAtA[i:], m.RealPath) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.RealPath))) + i -= len(m.ID) + copy(dAtA[i:], m.ID) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.ID))) i-- dAtA[i] = 0xa return len(dAtA) - i, nil } -func (m *SyftDescriptor) Marshal() (dAtA []byte, err error) { +func (m *Syscall) Marshal() (dAtA []byte, err error) { size := m.Size() dAtA = make([]byte, size) n, err := m.MarshalToSizedBuffer(dAtA[:size]) @@ -7142,23 +6933,70 @@ func (m *SyftDescriptor) Marshal() (dAtA []byte, err error) { return dAtA[:n], nil } -func (m *SyftDescriptor) MarshalTo(dAtA []byte) (int, error) { +func (m *Syscall) MarshalTo(dAtA []byte) (int, error) { size := m.Size() return m.MarshalToSizedBuffer(dAtA[:size]) } -func (m *SyftDescriptor) MarshalToSizedBuffer(dAtA []byte) (int, error) { +func (m *Syscall) MarshalToSizedBuffer(dAtA []byte) (int, error) { i := len(dAtA) _ = i var l int _ = l - if m.Configuration != nil { - i -= len(m.Configuration) - copy(dAtA[i:], m.Configuration) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.Configuration))) - i-- - dAtA[i] = 0x1a + if len(m.Args) > 0 { + for iNdEx := len(m.Args) - 1; iNdEx >= 0; iNdEx-- { + { + size, err := m.Args[iNdEx].MarshalToSizedBuffer(dAtA[:i]) + if err != nil { + return 0, err + } + i -= size + i = encodeVarintGenerated(dAtA, i, uint64(size)) + } + i-- + dAtA[i] = 0x22 + } + } + i = encodeVarintGenerated(dAtA, i, uint64(m.ErrnoRet)) + i-- + dAtA[i] = 0x18 + i -= len(m.Action) + copy(dAtA[i:], m.Action) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.Action))) + i-- + dAtA[i] = 0x12 + if len(m.Names) > 0 { + for iNdEx := len(m.Names) - 1; iNdEx >= 0; iNdEx-- { + i -= len(m.Names[iNdEx]) + copy(dAtA[i:], m.Names[iNdEx]) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.Names[iNdEx]))) + i-- + dAtA[i] = 0xa + } + } + return len(dAtA) - i, nil +} + +func (m *ToolMeta) Marshal() (dAtA []byte, err error) { + size := m.Size() + dAtA = make([]byte, size) + n, err := m.MarshalToSizedBuffer(dAtA[:size]) + if err != nil { + return nil, err } + return dAtA[:n], nil +} + +func (m *ToolMeta) MarshalTo(dAtA []byte) (int, error) { + size := m.Size() + return m.MarshalToSizedBuffer(dAtA[:size]) +} + +func (m *ToolMeta) MarshalToSizedBuffer(dAtA []byte) (int, error) { + i := len(dAtA) + _ = i + var l int + _ = l i -= len(m.Version) copy(dAtA[i:], m.Version) i = encodeVarintGenerated(dAtA, i, uint64(len(m.Version))) @@ -7172,7 +7010,7 @@ func (m *SyftDescriptor) MarshalToSizedBuffer(dAtA []byte) (int, error) { return len(dAtA) - i, nil } -func (m *SyftDocument) Marshal() (dAtA []byte, err error) { +func (m *UpstreamPackage) Marshal() (dAtA []byte, err error) { size := m.Size() dAtA = make([]byte, size) n, err := m.MarshalToSizedBuffer(dAtA[:size]) @@ -7182,102 +7020,30 @@ func (m *SyftDocument) Marshal() (dAtA []byte, err error) { return dAtA[:n], nil } -func (m *SyftDocument) MarshalTo(dAtA []byte) (int, error) { +func (m *UpstreamPackage) MarshalTo(dAtA []byte) (int, error) { size := m.Size() return m.MarshalToSizedBuffer(dAtA[:size]) } -func (m *SyftDocument) MarshalToSizedBuffer(dAtA []byte) (int, error) { +func (m *UpstreamPackage) MarshalToSizedBuffer(dAtA []byte) (int, error) { i := len(dAtA) _ = i var l int _ = l - { - size, err := m.Schema.MarshalToSizedBuffer(dAtA[:i]) - if err != nil { - return 0, err - } - i -= size - i = encodeVarintGenerated(dAtA, i, uint64(size)) - } - i-- - dAtA[i] = 0x3a - { - size, err := m.SyftDescriptor.MarshalToSizedBuffer(dAtA[:i]) - if err != nil { - return 0, err - } - i -= size - i = encodeVarintGenerated(dAtA, i, uint64(size)) - } - i-- - dAtA[i] = 0x32 - { - size, err := m.Distro.MarshalToSizedBuffer(dAtA[:i]) - if err != nil { - return 0, err - } - i -= size - i = encodeVarintGenerated(dAtA, i, uint64(size)) - } + i -= len(m.Version) + copy(dAtA[i:], m.Version) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.Version))) i-- - dAtA[i] = 0x2a - { - size, err := m.SyftSource.MarshalToSizedBuffer(dAtA[:i]) - if err != nil { - return 0, err - } - i -= size - i = encodeVarintGenerated(dAtA, i, uint64(size)) - } + dAtA[i] = 0x12 + i -= len(m.Name) + copy(dAtA[i:], m.Name) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.Name))) i-- - dAtA[i] = 0x22 - if len(m.Files) > 0 { - for iNdEx := len(m.Files) - 1; iNdEx >= 0; iNdEx-- { - { - size, err := m.Files[iNdEx].MarshalToSizedBuffer(dAtA[:i]) - if err != nil { - return 0, err - } - i -= size - i = encodeVarintGenerated(dAtA, i, uint64(size)) - } - i-- - dAtA[i] = 0x1a - } - } - if len(m.ArtifactRelationships) > 0 { - for iNdEx := len(m.ArtifactRelationships) - 1; iNdEx >= 0; iNdEx-- { - { - size, err := m.ArtifactRelationships[iNdEx].MarshalToSizedBuffer(dAtA[:i]) - if err != nil { - return 0, err - } - i -= size - i = encodeVarintGenerated(dAtA, i, uint64(size)) - } - i-- - dAtA[i] = 0x12 - } - } - if len(m.Artifacts) > 0 { - for iNdEx := len(m.Artifacts) - 1; iNdEx >= 0; iNdEx-- { - { - size, err := m.Artifacts[iNdEx].MarshalToSizedBuffer(dAtA[:i]) - if err != nil { - return 0, err - } - i -= size - i = encodeVarintGenerated(dAtA, i, uint64(size)) - } - i-- - dAtA[i] = 0xa - } - } + dAtA[i] = 0xa return len(dAtA) - i, nil } -func (m *SyftFile) Marshal() (dAtA []byte, err error) { +func (m *VEX) Marshal() (dAtA []byte, err error) { size := m.Size() dAtA = make([]byte, size) n, err := m.MarshalToSizedBuffer(dAtA[:size]) @@ -7287,46 +7053,20 @@ func (m *SyftFile) Marshal() (dAtA []byte, err error) { return dAtA[:n], nil } -func (m *SyftFile) MarshalTo(dAtA []byte) (int, error) { +func (m *VEX) MarshalTo(dAtA []byte) (int, error) { size := m.Size() return m.MarshalToSizedBuffer(dAtA[:size]) } -func (m *SyftFile) MarshalToSizedBuffer(dAtA []byte) (int, error) { +func (m *VEX) MarshalToSizedBuffer(dAtA []byte) (int, error) { i := len(dAtA) _ = i var l int _ = l - if m.Executable != nil { - { - size, err := m.Executable.MarshalToSizedBuffer(dAtA[:i]) - if err != nil { - return 0, err - } - i -= size - i = encodeVarintGenerated(dAtA, i, uint64(size)) - } - i-- - dAtA[i] = 0x3a - } - if len(m.Licenses) > 0 { - for iNdEx := len(m.Licenses) - 1; iNdEx >= 0; iNdEx-- { - { - size, err := m.Licenses[iNdEx].MarshalToSizedBuffer(dAtA[:i]) - if err != nil { - return 0, err - } - i -= size - i = encodeVarintGenerated(dAtA, i, uint64(size)) - } - i-- - dAtA[i] = 0x32 - } - } - if len(m.Digests) > 0 { - for iNdEx := len(m.Digests) - 1; iNdEx >= 0; iNdEx-- { + if len(m.Statements) > 0 { + for iNdEx := len(m.Statements) - 1; iNdEx >= 0; iNdEx-- { { - size, err := m.Digests[iNdEx].MarshalToSizedBuffer(dAtA[:i]) + size, err := m.Statements[iNdEx].MarshalToSizedBuffer(dAtA[:i]) if err != nil { return 0, err } @@ -7334,28 +7074,11 @@ func (m *SyftFile) MarshalToSizedBuffer(dAtA []byte) (int, error) { i = encodeVarintGenerated(dAtA, i, uint64(size)) } i-- - dAtA[i] = 0x2a - } - } - i -= len(m.Contents) - copy(dAtA[i:], m.Contents) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.Contents))) - i-- - dAtA[i] = 0x22 - if m.Metadata != nil { - { - size, err := m.Metadata.MarshalToSizedBuffer(dAtA[:i]) - if err != nil { - return 0, err - } - i -= size - i = encodeVarintGenerated(dAtA, i, uint64(size)) + dAtA[i] = 0x12 } - i-- - dAtA[i] = 0x1a } { - size, err := m.Location.MarshalToSizedBuffer(dAtA[:i]) + size, err := m.Metadata.MarshalToSizedBuffer(dAtA[:i]) if err != nil { return 0, err } @@ -7363,16 +7086,11 @@ func (m *SyftFile) MarshalToSizedBuffer(dAtA []byte) (int, error) { i = encodeVarintGenerated(dAtA, i, uint64(size)) } i-- - dAtA[i] = 0x12 - i -= len(m.ID) - copy(dAtA[i:], m.ID) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.ID))) - i-- dAtA[i] = 0xa return len(dAtA) - i, nil } -func (m *SyftPackage) Marshal() (dAtA []byte, err error) { +func (m *VexVulnerability) Marshal() (dAtA []byte, err error) { size := m.Size() dAtA = make([]byte, size) n, err := m.MarshalToSizedBuffer(dAtA[:size]) @@ -7382,40 +7100,44 @@ func (m *SyftPackage) Marshal() (dAtA []byte, err error) { return dAtA[:n], nil } -func (m *SyftPackage) MarshalTo(dAtA []byte) (int, error) { +func (m *VexVulnerability) MarshalTo(dAtA []byte) (int, error) { size := m.Size() return m.MarshalToSizedBuffer(dAtA[:size]) } -func (m *SyftPackage) MarshalToSizedBuffer(dAtA []byte) (int, error) { +func (m *VexVulnerability) MarshalToSizedBuffer(dAtA []byte) (int, error) { i := len(dAtA) _ = i var l int _ = l - { - size, err := m.PackageCustomData.MarshalToSizedBuffer(dAtA[:i]) - if err != nil { - return 0, err + if len(m.Aliases) > 0 { + for iNdEx := len(m.Aliases) - 1; iNdEx >= 0; iNdEx-- { + i -= len(m.Aliases[iNdEx]) + copy(dAtA[i:], m.Aliases[iNdEx]) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.Aliases[iNdEx]))) + i-- + dAtA[i] = 0x22 } - i -= size - i = encodeVarintGenerated(dAtA, i, uint64(size)) } + i -= len(m.Description) + copy(dAtA[i:], m.Description) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.Description))) + i-- + dAtA[i] = 0x1a + i -= len(m.Name) + copy(dAtA[i:], m.Name) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.Name))) i-- dAtA[i] = 0x12 - { - size, err := m.PackageBasicData.MarshalToSizedBuffer(dAtA[:i]) - if err != nil { - return 0, err - } - i -= size - i = encodeVarintGenerated(dAtA, i, uint64(size)) - } + i -= len(m.ID) + copy(dAtA[i:], m.ID) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.ID))) i-- dAtA[i] = 0xa return len(dAtA) - i, nil } -func (m *SyftRelationship) Marshal() (dAtA []byte, err error) { +func (m *VulnerabilitiesComponents) Marshal() (dAtA []byte, err error) { size := m.Size() dAtA = make([]byte, size) n, err := m.MarshalToSizedBuffer(dAtA[:size]) @@ -7425,42 +7147,40 @@ func (m *SyftRelationship) Marshal() (dAtA []byte, err error) { return dAtA[:n], nil } -func (m *SyftRelationship) MarshalTo(dAtA []byte) (int, error) { +func (m *VulnerabilitiesComponents) MarshalTo(dAtA []byte) (int, error) { size := m.Size() return m.MarshalToSizedBuffer(dAtA[:size]) } -func (m *SyftRelationship) MarshalToSizedBuffer(dAtA []byte) (int, error) { +func (m *VulnerabilitiesComponents) MarshalToSizedBuffer(dAtA []byte) (int, error) { i := len(dAtA) _ = i var l int _ = l - if m.Metadata != nil { - i -= len(m.Metadata) - copy(dAtA[i:], m.Metadata) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.Metadata))) - i-- - dAtA[i] = 0x22 + { + size, err := m.WorkloadVulnerabilitiesObj.MarshalToSizedBuffer(dAtA[:i]) + if err != nil { + return 0, err + } + i -= size + i = encodeVarintGenerated(dAtA, i, uint64(size)) } - i -= len(m.Type) - copy(dAtA[i:], m.Type) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.Type))) - i-- - dAtA[i] = 0x1a - i -= len(m.Child) - copy(dAtA[i:], m.Child) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.Child))) i-- dAtA[i] = 0x12 - i -= len(m.Parent) - copy(dAtA[i:], m.Parent) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.Parent))) + { + size, err := m.ImageVulnerabilitiesObj.MarshalToSizedBuffer(dAtA[:i]) + if err != nil { + return 0, err + } + i -= size + i = encodeVarintGenerated(dAtA, i, uint64(size)) + } i-- dAtA[i] = 0xa return len(dAtA) - i, nil } -func (m *SyftSource) Marshal() (dAtA []byte, err error) { +func (m *VulnerabilitiesObjScope) Marshal() (dAtA []byte, err error) { size := m.Size() dAtA = make([]byte, size) n, err := m.MarshalToSizedBuffer(dAtA[:size]) @@ -7470,31 +7190,19 @@ func (m *SyftSource) Marshal() (dAtA []byte, err error) { return dAtA[:n], nil } -func (m *SyftSource) MarshalTo(dAtA []byte) (int, error) { +func (m *VulnerabilitiesObjScope) MarshalTo(dAtA []byte) (int, error) { size := m.Size() return m.MarshalToSizedBuffer(dAtA[:size]) } -func (m *SyftSource) MarshalToSizedBuffer(dAtA []byte) (int, error) { +func (m *VulnerabilitiesObjScope) MarshalToSizedBuffer(dAtA []byte) (int, error) { i := len(dAtA) _ = i var l int _ = l - if m.Metadata != nil { - i -= len(m.Metadata) - copy(dAtA[i:], m.Metadata) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.Metadata))) - i-- - dAtA[i] = 0x2a - } - i -= len(m.Type) - copy(dAtA[i:], m.Type) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.Type))) - i-- - dAtA[i] = 0x22 - i -= len(m.Version) - copy(dAtA[i:], m.Version) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.Version))) + i -= len(m.Kind) + copy(dAtA[i:], m.Kind) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.Kind))) i-- dAtA[i] = 0x1a i -= len(m.Name) @@ -7502,15 +7210,15 @@ func (m *SyftSource) MarshalToSizedBuffer(dAtA []byte) (int, error) { i = encodeVarintGenerated(dAtA, i, uint64(len(m.Name))) i-- dAtA[i] = 0x12 - i -= len(m.ID) - copy(dAtA[i:], m.ID) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.ID))) + i -= len(m.Namespace) + copy(dAtA[i:], m.Namespace) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.Namespace))) i-- dAtA[i] = 0xa return len(dAtA) - i, nil } -func (m *Syscall) Marshal() (dAtA []byte, err error) { +func (m *Vulnerability) Marshal() (dAtA []byte, err error) { size := m.Size() dAtA = make([]byte, size) n, err := m.MarshalToSizedBuffer(dAtA[:size]) @@ -7520,20 +7228,20 @@ func (m *Syscall) Marshal() (dAtA []byte, err error) { return dAtA[:n], nil } -func (m *Syscall) MarshalTo(dAtA []byte) (int, error) { +func (m *Vulnerability) MarshalTo(dAtA []byte) (int, error) { size := m.Size() return m.MarshalToSizedBuffer(dAtA[:size]) } -func (m *Syscall) MarshalToSizedBuffer(dAtA []byte) (int, error) { +func (m *Vulnerability) MarshalToSizedBuffer(dAtA []byte) (int, error) { i := len(dAtA) _ = i var l int _ = l - if len(m.Args) > 0 { - for iNdEx := len(m.Args) - 1; iNdEx >= 0; iNdEx-- { + if len(m.Advisories) > 0 { + for iNdEx := len(m.Advisories) - 1; iNdEx >= 0; iNdEx-- { { - size, err := m.Args[iNdEx].MarshalToSizedBuffer(dAtA[:i]) + size, err := m.Advisories[iNdEx].MarshalToSizedBuffer(dAtA[:i]) if err != nil { return 0, err } @@ -7541,30 +7249,33 @@ func (m *Syscall) MarshalToSizedBuffer(dAtA []byte) (int, error) { i = encodeVarintGenerated(dAtA, i, uint64(size)) } i-- - dAtA[i] = 0x22 + dAtA[i] = 0x52 } } - i = encodeVarintGenerated(dAtA, i, uint64(m.ErrnoRet)) - i-- - dAtA[i] = 0x18 - i -= len(m.Action) - copy(dAtA[i:], m.Action) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.Action))) + { + size, err := m.Fix.MarshalToSizedBuffer(dAtA[:i]) + if err != nil { + return 0, err + } + i -= size + i = encodeVarintGenerated(dAtA, i, uint64(size)) + } i-- - dAtA[i] = 0x12 - if len(m.Names) > 0 { - for iNdEx := len(m.Names) - 1; iNdEx >= 0; iNdEx-- { - i -= len(m.Names[iNdEx]) - copy(dAtA[i:], m.Names[iNdEx]) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.Names[iNdEx]))) - i-- - dAtA[i] = 0xa + dAtA[i] = 0x4a + { + size, err := m.VulnerabilityMetadata.MarshalToSizedBuffer(dAtA[:i]) + if err != nil { + return 0, err } + i -= size + i = encodeVarintGenerated(dAtA, i, uint64(size)) } + i-- + dAtA[i] = 0x42 return len(dAtA) - i, nil } -func (m *ToolMeta) Marshal() (dAtA []byte, err error) { +func (m *VulnerabilityCounters) Marshal() (dAtA []byte, err error) { size := m.Size() dAtA = make([]byte, size) n, err := m.MarshalToSizedBuffer(dAtA[:size]) @@ -7574,30 +7285,26 @@ func (m *ToolMeta) Marshal() (dAtA []byte, err error) { return dAtA[:n], nil } -func (m *ToolMeta) MarshalTo(dAtA []byte) (int, error) { +func (m *VulnerabilityCounters) MarshalTo(dAtA []byte) (int, error) { size := m.Size() return m.MarshalToSizedBuffer(dAtA[:size]) } -func (m *ToolMeta) MarshalToSizedBuffer(dAtA []byte) (int, error) { +func (m *VulnerabilityCounters) MarshalToSizedBuffer(dAtA []byte) (int, error) { i := len(dAtA) _ = i var l int _ = l - i -= len(m.Version) - copy(dAtA[i:], m.Version) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.Version))) + i = encodeVarintGenerated(dAtA, i, uint64(m.Relevant)) i-- - dAtA[i] = 0x12 - i -= len(m.Name) - copy(dAtA[i:], m.Name) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.Name))) + dAtA[i] = 0x10 + i = encodeVarintGenerated(dAtA, i, uint64(m.All)) i-- - dAtA[i] = 0xa + dAtA[i] = 0x8 return len(dAtA) - i, nil } -func (m *UpstreamPackage) Marshal() (dAtA []byte, err error) { +func (m *VulnerabilityManifest) Marshal() (dAtA []byte, err error) { size := m.Size() dAtA = make([]byte, size) n, err := m.MarshalToSizedBuffer(dAtA[:size]) @@ -7607,30 +7314,50 @@ func (m *UpstreamPackage) Marshal() (dAtA []byte, err error) { return dAtA[:n], nil } -func (m *UpstreamPackage) MarshalTo(dAtA []byte) (int, error) { +func (m *VulnerabilityManifest) MarshalTo(dAtA []byte) (int, error) { size := m.Size() return m.MarshalToSizedBuffer(dAtA[:size]) } -func (m *UpstreamPackage) MarshalToSizedBuffer(dAtA []byte) (int, error) { +func (m *VulnerabilityManifest) MarshalToSizedBuffer(dAtA []byte) (int, error) { i := len(dAtA) _ = i var l int _ = l - i -= len(m.Version) - copy(dAtA[i:], m.Version) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.Version))) + { + size, err := m.Status.MarshalToSizedBuffer(dAtA[:i]) + if err != nil { + return 0, err + } + i -= size + i = encodeVarintGenerated(dAtA, i, uint64(size)) + } + i-- + dAtA[i] = 0x1a + { + size, err := m.Spec.MarshalToSizedBuffer(dAtA[:i]) + if err != nil { + return 0, err + } + i -= size + i = encodeVarintGenerated(dAtA, i, uint64(size)) + } i-- dAtA[i] = 0x12 - i -= len(m.Name) - copy(dAtA[i:], m.Name) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.Name))) + { + size, err := m.ObjectMeta.MarshalToSizedBuffer(dAtA[:i]) + if err != nil { + return 0, err + } + i -= size + i = encodeVarintGenerated(dAtA, i, uint64(size)) + } i-- dAtA[i] = 0xa return len(dAtA) - i, nil } -func (m *VEX) Marshal() (dAtA []byte, err error) { +func (m *VulnerabilityManifestList) Marshal() (dAtA []byte, err error) { size := m.Size() dAtA = make([]byte, size) n, err := m.MarshalToSizedBuffer(dAtA[:size]) @@ -7640,20 +7367,20 @@ func (m *VEX) Marshal() (dAtA []byte, err error) { return dAtA[:n], nil } -func (m *VEX) MarshalTo(dAtA []byte) (int, error) { +func (m *VulnerabilityManifestList) MarshalTo(dAtA []byte) (int, error) { size := m.Size() return m.MarshalToSizedBuffer(dAtA[:size]) } -func (m *VEX) MarshalToSizedBuffer(dAtA []byte) (int, error) { +func (m *VulnerabilityManifestList) MarshalToSizedBuffer(dAtA []byte) (int, error) { i := len(dAtA) _ = i var l int _ = l - if len(m.Statements) > 0 { - for iNdEx := len(m.Statements) - 1; iNdEx >= 0; iNdEx-- { + if len(m.Items) > 0 { + for iNdEx := len(m.Items) - 1; iNdEx >= 0; iNdEx-- { { - size, err := m.Statements[iNdEx].MarshalToSizedBuffer(dAtA[:i]) + size, err := m.Items[iNdEx].MarshalToSizedBuffer(dAtA[:i]) if err != nil { return 0, err } @@ -7665,7 +7392,7 @@ func (m *VEX) MarshalToSizedBuffer(dAtA []byte) (int, error) { } } { - size, err := m.Metadata.MarshalToSizedBuffer(dAtA[:i]) + size, err := m.ListMeta.MarshalToSizedBuffer(dAtA[:i]) if err != nil { return 0, err } @@ -7677,7 +7404,7 @@ func (m *VEX) MarshalToSizedBuffer(dAtA []byte) (int, error) { return len(dAtA) - i, nil } -func (m *VexVulnerability) Marshal() (dAtA []byte, err error) { +func (m *VulnerabilityManifestMeta) Marshal() (dAtA []byte, err error) { size := m.Size() dAtA = make([]byte, size) n, err := m.MarshalToSizedBuffer(dAtA[:size]) @@ -7687,44 +7414,48 @@ func (m *VexVulnerability) Marshal() (dAtA []byte, err error) { return dAtA[:n], nil } -func (m *VexVulnerability) MarshalTo(dAtA []byte) (int, error) { +func (m *VulnerabilityManifestMeta) MarshalTo(dAtA []byte) (int, error) { size := m.Size() return m.MarshalToSizedBuffer(dAtA[:size]) } -func (m *VexVulnerability) MarshalToSizedBuffer(dAtA []byte) (int, error) { +func (m *VulnerabilityManifestMeta) MarshalToSizedBuffer(dAtA []byte) (int, error) { i := len(dAtA) _ = i var l int _ = l - if len(m.Aliases) > 0 { - for iNdEx := len(m.Aliases) - 1; iNdEx >= 0; iNdEx-- { - i -= len(m.Aliases[iNdEx]) - copy(dAtA[i:], m.Aliases[iNdEx]) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.Aliases[iNdEx]))) - i-- - dAtA[i] = 0x22 + { + size, err := m.Report.MarshalToSizedBuffer(dAtA[:i]) + if err != nil { + return 0, err } + i -= size + i = encodeVarintGenerated(dAtA, i, uint64(size)) } - i -= len(m.Description) - copy(dAtA[i:], m.Description) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.Description))) i-- dAtA[i] = 0x1a - i -= len(m.Name) - copy(dAtA[i:], m.Name) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.Name))) + { + size, err := m.Tool.MarshalToSizedBuffer(dAtA[:i]) + if err != nil { + return 0, err + } + i -= size + i = encodeVarintGenerated(dAtA, i, uint64(size)) + } i-- dAtA[i] = 0x12 - i -= len(m.ID) - copy(dAtA[i:], m.ID) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.ID))) i-- - dAtA[i] = 0xa + if m.WithRelevancy { + dAtA[i] = 1 + } else { + dAtA[i] = 0 + } + i-- + dAtA[i] = 0x8 return len(dAtA) - i, nil } -func (m *VulnerabilitiesComponents) Marshal() (dAtA []byte, err error) { +func (m *VulnerabilityManifestReportMeta) Marshal() (dAtA []byte, err error) { size := m.Size() dAtA = make([]byte, size) n, err := m.MarshalToSizedBuffer(dAtA[:size]) @@ -7734,28 +7465,18 @@ func (m *VulnerabilitiesComponents) Marshal() (dAtA []byte, err error) { return dAtA[:n], nil } -func (m *VulnerabilitiesComponents) MarshalTo(dAtA []byte) (int, error) { +func (m *VulnerabilityManifestReportMeta) MarshalTo(dAtA []byte) (int, error) { size := m.Size() return m.MarshalToSizedBuffer(dAtA[:size]) } -func (m *VulnerabilitiesComponents) MarshalToSizedBuffer(dAtA []byte) (int, error) { +func (m *VulnerabilityManifestReportMeta) MarshalToSizedBuffer(dAtA []byte) (int, error) { i := len(dAtA) _ = i var l int _ = l { - size, err := m.WorkloadVulnerabilitiesObj.MarshalToSizedBuffer(dAtA[:i]) - if err != nil { - return 0, err - } - i -= size - i = encodeVarintGenerated(dAtA, i, uint64(size)) - } - i-- - dAtA[i] = 0x12 - { - size, err := m.ImageVulnerabilitiesObj.MarshalToSizedBuffer(dAtA[:i]) + size, err := m.CreatedAt.MarshalToSizedBuffer(dAtA[:i]) if err != nil { return 0, err } @@ -7767,7 +7488,7 @@ func (m *VulnerabilitiesComponents) MarshalToSizedBuffer(dAtA []byte) (int, erro return len(dAtA) - i, nil } -func (m *VulnerabilitiesObjScope) Marshal() (dAtA []byte, err error) { +func (m *VulnerabilityManifestSpec) Marshal() (dAtA []byte, err error) { size := m.Size() dAtA = make([]byte, size) n, err := m.MarshalToSizedBuffer(dAtA[:size]) @@ -7777,80 +7498,28 @@ func (m *VulnerabilitiesObjScope) Marshal() (dAtA []byte, err error) { return dAtA[:n], nil } -func (m *VulnerabilitiesObjScope) MarshalTo(dAtA []byte) (int, error) { +func (m *VulnerabilityManifestSpec) MarshalTo(dAtA []byte) (int, error) { size := m.Size() return m.MarshalToSizedBuffer(dAtA[:size]) } -func (m *VulnerabilitiesObjScope) MarshalToSizedBuffer(dAtA []byte) (int, error) { +func (m *VulnerabilityManifestSpec) MarshalToSizedBuffer(dAtA []byte) (int, error) { i := len(dAtA) _ = i var l int _ = l - i -= len(m.Kind) - copy(dAtA[i:], m.Kind) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.Kind))) - i-- - dAtA[i] = 0x1a - i -= len(m.Name) - copy(dAtA[i:], m.Name) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.Name))) + { + size, err := m.Payload.MarshalToSizedBuffer(dAtA[:i]) + if err != nil { + return 0, err + } + i -= size + i = encodeVarintGenerated(dAtA, i, uint64(size)) + } i-- dAtA[i] = 0x12 - i -= len(m.Namespace) - copy(dAtA[i:], m.Namespace) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.Namespace))) - i-- - dAtA[i] = 0xa - return len(dAtA) - i, nil -} - -func (m *Vulnerability) Marshal() (dAtA []byte, err error) { - size := m.Size() - dAtA = make([]byte, size) - n, err := m.MarshalToSizedBuffer(dAtA[:size]) - if err != nil { - return nil, err - } - return dAtA[:n], nil -} - -func (m *Vulnerability) MarshalTo(dAtA []byte) (int, error) { - size := m.Size() - return m.MarshalToSizedBuffer(dAtA[:size]) -} - -func (m *Vulnerability) MarshalToSizedBuffer(dAtA []byte) (int, error) { - i := len(dAtA) - _ = i - var l int - _ = l - if len(m.Advisories) > 0 { - for iNdEx := len(m.Advisories) - 1; iNdEx >= 0; iNdEx-- { - { - size, err := m.Advisories[iNdEx].MarshalToSizedBuffer(dAtA[:i]) - if err != nil { - return 0, err - } - i -= size - i = encodeVarintGenerated(dAtA, i, uint64(size)) - } - i-- - dAtA[i] = 0x52 - } - } - { - size, err := m.Fix.MarshalToSizedBuffer(dAtA[:i]) - if err != nil { - return 0, err - } - i -= size - i = encodeVarintGenerated(dAtA, i, uint64(size)) - } - i-- - dAtA[i] = 0x4a { - size, err := m.VulnerabilityMetadata.MarshalToSizedBuffer(dAtA[:i]) + size, err := m.Metadata.MarshalToSizedBuffer(dAtA[:i]) if err != nil { return 0, err } @@ -7858,11 +7527,11 @@ func (m *Vulnerability) MarshalToSizedBuffer(dAtA []byte) (int, error) { i = encodeVarintGenerated(dAtA, i, uint64(size)) } i-- - dAtA[i] = 0x42 + dAtA[i] = 0xa return len(dAtA) - i, nil } -func (m *VulnerabilityCounters) Marshal() (dAtA []byte, err error) { +func (m *VulnerabilityManifestStatus) Marshal() (dAtA []byte, err error) { size := m.Size() dAtA = make([]byte, size) n, err := m.MarshalToSizedBuffer(dAtA[:size]) @@ -7872,26 +7541,20 @@ func (m *VulnerabilityCounters) Marshal() (dAtA []byte, err error) { return dAtA[:n], nil } -func (m *VulnerabilityCounters) MarshalTo(dAtA []byte) (int, error) { +func (m *VulnerabilityManifestStatus) MarshalTo(dAtA []byte) (int, error) { size := m.Size() return m.MarshalToSizedBuffer(dAtA[:size]) } -func (m *VulnerabilityCounters) MarshalToSizedBuffer(dAtA []byte) (int, error) { +func (m *VulnerabilityManifestStatus) MarshalToSizedBuffer(dAtA []byte) (int, error) { i := len(dAtA) _ = i var l int _ = l - i = encodeVarintGenerated(dAtA, i, uint64(m.Relevant)) - i-- - dAtA[i] = 0x10 - i = encodeVarintGenerated(dAtA, i, uint64(m.All)) - i-- - dAtA[i] = 0x8 return len(dAtA) - i, nil } -func (m *VulnerabilityManifest) Marshal() (dAtA []byte, err error) { +func (m *VulnerabilityManifestSummary) Marshal() (dAtA []byte, err error) { size := m.Size() dAtA = make([]byte, size) n, err := m.MarshalToSizedBuffer(dAtA[:size]) @@ -7901,12 +7564,12 @@ func (m *VulnerabilityManifest) Marshal() (dAtA []byte, err error) { return dAtA[:n], nil } -func (m *VulnerabilityManifest) MarshalTo(dAtA []byte) (int, error) { +func (m *VulnerabilityManifestSummary) MarshalTo(dAtA []byte) (int, error) { size := m.Size() return m.MarshalToSizedBuffer(dAtA[:size]) } -func (m *VulnerabilityManifest) MarshalToSizedBuffer(dAtA []byte) (int, error) { +func (m *VulnerabilityManifestSummary) MarshalToSizedBuffer(dAtA []byte) (int, error) { i := len(dAtA) _ = i var l int @@ -7944,7 +7607,7 @@ func (m *VulnerabilityManifest) MarshalToSizedBuffer(dAtA []byte) (int, error) { return len(dAtA) - i, nil } -func (m *VulnerabilityManifestList) Marshal() (dAtA []byte, err error) { +func (m *VulnerabilityManifestSummaryList) Marshal() (dAtA []byte, err error) { size := m.Size() dAtA = make([]byte, size) n, err := m.MarshalToSizedBuffer(dAtA[:size]) @@ -7954,12 +7617,12 @@ func (m *VulnerabilityManifestList) Marshal() (dAtA []byte, err error) { return dAtA[:n], nil } -func (m *VulnerabilityManifestList) MarshalTo(dAtA []byte) (int, error) { +func (m *VulnerabilityManifestSummaryList) MarshalTo(dAtA []byte) (int, error) { size := m.Size() return m.MarshalToSizedBuffer(dAtA[:size]) } -func (m *VulnerabilityManifestList) MarshalToSizedBuffer(dAtA []byte) (int, error) { +func (m *VulnerabilityManifestSummaryList) MarshalToSizedBuffer(dAtA []byte) (int, error) { i := len(dAtA) _ = i var l int @@ -7991,7 +7654,7 @@ func (m *VulnerabilityManifestList) MarshalToSizedBuffer(dAtA []byte) (int, erro return len(dAtA) - i, nil } -func (m *VulnerabilityManifestMeta) Marshal() (dAtA []byte, err error) { +func (m *VulnerabilityManifestSummarySpec) Marshal() (dAtA []byte, err error) { size := m.Size() dAtA = make([]byte, size) n, err := m.MarshalToSizedBuffer(dAtA[:size]) @@ -8001,18 +7664,18 @@ func (m *VulnerabilityManifestMeta) Marshal() (dAtA []byte, err error) { return dAtA[:n], nil } -func (m *VulnerabilityManifestMeta) MarshalTo(dAtA []byte) (int, error) { +func (m *VulnerabilityManifestSummarySpec) MarshalTo(dAtA []byte) (int, error) { size := m.Size() return m.MarshalToSizedBuffer(dAtA[:size]) } -func (m *VulnerabilityManifestMeta) MarshalToSizedBuffer(dAtA []byte) (int, error) { +func (m *VulnerabilityManifestSummarySpec) MarshalToSizedBuffer(dAtA []byte) (int, error) { i := len(dAtA) _ = i var l int _ = l { - size, err := m.Report.MarshalToSizedBuffer(dAtA[:i]) + size, err := m.Vulnerabilities.MarshalToSizedBuffer(dAtA[:i]) if err != nil { return 0, err } @@ -8020,9 +7683,9 @@ func (m *VulnerabilityManifestMeta) MarshalToSizedBuffer(dAtA []byte) (int, erro i = encodeVarintGenerated(dAtA, i, uint64(size)) } i-- - dAtA[i] = 0x1a + dAtA[i] = 0x12 { - size, err := m.Tool.MarshalToSizedBuffer(dAtA[:i]) + size, err := m.Severities.MarshalToSizedBuffer(dAtA[:i]) if err != nil { return 0, err } @@ -8030,19 +7693,11 @@ func (m *VulnerabilityManifestMeta) MarshalToSizedBuffer(dAtA []byte) (int, erro i = encodeVarintGenerated(dAtA, i, uint64(size)) } i-- - dAtA[i] = 0x12 - i-- - if m.WithRelevancy { - dAtA[i] = 1 - } else { - dAtA[i] = 0 - } - i-- - dAtA[i] = 0x8 + dAtA[i] = 0xa return len(dAtA) - i, nil } -func (m *VulnerabilityManifestReportMeta) Marshal() (dAtA []byte, err error) { +func (m *VulnerabilityManifestToolMeta) Marshal() (dAtA []byte, err error) { size := m.Size() dAtA = make([]byte, size) n, err := m.MarshalToSizedBuffer(dAtA[:size]) @@ -8052,30 +7707,35 @@ func (m *VulnerabilityManifestReportMeta) Marshal() (dAtA []byte, err error) { return dAtA[:n], nil } -func (m *VulnerabilityManifestReportMeta) MarshalTo(dAtA []byte) (int, error) { +func (m *VulnerabilityManifestToolMeta) MarshalTo(dAtA []byte) (int, error) { size := m.Size() return m.MarshalToSizedBuffer(dAtA[:size]) } -func (m *VulnerabilityManifestReportMeta) MarshalToSizedBuffer(dAtA []byte) (int, error) { +func (m *VulnerabilityManifestToolMeta) MarshalToSizedBuffer(dAtA []byte) (int, error) { i := len(dAtA) _ = i var l int _ = l - { - size, err := m.CreatedAt.MarshalToSizedBuffer(dAtA[:i]) - if err != nil { - return 0, err - } - i -= size - i = encodeVarintGenerated(dAtA, i, uint64(size)) - } + i -= len(m.DatabaseVersion) + copy(dAtA[i:], m.DatabaseVersion) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.DatabaseVersion))) + i-- + dAtA[i] = 0x1a + i -= len(m.Version) + copy(dAtA[i:], m.Version) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.Version))) + i-- + dAtA[i] = 0x12 + i -= len(m.Name) + copy(dAtA[i:], m.Name) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.Name))) i-- dAtA[i] = 0xa return len(dAtA) - i, nil } -func (m *VulnerabilityManifestSpec) Marshal() (dAtA []byte, err error) { +func (m *VulnerabilityMetadata) Marshal() (dAtA []byte, err error) { size := m.Size() dAtA = make([]byte, size) n, err := m.MarshalToSizedBuffer(dAtA[:size]) @@ -8085,63 +7745,68 @@ func (m *VulnerabilityManifestSpec) Marshal() (dAtA []byte, err error) { return dAtA[:n], nil } -func (m *VulnerabilityManifestSpec) MarshalTo(dAtA []byte) (int, error) { +func (m *VulnerabilityMetadata) MarshalTo(dAtA []byte) (int, error) { size := m.Size() return m.MarshalToSizedBuffer(dAtA[:size]) } -func (m *VulnerabilityManifestSpec) MarshalToSizedBuffer(dAtA []byte) (int, error) { +func (m *VulnerabilityMetadata) MarshalToSizedBuffer(dAtA []byte) (int, error) { i := len(dAtA) _ = i var l int _ = l - { - size, err := m.Payload.MarshalToSizedBuffer(dAtA[:i]) - if err != nil { - return 0, err + if len(m.Cvss) > 0 { + for iNdEx := len(m.Cvss) - 1; iNdEx >= 0; iNdEx-- { + { + size, err := m.Cvss[iNdEx].MarshalToSizedBuffer(dAtA[:i]) + if err != nil { + return 0, err + } + i -= size + i = encodeVarintGenerated(dAtA, i, uint64(size)) + } + i-- + dAtA[i] = 0x3a } - i -= size - i = encodeVarintGenerated(dAtA, i, uint64(size)) } + i -= len(m.Description) + copy(dAtA[i:], m.Description) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.Description))) i-- - dAtA[i] = 0x12 - { - size, err := m.Metadata.MarshalToSizedBuffer(dAtA[:i]) - if err != nil { - return 0, err + dAtA[i] = 0x32 + if len(m.URLs) > 0 { + for iNdEx := len(m.URLs) - 1; iNdEx >= 0; iNdEx-- { + i -= len(m.URLs[iNdEx]) + copy(dAtA[i:], m.URLs[iNdEx]) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.URLs[iNdEx]))) + i-- + dAtA[i] = 0x2a } - i -= size - i = encodeVarintGenerated(dAtA, i, uint64(size)) } + i -= len(m.Severity) + copy(dAtA[i:], m.Severity) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.Severity))) + i-- + dAtA[i] = 0x22 + i -= len(m.Namespace) + copy(dAtA[i:], m.Namespace) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.Namespace))) + i-- + dAtA[i] = 0x1a + i -= len(m.DataSource) + copy(dAtA[i:], m.DataSource) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.DataSource))) + i-- + dAtA[i] = 0x12 + i -= len(m.ID) + copy(dAtA[i:], m.ID) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.ID))) i-- dAtA[i] = 0xa return len(dAtA) - i, nil } -func (m *VulnerabilityManifestStatus) Marshal() (dAtA []byte, err error) { - size := m.Size() - dAtA = make([]byte, size) - n, err := m.MarshalToSizedBuffer(dAtA[:size]) - if err != nil { - return nil, err - } - return dAtA[:n], nil -} - -func (m *VulnerabilityManifestStatus) MarshalTo(dAtA []byte) (int, error) { - size := m.Size() - return m.MarshalToSizedBuffer(dAtA[:size]) -} - -func (m *VulnerabilityManifestStatus) MarshalToSizedBuffer(dAtA []byte) (int, error) { - i := len(dAtA) - _ = i - var l int - _ = l - return len(dAtA) - i, nil -} - -func (m *VulnerabilityManifestSummary) Marshal() (dAtA []byte, err error) { +func (m *VulnerabilitySummary) Marshal() (dAtA []byte, err error) { size := m.Size() dAtA = make([]byte, size) n, err := m.MarshalToSizedBuffer(dAtA[:size]) @@ -8151,12 +7816,12 @@ func (m *VulnerabilityManifestSummary) Marshal() (dAtA []byte, err error) { return dAtA[:n], nil } -func (m *VulnerabilityManifestSummary) MarshalTo(dAtA []byte) (int, error) { +func (m *VulnerabilitySummary) MarshalTo(dAtA []byte) (int, error) { size := m.Size() return m.MarshalToSizedBuffer(dAtA[:size]) } -func (m *VulnerabilityManifestSummary) MarshalToSizedBuffer(dAtA []byte) (int, error) { +func (m *VulnerabilitySummary) MarshalToSizedBuffer(dAtA []byte) (int, error) { i := len(dAtA) _ = i var l int @@ -8194,7 +7859,7 @@ func (m *VulnerabilityManifestSummary) MarshalToSizedBuffer(dAtA []byte) (int, e return len(dAtA) - i, nil } -func (m *VulnerabilityManifestSummaryList) Marshal() (dAtA []byte, err error) { +func (m *VulnerabilitySummaryList) Marshal() (dAtA []byte, err error) { size := m.Size() dAtA = make([]byte, size) n, err := m.MarshalToSizedBuffer(dAtA[:size]) @@ -8204,12 +7869,12 @@ func (m *VulnerabilityManifestSummaryList) Marshal() (dAtA []byte, err error) { return dAtA[:n], nil } -func (m *VulnerabilityManifestSummaryList) MarshalTo(dAtA []byte) (int, error) { +func (m *VulnerabilitySummaryList) MarshalTo(dAtA []byte) (int, error) { size := m.Size() return m.MarshalToSizedBuffer(dAtA[:size]) } -func (m *VulnerabilityManifestSummaryList) MarshalToSizedBuffer(dAtA []byte) (int, error) { +func (m *VulnerabilitySummaryList) MarshalToSizedBuffer(dAtA []byte) (int, error) { i := len(dAtA) _ = i var l int @@ -8241,7 +7906,7 @@ func (m *VulnerabilityManifestSummaryList) MarshalToSizedBuffer(dAtA []byte) (in return len(dAtA) - i, nil } -func (m *VulnerabilityManifestSummarySpec) Marshal() (dAtA []byte, err error) { +func (m *VulnerabilitySummarySpec) Marshal() (dAtA []byte, err error) { size := m.Size() dAtA = make([]byte, size) n, err := m.MarshalToSizedBuffer(dAtA[:size]) @@ -8251,280 +7916,28 @@ func (m *VulnerabilityManifestSummarySpec) Marshal() (dAtA []byte, err error) { return dAtA[:n], nil } -func (m *VulnerabilityManifestSummarySpec) MarshalTo(dAtA []byte) (int, error) { +func (m *VulnerabilitySummarySpec) MarshalTo(dAtA []byte) (int, error) { size := m.Size() return m.MarshalToSizedBuffer(dAtA[:size]) } -func (m *VulnerabilityManifestSummarySpec) MarshalToSizedBuffer(dAtA []byte) (int, error) { +func (m *VulnerabilitySummarySpec) MarshalToSizedBuffer(dAtA []byte) (int, error) { i := len(dAtA) _ = i var l int _ = l - { - size, err := m.Vulnerabilities.MarshalToSizedBuffer(dAtA[:i]) - if err != nil { - return 0, err - } - i -= size - i = encodeVarintGenerated(dAtA, i, uint64(size)) - } - i-- - dAtA[i] = 0x12 - { - size, err := m.Severities.MarshalToSizedBuffer(dAtA[:i]) - if err != nil { - return 0, err - } - i -= size - i = encodeVarintGenerated(dAtA, i, uint64(size)) - } - i-- - dAtA[i] = 0xa - return len(dAtA) - i, nil -} - -func (m *VulnerabilityManifestToolMeta) Marshal() (dAtA []byte, err error) { - size := m.Size() - dAtA = make([]byte, size) - n, err := m.MarshalToSizedBuffer(dAtA[:size]) - if err != nil { - return nil, err - } - return dAtA[:n], nil -} - -func (m *VulnerabilityManifestToolMeta) MarshalTo(dAtA []byte) (int, error) { - size := m.Size() - return m.MarshalToSizedBuffer(dAtA[:size]) -} - -func (m *VulnerabilityManifestToolMeta) MarshalToSizedBuffer(dAtA []byte) (int, error) { - i := len(dAtA) - _ = i - var l int - _ = l - i -= len(m.DatabaseVersion) - copy(dAtA[i:], m.DatabaseVersion) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.DatabaseVersion))) - i-- - dAtA[i] = 0x1a - i -= len(m.Version) - copy(dAtA[i:], m.Version) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.Version))) - i-- - dAtA[i] = 0x12 - i -= len(m.Name) - copy(dAtA[i:], m.Name) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.Name))) - i-- - dAtA[i] = 0xa - return len(dAtA) - i, nil -} - -func (m *VulnerabilityMetadata) Marshal() (dAtA []byte, err error) { - size := m.Size() - dAtA = make([]byte, size) - n, err := m.MarshalToSizedBuffer(dAtA[:size]) - if err != nil { - return nil, err - } - return dAtA[:n], nil -} - -func (m *VulnerabilityMetadata) MarshalTo(dAtA []byte) (int, error) { - size := m.Size() - return m.MarshalToSizedBuffer(dAtA[:size]) -} - -func (m *VulnerabilityMetadata) MarshalToSizedBuffer(dAtA []byte) (int, error) { - i := len(dAtA) - _ = i - var l int - _ = l - if len(m.Cvss) > 0 { - for iNdEx := len(m.Cvss) - 1; iNdEx >= 0; iNdEx-- { - { - size, err := m.Cvss[iNdEx].MarshalToSizedBuffer(dAtA[:i]) - if err != nil { - return 0, err - } - i -= size - i = encodeVarintGenerated(dAtA, i, uint64(size)) - } - i-- - dAtA[i] = 0x3a - } - } - i -= len(m.Description) - copy(dAtA[i:], m.Description) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.Description))) - i-- - dAtA[i] = 0x32 - if len(m.URLs) > 0 { - for iNdEx := len(m.URLs) - 1; iNdEx >= 0; iNdEx-- { - i -= len(m.URLs[iNdEx]) - copy(dAtA[i:], m.URLs[iNdEx]) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.URLs[iNdEx]))) - i-- - dAtA[i] = 0x2a - } - } - i -= len(m.Severity) - copy(dAtA[i:], m.Severity) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.Severity))) - i-- - dAtA[i] = 0x22 - i -= len(m.Namespace) - copy(dAtA[i:], m.Namespace) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.Namespace))) - i-- - dAtA[i] = 0x1a - i -= len(m.DataSource) - copy(dAtA[i:], m.DataSource) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.DataSource))) - i-- - dAtA[i] = 0x12 - i -= len(m.ID) - copy(dAtA[i:], m.ID) - i = encodeVarintGenerated(dAtA, i, uint64(len(m.ID))) - i-- - dAtA[i] = 0xa - return len(dAtA) - i, nil -} - -func (m *VulnerabilitySummary) Marshal() (dAtA []byte, err error) { - size := m.Size() - dAtA = make([]byte, size) - n, err := m.MarshalToSizedBuffer(dAtA[:size]) - if err != nil { - return nil, err - } - return dAtA[:n], nil -} - -func (m *VulnerabilitySummary) MarshalTo(dAtA []byte) (int, error) { - size := m.Size() - return m.MarshalToSizedBuffer(dAtA[:size]) -} - -func (m *VulnerabilitySummary) MarshalToSizedBuffer(dAtA []byte) (int, error) { - i := len(dAtA) - _ = i - var l int - _ = l - { - size, err := m.Status.MarshalToSizedBuffer(dAtA[:i]) - if err != nil { - return 0, err - } - i -= size - i = encodeVarintGenerated(dAtA, i, uint64(size)) - } - i-- - dAtA[i] = 0x1a - { - size, err := m.Spec.MarshalToSizedBuffer(dAtA[:i]) - if err != nil { - return 0, err - } - i -= size - i = encodeVarintGenerated(dAtA, i, uint64(size)) - } - i-- - dAtA[i] = 0x12 - { - size, err := m.ObjectMeta.MarshalToSizedBuffer(dAtA[:i]) - if err != nil { - return 0, err - } - i -= size - i = encodeVarintGenerated(dAtA, i, uint64(size)) - } - i-- - dAtA[i] = 0xa - return len(dAtA) - i, nil -} - -func (m *VulnerabilitySummaryList) Marshal() (dAtA []byte, err error) { - size := m.Size() - dAtA = make([]byte, size) - n, err := m.MarshalToSizedBuffer(dAtA[:size]) - if err != nil { - return nil, err - } - return dAtA[:n], nil -} - -func (m *VulnerabilitySummaryList) MarshalTo(dAtA []byte) (int, error) { - size := m.Size() - return m.MarshalToSizedBuffer(dAtA[:size]) -} - -func (m *VulnerabilitySummaryList) MarshalToSizedBuffer(dAtA []byte) (int, error) { - i := len(dAtA) - _ = i - var l int - _ = l - if len(m.Items) > 0 { - for iNdEx := len(m.Items) - 1; iNdEx >= 0; iNdEx-- { - { - size, err := m.Items[iNdEx].MarshalToSizedBuffer(dAtA[:i]) - if err != nil { - return 0, err - } - i -= size - i = encodeVarintGenerated(dAtA, i, uint64(size)) - } - i-- - dAtA[i] = 0x12 - } - } - { - size, err := m.ListMeta.MarshalToSizedBuffer(dAtA[:i]) - if err != nil { - return 0, err - } - i -= size - i = encodeVarintGenerated(dAtA, i, uint64(size)) - } - i-- - dAtA[i] = 0xa - return len(dAtA) - i, nil -} - -func (m *VulnerabilitySummarySpec) Marshal() (dAtA []byte, err error) { - size := m.Size() - dAtA = make([]byte, size) - n, err := m.MarshalToSizedBuffer(dAtA[:size]) - if err != nil { - return nil, err - } - return dAtA[:n], nil -} - -func (m *VulnerabilitySummarySpec) MarshalTo(dAtA []byte) (int, error) { - size := m.Size() - return m.MarshalToSizedBuffer(dAtA[:size]) -} - -func (m *VulnerabilitySummarySpec) MarshalToSizedBuffer(dAtA []byte) (int, error) { - i := len(dAtA) - _ = i - var l int - _ = l - if len(m.WorkloadVulnerabilitiesObj) > 0 { - for iNdEx := len(m.WorkloadVulnerabilitiesObj) - 1; iNdEx >= 0; iNdEx-- { - { - size, err := m.WorkloadVulnerabilitiesObj[iNdEx].MarshalToSizedBuffer(dAtA[:i]) - if err != nil { - return 0, err - } - i -= size - i = encodeVarintGenerated(dAtA, i, uint64(size)) - } - i-- - dAtA[i] = 0x12 + if len(m.WorkloadVulnerabilitiesObj) > 0 { + for iNdEx := len(m.WorkloadVulnerabilitiesObj) - 1; iNdEx >= 0; iNdEx-- { + { + size, err := m.WorkloadVulnerabilitiesObj[iNdEx].MarshalToSizedBuffer(dAtA[:i]) + if err != nil { + return 0, err + } + i -= size + i = encodeVarintGenerated(dAtA, i, uint64(size)) + } + i-- + dAtA[i] = 0x12 } } { @@ -9019,143 +8432,7 @@ func (m *Advisory) Size() (n int) { return n } -func (m *ApplicationProfile) Size() (n int) { - if m == nil { - return 0 - } - var l int - _ = l - l = m.ObjectMeta.Size() - n += 1 + l + sovGenerated(uint64(l)) - l = m.Spec.Size() - n += 1 + l + sovGenerated(uint64(l)) - l = m.Status.Size() - n += 1 + l + sovGenerated(uint64(l)) - return n -} - -func (m *ApplicationProfileContainer) Size() (n int) { - if m == nil { - return 0 - } - var l int - _ = l - l = len(m.Name) - n += 1 + l + sovGenerated(uint64(l)) - if len(m.Capabilities) > 0 { - for _, s := range m.Capabilities { - l = len(s) - n += 1 + l + sovGenerated(uint64(l)) - } - } - if len(m.Execs) > 0 { - for _, e := range m.Execs { - l = e.Size() - n += 1 + l + sovGenerated(uint64(l)) - } - } - if len(m.Opens) > 0 { - for _, e := range m.Opens { - l = e.Size() - n += 1 + l + sovGenerated(uint64(l)) - } - } - if len(m.Syscalls) > 0 { - for _, s := range m.Syscalls { - l = len(s) - n += 1 + l + sovGenerated(uint64(l)) - } - } - l = m.SeccompProfile.Size() - n += 1 + l + sovGenerated(uint64(l)) - if len(m.Endpoints) > 0 { - for _, e := range m.Endpoints { - l = e.Size() - n += 1 + l + sovGenerated(uint64(l)) - } - } - l = len(m.ImageID) - n += 1 + l + sovGenerated(uint64(l)) - l = len(m.ImageTag) - n += 1 + l + sovGenerated(uint64(l)) - if len(m.PolicyByRuleId) > 0 { - for k, v := range m.PolicyByRuleId { - _ = k - _ = v - l = v.Size() - mapEntrySize := 1 + len(k) + sovGenerated(uint64(len(k))) + 1 + l + sovGenerated(uint64(l)) - n += mapEntrySize + 1 + sovGenerated(uint64(mapEntrySize)) - } - } - if len(m.IdentifiedCallStacks) > 0 { - for _, e := range m.IdentifiedCallStacks { - l = e.Size() - n += 1 + l + sovGenerated(uint64(l)) - } - } - return n -} - -func (m *ApplicationProfileList) Size() (n int) { - if m == nil { - return 0 - } - var l int - _ = l - l = m.ListMeta.Size() - n += 1 + l + sovGenerated(uint64(l)) - if len(m.Items) > 0 { - for _, e := range m.Items { - l = e.Size() - n += 1 + l + sovGenerated(uint64(l)) - } - } - return n -} - -func (m *ApplicationProfileSpec) Size() (n int) { - if m == nil { - return 0 - } - var l int - _ = l - if len(m.Architectures) > 0 { - for _, s := range m.Architectures { - l = len(s) - n += 1 + l + sovGenerated(uint64(l)) - } - } - if len(m.Containers) > 0 { - for _, e := range m.Containers { - l = e.Size() - n += 1 + l + sovGenerated(uint64(l)) - } - } - if len(m.InitContainers) > 0 { - for _, e := range m.InitContainers { - l = e.Size() - n += 1 + l + sovGenerated(uint64(l)) - } - } - if len(m.EphemeralContainers) > 0 { - for _, e := range m.EphemeralContainers { - l = e.Size() - n += 1 + l + sovGenerated(uint64(l)) - } - } - return n -} - -func (m *ApplicationProfileStatus) Size() (n int) { - if m == nil { - return 0 - } - var l int - _ = l - return n -} - -func (m *Arg) Size() (n int) { +func (m *Arg) Size() (n int) { if m == nil { return 0 } @@ -10559,88 +9836,6 @@ func (m *NetworkNeighbor) Size() (n int) { return n } -func (m *NetworkNeighborhood) Size() (n int) { - if m == nil { - return 0 - } - var l int - _ = l - l = m.ObjectMeta.Size() - n += 1 + l + sovGenerated(uint64(l)) - l = m.Spec.Size() - n += 1 + l + sovGenerated(uint64(l)) - return n -} - -func (m *NetworkNeighborhoodContainer) Size() (n int) { - if m == nil { - return 0 - } - var l int - _ = l - l = len(m.Name) - n += 1 + l + sovGenerated(uint64(l)) - if len(m.Ingress) > 0 { - for _, e := range m.Ingress { - l = e.Size() - n += 1 + l + sovGenerated(uint64(l)) - } - } - if len(m.Egress) > 0 { - for _, e := range m.Egress { - l = e.Size() - n += 1 + l + sovGenerated(uint64(l)) - } - } - return n -} - -func (m *NetworkNeighborhoodList) Size() (n int) { - if m == nil { - return 0 - } - var l int - _ = l - l = m.ListMeta.Size() - n += 1 + l + sovGenerated(uint64(l)) - if len(m.Items) > 0 { - for _, e := range m.Items { - l = e.Size() - n += 1 + l + sovGenerated(uint64(l)) - } - } - return n -} - -func (m *NetworkNeighborhoodSpec) Size() (n int) { - if m == nil { - return 0 - } - var l int - _ = l - l = m.LabelSelector.Size() - n += 1 + l + sovGenerated(uint64(l)) - if len(m.Containers) > 0 { - for _, e := range m.Containers { - l = e.Size() - n += 1 + l + sovGenerated(uint64(l)) - } - } - if len(m.InitContainers) > 0 { - for _, e := range m.InitContainers { - l = e.Size() - n += 1 + l + sovGenerated(uint64(l)) - } - } - if len(m.EphemeralContainers) > 0 { - for _, e := range m.EphemeralContainers { - l = e.Size() - n += 1 + l + sovGenerated(uint64(l)) - } - } - return n -} - func (m *NetworkPolicy) Size() (n int) { if m == nil { return 0 @@ -12239,162 +11434,47 @@ func (this *Advisory) String() string { }, "") return s } -func (this *ApplicationProfile) String() string { +func (this *Arg) String() string { if this == nil { return "nil" } - s := strings.Join([]string{`&ApplicationProfile{`, - `ObjectMeta:` + strings.Replace(strings.Replace(fmt.Sprintf("%v", this.ObjectMeta), "ObjectMeta", "v1.ObjectMeta", 1), `&`, ``, 1) + `,`, - `Spec:` + strings.Replace(strings.Replace(this.Spec.String(), "ApplicationProfileSpec", "ApplicationProfileSpec", 1), `&`, ``, 1) + `,`, - `Status:` + strings.Replace(strings.Replace(this.Status.String(), "ApplicationProfileStatus", "ApplicationProfileStatus", 1), `&`, ``, 1) + `,`, + s := strings.Join([]string{`&Arg{`, + `Index:` + fmt.Sprintf("%v", this.Index) + `,`, + `Value:` + fmt.Sprintf("%v", this.Value) + `,`, + `ValueTwo:` + fmt.Sprintf("%v", this.ValueTwo) + `,`, + `Op:` + fmt.Sprintf("%v", this.Op) + `,`, `}`, }, "") return s } -func (this *ApplicationProfileContainer) String() string { +func (this *CPE) String() string { if this == nil { return "nil" } - repeatedStringForExecs := "[]ExecCalls{" - for _, f := range this.Execs { - repeatedStringForExecs += strings.Replace(strings.Replace(f.String(), "ExecCalls", "ExecCalls", 1), `&`, ``, 1) + "," - } - repeatedStringForExecs += "}" - repeatedStringForOpens := "[]OpenCalls{" - for _, f := range this.Opens { - repeatedStringForOpens += strings.Replace(strings.Replace(f.String(), "OpenCalls", "OpenCalls", 1), `&`, ``, 1) + "," + s := strings.Join([]string{`&CPE{`, + `Value:` + fmt.Sprintf("%v", this.Value) + `,`, + `Source:` + fmt.Sprintf("%v", this.Source) + `,`, + `}`, + }, "") + return s +} +func (this *CallStack) String() string { + if this == nil { + return "nil" } - repeatedStringForOpens += "}" - repeatedStringForEndpoints := "[]HTTPEndpoint{" - for _, f := range this.Endpoints { - repeatedStringForEndpoints += strings.Replace(strings.Replace(f.String(), "HTTPEndpoint", "HTTPEndpoint", 1), `&`, ``, 1) + "," + s := strings.Join([]string{`&CallStack{`, + `Root:` + strings.Replace(strings.Replace(this.Root.String(), "CallStackNode", "CallStackNode", 1), `&`, ``, 1) + `,`, + `}`, + }, "") + return s +} +func (this *CallStackNode) String() string { + if this == nil { + return "nil" } - repeatedStringForEndpoints += "}" - repeatedStringForIdentifiedCallStacks := "[]IdentifiedCallStack{" - for _, f := range this.IdentifiedCallStacks { - repeatedStringForIdentifiedCallStacks += strings.Replace(strings.Replace(f.String(), "IdentifiedCallStack", "IdentifiedCallStack", 1), `&`, ``, 1) + "," - } - repeatedStringForIdentifiedCallStacks += "}" - keysForPolicyByRuleId := make([]string, 0, len(this.PolicyByRuleId)) - for k := range this.PolicyByRuleId { - keysForPolicyByRuleId = append(keysForPolicyByRuleId, k) - } - sort.Strings(keysForPolicyByRuleId) - mapStringForPolicyByRuleId := "map[string]RulePolicy{" - for _, k := range keysForPolicyByRuleId { - mapStringForPolicyByRuleId += fmt.Sprintf("%v: %v,", k, this.PolicyByRuleId[k]) - } - mapStringForPolicyByRuleId += "}" - s := strings.Join([]string{`&ApplicationProfileContainer{`, - `Name:` + fmt.Sprintf("%v", this.Name) + `,`, - `Capabilities:` + fmt.Sprintf("%v", this.Capabilities) + `,`, - `Execs:` + repeatedStringForExecs + `,`, - `Opens:` + repeatedStringForOpens + `,`, - `Syscalls:` + fmt.Sprintf("%v", this.Syscalls) + `,`, - `SeccompProfile:` + strings.Replace(strings.Replace(this.SeccompProfile.String(), "SingleSeccompProfile", "SingleSeccompProfile", 1), `&`, ``, 1) + `,`, - `Endpoints:` + repeatedStringForEndpoints + `,`, - `ImageID:` + fmt.Sprintf("%v", this.ImageID) + `,`, - `ImageTag:` + fmt.Sprintf("%v", this.ImageTag) + `,`, - `PolicyByRuleId:` + mapStringForPolicyByRuleId + `,`, - `IdentifiedCallStacks:` + repeatedStringForIdentifiedCallStacks + `,`, - `}`, - }, "") - return s -} -func (this *ApplicationProfileList) String() string { - if this == nil { - return "nil" - } - repeatedStringForItems := "[]ApplicationProfile{" - for _, f := range this.Items { - repeatedStringForItems += strings.Replace(strings.Replace(f.String(), "ApplicationProfile", "ApplicationProfile", 1), `&`, ``, 1) + "," - } - repeatedStringForItems += "}" - s := strings.Join([]string{`&ApplicationProfileList{`, - `ListMeta:` + strings.Replace(strings.Replace(fmt.Sprintf("%v", this.ListMeta), "ListMeta", "v1.ListMeta", 1), `&`, ``, 1) + `,`, - `Items:` + repeatedStringForItems + `,`, - `}`, - }, "") - return s -} -func (this *ApplicationProfileSpec) String() string { - if this == nil { - return "nil" - } - repeatedStringForContainers := "[]ApplicationProfileContainer{" - for _, f := range this.Containers { - repeatedStringForContainers += strings.Replace(strings.Replace(f.String(), "ApplicationProfileContainer", "ApplicationProfileContainer", 1), `&`, ``, 1) + "," - } - repeatedStringForContainers += "}" - repeatedStringForInitContainers := "[]ApplicationProfileContainer{" - for _, f := range this.InitContainers { - repeatedStringForInitContainers += strings.Replace(strings.Replace(f.String(), "ApplicationProfileContainer", "ApplicationProfileContainer", 1), `&`, ``, 1) + "," - } - repeatedStringForInitContainers += "}" - repeatedStringForEphemeralContainers := "[]ApplicationProfileContainer{" - for _, f := range this.EphemeralContainers { - repeatedStringForEphemeralContainers += strings.Replace(strings.Replace(f.String(), "ApplicationProfileContainer", "ApplicationProfileContainer", 1), `&`, ``, 1) + "," - } - repeatedStringForEphemeralContainers += "}" - s := strings.Join([]string{`&ApplicationProfileSpec{`, - `Architectures:` + fmt.Sprintf("%v", this.Architectures) + `,`, - `Containers:` + repeatedStringForContainers + `,`, - `InitContainers:` + repeatedStringForInitContainers + `,`, - `EphemeralContainers:` + repeatedStringForEphemeralContainers + `,`, - `}`, - }, "") - return s -} -func (this *ApplicationProfileStatus) String() string { - if this == nil { - return "nil" - } - s := strings.Join([]string{`&ApplicationProfileStatus{`, - `}`, - }, "") - return s -} -func (this *Arg) String() string { - if this == nil { - return "nil" - } - s := strings.Join([]string{`&Arg{`, - `Index:` + fmt.Sprintf("%v", this.Index) + `,`, - `Value:` + fmt.Sprintf("%v", this.Value) + `,`, - `ValueTwo:` + fmt.Sprintf("%v", this.ValueTwo) + `,`, - `Op:` + fmt.Sprintf("%v", this.Op) + `,`, - `}`, - }, "") - return s -} -func (this *CPE) String() string { - if this == nil { - return "nil" - } - s := strings.Join([]string{`&CPE{`, - `Value:` + fmt.Sprintf("%v", this.Value) + `,`, - `Source:` + fmt.Sprintf("%v", this.Source) + `,`, - `}`, - }, "") - return s -} -func (this *CallStack) String() string { - if this == nil { - return "nil" - } - s := strings.Join([]string{`&CallStack{`, - `Root:` + strings.Replace(strings.Replace(this.Root.String(), "CallStackNode", "CallStackNode", 1), `&`, ``, 1) + `,`, - `}`, - }, "") - return s -} -func (this *CallStackNode) String() string { - if this == nil { - return "nil" - } - repeatedStringForChildren := "[]CallStackNode{" - for _, f := range this.Children { - repeatedStringForChildren += strings.Replace(strings.Replace(f.String(), "CallStackNode", "CallStackNode", 1), `&`, ``, 1) + "," + repeatedStringForChildren := "[]CallStackNode{" + for _, f := range this.Children { + repeatedStringForChildren += strings.Replace(strings.Replace(f.String(), "CallStackNode", "CallStackNode", 1), `&`, ``, 1) + "," } repeatedStringForChildren += "}" s := strings.Join([]string{`&CallStackNode{`, @@ -13459,83 +12539,6 @@ func (this *NetworkNeighbor) String() string { }, "") return s } -func (this *NetworkNeighborhood) String() string { - if this == nil { - return "nil" - } - s := strings.Join([]string{`&NetworkNeighborhood{`, - `ObjectMeta:` + strings.Replace(strings.Replace(fmt.Sprintf("%v", this.ObjectMeta), "ObjectMeta", "v1.ObjectMeta", 1), `&`, ``, 1) + `,`, - `Spec:` + strings.Replace(strings.Replace(this.Spec.String(), "NetworkNeighborhoodSpec", "NetworkNeighborhoodSpec", 1), `&`, ``, 1) + `,`, - `}`, - }, "") - return s -} -func (this *NetworkNeighborhoodContainer) String() string { - if this == nil { - return "nil" - } - repeatedStringForIngress := "[]NetworkNeighbor{" - for _, f := range this.Ingress { - repeatedStringForIngress += strings.Replace(strings.Replace(f.String(), "NetworkNeighbor", "NetworkNeighbor", 1), `&`, ``, 1) + "," - } - repeatedStringForIngress += "}" - repeatedStringForEgress := "[]NetworkNeighbor{" - for _, f := range this.Egress { - repeatedStringForEgress += strings.Replace(strings.Replace(f.String(), "NetworkNeighbor", "NetworkNeighbor", 1), `&`, ``, 1) + "," - } - repeatedStringForEgress += "}" - s := strings.Join([]string{`&NetworkNeighborhoodContainer{`, - `Name:` + fmt.Sprintf("%v", this.Name) + `,`, - `Ingress:` + repeatedStringForIngress + `,`, - `Egress:` + repeatedStringForEgress + `,`, - `}`, - }, "") - return s -} -func (this *NetworkNeighborhoodList) String() string { - if this == nil { - return "nil" - } - repeatedStringForItems := "[]NetworkNeighborhood{" - for _, f := range this.Items { - repeatedStringForItems += strings.Replace(strings.Replace(f.String(), "NetworkNeighborhood", "NetworkNeighborhood", 1), `&`, ``, 1) + "," - } - repeatedStringForItems += "}" - s := strings.Join([]string{`&NetworkNeighborhoodList{`, - `ListMeta:` + strings.Replace(strings.Replace(fmt.Sprintf("%v", this.ListMeta), "ListMeta", "v1.ListMeta", 1), `&`, ``, 1) + `,`, - `Items:` + repeatedStringForItems + `,`, - `}`, - }, "") - return s -} -func (this *NetworkNeighborhoodSpec) String() string { - if this == nil { - return "nil" - } - repeatedStringForContainers := "[]NetworkNeighborhoodContainer{" - for _, f := range this.Containers { - repeatedStringForContainers += strings.Replace(strings.Replace(f.String(), "NetworkNeighborhoodContainer", "NetworkNeighborhoodContainer", 1), `&`, ``, 1) + "," - } - repeatedStringForContainers += "}" - repeatedStringForInitContainers := "[]NetworkNeighborhoodContainer{" - for _, f := range this.InitContainers { - repeatedStringForInitContainers += strings.Replace(strings.Replace(f.String(), "NetworkNeighborhoodContainer", "NetworkNeighborhoodContainer", 1), `&`, ``, 1) + "," - } - repeatedStringForInitContainers += "}" - repeatedStringForEphemeralContainers := "[]NetworkNeighborhoodContainer{" - for _, f := range this.EphemeralContainers { - repeatedStringForEphemeralContainers += strings.Replace(strings.Replace(f.String(), "NetworkNeighborhoodContainer", "NetworkNeighborhoodContainer", 1), `&`, ``, 1) + "," - } - repeatedStringForEphemeralContainers += "}" - s := strings.Join([]string{`&NetworkNeighborhoodSpec{`, - `LabelSelector:` + strings.Replace(strings.Replace(fmt.Sprintf("%v", this.LabelSelector), "LabelSelector", "v1.LabelSelector", 1), `&`, ``, 1) + `,`, - `Containers:` + repeatedStringForContainers + `,`, - `InitContainers:` + repeatedStringForInitContainers + `,`, - `EphemeralContainers:` + repeatedStringForEphemeralContainers + `,`, - `}`, - }, "") - return s -} func (this *NetworkPolicy) String() string { if this == nil { return "nil" @@ -14932,972 +13935,14 @@ func (m *Advisory) Unmarshal(dAtA []byte) error { if intStringLen < 0 { return ErrInvalidLengthGenerated } - postIndex := iNdEx + intStringLen - if postIndex < 0 { - return ErrInvalidLengthGenerated - } - if postIndex > l { - return io.ErrUnexpectedEOF - } - m.Link = string(dAtA[iNdEx:postIndex]) - iNdEx = postIndex - default: - iNdEx = preIndex - skippy, err := skipGenerated(dAtA[iNdEx:]) - if err != nil { - return err - } - if (skippy < 0) || (iNdEx+skippy) < 0 { - return ErrInvalidLengthGenerated - } - if (iNdEx + skippy) > l { - return io.ErrUnexpectedEOF - } - iNdEx += skippy - } - } - - if iNdEx > l { - return io.ErrUnexpectedEOF - } - return nil -} -func (m *ApplicationProfile) Unmarshal(dAtA []byte) error { - l := len(dAtA) - iNdEx := 0 - for iNdEx < l { - preIndex := iNdEx - var wire uint64 - for shift := uint(0); ; shift += 7 { - if shift >= 64 { - return ErrIntOverflowGenerated - } - if iNdEx >= l { - return io.ErrUnexpectedEOF - } - b := dAtA[iNdEx] - iNdEx++ - wire |= uint64(b&0x7F) << shift - if b < 0x80 { - break - } - } - fieldNum := int32(wire >> 3) - wireType := int(wire & 0x7) - if wireType == 4 { - return fmt.Errorf("proto: ApplicationProfile: wiretype end group for non-group") - } - if fieldNum <= 0 { - return fmt.Errorf("proto: ApplicationProfile: illegal tag %d (wire type %d)", fieldNum, wire) - } - switch fieldNum { - case 1: - if wireType != 2 { - return fmt.Errorf("proto: wrong wireType = %d for field ObjectMeta", wireType) - } - var msglen int - for shift := uint(0); ; shift += 7 { - if shift >= 64 { - return ErrIntOverflowGenerated - } - if iNdEx >= l { - return io.ErrUnexpectedEOF - } - b := dAtA[iNdEx] - iNdEx++ - msglen |= int(b&0x7F) << shift - if b < 0x80 { - break - } - } - if msglen < 0 { - return ErrInvalidLengthGenerated - } - postIndex := iNdEx + msglen - if postIndex < 0 { - return ErrInvalidLengthGenerated - } - if postIndex > l { - return io.ErrUnexpectedEOF - } - if err := m.ObjectMeta.Unmarshal(dAtA[iNdEx:postIndex]); err != nil { - return err - } - iNdEx = postIndex - case 2: - if wireType != 2 { - return fmt.Errorf("proto: wrong wireType = %d for field Spec", wireType) - } - var msglen int - for shift := uint(0); ; shift += 7 { - if shift >= 64 { - return ErrIntOverflowGenerated - } - if iNdEx >= l { - return io.ErrUnexpectedEOF - } - b := dAtA[iNdEx] - iNdEx++ - msglen |= int(b&0x7F) << shift - if b < 0x80 { - break - } - } - if msglen < 0 { - return ErrInvalidLengthGenerated - } - postIndex := iNdEx + msglen - if postIndex < 0 { - return ErrInvalidLengthGenerated - } - if postIndex > l { - return io.ErrUnexpectedEOF - } - if err := m.Spec.Unmarshal(dAtA[iNdEx:postIndex]); err != nil { - return err - } - iNdEx = postIndex - case 3: - if wireType != 2 { - return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType) - } - var msglen int - for shift := uint(0); ; shift += 7 { - if shift >= 64 { - return ErrIntOverflowGenerated - } - if iNdEx >= l { - return io.ErrUnexpectedEOF - } - b := dAtA[iNdEx] - iNdEx++ - msglen |= int(b&0x7F) << shift - if b < 0x80 { - break - } - } - if msglen < 0 { - return ErrInvalidLengthGenerated - } - postIndex := iNdEx + msglen - if postIndex < 0 { - return ErrInvalidLengthGenerated - } - if postIndex > l { - return io.ErrUnexpectedEOF - } - if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil { - return err - } - iNdEx = postIndex - default: - iNdEx = preIndex - skippy, err := skipGenerated(dAtA[iNdEx:]) - if err != nil { - return err - } - if (skippy < 0) || (iNdEx+skippy) < 0 { - return ErrInvalidLengthGenerated - } - if (iNdEx + skippy) > l { - return io.ErrUnexpectedEOF - } - iNdEx += skippy - } - } - - if iNdEx > l { - return io.ErrUnexpectedEOF - } - return nil -} -func (m *ApplicationProfileContainer) Unmarshal(dAtA []byte) error { - l := len(dAtA) - iNdEx := 0 - for iNdEx < l { - preIndex := iNdEx - var wire uint64 - for shift := uint(0); ; shift += 7 { - if shift >= 64 { - return ErrIntOverflowGenerated - } - if iNdEx >= l { - return io.ErrUnexpectedEOF - } - b := dAtA[iNdEx] - iNdEx++ - wire |= uint64(b&0x7F) << shift - if b < 0x80 { - break - } - } - fieldNum := int32(wire >> 3) - wireType := int(wire & 0x7) - if wireType == 4 { - return fmt.Errorf("proto: ApplicationProfileContainer: wiretype end group for non-group") - } - if fieldNum <= 0 { - return fmt.Errorf("proto: ApplicationProfileContainer: illegal tag %d (wire type %d)", fieldNum, wire) - } - switch fieldNum { - case 1: - if wireType != 2 { - return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType) - } - var stringLen uint64 - for shift := uint(0); ; shift += 7 { - if shift >= 64 { - return ErrIntOverflowGenerated - } - if iNdEx >= l { - return io.ErrUnexpectedEOF - } - b := dAtA[iNdEx] - iNdEx++ - stringLen |= uint64(b&0x7F) << shift - if b < 0x80 { - break - } - } - intStringLen := int(stringLen) - if intStringLen < 0 { - return ErrInvalidLengthGenerated - } - postIndex := iNdEx + intStringLen - if postIndex < 0 { - return ErrInvalidLengthGenerated - } - if postIndex > l { - return io.ErrUnexpectedEOF - } - m.Name = string(dAtA[iNdEx:postIndex]) - iNdEx = postIndex - case 2: - if wireType != 2 { - return fmt.Errorf("proto: wrong wireType = %d for field Capabilities", wireType) - } - var stringLen uint64 - for shift := uint(0); ; shift += 7 { - if shift >= 64 { - return ErrIntOverflowGenerated - } - if iNdEx >= l { - return io.ErrUnexpectedEOF - } - b := dAtA[iNdEx] - iNdEx++ - stringLen |= uint64(b&0x7F) << shift - if b < 0x80 { - break - } - } - intStringLen := int(stringLen) - if intStringLen < 0 { - return ErrInvalidLengthGenerated - } - postIndex := iNdEx + intStringLen - if postIndex < 0 { - return ErrInvalidLengthGenerated - } - if postIndex > l { - return io.ErrUnexpectedEOF - } - m.Capabilities = append(m.Capabilities, string(dAtA[iNdEx:postIndex])) - iNdEx = postIndex - case 3: - if wireType != 2 { - return fmt.Errorf("proto: wrong wireType = %d for field Execs", wireType) - } - var msglen int - for shift := uint(0); ; shift += 7 { - if shift >= 64 { - return ErrIntOverflowGenerated - } - if iNdEx >= l { - return io.ErrUnexpectedEOF - } - b := dAtA[iNdEx] - iNdEx++ - msglen |= int(b&0x7F) << shift - if b < 0x80 { - break - } - } - if msglen < 0 { - return ErrInvalidLengthGenerated - } - postIndex := iNdEx + msglen - if postIndex < 0 { - return ErrInvalidLengthGenerated - } - if postIndex > l { - return io.ErrUnexpectedEOF - } - m.Execs = append(m.Execs, ExecCalls{}) - if err := m.Execs[len(m.Execs)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil { - return err - } - iNdEx = postIndex - case 4: - if wireType != 2 { - return fmt.Errorf("proto: wrong wireType = %d for field Opens", wireType) - } - var msglen int - for shift := uint(0); ; shift += 7 { - if shift >= 64 { - return ErrIntOverflowGenerated - } - if iNdEx >= l { - return io.ErrUnexpectedEOF - } - b := dAtA[iNdEx] - iNdEx++ - msglen |= int(b&0x7F) << shift - if b < 0x80 { - break - } - } - if msglen < 0 { - return ErrInvalidLengthGenerated - } - postIndex := iNdEx + msglen - if postIndex < 0 { - return ErrInvalidLengthGenerated - } - if postIndex > l { - return io.ErrUnexpectedEOF - } - m.Opens = append(m.Opens, OpenCalls{}) - if err := m.Opens[len(m.Opens)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil { - return err - } - iNdEx = postIndex - case 5: - if wireType != 2 { - return fmt.Errorf("proto: wrong wireType = %d for field Syscalls", wireType) - } - var stringLen uint64 - for shift := uint(0); ; shift += 7 { - if shift >= 64 { - return ErrIntOverflowGenerated - } - if iNdEx >= l { - return io.ErrUnexpectedEOF - } - b := dAtA[iNdEx] - iNdEx++ - stringLen |= uint64(b&0x7F) << shift - if b < 0x80 { - break - } - } - intStringLen := int(stringLen) - if intStringLen < 0 { - return ErrInvalidLengthGenerated - } - postIndex := iNdEx + intStringLen - if postIndex < 0 { - return ErrInvalidLengthGenerated - } - if postIndex > l { - return io.ErrUnexpectedEOF - } - m.Syscalls = append(m.Syscalls, string(dAtA[iNdEx:postIndex])) - iNdEx = postIndex - case 6: - if wireType != 2 { - return fmt.Errorf("proto: wrong wireType = %d for field SeccompProfile", wireType) - } - var msglen int - for shift := uint(0); ; shift += 7 { - if shift >= 64 { - return ErrIntOverflowGenerated - } - if iNdEx >= l { - return io.ErrUnexpectedEOF - } - b := dAtA[iNdEx] - iNdEx++ - msglen |= int(b&0x7F) << shift - if b < 0x80 { - break - } - } - if msglen < 0 { - return ErrInvalidLengthGenerated - } - postIndex := iNdEx + msglen - if postIndex < 0 { - return ErrInvalidLengthGenerated - } - if postIndex > l { - return io.ErrUnexpectedEOF - } - if err := m.SeccompProfile.Unmarshal(dAtA[iNdEx:postIndex]); err != nil { - return err - } - iNdEx = postIndex - case 7: - if wireType != 2 { - return fmt.Errorf("proto: wrong wireType = %d for field Endpoints", wireType) - } - var msglen int - for shift := uint(0); ; shift += 7 { - if shift >= 64 { - return ErrIntOverflowGenerated - } - if iNdEx >= l { - return io.ErrUnexpectedEOF - } - b := dAtA[iNdEx] - iNdEx++ - msglen |= int(b&0x7F) << shift - if b < 0x80 { - break - } - } - if msglen < 0 { - return ErrInvalidLengthGenerated - } - postIndex := iNdEx + msglen - if postIndex < 0 { - return ErrInvalidLengthGenerated - } - if postIndex > l { - return io.ErrUnexpectedEOF - } - m.Endpoints = append(m.Endpoints, HTTPEndpoint{}) - if err := m.Endpoints[len(m.Endpoints)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil { - return err - } - iNdEx = postIndex - case 8: - if wireType != 2 { - return fmt.Errorf("proto: wrong wireType = %d for field ImageID", wireType) - } - var stringLen uint64 - for shift := uint(0); ; shift += 7 { - if shift >= 64 { - return ErrIntOverflowGenerated - } - if iNdEx >= l { - return io.ErrUnexpectedEOF - } - b := dAtA[iNdEx] - iNdEx++ - stringLen |= uint64(b&0x7F) << shift - if b < 0x80 { - break - } - } - intStringLen := int(stringLen) - if intStringLen < 0 { - return ErrInvalidLengthGenerated - } - postIndex := iNdEx + intStringLen - if postIndex < 0 { - return ErrInvalidLengthGenerated - } - if postIndex > l { - return io.ErrUnexpectedEOF - } - m.ImageID = string(dAtA[iNdEx:postIndex]) - iNdEx = postIndex - case 9: - if wireType != 2 { - return fmt.Errorf("proto: wrong wireType = %d for field ImageTag", wireType) - } - var stringLen uint64 - for shift := uint(0); ; shift += 7 { - if shift >= 64 { - return ErrIntOverflowGenerated - } - if iNdEx >= l { - return io.ErrUnexpectedEOF - } - b := dAtA[iNdEx] - iNdEx++ - stringLen |= uint64(b&0x7F) << shift - if b < 0x80 { - break - } - } - intStringLen := int(stringLen) - if intStringLen < 0 { - return ErrInvalidLengthGenerated - } - postIndex := iNdEx + intStringLen - if postIndex < 0 { - return ErrInvalidLengthGenerated - } - if postIndex > l { - return io.ErrUnexpectedEOF - } - m.ImageTag = string(dAtA[iNdEx:postIndex]) - iNdEx = postIndex - case 10: - if wireType != 2 { - return fmt.Errorf("proto: wrong wireType = %d for field PolicyByRuleId", wireType) - } - var msglen int - for shift := uint(0); ; shift += 7 { - if shift >= 64 { - return ErrIntOverflowGenerated - } - if iNdEx >= l { - return io.ErrUnexpectedEOF - } - b := dAtA[iNdEx] - iNdEx++ - msglen |= int(b&0x7F) << shift - if b < 0x80 { - break - } - } - if msglen < 0 { - return ErrInvalidLengthGenerated - } - postIndex := iNdEx + msglen - if postIndex < 0 { - return ErrInvalidLengthGenerated - } - if postIndex > l { - return io.ErrUnexpectedEOF - } - if m.PolicyByRuleId == nil { - m.PolicyByRuleId = make(map[string]RulePolicy) - } - var mapkey string - mapvalue := &RulePolicy{} - for iNdEx < postIndex { - entryPreIndex := iNdEx - var wire uint64 - for shift := uint(0); ; shift += 7 { - if shift >= 64 { - return ErrIntOverflowGenerated - } - if iNdEx >= l { - return io.ErrUnexpectedEOF - } - b := dAtA[iNdEx] - iNdEx++ - wire |= uint64(b&0x7F) << shift - if b < 0x80 { - break - } - } - fieldNum := int32(wire >> 3) - if fieldNum == 1 { - var stringLenmapkey uint64 - for shift := uint(0); ; shift += 7 { - if shift >= 64 { - return ErrIntOverflowGenerated - } - if iNdEx >= l { - return io.ErrUnexpectedEOF - } - b := dAtA[iNdEx] - iNdEx++ - stringLenmapkey |= uint64(b&0x7F) << shift - if b < 0x80 { - break - } - } - intStringLenmapkey := int(stringLenmapkey) - if intStringLenmapkey < 0 { - return ErrInvalidLengthGenerated - } - postStringIndexmapkey := iNdEx + intStringLenmapkey - if postStringIndexmapkey < 0 { - return ErrInvalidLengthGenerated - } - if postStringIndexmapkey > l { - return io.ErrUnexpectedEOF - } - mapkey = string(dAtA[iNdEx:postStringIndexmapkey]) - iNdEx = postStringIndexmapkey - } else if fieldNum == 2 { - var mapmsglen int - for shift := uint(0); ; shift += 7 { - if shift >= 64 { - return ErrIntOverflowGenerated - } - if iNdEx >= l { - return io.ErrUnexpectedEOF - } - b := dAtA[iNdEx] - iNdEx++ - mapmsglen |= int(b&0x7F) << shift - if b < 0x80 { - break - } - } - if mapmsglen < 0 { - return ErrInvalidLengthGenerated - } - postmsgIndex := iNdEx + mapmsglen - if postmsgIndex < 0 { - return ErrInvalidLengthGenerated - } - if postmsgIndex > l { - return io.ErrUnexpectedEOF - } - mapvalue = &RulePolicy{} - if err := mapvalue.Unmarshal(dAtA[iNdEx:postmsgIndex]); err != nil { - return err - } - iNdEx = postmsgIndex - } else { - iNdEx = entryPreIndex - skippy, err := skipGenerated(dAtA[iNdEx:]) - if err != nil { - return err - } - if (skippy < 0) || (iNdEx+skippy) < 0 { - return ErrInvalidLengthGenerated - } - if (iNdEx + skippy) > postIndex { - return io.ErrUnexpectedEOF - } - iNdEx += skippy - } - } - m.PolicyByRuleId[mapkey] = *mapvalue - iNdEx = postIndex - case 11: - if wireType != 2 { - return fmt.Errorf("proto: wrong wireType = %d for field IdentifiedCallStacks", wireType) - } - var msglen int - for shift := uint(0); ; shift += 7 { - if shift >= 64 { - return ErrIntOverflowGenerated - } - if iNdEx >= l { - return io.ErrUnexpectedEOF - } - b := dAtA[iNdEx] - iNdEx++ - msglen |= int(b&0x7F) << shift - if b < 0x80 { - break - } - } - if msglen < 0 { - return ErrInvalidLengthGenerated - } - postIndex := iNdEx + msglen - if postIndex < 0 { - return ErrInvalidLengthGenerated - } - if postIndex > l { - return io.ErrUnexpectedEOF - } - m.IdentifiedCallStacks = append(m.IdentifiedCallStacks, IdentifiedCallStack{}) - if err := m.IdentifiedCallStacks[len(m.IdentifiedCallStacks)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil { - return err - } - iNdEx = postIndex - default: - iNdEx = preIndex - skippy, err := skipGenerated(dAtA[iNdEx:]) - if err != nil { - return err - } - if (skippy < 0) || (iNdEx+skippy) < 0 { - return ErrInvalidLengthGenerated - } - if (iNdEx + skippy) > l { - return io.ErrUnexpectedEOF - } - iNdEx += skippy - } - } - - if iNdEx > l { - return io.ErrUnexpectedEOF - } - return nil -} -func (m *ApplicationProfileList) Unmarshal(dAtA []byte) error { - l := len(dAtA) - iNdEx := 0 - for iNdEx < l { - preIndex := iNdEx - var wire uint64 - for shift := uint(0); ; shift += 7 { - if shift >= 64 { - return ErrIntOverflowGenerated - } - if iNdEx >= l { - return io.ErrUnexpectedEOF - } - b := dAtA[iNdEx] - iNdEx++ - wire |= uint64(b&0x7F) << shift - if b < 0x80 { - break - } - } - fieldNum := int32(wire >> 3) - wireType := int(wire & 0x7) - if wireType == 4 { - return fmt.Errorf("proto: ApplicationProfileList: wiretype end group for non-group") - } - if fieldNum <= 0 { - return fmt.Errorf("proto: ApplicationProfileList: illegal tag %d (wire type %d)", fieldNum, wire) - } - switch fieldNum { - case 1: - if wireType != 2 { - return fmt.Errorf("proto: wrong wireType = %d for field ListMeta", wireType) - } - var msglen int - for shift := uint(0); ; shift += 7 { - if shift >= 64 { - return ErrIntOverflowGenerated - } - if iNdEx >= l { - return io.ErrUnexpectedEOF - } - b := dAtA[iNdEx] - iNdEx++ - msglen |= int(b&0x7F) << shift - if b < 0x80 { - break - } - } - if msglen < 0 { - return ErrInvalidLengthGenerated - } - postIndex := iNdEx + msglen - if postIndex < 0 { - return ErrInvalidLengthGenerated - } - if postIndex > l { - return io.ErrUnexpectedEOF - } - if err := m.ListMeta.Unmarshal(dAtA[iNdEx:postIndex]); err != nil { - return err - } - iNdEx = postIndex - case 2: - if wireType != 2 { - return fmt.Errorf("proto: wrong wireType = %d for field Items", wireType) - } - var msglen int - for shift := uint(0); ; shift += 7 { - if shift >= 64 { - return ErrIntOverflowGenerated - } - if iNdEx >= l { - return io.ErrUnexpectedEOF - } - b := dAtA[iNdEx] - iNdEx++ - msglen |= int(b&0x7F) << shift - if b < 0x80 { - break - } - } - if msglen < 0 { - return ErrInvalidLengthGenerated - } - postIndex := iNdEx + msglen - if postIndex < 0 { - return ErrInvalidLengthGenerated - } - if postIndex > l { - return io.ErrUnexpectedEOF - } - m.Items = append(m.Items, ApplicationProfile{}) - if err := m.Items[len(m.Items)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil { - return err - } - iNdEx = postIndex - default: - iNdEx = preIndex - skippy, err := skipGenerated(dAtA[iNdEx:]) - if err != nil { - return err - } - if (skippy < 0) || (iNdEx+skippy) < 0 { - return ErrInvalidLengthGenerated - } - if (iNdEx + skippy) > l { - return io.ErrUnexpectedEOF - } - iNdEx += skippy - } - } - - if iNdEx > l { - return io.ErrUnexpectedEOF - } - return nil -} -func (m *ApplicationProfileSpec) Unmarshal(dAtA []byte) error { - l := len(dAtA) - iNdEx := 0 - for iNdEx < l { - preIndex := iNdEx - var wire uint64 - for shift := uint(0); ; shift += 7 { - if shift >= 64 { - return ErrIntOverflowGenerated - } - if iNdEx >= l { - return io.ErrUnexpectedEOF - } - b := dAtA[iNdEx] - iNdEx++ - wire |= uint64(b&0x7F) << shift - if b < 0x80 { - break - } - } - fieldNum := int32(wire >> 3) - wireType := int(wire & 0x7) - if wireType == 4 { - return fmt.Errorf("proto: ApplicationProfileSpec: wiretype end group for non-group") - } - if fieldNum <= 0 { - return fmt.Errorf("proto: ApplicationProfileSpec: illegal tag %d (wire type %d)", fieldNum, wire) - } - switch fieldNum { - case 1: - if wireType != 2 { - return fmt.Errorf("proto: wrong wireType = %d for field Architectures", wireType) - } - var stringLen uint64 - for shift := uint(0); ; shift += 7 { - if shift >= 64 { - return ErrIntOverflowGenerated - } - if iNdEx >= l { - return io.ErrUnexpectedEOF - } - b := dAtA[iNdEx] - iNdEx++ - stringLen |= uint64(b&0x7F) << shift - if b < 0x80 { - break - } - } - intStringLen := int(stringLen) - if intStringLen < 0 { - return ErrInvalidLengthGenerated - } - postIndex := iNdEx + intStringLen - if postIndex < 0 { - return ErrInvalidLengthGenerated - } - if postIndex > l { - return io.ErrUnexpectedEOF - } - m.Architectures = append(m.Architectures, string(dAtA[iNdEx:postIndex])) - iNdEx = postIndex - case 2: - if wireType != 2 { - return fmt.Errorf("proto: wrong wireType = %d for field Containers", wireType) - } - var msglen int - for shift := uint(0); ; shift += 7 { - if shift >= 64 { - return ErrIntOverflowGenerated - } - if iNdEx >= l { - return io.ErrUnexpectedEOF - } - b := dAtA[iNdEx] - iNdEx++ - msglen |= int(b&0x7F) << shift - if b < 0x80 { - break - } - } - if msglen < 0 { - return ErrInvalidLengthGenerated - } - postIndex := iNdEx + msglen - if postIndex < 0 { - return ErrInvalidLengthGenerated - } - if postIndex > l { - return io.ErrUnexpectedEOF - } - m.Containers = append(m.Containers, ApplicationProfileContainer{}) - if err := m.Containers[len(m.Containers)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil { - return err - } - iNdEx = postIndex - case 3: - if wireType != 2 { - return fmt.Errorf("proto: wrong wireType = %d for field InitContainers", wireType) - } - var msglen int - for shift := uint(0); ; shift += 7 { - if shift >= 64 { - return ErrIntOverflowGenerated - } - if iNdEx >= l { - return io.ErrUnexpectedEOF - } - b := dAtA[iNdEx] - iNdEx++ - msglen |= int(b&0x7F) << shift - if b < 0x80 { - break - } - } - if msglen < 0 { - return ErrInvalidLengthGenerated - } - postIndex := iNdEx + msglen - if postIndex < 0 { - return ErrInvalidLengthGenerated - } - if postIndex > l { - return io.ErrUnexpectedEOF - } - m.InitContainers = append(m.InitContainers, ApplicationProfileContainer{}) - if err := m.InitContainers[len(m.InitContainers)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil { - return err - } - iNdEx = postIndex - case 4: - if wireType != 2 { - return fmt.Errorf("proto: wrong wireType = %d for field EphemeralContainers", wireType) - } - var msglen int - for shift := uint(0); ; shift += 7 { - if shift >= 64 { - return ErrIntOverflowGenerated - } - if iNdEx >= l { - return io.ErrUnexpectedEOF - } - b := dAtA[iNdEx] - iNdEx++ - msglen |= int(b&0x7F) << shift - if b < 0x80 { - break - } - } - if msglen < 0 { - return ErrInvalidLengthGenerated - } - postIndex := iNdEx + msglen + postIndex := iNdEx + intStringLen if postIndex < 0 { return ErrInvalidLengthGenerated } if postIndex > l { return io.ErrUnexpectedEOF } - m.EphemeralContainers = append(m.EphemeralContainers, ApplicationProfileContainer{}) - if err := m.EphemeralContainers[len(m.EphemeralContainers)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil { - return err - } + m.Link = string(dAtA[iNdEx:postIndex]) iNdEx = postIndex default: iNdEx = preIndex @@ -15920,56 +13965,6 @@ func (m *ApplicationProfileSpec) Unmarshal(dAtA []byte) error { } return nil } -func (m *ApplicationProfileStatus) Unmarshal(dAtA []byte) error { - l := len(dAtA) - iNdEx := 0 - for iNdEx < l { - preIndex := iNdEx - var wire uint64 - for shift := uint(0); ; shift += 7 { - if shift >= 64 { - return ErrIntOverflowGenerated - } - if iNdEx >= l { - return io.ErrUnexpectedEOF - } - b := dAtA[iNdEx] - iNdEx++ - wire |= uint64(b&0x7F) << shift - if b < 0x80 { - break - } - } - fieldNum := int32(wire >> 3) - wireType := int(wire & 0x7) - if wireType == 4 { - return fmt.Errorf("proto: ApplicationProfileStatus: wiretype end group for non-group") - } - if fieldNum <= 0 { - return fmt.Errorf("proto: ApplicationProfileStatus: illegal tag %d (wire type %d)", fieldNum, wire) - } - switch fieldNum { - default: - iNdEx = preIndex - skippy, err := skipGenerated(dAtA[iNdEx:]) - if err != nil { - return err - } - if (skippy < 0) || (iNdEx+skippy) < 0 { - return ErrInvalidLengthGenerated - } - if (iNdEx + skippy) > l { - return io.ErrUnexpectedEOF - } - iNdEx += skippy - } - } - - if iNdEx > l { - return io.ErrUnexpectedEOF - } - return nil -} func (m *Arg) Unmarshal(dAtA []byte) error { l := len(dAtA) iNdEx := 0 @@ -26649,225 +24644,41 @@ func (m *LocationMetadata) Unmarshal(dAtA []byte) error { return io.ErrUnexpectedEOF } b := dAtA[iNdEx] - iNdEx++ - stringLenmapvalue |= uint64(b&0x7F) << shift - if b < 0x80 { - break - } - } - intStringLenmapvalue := int(stringLenmapvalue) - if intStringLenmapvalue < 0 { - return ErrInvalidLengthGenerated - } - postStringIndexmapvalue := iNdEx + intStringLenmapvalue - if postStringIndexmapvalue < 0 { - return ErrInvalidLengthGenerated - } - if postStringIndexmapvalue > l { - return io.ErrUnexpectedEOF - } - mapvalue = string(dAtA[iNdEx:postStringIndexmapvalue]) - iNdEx = postStringIndexmapvalue - } else { - iNdEx = entryPreIndex - skippy, err := skipGenerated(dAtA[iNdEx:]) - if err != nil { - return err - } - if (skippy < 0) || (iNdEx+skippy) < 0 { - return ErrInvalidLengthGenerated - } - if (iNdEx + skippy) > postIndex { - return io.ErrUnexpectedEOF - } - iNdEx += skippy - } - } - m.Annotations[mapkey] = mapvalue - iNdEx = postIndex - default: - iNdEx = preIndex - skippy, err := skipGenerated(dAtA[iNdEx:]) - if err != nil { - return err - } - if (skippy < 0) || (iNdEx+skippy) < 0 { - return ErrInvalidLengthGenerated - } - if (iNdEx + skippy) > l { - return io.ErrUnexpectedEOF - } - iNdEx += skippy - } - } - - if iNdEx > l { - return io.ErrUnexpectedEOF - } - return nil -} -func (m *Match) Unmarshal(dAtA []byte) error { - l := len(dAtA) - iNdEx := 0 - for iNdEx < l { - preIndex := iNdEx - var wire uint64 - for shift := uint(0); ; shift += 7 { - if shift >= 64 { - return ErrIntOverflowGenerated - } - if iNdEx >= l { - return io.ErrUnexpectedEOF - } - b := dAtA[iNdEx] - iNdEx++ - wire |= uint64(b&0x7F) << shift - if b < 0x80 { - break - } - } - fieldNum := int32(wire >> 3) - wireType := int(wire & 0x7) - if wireType == 4 { - return fmt.Errorf("proto: Match: wiretype end group for non-group") - } - if fieldNum <= 0 { - return fmt.Errorf("proto: Match: illegal tag %d (wire type %d)", fieldNum, wire) - } - switch fieldNum { - case 1: - if wireType != 2 { - return fmt.Errorf("proto: wrong wireType = %d for field Vulnerability", wireType) - } - var msglen int - for shift := uint(0); ; shift += 7 { - if shift >= 64 { - return ErrIntOverflowGenerated - } - if iNdEx >= l { - return io.ErrUnexpectedEOF - } - b := dAtA[iNdEx] - iNdEx++ - msglen |= int(b&0x7F) << shift - if b < 0x80 { - break - } - } - if msglen < 0 { - return ErrInvalidLengthGenerated - } - postIndex := iNdEx + msglen - if postIndex < 0 { - return ErrInvalidLengthGenerated - } - if postIndex > l { - return io.ErrUnexpectedEOF - } - if err := m.Vulnerability.Unmarshal(dAtA[iNdEx:postIndex]); err != nil { - return err - } - iNdEx = postIndex - case 2: - if wireType != 2 { - return fmt.Errorf("proto: wrong wireType = %d for field RelatedVulnerabilities", wireType) - } - var msglen int - for shift := uint(0); ; shift += 7 { - if shift >= 64 { - return ErrIntOverflowGenerated - } - if iNdEx >= l { - return io.ErrUnexpectedEOF - } - b := dAtA[iNdEx] - iNdEx++ - msglen |= int(b&0x7F) << shift - if b < 0x80 { - break - } - } - if msglen < 0 { - return ErrInvalidLengthGenerated - } - postIndex := iNdEx + msglen - if postIndex < 0 { - return ErrInvalidLengthGenerated - } - if postIndex > l { - return io.ErrUnexpectedEOF - } - m.RelatedVulnerabilities = append(m.RelatedVulnerabilities, VulnerabilityMetadata{}) - if err := m.RelatedVulnerabilities[len(m.RelatedVulnerabilities)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil { - return err - } - iNdEx = postIndex - case 3: - if wireType != 2 { - return fmt.Errorf("proto: wrong wireType = %d for field MatchDetails", wireType) - } - var msglen int - for shift := uint(0); ; shift += 7 { - if shift >= 64 { - return ErrIntOverflowGenerated - } - if iNdEx >= l { - return io.ErrUnexpectedEOF - } - b := dAtA[iNdEx] - iNdEx++ - msglen |= int(b&0x7F) << shift - if b < 0x80 { - break - } - } - if msglen < 0 { - return ErrInvalidLengthGenerated - } - postIndex := iNdEx + msglen - if postIndex < 0 { - return ErrInvalidLengthGenerated - } - if postIndex > l { - return io.ErrUnexpectedEOF - } - m.MatchDetails = append(m.MatchDetails, MatchDetails{}) - if err := m.MatchDetails[len(m.MatchDetails)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil { - return err - } - iNdEx = postIndex - case 4: - if wireType != 2 { - return fmt.Errorf("proto: wrong wireType = %d for field Artifact", wireType) - } - var msglen int - for shift := uint(0); ; shift += 7 { - if shift >= 64 { - return ErrIntOverflowGenerated - } - if iNdEx >= l { - return io.ErrUnexpectedEOF - } - b := dAtA[iNdEx] - iNdEx++ - msglen |= int(b&0x7F) << shift - if b < 0x80 { - break + iNdEx++ + stringLenmapvalue |= uint64(b&0x7F) << shift + if b < 0x80 { + break + } + } + intStringLenmapvalue := int(stringLenmapvalue) + if intStringLenmapvalue < 0 { + return ErrInvalidLengthGenerated + } + postStringIndexmapvalue := iNdEx + intStringLenmapvalue + if postStringIndexmapvalue < 0 { + return ErrInvalidLengthGenerated + } + if postStringIndexmapvalue > l { + return io.ErrUnexpectedEOF + } + mapvalue = string(dAtA[iNdEx:postStringIndexmapvalue]) + iNdEx = postStringIndexmapvalue + } else { + iNdEx = entryPreIndex + skippy, err := skipGenerated(dAtA[iNdEx:]) + if err != nil { + return err + } + if (skippy < 0) || (iNdEx+skippy) < 0 { + return ErrInvalidLengthGenerated + } + if (iNdEx + skippy) > postIndex { + return io.ErrUnexpectedEOF + } + iNdEx += skippy } } - if msglen < 0 { - return ErrInvalidLengthGenerated - } - postIndex := iNdEx + msglen - if postIndex < 0 { - return ErrInvalidLengthGenerated - } - if postIndex > l { - return io.ErrUnexpectedEOF - } - if err := m.Artifact.Unmarshal(dAtA[iNdEx:postIndex]); err != nil { - return err - } + m.Annotations[mapkey] = mapvalue iNdEx = postIndex default: iNdEx = preIndex @@ -26890,7 +24701,7 @@ func (m *Match) Unmarshal(dAtA []byte) error { } return nil } -func (m *MatchDetails) Unmarshal(dAtA []byte) error { +func (m *Match) Unmarshal(dAtA []byte) error { l := len(dAtA) iNdEx := 0 for iNdEx < l { @@ -26913,17 +24724,17 @@ func (m *MatchDetails) Unmarshal(dAtA []byte) error { fieldNum := int32(wire >> 3) wireType := int(wire & 0x7) if wireType == 4 { - return fmt.Errorf("proto: MatchDetails: wiretype end group for non-group") + return fmt.Errorf("proto: Match: wiretype end group for non-group") } if fieldNum <= 0 { - return fmt.Errorf("proto: MatchDetails: illegal tag %d (wire type %d)", fieldNum, wire) + return fmt.Errorf("proto: Match: illegal tag %d (wire type %d)", fieldNum, wire) } switch fieldNum { case 1: if wireType != 2 { - return fmt.Errorf("proto: wrong wireType = %d for field Type", wireType) + return fmt.Errorf("proto: wrong wireType = %d for field Vulnerability", wireType) } - var stringLen uint64 + var msglen int for shift := uint(0); ; shift += 7 { if shift >= 64 { return ErrIntOverflowGenerated @@ -26933,29 +24744,30 @@ func (m *MatchDetails) Unmarshal(dAtA []byte) error { } b := dAtA[iNdEx] iNdEx++ - stringLen |= uint64(b&0x7F) << shift + msglen |= int(b&0x7F) << shift if b < 0x80 { break } } - intStringLen := int(stringLen) - if intStringLen < 0 { + if msglen < 0 { return ErrInvalidLengthGenerated } - postIndex := iNdEx + intStringLen + postIndex := iNdEx + msglen if postIndex < 0 { return ErrInvalidLengthGenerated } if postIndex > l { return io.ErrUnexpectedEOF } - m.Type = string(dAtA[iNdEx:postIndex]) + if err := m.Vulnerability.Unmarshal(dAtA[iNdEx:postIndex]); err != nil { + return err + } iNdEx = postIndex case 2: if wireType != 2 { - return fmt.Errorf("proto: wrong wireType = %d for field Matcher", wireType) + return fmt.Errorf("proto: wrong wireType = %d for field RelatedVulnerabilities", wireType) } - var stringLen uint64 + var msglen int for shift := uint(0); ; shift += 7 { if shift >= 64 { return ErrIntOverflowGenerated @@ -26965,29 +24777,31 @@ func (m *MatchDetails) Unmarshal(dAtA []byte) error { } b := dAtA[iNdEx] iNdEx++ - stringLen |= uint64(b&0x7F) << shift + msglen |= int(b&0x7F) << shift if b < 0x80 { break } } - intStringLen := int(stringLen) - if intStringLen < 0 { + if msglen < 0 { return ErrInvalidLengthGenerated } - postIndex := iNdEx + intStringLen + postIndex := iNdEx + msglen if postIndex < 0 { return ErrInvalidLengthGenerated } if postIndex > l { return io.ErrUnexpectedEOF } - m.Matcher = string(dAtA[iNdEx:postIndex]) + m.RelatedVulnerabilities = append(m.RelatedVulnerabilities, VulnerabilityMetadata{}) + if err := m.RelatedVulnerabilities[len(m.RelatedVulnerabilities)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil { + return err + } iNdEx = postIndex case 3: if wireType != 2 { - return fmt.Errorf("proto: wrong wireType = %d for field SearchedBy", wireType) + return fmt.Errorf("proto: wrong wireType = %d for field MatchDetails", wireType) } - var byteLen int + var msglen int for shift := uint(0); ; shift += 7 { if shift >= 64 { return ErrIntOverflowGenerated @@ -26997,31 +24811,31 @@ func (m *MatchDetails) Unmarshal(dAtA []byte) error { } b := dAtA[iNdEx] iNdEx++ - byteLen |= int(b&0x7F) << shift + msglen |= int(b&0x7F) << shift if b < 0x80 { break } } - if byteLen < 0 { + if msglen < 0 { return ErrInvalidLengthGenerated } - postIndex := iNdEx + byteLen + postIndex := iNdEx + msglen if postIndex < 0 { return ErrInvalidLengthGenerated } if postIndex > l { return io.ErrUnexpectedEOF } - m.SearchedBy = append(m.SearchedBy[:0], dAtA[iNdEx:postIndex]...) - if m.SearchedBy == nil { - m.SearchedBy = []byte{} + m.MatchDetails = append(m.MatchDetails, MatchDetails{}) + if err := m.MatchDetails[len(m.MatchDetails)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil { + return err } iNdEx = postIndex case 4: if wireType != 2 { - return fmt.Errorf("proto: wrong wireType = %d for field Found", wireType) + return fmt.Errorf("proto: wrong wireType = %d for field Artifact", wireType) } - var byteLen int + var msglen int for shift := uint(0); ; shift += 7 { if shift >= 64 { return ErrIntOverflowGenerated @@ -27031,24 +24845,23 @@ func (m *MatchDetails) Unmarshal(dAtA []byte) error { } b := dAtA[iNdEx] iNdEx++ - byteLen |= int(b&0x7F) << shift + msglen |= int(b&0x7F) << shift if b < 0x80 { break } } - if byteLen < 0 { + if msglen < 0 { return ErrInvalidLengthGenerated } - postIndex := iNdEx + byteLen + postIndex := iNdEx + msglen if postIndex < 0 { return ErrInvalidLengthGenerated } if postIndex > l { return io.ErrUnexpectedEOF } - m.Found = append(m.Found[:0], dAtA[iNdEx:postIndex]...) - if m.Found == nil { - m.Found = []byte{} + if err := m.Artifact.Unmarshal(dAtA[iNdEx:postIndex]); err != nil { + return err } iNdEx = postIndex default: @@ -27072,7 +24885,7 @@ func (m *MatchDetails) Unmarshal(dAtA []byte) error { } return nil } -func (m *Metadata) Unmarshal(dAtA []byte) error { +func (m *MatchDetails) Unmarshal(dAtA []byte) error { l := len(dAtA) iNdEx := 0 for iNdEx < l { @@ -27090,148 +24903,20 @@ func (m *Metadata) Unmarshal(dAtA []byte) error { wire |= uint64(b&0x7F) << shift if b < 0x80 { break - } - } - fieldNum := int32(wire >> 3) - wireType := int(wire & 0x7) - if wireType == 4 { - return fmt.Errorf("proto: Metadata: wiretype end group for non-group") - } - if fieldNum <= 0 { - return fmt.Errorf("proto: Metadata: illegal tag %d (wire type %d)", fieldNum, wire) - } - switch fieldNum { - case 1: - if wireType != 2 { - return fmt.Errorf("proto: wrong wireType = %d for field Context", wireType) - } - var stringLen uint64 - for shift := uint(0); ; shift += 7 { - if shift >= 64 { - return ErrIntOverflowGenerated - } - if iNdEx >= l { - return io.ErrUnexpectedEOF - } - b := dAtA[iNdEx] - iNdEx++ - stringLen |= uint64(b&0x7F) << shift - if b < 0x80 { - break - } - } - intStringLen := int(stringLen) - if intStringLen < 0 { - return ErrInvalidLengthGenerated - } - postIndex := iNdEx + intStringLen - if postIndex < 0 { - return ErrInvalidLengthGenerated - } - if postIndex > l { - return io.ErrUnexpectedEOF - } - m.Context = string(dAtA[iNdEx:postIndex]) - iNdEx = postIndex - case 2: - if wireType != 2 { - return fmt.Errorf("proto: wrong wireType = %d for field ID", wireType) - } - var stringLen uint64 - for shift := uint(0); ; shift += 7 { - if shift >= 64 { - return ErrIntOverflowGenerated - } - if iNdEx >= l { - return io.ErrUnexpectedEOF - } - b := dAtA[iNdEx] - iNdEx++ - stringLen |= uint64(b&0x7F) << shift - if b < 0x80 { - break - } - } - intStringLen := int(stringLen) - if intStringLen < 0 { - return ErrInvalidLengthGenerated - } - postIndex := iNdEx + intStringLen - if postIndex < 0 { - return ErrInvalidLengthGenerated - } - if postIndex > l { - return io.ErrUnexpectedEOF - } - m.ID = string(dAtA[iNdEx:postIndex]) - iNdEx = postIndex - case 3: - if wireType != 2 { - return fmt.Errorf("proto: wrong wireType = %d for field Author", wireType) - } - var stringLen uint64 - for shift := uint(0); ; shift += 7 { - if shift >= 64 { - return ErrIntOverflowGenerated - } - if iNdEx >= l { - return io.ErrUnexpectedEOF - } - b := dAtA[iNdEx] - iNdEx++ - stringLen |= uint64(b&0x7F) << shift - if b < 0x80 { - break - } - } - intStringLen := int(stringLen) - if intStringLen < 0 { - return ErrInvalidLengthGenerated - } - postIndex := iNdEx + intStringLen - if postIndex < 0 { - return ErrInvalidLengthGenerated - } - if postIndex > l { - return io.ErrUnexpectedEOF - } - m.Author = string(dAtA[iNdEx:postIndex]) - iNdEx = postIndex - case 4: - if wireType != 2 { - return fmt.Errorf("proto: wrong wireType = %d for field AuthorRole", wireType) - } - var stringLen uint64 - for shift := uint(0); ; shift += 7 { - if shift >= 64 { - return ErrIntOverflowGenerated - } - if iNdEx >= l { - return io.ErrUnexpectedEOF - } - b := dAtA[iNdEx] - iNdEx++ - stringLen |= uint64(b&0x7F) << shift - if b < 0x80 { - break - } - } - intStringLen := int(stringLen) - if intStringLen < 0 { - return ErrInvalidLengthGenerated - } - postIndex := iNdEx + intStringLen - if postIndex < 0 { - return ErrInvalidLengthGenerated - } - if postIndex > l { - return io.ErrUnexpectedEOF - } - m.AuthorRole = string(dAtA[iNdEx:postIndex]) - iNdEx = postIndex - case 5: + } + } + fieldNum := int32(wire >> 3) + wireType := int(wire & 0x7) + if wireType == 4 { + return fmt.Errorf("proto: MatchDetails: wiretype end group for non-group") + } + if fieldNum <= 0 { + return fmt.Errorf("proto: MatchDetails: illegal tag %d (wire type %d)", fieldNum, wire) + } + switch fieldNum { + case 1: if wireType != 2 { - return fmt.Errorf("proto: wrong wireType = %d for field Timestamp", wireType) + return fmt.Errorf("proto: wrong wireType = %d for field Type", wireType) } var stringLen uint64 for shift := uint(0); ; shift += 7 { @@ -27259,11 +24944,11 @@ func (m *Metadata) Unmarshal(dAtA []byte) error { if postIndex > l { return io.ErrUnexpectedEOF } - m.Timestamp = string(dAtA[iNdEx:postIndex]) + m.Type = string(dAtA[iNdEx:postIndex]) iNdEx = postIndex - case 6: + case 2: if wireType != 2 { - return fmt.Errorf("proto: wrong wireType = %d for field LastUpdated", wireType) + return fmt.Errorf("proto: wrong wireType = %d for field Matcher", wireType) } var stringLen uint64 for shift := uint(0); ; shift += 7 { @@ -27291,32 +24976,13 @@ func (m *Metadata) Unmarshal(dAtA []byte) error { if postIndex > l { return io.ErrUnexpectedEOF } - m.LastUpdated = string(dAtA[iNdEx:postIndex]) + m.Matcher = string(dAtA[iNdEx:postIndex]) iNdEx = postIndex - case 7: - if wireType != 0 { - return fmt.Errorf("proto: wrong wireType = %d for field Version", wireType) - } - m.Version = 0 - for shift := uint(0); ; shift += 7 { - if shift >= 64 { - return ErrIntOverflowGenerated - } - if iNdEx >= l { - return io.ErrUnexpectedEOF - } - b := dAtA[iNdEx] - iNdEx++ - m.Version |= int64(b&0x7F) << shift - if b < 0x80 { - break - } - } - case 8: + case 3: if wireType != 2 { - return fmt.Errorf("proto: wrong wireType = %d for field Tooling", wireType) + return fmt.Errorf("proto: wrong wireType = %d for field SearchedBy", wireType) } - var stringLen uint64 + var byteLen int for shift := uint(0); ; shift += 7 { if shift >= 64 { return ErrIntOverflowGenerated @@ -27326,29 +24992,31 @@ func (m *Metadata) Unmarshal(dAtA []byte) error { } b := dAtA[iNdEx] iNdEx++ - stringLen |= uint64(b&0x7F) << shift + byteLen |= int(b&0x7F) << shift if b < 0x80 { break } } - intStringLen := int(stringLen) - if intStringLen < 0 { + if byteLen < 0 { return ErrInvalidLengthGenerated } - postIndex := iNdEx + intStringLen + postIndex := iNdEx + byteLen if postIndex < 0 { return ErrInvalidLengthGenerated } if postIndex > l { return io.ErrUnexpectedEOF } - m.Tooling = string(dAtA[iNdEx:postIndex]) + m.SearchedBy = append(m.SearchedBy[:0], dAtA[iNdEx:postIndex]...) + if m.SearchedBy == nil { + m.SearchedBy = []byte{} + } iNdEx = postIndex - case 9: + case 4: if wireType != 2 { - return fmt.Errorf("proto: wrong wireType = %d for field Supplier", wireType) + return fmt.Errorf("proto: wrong wireType = %d for field Found", wireType) } - var stringLen uint64 + var byteLen int for shift := uint(0); ; shift += 7 { if shift >= 64 { return ErrIntOverflowGenerated @@ -27358,23 +25026,25 @@ func (m *Metadata) Unmarshal(dAtA []byte) error { } b := dAtA[iNdEx] iNdEx++ - stringLen |= uint64(b&0x7F) << shift + byteLen |= int(b&0x7F) << shift if b < 0x80 { break } } - intStringLen := int(stringLen) - if intStringLen < 0 { + if byteLen < 0 { return ErrInvalidLengthGenerated } - postIndex := iNdEx + intStringLen + postIndex := iNdEx + byteLen if postIndex < 0 { return ErrInvalidLengthGenerated } if postIndex > l { return io.ErrUnexpectedEOF } - m.Supplier = string(dAtA[iNdEx:postIndex]) + m.Found = append(m.Found[:0], dAtA[iNdEx:postIndex]...) + if m.Found == nil { + m.Found = []byte{} + } iNdEx = postIndex default: iNdEx = preIndex @@ -27397,7 +25067,7 @@ func (m *Metadata) Unmarshal(dAtA []byte) error { } return nil } -func (m *NetworkNeighbor) Unmarshal(dAtA []byte) error { +func (m *Metadata) Unmarshal(dAtA []byte) error { l := len(dAtA) iNdEx := 0 for iNdEx < l { @@ -27420,15 +25090,15 @@ func (m *NetworkNeighbor) Unmarshal(dAtA []byte) error { fieldNum := int32(wire >> 3) wireType := int(wire & 0x7) if wireType == 4 { - return fmt.Errorf("proto: NetworkNeighbor: wiretype end group for non-group") + return fmt.Errorf("proto: Metadata: wiretype end group for non-group") } if fieldNum <= 0 { - return fmt.Errorf("proto: NetworkNeighbor: illegal tag %d (wire type %d)", fieldNum, wire) + return fmt.Errorf("proto: Metadata: illegal tag %d (wire type %d)", fieldNum, wire) } switch fieldNum { case 1: if wireType != 2 { - return fmt.Errorf("proto: wrong wireType = %d for field Identifier", wireType) + return fmt.Errorf("proto: wrong wireType = %d for field Context", wireType) } var stringLen uint64 for shift := uint(0); ; shift += 7 { @@ -27456,11 +25126,11 @@ func (m *NetworkNeighbor) Unmarshal(dAtA []byte) error { if postIndex > l { return io.ErrUnexpectedEOF } - m.Identifier = string(dAtA[iNdEx:postIndex]) + m.Context = string(dAtA[iNdEx:postIndex]) iNdEx = postIndex case 2: if wireType != 2 { - return fmt.Errorf("proto: wrong wireType = %d for field Type", wireType) + return fmt.Errorf("proto: wrong wireType = %d for field ID", wireType) } var stringLen uint64 for shift := uint(0); ; shift += 7 { @@ -27488,11 +25158,11 @@ func (m *NetworkNeighbor) Unmarshal(dAtA []byte) error { if postIndex > l { return io.ErrUnexpectedEOF } - m.Type = CommunicationType(dAtA[iNdEx:postIndex]) + m.ID = string(dAtA[iNdEx:postIndex]) iNdEx = postIndex case 3: if wireType != 2 { - return fmt.Errorf("proto: wrong wireType = %d for field DNS", wireType) + return fmt.Errorf("proto: wrong wireType = %d for field Author", wireType) } var stringLen uint64 for shift := uint(0); ; shift += 7 { @@ -27520,11 +25190,11 @@ func (m *NetworkNeighbor) Unmarshal(dAtA []byte) error { if postIndex > l { return io.ErrUnexpectedEOF } - m.DNS = string(dAtA[iNdEx:postIndex]) + m.Author = string(dAtA[iNdEx:postIndex]) iNdEx = postIndex case 4: if wireType != 2 { - return fmt.Errorf("proto: wrong wireType = %d for field DNSNames", wireType) + return fmt.Errorf("proto: wrong wireType = %d for field AuthorRole", wireType) } var stringLen uint64 for shift := uint(0); ; shift += 7 { @@ -27552,13 +25222,13 @@ func (m *NetworkNeighbor) Unmarshal(dAtA []byte) error { if postIndex > l { return io.ErrUnexpectedEOF } - m.DNSNames = append(m.DNSNames, string(dAtA[iNdEx:postIndex])) + m.AuthorRole = string(dAtA[iNdEx:postIndex]) iNdEx = postIndex case 5: if wireType != 2 { - return fmt.Errorf("proto: wrong wireType = %d for field Ports", wireType) + return fmt.Errorf("proto: wrong wireType = %d for field Timestamp", wireType) } - var msglen int + var stringLen uint64 for shift := uint(0); ; shift += 7 { if shift >= 64 { return ErrIntOverflowGenerated @@ -27568,101 +25238,27 @@ func (m *NetworkNeighbor) Unmarshal(dAtA []byte) error { } b := dAtA[iNdEx] iNdEx++ - msglen |= int(b&0x7F) << shift + stringLen |= uint64(b&0x7F) << shift if b < 0x80 { break } } - if msglen < 0 { + intStringLen := int(stringLen) + if intStringLen < 0 { return ErrInvalidLengthGenerated } - postIndex := iNdEx + msglen + postIndex := iNdEx + intStringLen if postIndex < 0 { return ErrInvalidLengthGenerated } if postIndex > l { return io.ErrUnexpectedEOF } - m.Ports = append(m.Ports, NetworkPort{}) - if err := m.Ports[len(m.Ports)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil { - return err - } + m.Timestamp = string(dAtA[iNdEx:postIndex]) iNdEx = postIndex case 6: if wireType != 2 { - return fmt.Errorf("proto: wrong wireType = %d for field PodSelector", wireType) - } - var msglen int - for shift := uint(0); ; shift += 7 { - if shift >= 64 { - return ErrIntOverflowGenerated - } - if iNdEx >= l { - return io.ErrUnexpectedEOF - } - b := dAtA[iNdEx] - iNdEx++ - msglen |= int(b&0x7F) << shift - if b < 0x80 { - break - } - } - if msglen < 0 { - return ErrInvalidLengthGenerated - } - postIndex := iNdEx + msglen - if postIndex < 0 { - return ErrInvalidLengthGenerated - } - if postIndex > l { - return io.ErrUnexpectedEOF - } - if m.PodSelector == nil { - m.PodSelector = &v1.LabelSelector{} - } - if err := m.PodSelector.Unmarshal(dAtA[iNdEx:postIndex]); err != nil { - return err - } - iNdEx = postIndex - case 7: - if wireType != 2 { - return fmt.Errorf("proto: wrong wireType = %d for field NamespaceSelector", wireType) - } - var msglen int - for shift := uint(0); ; shift += 7 { - if shift >= 64 { - return ErrIntOverflowGenerated - } - if iNdEx >= l { - return io.ErrUnexpectedEOF - } - b := dAtA[iNdEx] - iNdEx++ - msglen |= int(b&0x7F) << shift - if b < 0x80 { - break - } - } - if msglen < 0 { - return ErrInvalidLengthGenerated - } - postIndex := iNdEx + msglen - if postIndex < 0 { - return ErrInvalidLengthGenerated - } - if postIndex > l { - return io.ErrUnexpectedEOF - } - if m.NamespaceSelector == nil { - m.NamespaceSelector = &v1.LabelSelector{} - } - if err := m.NamespaceSelector.Unmarshal(dAtA[iNdEx:postIndex]); err != nil { - return err - } - iNdEx = postIndex - case 8: - if wireType != 2 { - return fmt.Errorf("proto: wrong wireType = %d for field IPAddress", wireType) + return fmt.Errorf("proto: wrong wireType = %d for field LastUpdated", wireType) } var stringLen uint64 for shift := uint(0); ; shift += 7 { @@ -27690,13 +25286,13 @@ func (m *NetworkNeighbor) Unmarshal(dAtA []byte) error { if postIndex > l { return io.ErrUnexpectedEOF } - m.IPAddress = string(dAtA[iNdEx:postIndex]) + m.LastUpdated = string(dAtA[iNdEx:postIndex]) iNdEx = postIndex - case 9: - if wireType != 2 { - return fmt.Errorf("proto: wrong wireType = %d for field IPAddresses", wireType) + case 7: + if wireType != 0 { + return fmt.Errorf("proto: wrong wireType = %d for field Version", wireType) } - var stringLen uint64 + m.Version = 0 for shift := uint(0); ; shift += 7 { if shift >= 64 { return ErrIntOverflowGenerated @@ -27705,80 +25301,17 @@ func (m *NetworkNeighbor) Unmarshal(dAtA []byte) error { return io.ErrUnexpectedEOF } b := dAtA[iNdEx] - iNdEx++ - stringLen |= uint64(b&0x7F) << shift - if b < 0x80 { - break - } - } - intStringLen := int(stringLen) - if intStringLen < 0 { - return ErrInvalidLengthGenerated - } - postIndex := iNdEx + intStringLen - if postIndex < 0 { - return ErrInvalidLengthGenerated - } - if postIndex > l { - return io.ErrUnexpectedEOF - } - m.IPAddresses = append(m.IPAddresses, string(dAtA[iNdEx:postIndex])) - iNdEx = postIndex - default: - iNdEx = preIndex - skippy, err := skipGenerated(dAtA[iNdEx:]) - if err != nil { - return err - } - if (skippy < 0) || (iNdEx+skippy) < 0 { - return ErrInvalidLengthGenerated - } - if (iNdEx + skippy) > l { - return io.ErrUnexpectedEOF - } - iNdEx += skippy - } - } - - if iNdEx > l { - return io.ErrUnexpectedEOF - } - return nil -} -func (m *NetworkNeighborhood) Unmarshal(dAtA []byte) error { - l := len(dAtA) - iNdEx := 0 - for iNdEx < l { - preIndex := iNdEx - var wire uint64 - for shift := uint(0); ; shift += 7 { - if shift >= 64 { - return ErrIntOverflowGenerated - } - if iNdEx >= l { - return io.ErrUnexpectedEOF - } - b := dAtA[iNdEx] - iNdEx++ - wire |= uint64(b&0x7F) << shift - if b < 0x80 { - break + iNdEx++ + m.Version |= int64(b&0x7F) << shift + if b < 0x80 { + break + } } - } - fieldNum := int32(wire >> 3) - wireType := int(wire & 0x7) - if wireType == 4 { - return fmt.Errorf("proto: NetworkNeighborhood: wiretype end group for non-group") - } - if fieldNum <= 0 { - return fmt.Errorf("proto: NetworkNeighborhood: illegal tag %d (wire type %d)", fieldNum, wire) - } - switch fieldNum { - case 1: + case 8: if wireType != 2 { - return fmt.Errorf("proto: wrong wireType = %d for field ObjectMeta", wireType) + return fmt.Errorf("proto: wrong wireType = %d for field Tooling", wireType) } - var msglen int + var stringLen uint64 for shift := uint(0); ; shift += 7 { if shift >= 64 { return ErrIntOverflowGenerated @@ -27788,30 +25321,29 @@ func (m *NetworkNeighborhood) Unmarshal(dAtA []byte) error { } b := dAtA[iNdEx] iNdEx++ - msglen |= int(b&0x7F) << shift + stringLen |= uint64(b&0x7F) << shift if b < 0x80 { break } } - if msglen < 0 { + intStringLen := int(stringLen) + if intStringLen < 0 { return ErrInvalidLengthGenerated } - postIndex := iNdEx + msglen + postIndex := iNdEx + intStringLen if postIndex < 0 { return ErrInvalidLengthGenerated } if postIndex > l { return io.ErrUnexpectedEOF } - if err := m.ObjectMeta.Unmarshal(dAtA[iNdEx:postIndex]); err != nil { - return err - } + m.Tooling = string(dAtA[iNdEx:postIndex]) iNdEx = postIndex - case 2: + case 9: if wireType != 2 { - return fmt.Errorf("proto: wrong wireType = %d for field Spec", wireType) + return fmt.Errorf("proto: wrong wireType = %d for field Supplier", wireType) } - var msglen int + var stringLen uint64 for shift := uint(0); ; shift += 7 { if shift >= 64 { return ErrIntOverflowGenerated @@ -27821,24 +25353,23 @@ func (m *NetworkNeighborhood) Unmarshal(dAtA []byte) error { } b := dAtA[iNdEx] iNdEx++ - msglen |= int(b&0x7F) << shift + stringLen |= uint64(b&0x7F) << shift if b < 0x80 { break } } - if msglen < 0 { + intStringLen := int(stringLen) + if intStringLen < 0 { return ErrInvalidLengthGenerated } - postIndex := iNdEx + msglen + postIndex := iNdEx + intStringLen if postIndex < 0 { return ErrInvalidLengthGenerated } if postIndex > l { return io.ErrUnexpectedEOF } - if err := m.Spec.Unmarshal(dAtA[iNdEx:postIndex]); err != nil { - return err - } + m.Supplier = string(dAtA[iNdEx:postIndex]) iNdEx = postIndex default: iNdEx = preIndex @@ -27861,7 +25392,7 @@ func (m *NetworkNeighborhood) Unmarshal(dAtA []byte) error { } return nil } -func (m *NetworkNeighborhoodContainer) Unmarshal(dAtA []byte) error { +func (m *NetworkNeighbor) Unmarshal(dAtA []byte) error { l := len(dAtA) iNdEx := 0 for iNdEx < l { @@ -27884,15 +25415,15 @@ func (m *NetworkNeighborhoodContainer) Unmarshal(dAtA []byte) error { fieldNum := int32(wire >> 3) wireType := int(wire & 0x7) if wireType == 4 { - return fmt.Errorf("proto: NetworkNeighborhoodContainer: wiretype end group for non-group") + return fmt.Errorf("proto: NetworkNeighbor: wiretype end group for non-group") } if fieldNum <= 0 { - return fmt.Errorf("proto: NetworkNeighborhoodContainer: illegal tag %d (wire type %d)", fieldNum, wire) + return fmt.Errorf("proto: NetworkNeighbor: illegal tag %d (wire type %d)", fieldNum, wire) } switch fieldNum { case 1: if wireType != 2 { - return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType) + return fmt.Errorf("proto: wrong wireType = %d for field Identifier", wireType) } var stringLen uint64 for shift := uint(0); ; shift += 7 { @@ -27920,13 +25451,13 @@ func (m *NetworkNeighborhoodContainer) Unmarshal(dAtA []byte) error { if postIndex > l { return io.ErrUnexpectedEOF } - m.Name = string(dAtA[iNdEx:postIndex]) + m.Identifier = string(dAtA[iNdEx:postIndex]) iNdEx = postIndex case 2: if wireType != 2 { - return fmt.Errorf("proto: wrong wireType = %d for field Ingress", wireType) + return fmt.Errorf("proto: wrong wireType = %d for field Type", wireType) } - var msglen int + var stringLen uint64 for shift := uint(0); ; shift += 7 { if shift >= 64 { return ErrIntOverflowGenerated @@ -27936,31 +25467,29 @@ func (m *NetworkNeighborhoodContainer) Unmarshal(dAtA []byte) error { } b := dAtA[iNdEx] iNdEx++ - msglen |= int(b&0x7F) << shift + stringLen |= uint64(b&0x7F) << shift if b < 0x80 { break } } - if msglen < 0 { + intStringLen := int(stringLen) + if intStringLen < 0 { return ErrInvalidLengthGenerated } - postIndex := iNdEx + msglen + postIndex := iNdEx + intStringLen if postIndex < 0 { return ErrInvalidLengthGenerated } if postIndex > l { return io.ErrUnexpectedEOF } - m.Ingress = append(m.Ingress, NetworkNeighbor{}) - if err := m.Ingress[len(m.Ingress)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil { - return err - } + m.Type = CommunicationType(dAtA[iNdEx:postIndex]) iNdEx = postIndex case 3: if wireType != 2 { - return fmt.Errorf("proto: wrong wireType = %d for field Egress", wireType) + return fmt.Errorf("proto: wrong wireType = %d for field DNS", wireType) } - var msglen int + var stringLen uint64 for shift := uint(0); ; shift += 7 { if shift >= 64 { return ErrIntOverflowGenerated @@ -27970,81 +25499,29 @@ func (m *NetworkNeighborhoodContainer) Unmarshal(dAtA []byte) error { } b := dAtA[iNdEx] iNdEx++ - msglen |= int(b&0x7F) << shift + stringLen |= uint64(b&0x7F) << shift if b < 0x80 { break } } - if msglen < 0 { + intStringLen := int(stringLen) + if intStringLen < 0 { return ErrInvalidLengthGenerated } - postIndex := iNdEx + msglen + postIndex := iNdEx + intStringLen if postIndex < 0 { return ErrInvalidLengthGenerated } if postIndex > l { return io.ErrUnexpectedEOF } - m.Egress = append(m.Egress, NetworkNeighbor{}) - if err := m.Egress[len(m.Egress)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil { - return err - } + m.DNS = string(dAtA[iNdEx:postIndex]) iNdEx = postIndex - default: - iNdEx = preIndex - skippy, err := skipGenerated(dAtA[iNdEx:]) - if err != nil { - return err - } - if (skippy < 0) || (iNdEx+skippy) < 0 { - return ErrInvalidLengthGenerated - } - if (iNdEx + skippy) > l { - return io.ErrUnexpectedEOF - } - iNdEx += skippy - } - } - - if iNdEx > l { - return io.ErrUnexpectedEOF - } - return nil -} -func (m *NetworkNeighborhoodList) Unmarshal(dAtA []byte) error { - l := len(dAtA) - iNdEx := 0 - for iNdEx < l { - preIndex := iNdEx - var wire uint64 - for shift := uint(0); ; shift += 7 { - if shift >= 64 { - return ErrIntOverflowGenerated - } - if iNdEx >= l { - return io.ErrUnexpectedEOF - } - b := dAtA[iNdEx] - iNdEx++ - wire |= uint64(b&0x7F) << shift - if b < 0x80 { - break - } - } - fieldNum := int32(wire >> 3) - wireType := int(wire & 0x7) - if wireType == 4 { - return fmt.Errorf("proto: NetworkNeighborhoodList: wiretype end group for non-group") - } - if fieldNum <= 0 { - return fmt.Errorf("proto: NetworkNeighborhoodList: illegal tag %d (wire type %d)", fieldNum, wire) - } - switch fieldNum { - case 1: + case 4: if wireType != 2 { - return fmt.Errorf("proto: wrong wireType = %d for field ListMeta", wireType) + return fmt.Errorf("proto: wrong wireType = %d for field DNSNames", wireType) } - var msglen int + var stringLen uint64 for shift := uint(0); ; shift += 7 { if shift >= 64 { return ErrIntOverflowGenerated @@ -28054,28 +25531,27 @@ func (m *NetworkNeighborhoodList) Unmarshal(dAtA []byte) error { } b := dAtA[iNdEx] iNdEx++ - msglen |= int(b&0x7F) << shift + stringLen |= uint64(b&0x7F) << shift if b < 0x80 { break } } - if msglen < 0 { + intStringLen := int(stringLen) + if intStringLen < 0 { return ErrInvalidLengthGenerated } - postIndex := iNdEx + msglen + postIndex := iNdEx + intStringLen if postIndex < 0 { return ErrInvalidLengthGenerated } if postIndex > l { return io.ErrUnexpectedEOF } - if err := m.ListMeta.Unmarshal(dAtA[iNdEx:postIndex]); err != nil { - return err - } + m.DNSNames = append(m.DNSNames, string(dAtA[iNdEx:postIndex])) iNdEx = postIndex - case 2: + case 5: if wireType != 2 { - return fmt.Errorf("proto: wrong wireType = %d for field Items", wireType) + return fmt.Errorf("proto: wrong wireType = %d for field Ports", wireType) } var msglen int for shift := uint(0); ; shift += 7 { @@ -28102,64 +25578,14 @@ func (m *NetworkNeighborhoodList) Unmarshal(dAtA []byte) error { if postIndex > l { return io.ErrUnexpectedEOF } - m.Items = append(m.Items, NetworkNeighborhood{}) - if err := m.Items[len(m.Items)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil { + m.Ports = append(m.Ports, NetworkPort{}) + if err := m.Ports[len(m.Ports)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil { return err } iNdEx = postIndex - default: - iNdEx = preIndex - skippy, err := skipGenerated(dAtA[iNdEx:]) - if err != nil { - return err - } - if (skippy < 0) || (iNdEx+skippy) < 0 { - return ErrInvalidLengthGenerated - } - if (iNdEx + skippy) > l { - return io.ErrUnexpectedEOF - } - iNdEx += skippy - } - } - - if iNdEx > l { - return io.ErrUnexpectedEOF - } - return nil -} -func (m *NetworkNeighborhoodSpec) Unmarshal(dAtA []byte) error { - l := len(dAtA) - iNdEx := 0 - for iNdEx < l { - preIndex := iNdEx - var wire uint64 - for shift := uint(0); ; shift += 7 { - if shift >= 64 { - return ErrIntOverflowGenerated - } - if iNdEx >= l { - return io.ErrUnexpectedEOF - } - b := dAtA[iNdEx] - iNdEx++ - wire |= uint64(b&0x7F) << shift - if b < 0x80 { - break - } - } - fieldNum := int32(wire >> 3) - wireType := int(wire & 0x7) - if wireType == 4 { - return fmt.Errorf("proto: NetworkNeighborhoodSpec: wiretype end group for non-group") - } - if fieldNum <= 0 { - return fmt.Errorf("proto: NetworkNeighborhoodSpec: illegal tag %d (wire type %d)", fieldNum, wire) - } - switch fieldNum { - case 3: + case 6: if wireType != 2 { - return fmt.Errorf("proto: wrong wireType = %d for field LabelSelector", wireType) + return fmt.Errorf("proto: wrong wireType = %d for field PodSelector", wireType) } var msglen int for shift := uint(0); ; shift += 7 { @@ -28186,13 +25612,16 @@ func (m *NetworkNeighborhoodSpec) Unmarshal(dAtA []byte) error { if postIndex > l { return io.ErrUnexpectedEOF } - if err := m.LabelSelector.Unmarshal(dAtA[iNdEx:postIndex]); err != nil { + if m.PodSelector == nil { + m.PodSelector = &v1.LabelSelector{} + } + if err := m.PodSelector.Unmarshal(dAtA[iNdEx:postIndex]); err != nil { return err } iNdEx = postIndex - case 4: + case 7: if wireType != 2 { - return fmt.Errorf("proto: wrong wireType = %d for field Containers", wireType) + return fmt.Errorf("proto: wrong wireType = %d for field NamespaceSelector", wireType) } var msglen int for shift := uint(0); ; shift += 7 { @@ -28219,16 +25648,18 @@ func (m *NetworkNeighborhoodSpec) Unmarshal(dAtA []byte) error { if postIndex > l { return io.ErrUnexpectedEOF } - m.Containers = append(m.Containers, NetworkNeighborhoodContainer{}) - if err := m.Containers[len(m.Containers)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil { + if m.NamespaceSelector == nil { + m.NamespaceSelector = &v1.LabelSelector{} + } + if err := m.NamespaceSelector.Unmarshal(dAtA[iNdEx:postIndex]); err != nil { return err } iNdEx = postIndex - case 5: + case 8: if wireType != 2 { - return fmt.Errorf("proto: wrong wireType = %d for field InitContainers", wireType) + return fmt.Errorf("proto: wrong wireType = %d for field IPAddress", wireType) } - var msglen int + var stringLen uint64 for shift := uint(0); ; shift += 7 { if shift >= 64 { return ErrIntOverflowGenerated @@ -28238,31 +25669,29 @@ func (m *NetworkNeighborhoodSpec) Unmarshal(dAtA []byte) error { } b := dAtA[iNdEx] iNdEx++ - msglen |= int(b&0x7F) << shift + stringLen |= uint64(b&0x7F) << shift if b < 0x80 { break } } - if msglen < 0 { + intStringLen := int(stringLen) + if intStringLen < 0 { return ErrInvalidLengthGenerated } - postIndex := iNdEx + msglen + postIndex := iNdEx + intStringLen if postIndex < 0 { return ErrInvalidLengthGenerated } if postIndex > l { return io.ErrUnexpectedEOF } - m.InitContainers = append(m.InitContainers, NetworkNeighborhoodContainer{}) - if err := m.InitContainers[len(m.InitContainers)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil { - return err - } + m.IPAddress = string(dAtA[iNdEx:postIndex]) iNdEx = postIndex - case 6: + case 9: if wireType != 2 { - return fmt.Errorf("proto: wrong wireType = %d for field EphemeralContainers", wireType) + return fmt.Errorf("proto: wrong wireType = %d for field IPAddresses", wireType) } - var msglen int + var stringLen uint64 for shift := uint(0); ; shift += 7 { if shift >= 64 { return ErrIntOverflowGenerated @@ -28272,25 +25701,23 @@ func (m *NetworkNeighborhoodSpec) Unmarshal(dAtA []byte) error { } b := dAtA[iNdEx] iNdEx++ - msglen |= int(b&0x7F) << shift + stringLen |= uint64(b&0x7F) << shift if b < 0x80 { break } } - if msglen < 0 { + intStringLen := int(stringLen) + if intStringLen < 0 { return ErrInvalidLengthGenerated } - postIndex := iNdEx + msglen + postIndex := iNdEx + intStringLen if postIndex < 0 { return ErrInvalidLengthGenerated } if postIndex > l { return io.ErrUnexpectedEOF } - m.EphemeralContainers = append(m.EphemeralContainers, NetworkNeighborhoodContainer{}) - if err := m.EphemeralContainers[len(m.EphemeralContainers)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil { - return err - } + m.IPAddresses = append(m.IPAddresses, string(dAtA[iNdEx:postIndex])) iNdEx = postIndex default: iNdEx = preIndex diff --git a/pkg/apis/softwarecomposition/v1beta1/generated.proto b/pkg/apis/softwarecomposition/v1beta1/generated.proto index 8aa1beecb..55c527b79 100644 --- a/pkg/apis/softwarecomposition/v1beta1/generated.proto +++ b/pkg/apis/softwarecomposition/v1beta1/generated.proto @@ -35,71 +35,6 @@ message Advisory { optional string link = 2; } -message ApplicationProfile { - optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1; - - optional ApplicationProfileSpec spec = 2; - - optional ApplicationProfileStatus status = 3; -} - -message ApplicationProfileContainer { - optional string name = 1; - - repeated string capabilities = 2; - - // +patchMergeKey=path - // +patchStrategy=merge - repeated ExecCalls execs = 3; - - // +patchMergeKey=path - // +patchStrategy=merge - repeated OpenCalls opens = 4; - - repeated string syscalls = 5; - - optional SingleSeccompProfile seccompProfile = 6; - - // +patchStrategy=merge - // +patchMergeKey=endpoint - repeated HTTPEndpoint endpoints = 7; - - optional string imageID = 8; - - optional string imageTag = 9; - - // +patchStrategy=merge - // +patchMergeKey=ruleId - map rulePolicies = 10; - - repeated IdentifiedCallStack identifiedCallStacks = 11; -} - -message ApplicationProfileList { - optional .k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1; - - repeated ApplicationProfile items = 2; -} - -message ApplicationProfileSpec { - repeated string architectures = 1; - - // +patchMergeKey=name - // +patchStrategy=merge - repeated ApplicationProfileContainer containers = 2; - - // +patchMergeKey=name - // +patchStrategy=merge - repeated ApplicationProfileContainer initContainers = 3; - - // +patchMergeKey=name - // +patchStrategy=merge - repeated ApplicationProfileContainer ephemeralContainers = 4; -} - -message ApplicationProfileStatus { -} - // Arg defines the specific syscall in seccomp. message Arg { // the index for syscall arguments in seccomp @@ -965,38 +900,6 @@ message NetworkNeighbor { repeated string ipAddresses = 9; } -// NetworkNeighborhood represents a list of network communications for a specific workload. -message NetworkNeighborhood { - optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1; - - optional NetworkNeighborhoodSpec spec = 2; -} - -message NetworkNeighborhoodContainer { - optional string name = 1; - - repeated NetworkNeighbor ingress = 2; - - repeated NetworkNeighbor egress = 3; -} - -// NetworkNeighborhoodList is a list of NetworkNeighborhoods. -message NetworkNeighborhoodList { - optional .k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1; - - repeated NetworkNeighborhood items = 2; -} - -message NetworkNeighborhoodSpec { - optional .k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelector labelSelector = 3; - - repeated NetworkNeighborhoodContainer containers = 4; - - repeated NetworkNeighborhoodContainer initContainers = 5; - - repeated NetworkNeighborhoodContainer ephemeralContainers = 6; -} - message NetworkPolicy { optional string kind = 1; diff --git a/pkg/apis/softwarecomposition/v1beta1/generated.protomessage.pb.go b/pkg/apis/softwarecomposition/v1beta1/generated.protomessage.pb.go deleted file mode 100644 index f3dfcbe82..000000000 --- a/pkg/apis/softwarecomposition/v1beta1/generated.protomessage.pb.go +++ /dev/null @@ -1,362 +0,0 @@ -//go:build kubernetes_protomessage_one_more_release -// +build kubernetes_protomessage_one_more_release - -/* -Copyright The Kubernetes Authors. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -*/ - -// Code generated by go-to-protobuf. DO NOT EDIT. - -package v1beta1 - -func (*Advisory) ProtoMessage() {} - -func (*ApplicationProfile) ProtoMessage() {} - -func (*ApplicationProfileContainer) ProtoMessage() {} - -func (*ApplicationProfileList) ProtoMessage() {} - -func (*ApplicationProfileSpec) ProtoMessage() {} - -func (*ApplicationProfileStatus) ProtoMessage() {} - -func (*Arg) ProtoMessage() {} - -func (*CPE) ProtoMessage() {} - -func (*CallStack) ProtoMessage() {} - -func (*CallStackNode) ProtoMessage() {} - -func (*CollapseConfigEntry) ProtoMessage() {} - -func (*CollapseConfiguration) ProtoMessage() {} - -func (*CollapseConfigurationList) ProtoMessage() {} - -func (*CollapseConfigurationSpec) ProtoMessage() {} - -func (*Component) ProtoMessage() {} - -func (*Condition) ProtoMessage() {} - -func (*ConditionedStatus) ProtoMessage() {} - -func (*ConfigurationScanSummary) ProtoMessage() {} - -func (*ConfigurationScanSummaryList) ProtoMessage() {} - -func (*ConfigurationScanSummarySpec) ProtoMessage() {} - -func (*ContainerProfile) ProtoMessage() {} - -func (*ContainerProfileList) ProtoMessage() {} - -func (*ContainerProfileSpec) ProtoMessage() {} - -func (*ContainerProfileStatus) ProtoMessage() {} - -func (*ControlSeverity) ProtoMessage() {} - -func (*Coordinates) ProtoMessage() {} - -func (*Cvss) ProtoMessage() {} - -func (*CvssMetrics) ProtoMessage() {} - -func (*Descriptor) ProtoMessage() {} - -func (*Digest) ProtoMessage() {} - -func (*Distribution) ProtoMessage() {} - -func (*ELFSecurityFeatures) ProtoMessage() {} - -func (*ExecCalls) ProtoMessage() {} - -func (*Executable) ProtoMessage() {} - -func (*FileLicense) ProtoMessage() {} - -func (*FileLicenseEvidence) ProtoMessage() {} - -func (*FileMetadataEntry) ProtoMessage() {} - -func (*Fix) ProtoMessage() {} - -func (*GeneratedNetworkPolicy) ProtoMessage() {} - -func (*GeneratedNetworkPolicyList) ProtoMessage() {} - -func (*GrypeDocument) ProtoMessage() {} - -func (*GrypePackage) ProtoMessage() {} - -func (*HTTPEndpoint) ProtoMessage() {} - -func (*HTTPIngressPath) ProtoMessage() {} - -func (*HTTPIngressRuleValue) ProtoMessage() {} - -func (*IPBlock) ProtoMessage() {} - -func (*IdentifiedCallStack) ProtoMessage() {} - -func (*IgnoreRule) ProtoMessage() {} - -func (*IgnoreRulePackage) ProtoMessage() {} - -func (*IgnoredMatch) ProtoMessage() {} - -func (*Ingress) ProtoMessage() {} - -func (*IngressBackend) ProtoMessage() {} - -func (*IngressClass) ProtoMessage() {} - -func (*IngressClassList) ProtoMessage() {} - -func (*IngressClassParametersReference) ProtoMessage() {} - -func (*IngressClassSpec) ProtoMessage() {} - -func (*IngressList) ProtoMessage() {} - -func (*IngressLoadBalancerIngress) ProtoMessage() {} - -func (*IngressLoadBalancerStatus) ProtoMessage() {} - -func (*IngressPortStatus) ProtoMessage() {} - -func (*IngressRule) ProtoMessage() {} - -func (*IngressRuleValue) ProtoMessage() {} - -func (*IngressServiceBackend) ProtoMessage() {} - -func (*IngressSpec) ProtoMessage() {} - -func (*IngressStatus) ProtoMessage() {} - -func (*IngressTLS) ProtoMessage() {} - -func (*KnownServer) ProtoMessage() {} - -func (*KnownServerEntry) ProtoMessage() {} - -func (*KnownServerList) ProtoMessage() {} - -func (*License) ProtoMessage() {} - -func (*LinuxRelease) ProtoMessage() {} - -func (*Location) ProtoMessage() {} - -func (*LocationData) ProtoMessage() {} - -func (*LocationMetadata) ProtoMessage() {} - -func (*Match) ProtoMessage() {} - -func (*MatchDetails) ProtoMessage() {} - -func (*Metadata) ProtoMessage() {} - -func (*NetworkNeighbor) ProtoMessage() {} - -func (*NetworkNeighborhood) ProtoMessage() {} - -func (*NetworkNeighborhoodContainer) ProtoMessage() {} - -func (*NetworkNeighborhoodList) ProtoMessage() {} - -func (*NetworkNeighborhoodSpec) ProtoMessage() {} - -func (*NetworkPolicy) ProtoMessage() {} - -func (*NetworkPolicyEgressRule) ProtoMessage() {} - -func (*NetworkPolicyIngressRule) ProtoMessage() {} - -func (*NetworkPolicyList) ProtoMessage() {} - -func (*NetworkPolicyPeer) ProtoMessage() {} - -func (*NetworkPolicyPort) ProtoMessage() {} - -func (*NetworkPolicySpec) ProtoMessage() {} - -func (*NetworkPolicyStatus) ProtoMessage() {} - -func (*NetworkPort) ProtoMessage() {} - -func (*OpenCalls) ProtoMessage() {} - -func (*OpenVulnerabilityExchangeContainer) ProtoMessage() {} - -func (*OpenVulnerabilityExchangeContainerList) ProtoMessage() {} - -func (*PackageBasicData) ProtoMessage() {} - -func (*PackageBasicDataV01011) ProtoMessage() {} - -func (*PackageCustomData) ProtoMessage() {} - -func (*PolicyRef) ProtoMessage() {} - -func (*Product) ProtoMessage() {} - -func (*ReportMeta) ProtoMessage() {} - -func (*RulePath) ProtoMessage() {} - -func (*RulePolicy) ProtoMessage() {} - -func (*RuleStatus) ProtoMessage() {} - -func (*SBOMSyft) ProtoMessage() {} - -func (*SBOMSyftFiltered) ProtoMessage() {} - -func (*SBOMSyftFilteredList) ProtoMessage() {} - -func (*SBOMSyftList) ProtoMessage() {} - -func (*SBOMSyftSpec) ProtoMessage() {} - -func (*SBOMSyftStatus) ProtoMessage() {} - -func (*SPDXMeta) ProtoMessage() {} - -func (*ScannedControl) ProtoMessage() {} - -func (*ScannedControlRule) ProtoMessage() {} - -func (*ScannedControlStatus) ProtoMessage() {} - -func (*ScannedControlSummary) ProtoMessage() {} - -func (*Schema) ProtoMessage() {} - -func (*SeccompProfile) ProtoMessage() {} - -func (*SeccompProfileList) ProtoMessage() {} - -func (*SeccompProfileSpec) ProtoMessage() {} - -func (*SeccompProfileStatus) ProtoMessage() {} - -func (*ServiceBackendPort) ProtoMessage() {} - -func (*SeveritySummary) ProtoMessage() {} - -func (*SingleSeccompProfile) ProtoMessage() {} - -func (*SingleSeccompProfileSpec) ProtoMessage() {} - -func (*SingleSeccompProfileStatus) ProtoMessage() {} - -func (*Source) ProtoMessage() {} - -func (*SpecBase) ProtoMessage() {} - -func (*StackFrame) ProtoMessage() {} - -func (*Statement) ProtoMessage() {} - -func (*StatusBase) ProtoMessage() {} - -func (*Subcomponent) ProtoMessage() {} - -func (*SyftCoordinates) ProtoMessage() {} - -func (*SyftDescriptor) ProtoMessage() {} - -func (*SyftDocument) ProtoMessage() {} - -func (*SyftFile) ProtoMessage() {} - -func (*SyftPackage) ProtoMessage() {} - -func (*SyftRelationship) ProtoMessage() {} - -func (*SyftSource) ProtoMessage() {} - -func (*Syscall) ProtoMessage() {} - -func (*ToolMeta) ProtoMessage() {} - -func (*UpstreamPackage) ProtoMessage() {} - -func (*VEX) ProtoMessage() {} - -func (*VexVulnerability) ProtoMessage() {} - -func (*VulnerabilitiesComponents) ProtoMessage() {} - -func (*VulnerabilitiesObjScope) ProtoMessage() {} - -func (*Vulnerability) ProtoMessage() {} - -func (*VulnerabilityCounters) ProtoMessage() {} - -func (*VulnerabilityManifest) ProtoMessage() {} - -func (*VulnerabilityManifestList) ProtoMessage() {} - -func (*VulnerabilityManifestMeta) ProtoMessage() {} - -func (*VulnerabilityManifestReportMeta) ProtoMessage() {} - -func (*VulnerabilityManifestSpec) ProtoMessage() {} - -func (*VulnerabilityManifestStatus) ProtoMessage() {} - -func (*VulnerabilityManifestSummary) ProtoMessage() {} - -func (*VulnerabilityManifestSummaryList) ProtoMessage() {} - -func (*VulnerabilityManifestSummarySpec) ProtoMessage() {} - -func (*VulnerabilityManifestToolMeta) ProtoMessage() {} - -func (*VulnerabilityMetadata) ProtoMessage() {} - -func (*VulnerabilitySummary) ProtoMessage() {} - -func (*VulnerabilitySummaryList) ProtoMessage() {} - -func (*VulnerabilitySummarySpec) ProtoMessage() {} - -func (*VulnerabilitySummaryStatus) ProtoMessage() {} - -func (*WorkloadConfigurationScan) ProtoMessage() {} - -func (*WorkloadConfigurationScanList) ProtoMessage() {} - -func (*WorkloadConfigurationScanSeveritiesSummary) ProtoMessage() {} - -func (*WorkloadConfigurationScanSpec) ProtoMessage() {} - -func (*WorkloadConfigurationScanSummary) ProtoMessage() {} - -func (*WorkloadConfigurationScanSummaryIdentifier) ProtoMessage() {} - -func (*WorkloadConfigurationScanSummaryList) ProtoMessage() {} - -func (*WorkloadConfigurationScanSummarySpec) ProtoMessage() {} - -func (*WorkloadScanRelatedObject) ProtoMessage() {} diff --git a/pkg/apis/softwarecomposition/v1beta1/network_types.go b/pkg/apis/softwarecomposition/v1beta1/network_types.go index ae012a8e0..e16e17d9c 100644 --- a/pkg/apis/softwarecomposition/v1beta1/network_types.go +++ b/pkg/apis/softwarecomposition/v1beta1/network_types.go @@ -16,40 +16,6 @@ const ( CommunicationTypeEgress CommunicationType = "external" ) -// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object - -// NetworkNeighborhoodList is a list of NetworkNeighborhoods. -type NetworkNeighborhoodList struct { - metav1.TypeMeta `json:",inline"` - metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"` - - Items []NetworkNeighborhood `json:"items" protobuf:"bytes,2,rep,name=items"` -} - -// +genclient -// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object - -// NetworkNeighborhood represents a list of network communications for a specific workload. -type NetworkNeighborhood struct { - metav1.TypeMeta `json:",inline"` - metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"` - - Spec NetworkNeighborhoodSpec `json:"spec" protobuf:"bytes,2,req,name=spec"` -} - -type NetworkNeighborhoodSpec struct { - metav1.LabelSelector `json:",inline" protobuf:"bytes,3,opt,name=labelSelector"` - Containers []NetworkNeighborhoodContainer `json:"containers" protobuf:"bytes,4,rep,name=containers"` - InitContainers []NetworkNeighborhoodContainer `json:"initContainers" protobuf:"bytes,5,rep,name=initContainers"` - EphemeralContainers []NetworkNeighborhoodContainer `json:"ephemeralContainers" protobuf:"bytes,6,rep,name=ephemeralContainers"` -} - -type NetworkNeighborhoodContainer struct { - Name string `json:"name" protobuf:"bytes,1,req,name=name"` - Ingress []NetworkNeighbor `json:"ingress" protobuf:"bytes,2,rep,name=ingress"` - Egress []NetworkNeighbor `json:"egress" protobuf:"bytes,3,rep,name=egress"` -} - // NetworkNeighbor represents a single network communication made by this resource. type NetworkNeighbor struct { Identifier string `json:"identifier" protobuf:"bytes,1,req,name=identifier"` // A unique identifier for this entry diff --git a/pkg/apis/softwarecomposition/v1beta1/network_types_protobuf_test.go b/pkg/apis/softwarecomposition/v1beta1/network_types_protobuf_test.go index 63b166bbd..3085f7b09 100644 --- a/pkg/apis/softwarecomposition/v1beta1/network_types_protobuf_test.go +++ b/pkg/apis/softwarecomposition/v1beta1/network_types_protobuf_test.go @@ -7,7 +7,7 @@ import ( // TestNetworkNeighbor_IPAddresses_ProtobufRoundtrip pins the v0.0.2 // protobuf wire contract for the new IPAddresses field. Storage persists -// NetworkNeighborhood objects to etcd via this protobuf encoding; if +// network neighbor entries to etcd via this protobuf encoding; if // the field is dropped on round-trip, the spec field is silently lost // and runtime matchers see an empty list. // diff --git a/pkg/apis/softwarecomposition/v1beta1/networkpolicy/v2/networkpolicy.go b/pkg/apis/softwarecomposition/v1beta1/networkpolicy/v2/networkpolicy.go deleted file mode 100644 index d82b7fce2..000000000 --- a/pkg/apis/softwarecomposition/v1beta1/networkpolicy/v2/networkpolicy.go +++ /dev/null @@ -1,55 +0,0 @@ -package networkpolicy - -import ( - sc "github.com/kubescape/storage/pkg/apis/softwarecomposition" - np "github.com/kubescape/storage/pkg/apis/softwarecomposition/networkpolicy/v2" - "github.com/kubescape/storage/pkg/apis/softwarecomposition/v1beta1" - metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" -) - -const ( - storageV1Beta1ApiVersion = "spdx.softwarecomposition.kubescape.io/v1beta1" -) - -func GenerateNetworkPolicy(networkNeighborhood *v1beta1.NetworkNeighborhood, knownServersFinder sc.IKnownServersFinder, timeProvider metav1.Time) (v1beta1.GeneratedNetworkPolicy, error) { - networkNeighborhoodV1, err := convertNetworkNeighborhood(networkNeighborhood) - if err != nil { - return v1beta1.GeneratedNetworkPolicy{}, err - } - - npv1, err := np.GenerateNetworkPolicy(networkNeighborhoodV1, knownServersFinder, timeProvider) - if err != nil { - return v1beta1.GeneratedNetworkPolicy{}, err - } - - return convertGeneratedNetworkPolicy(&npv1) - -} - -func convertGeneratedNetworkPolicy(old *sc.GeneratedNetworkPolicy) (v1beta1.GeneratedNetworkPolicy, error) { - npv1beta1 := v1beta1.GeneratedNetworkPolicy{} - if err := v1beta1.Convert_softwarecomposition_GeneratedNetworkPolicy_To_v1beta1_GeneratedNetworkPolicy(old, &npv1beta1, nil); err != nil { - return v1beta1.GeneratedNetworkPolicy{}, err - } - npv1beta1.TypeMeta.APIVersion = storageV1Beta1ApiVersion - npv1beta1.TypeMeta.Kind = "GeneratedNetworkPolicy" - return npv1beta1, nil -} - -func convertNetworkNeighborhood(old *v1beta1.NetworkNeighborhood) (*sc.NetworkNeighborhood, error) { - neighbors := &sc.NetworkNeighborhood{} - err := v1beta1.Convert_v1beta1_NetworkNeighborhood_To_softwarecomposition_NetworkNeighborhood(old, neighbors, nil) - return neighbors, err -} -func convertKnownServersList(old []v1beta1.KnownServer) ([]sc.KnownServer, error) { - var servers []sc.KnownServer - for i := range old { - k := sc.KnownServer{} - err := v1beta1.Convert_v1beta1_KnownServer_To_softwarecomposition_KnownServer(&old[i], &k, nil) - if err != nil { - return nil, err - } - servers = append(servers, k) - } - return servers, nil -} diff --git a/pkg/apis/softwarecomposition/v1beta1/networkpolicy/v2/networkpolicy_test.go b/pkg/apis/softwarecomposition/v1beta1/networkpolicy/v2/networkpolicy_test.go deleted file mode 100644 index b1239666a..000000000 --- a/pkg/apis/softwarecomposition/v1beta1/networkpolicy/v2/networkpolicy_test.go +++ /dev/null @@ -1,132 +0,0 @@ -package networkpolicy - -import ( - _ "embed" - "encoding/json" - "fmt" - "reflect" - "slices" - "testing" - - metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" - - sc "github.com/kubescape/storage/pkg/apis/softwarecomposition" - "github.com/kubescape/storage/pkg/apis/softwarecomposition/v1beta1" - "github.com/stretchr/testify/assert" -) - -//go:embed testdata/nn-operator.json -var networkNeighborhoodFile string - -//go:embed testdata/np-operator.json -var networkPolicyFile string - -//go:embed testdata/known-servers.json -var knownServersFile string - -func TestGenerateNetworkPolicyFromFile(t *testing.T) { - timeProvider := metav1.Now() - - networkNeighborhood := &v1beta1.NetworkNeighborhood{} - knownServers := []v1beta1.KnownServer{} - expectedNetworkPolicy := &v1beta1.GeneratedNetworkPolicy{} - - if err := json.Unmarshal([]byte(networkNeighborhoodFile), networkNeighborhood); err != nil { - t.Fatalf("failed to unmarshal JSON data from file %s: %v", networkNeighborhoodFile, err) - } - if err := json.Unmarshal([]byte(knownServersFile), &knownServers); err != nil { - t.Fatalf("failed to unmarshal JSON data from file %s: %v", networkNeighborhoodFile, err) - } - if err := json.Unmarshal([]byte(networkPolicyFile), expectedNetworkPolicy); err != nil { - t.Fatalf("failed to unmarshal JSON data from file %s: %v", networkNeighborhoodFile, err) - } - knownServersV1, err := convertKnownServersList(knownServers) - assert.NoError(t, err) - // Generate the network policy - generatedNetworkPolicy, err := GenerateNetworkPolicy(networkNeighborhood, sc.NewKnownServersFinderImpl(knownServersV1), timeProvider) - if err != nil { - t.Fatalf("failed to generate network policy: %v", err) - } - - // Compare the generated policy with the expected policy - assert.Nil(t, compareNP(&generatedNetworkPolicy, expectedNetworkPolicy)) -} - -func compareNP(p1, p2 *v1beta1.GeneratedNetworkPolicy) error { - if p1 == nil || p2 == nil { - return fmt.Errorf("one of the policies is nil") - } - if !reflect.DeepEqual(p1.TypeMeta, p2.TypeMeta) { - return fmt.Errorf("TypeMeta is different. p1.TypeMeta: %s, p2.TypeMeta: %s", toString(p1.TypeMeta), p2.TypeMeta) - } - p1.ObjectMeta.CreationTimestamp = metav1.Time{} - p2.ObjectMeta.CreationTimestamp = metav1.Time{} - if !reflect.DeepEqual(p1.ObjectMeta, p2.ObjectMeta) { - return fmt.Errorf("ObjectMeta is different. p1.ObjectMeta: %s, p2.ObjectMeta: %s", toString(p1.ObjectMeta), toString(p2.ObjectMeta)) - } - - if !reflect.DeepEqual(p1.Spec.GetAnnotations(), p2.Spec.GetAnnotations()) { - return fmt.Errorf("Spec is different. p1.Spec.GetAnnotations: %v, p2.Spec.GetAnnotations: %v", p1.Spec.GetAnnotations(), p2.Spec.GetAnnotations()) - } - if !reflect.DeepEqual(p1.Spec.GetLabels(), p2.Spec.GetLabels()) { - return fmt.Errorf("Spec is different. p1.Spec.GetLabels: %v, p2.Spec.GetLabels: %v", p1.Spec.GetLabels(), p2.Spec.GetLabels()) - } - if !reflect.DeepEqual(p1.Spec.Name, p2.Spec.Name) { - return fmt.Errorf("Spec is different. p1.Spec.Name: %v, p2.Spec.Name: %v", p1.Spec.Name, p2.Spec.Name) - } - if err := compareEgress(p1.Spec.Spec.Egress, p1.Spec.Spec.Egress); err != nil { - return fmt.Errorf("Spec is different. p1.Spec.Spec.Egress: %v, p2.Spec.Spec.Egress: %v", p1.Spec.Spec.Egress, p2.Spec.Spec.Egress) - } - if err := compareIngress(p1.Spec.Spec.Ingress, p1.Spec.Spec.Ingress); err != nil { - return fmt.Errorf("Spec is different. p1.Spec.Spec.Ingress: %v, p2.Spec.Spec.Ingress: %v", p1.Spec.Spec.Ingress, p2.Spec.Spec.Ingress) - } - - if !reflect.DeepEqual(p1.Spec.Spec.PodSelector, p2.Spec.Spec.PodSelector) { - return fmt.Errorf("Spec is different. p1.Spec.Spec.PodSelector: %v, p2.Spec.Spec.PodSelector: %v", p1.Spec.Spec.PodSelector, p2.Spec.Spec.PodSelector) - } - if !reflect.DeepEqual(p1.Spec.Spec.PolicyTypes, p2.Spec.Spec.PolicyTypes) { - return fmt.Errorf("Spec is different. p1.Spec.Spec.PolicyTypes: %v, p2.Spec.Spec.PolicyTypes: %v", p1.Spec.Spec.PolicyTypes, p2.Spec.Spec.PolicyTypes) - } - return nil -} - -func toString(i interface{}) string { - b, _ := json.Marshal(i) - return string(b) -} - -func compareIngress(a, b []v1beta1.NetworkPolicyIngressRule) error { - if len(a) != len(b) { - return fmt.Errorf("len(a) != len(b). len(a): %d, len(b): %d", len(a), len(b)) - } - var al []string - var bl []string - for i := range a { - al = append(al, toString(a[i])) - bl = append(bl, toString(b[i])) - } - slices.Sort(al) - slices.Sort(bl) - if !reflect.DeepEqual(al, bl) { - return fmt.Errorf("a != b. a: %v, b: %v", a, b) - } - return nil -} - -func compareEgress(a, b []v1beta1.NetworkPolicyEgressRule) error { - if len(a) != len(b) { - return fmt.Errorf("len(a) != len(b). len(a): %d, len(b): %d", len(a), len(b)) - } - var al []string - var bl []string - for i := range a { - al = append(al, toString(a[i])) - bl = append(bl, toString(b[i])) - } - slices.Sort(al) - slices.Sort(bl) - if !reflect.DeepEqual(al, bl) { - return fmt.Errorf("a != b. a: %v, b: %v", a, b) - } - return nil -} diff --git a/pkg/apis/softwarecomposition/v1beta1/networkpolicy/v2/testdata/known-servers.json b/pkg/apis/softwarecomposition/v1beta1/networkpolicy/v2/testdata/known-servers.json deleted file mode 100644 index 256f27201..000000000 --- a/pkg/apis/softwarecomposition/v1beta1/networkpolicy/v2/testdata/known-servers.json +++ /dev/null @@ -1,24 +0,0 @@ -[ - { - "apiVersion": "spdx.softwarecomposition.kubescape.io/v1beta1", - "kind": "KnownServer", - "metadata": { - "creationTimestamp": "2024-06-02T08:04:02Z", - "name": "my-org", - "resourceVersion": "1", - "uid": "caf185d6-a59a-4fd1-81cd-0ce44be34b44" - }, - "spec": [ - { - "ipBlock": "16.170.0.0/15", - "name": "my-cloud", - "server": "cloud.io" - }, - { - "ipBlock": "13.50.180.111/24", - "name": "my-cloud", - "server": "cloud.io" - } - ] - } -] \ No newline at end of file diff --git a/pkg/apis/softwarecomposition/v1beta1/networkpolicy/v2/testdata/nn-operator.json b/pkg/apis/softwarecomposition/v1beta1/networkpolicy/v2/testdata/nn-operator.json deleted file mode 100644 index f04bf5a54..000000000 --- a/pkg/apis/softwarecomposition/v1beta1/networkpolicy/v2/testdata/nn-operator.json +++ /dev/null @@ -1,304 +0,0 @@ -{ - "apiVersion": "spdx.softwarecomposition.kubescape.io/v1beta1", - "kind": "NetworkNeighborhood", - "metadata": { - "annotations": { - "kubescape.io/completion": "complete", - "kubescape.io/resource-size": "13", - "kubescape.io/status": "completed", - "kubescape.io/wlid": "wlid://cluster-do-fra1-dwertent/namespace-kubescape/deployment-operator" - }, - "creationTimestamp": "2024-05-30T08:20:01Z", - "labels": { - "kubescape.io/instance-template-hash": "55df98fc6d", - "kubescape.io/workload-api-group": "apps", - "kubescape.io/workload-api-version": "v1", - "kubescape.io/workload-kind": "Deployment", - "kubescape.io/workload-name": "operator", - "kubescape.io/workload-namespace": "kubescape", - "kubescape.io/workload-resource-version": "5358810" - }, - "name": "replicaset-operator-55df98fc6d", - "namespace": "kubescape", - "resourceVersion": "1", - "uid": "98333be8-c05a-49ff-b0ff-fe029060b241" - }, - "spec": { - "containers": [ - { - "egress": [ - { - "dns": "version-check.ks-services.co.", - "dnsNames": [ - "version-check.ks-services.co." - ], - "identifier": "2393462a016456c7d3b0a027c2106de039bb34d36bf58ffff7fc8635304170aa", - "ipAddress": "35.186.253.219", - "namespaceSelector": null, - "podSelector": null, - "ports": [ - { - "name": "TCP-443", - "port": 443, - "protocol": "TCP" - } - ], - "type": "external" - }, - { - "dns": "", - "dnsNames": null, - "identifier": "ad98a9e00a1e4a5efbbd827f432595a31085d0e8dcec365dbdfd8141bf3cbe3e", - "ipAddress": "", - "namespaceSelector": null, - "podSelector": { - "matchLabels": { - "app": "otel-collector" - } - }, - "ports": [ - { - "name": "TCP-4317", - "port": 4317, - "protocol": "TCP" - } - ], - "type": "internal" - }, - { - "dns": "", - "dnsNames": null, - "identifier": "ed8a3fa8750dd7045e9abb755f5dbd1a2025f5ed49c1ed67b7d8e1c534899bbb", - "ipAddress": "", - "namespaceSelector": null, - "podSelector": { - "matchLabels": { - "app": "kubescape" - } - }, - "ports": [ - { - "name": "TCP-8080", - "port": 8080, - "protocol": "TCP" - } - ], - "type": "internal" - }, - { - "dns": "", - "dnsNames": null, - "identifier": "e6d07dcea08c02c35494f7aed68e7cff6d51843c5fbb36032a905f11ba833c13", - "ipAddress": "", - "namespaceSelector": null, - "podSelector": { - "matchLabels": { - "app": "gateway" - } - }, - "ports": [ - { - "name": "TCP-8001", - "port": 8001, - "protocol": "TCP" - } - ], - "type": "internal" - }, - { - "dns": "", - "dnsNames": null, - "identifier": "ba56b560f0008cb2227752015bf87c5fc365fb8dfd5599162cbe71f105dfce00", - "ipAddress": "", - "namespaceSelector": null, - "podSelector": { - "matchLabels": { - "app": "kubevuln" - } - }, - "ports": [ - { - "name": "TCP-8080", - "port": 8080, - "protocol": "TCP" - } - ], - "type": "internal" - }, - { - "dns": "report.armo.cloud.", - "dnsNames": [ - "report.armo.cloud." - ], - "identifier": "c6bf8190e40278af21d4d561ed3256e05a6c240a1865f19baf353cdb45d8c363", - "ipAddress": "16.170.46.131", - "namespaceSelector": null, - "podSelector": null, - "ports": [ - { - "name": "TCP-443", - "port": 443, - "protocol": "TCP" - } - ], - "type": "external" - }, - { - "dns": "report.armo.cloud.", - "dnsNames": [ - "report.armo.cloud." - ], - "identifier": "83260a3ba8236e69f12ebb706196a2d9541b6c2771cb481dde4f3f5816a1cd94", - "ipAddress": "16.171.184.118", - "namespaceSelector": null, - "podSelector": null, - "ports": [ - { - "name": "TCP-443", - "port": 443, - "protocol": "TCP" - } - ], - "type": "external" - }, - { - "dns": "", - "dnsNames": null, - "identifier": "e5e8ca3d76f701a19b7478fdc1c8c24ccc6cef9902b52c8c7e015439e2a1ddf3", - "ipAddress": "", - "namespaceSelector": { - "matchLabels": { - "kubernetes.io/metadata.name": "kube-system" - } - }, - "podSelector": { - "matchLabels": { - "k8s-app": "kube-dns" - } - }, - "ports": [ - { - "name": "UDP-53", - "port": 53, - "protocol": "UDP" - } - ], - "type": "internal" - }, - { - "dns": "", - "dnsNames": null, - "identifier": "275a177484719f71d0e1dc151f5bca143095b34c1bf4b3525131cce48970bedb", - "ipAddress": "10.245.0.1", - "namespaceSelector": { - "matchLabels": { - "kubernetes.io/metadata.name": "default" - } - }, - "podSelector": { - "matchLabels": { - "component": "apiserver", - "provider": "kubernetes" - } - }, - "ports": [ - { - "name": "TCP-443", - "port": 443, - "protocol": "TCP" - } - ], - "type": "internal" - }, - { - "dns": "report.armo.cloud.", - "dnsNames": [ - "report.armo.cloud." - ], - "identifier": "ba5459ff4343e49a03322aab030b548e688dcac5fd6814e3ab8415e949c71bb2", - "ipAddress": "13.50.180.111", - "namespaceSelector": null, - "podSelector": null, - "ports": [ - { - "name": "TCP-443", - "port": 443, - "protocol": "TCP" - } - ], - "type": "external" - } - ], - "ingress": [ - { - "dns": "", - "dnsNames": null, - "identifier": "e09f0b1719b5a3a09e401846cb4a171b6e1b9d5fb00df7d9f886e344aa42b861", - "ipAddress": "10.244.0.73", - "namespaceSelector": null, - "podSelector": null, - "ports": [ - { - "name": "TCP-8000", - "port": 8000, - "protocol": "TCP" - } - ], - "type": "external" - }, - { - "dns": "", - "dnsNames": null, - "identifier": "8d888c23b764ff6cf9fb900bf51c53287f10e889eac145c090890d546751d81e", - "ipAddress": "10.244.0.67", - "namespaceSelector": null, - "podSelector": null, - "ports": [ - { - "name": "TCP-4002", - "port": 4002, - "protocol": "TCP" - } - ], - "type": "external" - }, - { - "dns": "", - "dnsNames": null, - "identifier": "a7831eb3c44184545e41f512277c3e246e60b3fe83272223f114a4db1f9759c0", - "ipAddress": "", - "namespaceSelector": null, - "podSelector": { - "matchLabels": { - "app": "kubescape-scheduler", - "app.kubernetes.io/name": "kubescape-scheduler", - "armo.tier": "kubescape-scan", - "batch.kubernetes.io/controller-uid": "c3f4e988-0cca-40e6-bd25-69872d41281a", - "batch.kubernetes.io/job-name": "kubescape-scheduler-28618366", - "controller-uid": "c3f4e988-0cca-40e6-bd25-69872d41281a", - "job-name": "kubescape-scheduler-28618366", - "kubescape.io/tier": "core" - } - }, - "ports": [ - { - "name": "TCP-4002", - "port": 4002, - "protocol": "TCP" - } - ], - "type": "internal" - } - ], - "name": "operator" - } - ], - "ephemeralContainers": null, - "initContainers": null, - "matchLabels": { - "app.kubernetes.io/instance": "kubescape", - "app.kubernetes.io/name": "operator", - "tier": "ks-control-plane" - } - } -} diff --git a/pkg/apis/softwarecomposition/v1beta1/networkpolicy/v2/testdata/np-operator.json b/pkg/apis/softwarecomposition/v1beta1/networkpolicy/v2/testdata/np-operator.json deleted file mode 100644 index 94d54d604..000000000 --- a/pkg/apis/softwarecomposition/v1beta1/networkpolicy/v2/testdata/np-operator.json +++ /dev/null @@ -1,281 +0,0 @@ -{ - "apiVersion": "spdx.softwarecomposition.kubescape.io/v1beta1", - "kind": "GeneratedNetworkPolicy", - "metadata": { - "creationTimestamp": null, - "labels": { - "kubescape.io/workload-api-group": "apps", - "kubescape.io/workload-api-version": "v1", - "kubescape.io/workload-kind": "Deployment", - "kubescape.io/workload-name": "operator", - "kubescape.io/workload-namespace": "kubescape", - "kubescape.io/workload-resource-version": "5358810" - }, - "name": "replicaset-operator-55df98fc6d", - "namespace": "kubescape" - }, - "policyRef": [ - { - "dns": "report.armo.cloud.", - "ipBlock": "13.50.180.111/24", - "name": "my-cloud", - "originalIP": "13.50.180.111", - "server": "cloud.io" - }, - { - "dns": "report.armo.cloud.", - "ipBlock": "16.170.0.0/15", - "name": "my-cloud", - "originalIP": "16.171.184.118", - "server": "cloud.io" - }, - { - "dns": "report.armo.cloud.", - "ipBlock": "16.170.0.0/15", - "name": "my-cloud", - "originalIP": "16.170.46.131", - "server": "cloud.io" - }, - { - "dns": "version-check.ks-services.co.", - "ipBlock": "35.186.253.219/32", - "name": "", - "originalIP": "35.186.253.219", - "server": "" - } - ], - "spec": { - "apiVersion": "networking.k8s.io/v1", - "kind": "NetworkPolicy", - "metadata": { - "annotations": { - "generated-by": "kubescape" - }, - "creationTimestamp": null, - "labels": { - "kubescape.io/workload-api-group": "apps", - "kubescape.io/workload-api-version": "v1", - "kubescape.io/workload-kind": "Deployment", - "kubescape.io/workload-name": "operator", - "kubescape.io/workload-namespace": "kubescape", - "kubescape.io/workload-resource-version": "5358810" - }, - "name": "deployment-operator", - "namespace": "kubescape" - }, - "spec": { - "ingress": [ - { - "from": [ - { - "ipBlock": { - "cidr": "10.244.0.67/32" - } - } - ], - "ports": [ - { - "port": 4002, - "protocol": "TCP" - } - ] - }, - { - "from": [ - { - "ipBlock": { - "cidr": "10.244.0.73/32" - } - } - ], - "ports": [ - { - "port": 8000, - "protocol": "TCP" - } - ] - }, - { - "from": [ - { - "podSelector": { - "matchLabels": { - "app": "kubescape-scheduler", - "app.kubernetes.io/name": "kubescape-scheduler", - "armo.tier": "kubescape-scan", - "batch.kubernetes.io/controller-uid": "c3f4e988-0cca-40e6-bd25-69872d41281a", - "batch.kubernetes.io/job-name": "kubescape-scheduler-28618366", - "controller-uid": "c3f4e988-0cca-40e6-bd25-69872d41281a", - "job-name": "kubescape-scheduler-28618366", - "kubescape.io/tier": "core" - } - } - } - ], - "ports": [ - { - "port": 4002, - "protocol": "TCP" - } - ] - } - ], - "egress": [ - { - "ports": [ - { - "port": 443, - "protocol": "TCP" - } - ], - "to": [ - { - "ipBlock": { - "cidr": "13.50.180.111/24" - } - }, - { - "ipBlock": { - "cidr": "16.170.0.0/15" - } - }, - { - "ipBlock": { - "cidr": "35.186.253.219/32" - } - } - ] - }, - { - "ports": [ - { - "port": 4317, - "protocol": "TCP" - } - ], - "to": [ - { - "podSelector": { - "matchLabels": { - "app": "otel-collector" - } - } - } - ] - }, - { - "ports": [ - { - "port": 53, - "protocol": "UDP" - } - ], - "to": [ - { - "namespaceSelector": { - "matchLabels": { - "kubernetes.io/metadata.name": "kube-system" - } - }, - "podSelector": { - "matchLabels": { - "k8s-app": "kube-dns" - } - } - } - ] - }, - { - "ports": [ - { - "port": 8001, - "protocol": "TCP" - } - ], - "to": [ - { - "podSelector": { - "matchLabels": { - "app": "gateway" - } - } - } - ] - }, - { - "ports": [ - { - "port": 8080, - "protocol": "TCP" - } - ], - "to": [ - { - "podSelector": { - "matchLabels": { - "app": "kubevuln" - } - } - } - ] - }, - { - "ports": [ - { - "port": 8080, - "protocol": "TCP" - } - ], - "to": [ - { - "podSelector": { - "matchLabels": { - "app": "kubescape" - } - } - } - ] - }, - { - "ports": [ - { - "port": 443, - "protocol": "TCP" - } - ], - "to": [ - { - "namespaceSelector": { - "matchLabels": { - "kubernetes.io/metadata.name": "default" - } - }, - "podSelector": { - "matchLabels": { - "component": "apiserver", - "provider": "kubernetes" - } - } - }, - { - "ipBlock": { - "cidr": "10.245.0.1/32" - } - } - ] - } - ], - "podSelector": { - "matchLabels": { - "app.kubernetes.io/instance": "kubescape", - "app.kubernetes.io/name": "operator", - "tier": "ks-control-plane" - } - }, - "policyTypes": [ - "Ingress", - "Egress" - ] - } - } -} diff --git a/pkg/apis/softwarecomposition/v1beta1/networkpolicy/v2/testdata/np.new.json b/pkg/apis/softwarecomposition/v1beta1/networkpolicy/v2/testdata/np.new.json deleted file mode 100644 index 6d097c5f1..000000000 --- a/pkg/apis/softwarecomposition/v1beta1/networkpolicy/v2/testdata/np.new.json +++ /dev/null @@ -1,281 +0,0 @@ -{ - "kind": "GeneratedNetworkPolicy", - "apiVersion": "spdx.softwarecomposition.kubescape.io/v1beta1", - "metadata": { - "name": "replicaset-operator-55df98fc6d", - "namespace": "kubescape", - "creationTimestamp": null, - "labels": { - "kubescape.io/workload-api-group": "apps", - "kubescape.io/workload-api-version": "v1", - "kubescape.io/workload-kind": "Deployment", - "kubescape.io/workload-name": "operator", - "kubescape.io/workload-namespace": "kubescape", - "kubescape.io/workload-resource-version": "5358810" - } - }, - "policyRef": [ - { - "ipBlock": "35.186.253.219/32", - "originalIP": "35.186.253.219", - "dns": "version-check.ks-services.co.", - "name": "", - "server": "" - }, - { - "ipBlock": "16.170.0.0/15", - "originalIP": "16.170.46.131", - "dns": "report.armo.cloud.", - "name": "my-cloud", - "server": "cloud.io" - }, - { - "ipBlock": "16.170.0.0/15", - "originalIP": "16.171.184.118", - "dns": "report.armo.cloud.", - "name": "my-cloud", - "server": "cloud.io" - }, - { - "ipBlock": "13.50.180.111/24", - "originalIP": "13.50.180.111", - "dns": "report.armo.cloud.", - "name": "my-cloud", - "server": "cloud.io" - } - ], - "spec": { - "kind": "NetworkPolicy", - "apiVersion": "networking.k8s.io/v1", - "metadata": { - "name": "replicaset-operator-55df98fc6d", - "namespace": "kubescape", - "creationTimestamp": null, - "labels": { - "kubescape.io/workload-api-group": "apps", - "kubescape.io/workload-api-version": "v1", - "kubescape.io/workload-kind": "Deployment", - "kubescape.io/workload-name": "operator", - "kubescape.io/workload-namespace": "kubescape", - "kubescape.io/workload-resource-version": "5358810" - }, - "annotations": { - "generated-by": "kubescape" - } - }, - "spec": { - "podSelector": { - "matchLabels": { - "app.kubernetes.io/instance": "kubescape", - "app.kubernetes.io/name": "operator", - "tier": "ks-control-plane" - } - }, - "ingress": [ - { - "ports": [ - { - "protocol": "TCP", - "port": 4002 - } - ], - "from": [ - { - "ipBlock": { - "cidr": "10.244.0.67/32" - } - } - ] - }, - { - "ports": [ - { - "protocol": "TCP", - "port": 8000 - } - ], - "from": [ - { - "ipBlock": { - "cidr": "10.244.0.73/32" - } - } - ] - }, - { - "ports": [ - { - "protocol": "TCP", - "port": 4002 - } - ], - "from": [ - { - "podSelector": { - "matchLabels": { - "app": "kubescape-scheduler", - "app.kubernetes.io/name": "kubescape-scheduler", - "armo.tier": "kubescape-scan", - "batch.kubernetes.io/controller-uid": "c3f4e988-0cca-40e6-bd25-69872d41281a", - "batch.kubernetes.io/job-name": "kubescape-scheduler-28618366", - "controller-uid": "c3f4e988-0cca-40e6-bd25-69872d41281a", - "job-name": "kubescape-scheduler-28618366", - "kubescape.io/tier": "core" - } - } - } - ] - } - ], - "egress": [ - { - "ports": [ - { - "protocol": "TCP", - "port": 443 - } - ], - "to": [ - { - "ipBlock": { - "cidr": "13.50.180.111/24" - } - }, - { - "ipBlock": { - "cidr": "16.170.0.0/15" - } - }, - { - "ipBlock": { - "cidr": "35.186.253.219/32" - } - } - ] - }, - { - "ports": [ - { - "protocol": "TCP", - "port": 4317 - } - ], - "to": [ - { - "podSelector": { - "matchLabels": { - "app": "otel-collector" - } - } - } - ] - }, - { - "ports": [ - { - "protocol": "TCP", - "port": 8080 - } - ], - "to": [ - { - "podSelector": { - "matchLabels": { - "app": "kubescape" - } - } - } - ] - }, - { - "ports": [ - { - "protocol": "TCP", - "port": 8001 - } - ], - "to": [ - { - "podSelector": { - "matchLabels": { - "app": "gateway" - } - } - } - ] - }, - { - "ports": [ - { - "protocol": "TCP", - "port": 8080 - } - ], - "to": [ - { - "podSelector": { - "matchLabels": { - "app": "kubevuln" - } - } - } - ] - }, - { - "ports": [ - { - "protocol": "UDP", - "port": 53 - } - ], - "to": [ - { - "podSelector": { - "matchLabels": { - "k8s-app": "kube-dns" - } - }, - "namespaceSelector": { - "matchLabels": { - "kubernetes.io/metadata.name": "kube-system" - } - } - } - ] - }, - { - "ports": [ - { - "protocol": "TCP", - "port": 443 - } - ], - "to": [ - { - "podSelector": { - "matchLabels": { - "component": "apiserver", - "provider": "kubernetes" - } - }, - "namespaceSelector": { - "matchLabels": { - "kubernetes.io/metadata.name": "default" - } - } - }, - { - "ipBlock": { - "cidr": "10.245.0.1/32" - } - } - ] - } - ], - "policyTypes": [ - "Ingress", - "Egress" - ] - } - } -} \ No newline at end of file diff --git a/pkg/apis/softwarecomposition/v1beta1/register.go b/pkg/apis/softwarecomposition/v1beta1/register.go index 193896cba..645f07614 100644 --- a/pkg/apis/softwarecomposition/v1beta1/register.go +++ b/pkg/apis/softwarecomposition/v1beta1/register.go @@ -61,12 +61,8 @@ func addKnownTypes(scheme *runtime.Scheme) error { &ConfigurationScanSummaryList{}, &VulnerabilitySummary{}, &VulnerabilitySummaryList{}, - &ApplicationProfile{}, - &ApplicationProfileList{}, &ContainerProfile{}, &ContainerProfileList{}, - &NetworkNeighborhood{}, - &NetworkNeighborhoodList{}, &OpenVulnerabilityExchangeContainer{}, &OpenVulnerabilityExchangeContainerList{}, &GeneratedNetworkPolicyList{}, diff --git a/pkg/apis/softwarecomposition/v1beta1/types.go b/pkg/apis/softwarecomposition/v1beta1/types.go index ea5513cbf..c0535fcb8 100644 --- a/pkg/apis/softwarecomposition/v1beta1/types.go +++ b/pkg/apis/softwarecomposition/v1beta1/types.go @@ -179,52 +179,6 @@ type VulnerabilitySummaryList struct { Items []VulnerabilitySummary `json:"items" protobuf:"bytes,2,rep,name=items"` } -// +genclient -// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object - -type ApplicationProfile struct { - metav1.TypeMeta `json:",inline"` - metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"` - - Spec ApplicationProfileSpec `json:"spec,omitempty" protobuf:"bytes,2,opt,name=spec"` - Status ApplicationProfileStatus `json:"status,omitempty" protobuf:"bytes,3,opt,name=status"` -} - -type ApplicationProfileSpec struct { - Architectures []string `json:"architectures" protobuf:"bytes,1,rep,name=architectures"` - // +patchMergeKey=name - // +patchStrategy=merge - Containers []ApplicationProfileContainer `json:"containers,omitempty" patchStrategy:"merge" patchMergeKey:"name" protobuf:"bytes,2,rep,name=containers"` - // +patchMergeKey=name - // +patchStrategy=merge - InitContainers []ApplicationProfileContainer `json:"initContainers,omitempty" patchStrategy:"merge" patchMergeKey:"name" protobuf:"bytes,3,rep,name=initContainers"` - // +patchMergeKey=name - // +patchStrategy=merge - EphemeralContainers []ApplicationProfileContainer `json:"ephemeralContainers,omitempty" patchStrategy:"merge" patchMergeKey:"name" protobuf:"bytes,4,rep,name=ephemeralContainers"` -} - -type ApplicationProfileContainer struct { - Name string `json:"name,omitempty" protobuf:"bytes,1,opt,name=name"` - Capabilities []string `json:"capabilities" protobuf:"bytes,2,rep,name=capabilities"` - // +patchMergeKey=path - // +patchStrategy=merge - Execs []ExecCalls `json:"execs" patchStrategy:"merge" patchMergeKey:"path" protobuf:"bytes,3,rep,name=execs"` - // +patchMergeKey=path - // +patchStrategy=merge - Opens []OpenCalls `json:"opens" patchStrategy:"merge" patchMergeKey:"path" protobuf:"bytes,4,rep,name=opens"` - Syscalls []string `json:"syscalls" protobuf:"bytes,5,rep,name=syscalls"` - SeccompProfile SingleSeccompProfile `json:"seccompProfile,omitempty" protobuf:"bytes,6,opt,name=seccompProfile"` - // +patchStrategy=merge - // +patchMergeKey=endpoint - Endpoints []HTTPEndpoint `json:"endpoints" patchStrategy:"merge" patchMergeKey:"endpoint" protobuf:"bytes,7,rep,name=endpoints"` - ImageID string `json:"imageID" protobuf:"bytes,8,opt,name=imageID"` - ImageTag string `json:"imageTag" protobuf:"bytes,9,opt,name=imageTag"` - // +patchStrategy=merge - // +patchMergeKey=ruleId - PolicyByRuleId map[string]RulePolicy `json:"rulePolicies" protobuf:"bytes,10,rep,name=rulePolicies" patchStrategy:"merge" patchMergeKey:"ruleId"` - IdentifiedCallStacks []IdentifiedCallStack `json:"identifiedCallStacks" protobuf:"bytes,11,rep,name=identifiedCallStacks"` -} - type ExecCalls struct { Path string `json:"path,omitempty" protobuf:"bytes,1,opt,name=path"` Args []string `json:"args,omitempty" protobuf:"bytes,2,opt,name=args"` @@ -267,18 +221,6 @@ type CallStack struct { Root CallStackNode `json:"root" protobuf:"bytes,1,opt,name=root"` } -type ApplicationProfileStatus struct { -} - -// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object - -type ApplicationProfileList struct { - metav1.TypeMeta `json:",inline"` - metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"` - - Items []ApplicationProfile `json:"items" protobuf:"bytes,2,rep,name=items"` -} - // +genclient // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object diff --git a/pkg/apis/softwarecomposition/v1beta1/zz_generated.conversion.go b/pkg/apis/softwarecomposition/v1beta1/zz_generated.conversion.go index bbf89dfe5..3d5605cd1 100644 --- a/pkg/apis/softwarecomposition/v1beta1/zz_generated.conversion.go +++ b/pkg/apis/softwarecomposition/v1beta1/zz_generated.conversion.go @@ -51,56 +51,6 @@ func RegisterConversions(s *runtime.Scheme) error { }); err != nil { return err } - if err := s.AddGeneratedConversionFunc((*ApplicationProfile)(nil), (*softwarecomposition.ApplicationProfile)(nil), func(a, b interface{}, scope conversion.Scope) error { - return Convert_v1beta1_ApplicationProfile_To_softwarecomposition_ApplicationProfile(a.(*ApplicationProfile), b.(*softwarecomposition.ApplicationProfile), scope) - }); err != nil { - return err - } - if err := s.AddGeneratedConversionFunc((*softwarecomposition.ApplicationProfile)(nil), (*ApplicationProfile)(nil), func(a, b interface{}, scope conversion.Scope) error { - return Convert_softwarecomposition_ApplicationProfile_To_v1beta1_ApplicationProfile(a.(*softwarecomposition.ApplicationProfile), b.(*ApplicationProfile), scope) - }); err != nil { - return err - } - if err := s.AddGeneratedConversionFunc((*ApplicationProfileContainer)(nil), (*softwarecomposition.ApplicationProfileContainer)(nil), func(a, b interface{}, scope conversion.Scope) error { - return Convert_v1beta1_ApplicationProfileContainer_To_softwarecomposition_ApplicationProfileContainer(a.(*ApplicationProfileContainer), b.(*softwarecomposition.ApplicationProfileContainer), scope) - }); err != nil { - return err - } - if err := s.AddGeneratedConversionFunc((*softwarecomposition.ApplicationProfileContainer)(nil), (*ApplicationProfileContainer)(nil), func(a, b interface{}, scope conversion.Scope) error { - return Convert_softwarecomposition_ApplicationProfileContainer_To_v1beta1_ApplicationProfileContainer(a.(*softwarecomposition.ApplicationProfileContainer), b.(*ApplicationProfileContainer), scope) - }); err != nil { - return err - } - if err := s.AddGeneratedConversionFunc((*ApplicationProfileList)(nil), (*softwarecomposition.ApplicationProfileList)(nil), func(a, b interface{}, scope conversion.Scope) error { - return Convert_v1beta1_ApplicationProfileList_To_softwarecomposition_ApplicationProfileList(a.(*ApplicationProfileList), b.(*softwarecomposition.ApplicationProfileList), scope) - }); err != nil { - return err - } - if err := s.AddGeneratedConversionFunc((*softwarecomposition.ApplicationProfileList)(nil), (*ApplicationProfileList)(nil), func(a, b interface{}, scope conversion.Scope) error { - return Convert_softwarecomposition_ApplicationProfileList_To_v1beta1_ApplicationProfileList(a.(*softwarecomposition.ApplicationProfileList), b.(*ApplicationProfileList), scope) - }); err != nil { - return err - } - if err := s.AddGeneratedConversionFunc((*ApplicationProfileSpec)(nil), (*softwarecomposition.ApplicationProfileSpec)(nil), func(a, b interface{}, scope conversion.Scope) error { - return Convert_v1beta1_ApplicationProfileSpec_To_softwarecomposition_ApplicationProfileSpec(a.(*ApplicationProfileSpec), b.(*softwarecomposition.ApplicationProfileSpec), scope) - }); err != nil { - return err - } - if err := s.AddGeneratedConversionFunc((*softwarecomposition.ApplicationProfileSpec)(nil), (*ApplicationProfileSpec)(nil), func(a, b interface{}, scope conversion.Scope) error { - return Convert_softwarecomposition_ApplicationProfileSpec_To_v1beta1_ApplicationProfileSpec(a.(*softwarecomposition.ApplicationProfileSpec), b.(*ApplicationProfileSpec), scope) - }); err != nil { - return err - } - if err := s.AddGeneratedConversionFunc((*ApplicationProfileStatus)(nil), (*softwarecomposition.ApplicationProfileStatus)(nil), func(a, b interface{}, scope conversion.Scope) error { - return Convert_v1beta1_ApplicationProfileStatus_To_softwarecomposition_ApplicationProfileStatus(a.(*ApplicationProfileStatus), b.(*softwarecomposition.ApplicationProfileStatus), scope) - }); err != nil { - return err - } - if err := s.AddGeneratedConversionFunc((*softwarecomposition.ApplicationProfileStatus)(nil), (*ApplicationProfileStatus)(nil), func(a, b interface{}, scope conversion.Scope) error { - return Convert_softwarecomposition_ApplicationProfileStatus_To_v1beta1_ApplicationProfileStatus(a.(*softwarecomposition.ApplicationProfileStatus), b.(*ApplicationProfileStatus), scope) - }); err != nil { - return err - } if err := s.AddGeneratedConversionFunc((*Arg)(nil), (*softwarecomposition.Arg)(nil), func(a, b interface{}, scope conversion.Scope) error { return Convert_v1beta1_Arg_To_softwarecomposition_Arg(a.(*Arg), b.(*softwarecomposition.Arg), scope) }); err != nil { @@ -821,46 +771,6 @@ func RegisterConversions(s *runtime.Scheme) error { }); err != nil { return err } - if err := s.AddGeneratedConversionFunc((*NetworkNeighborhood)(nil), (*softwarecomposition.NetworkNeighborhood)(nil), func(a, b interface{}, scope conversion.Scope) error { - return Convert_v1beta1_NetworkNeighborhood_To_softwarecomposition_NetworkNeighborhood(a.(*NetworkNeighborhood), b.(*softwarecomposition.NetworkNeighborhood), scope) - }); err != nil { - return err - } - if err := s.AddGeneratedConversionFunc((*softwarecomposition.NetworkNeighborhood)(nil), (*NetworkNeighborhood)(nil), func(a, b interface{}, scope conversion.Scope) error { - return Convert_softwarecomposition_NetworkNeighborhood_To_v1beta1_NetworkNeighborhood(a.(*softwarecomposition.NetworkNeighborhood), b.(*NetworkNeighborhood), scope) - }); err != nil { - return err - } - if err := s.AddGeneratedConversionFunc((*NetworkNeighborhoodContainer)(nil), (*softwarecomposition.NetworkNeighborhoodContainer)(nil), func(a, b interface{}, scope conversion.Scope) error { - return Convert_v1beta1_NetworkNeighborhoodContainer_To_softwarecomposition_NetworkNeighborhoodContainer(a.(*NetworkNeighborhoodContainer), b.(*softwarecomposition.NetworkNeighborhoodContainer), scope) - }); err != nil { - return err - } - if err := s.AddGeneratedConversionFunc((*softwarecomposition.NetworkNeighborhoodContainer)(nil), (*NetworkNeighborhoodContainer)(nil), func(a, b interface{}, scope conversion.Scope) error { - return Convert_softwarecomposition_NetworkNeighborhoodContainer_To_v1beta1_NetworkNeighborhoodContainer(a.(*softwarecomposition.NetworkNeighborhoodContainer), b.(*NetworkNeighborhoodContainer), scope) - }); err != nil { - return err - } - if err := s.AddGeneratedConversionFunc((*NetworkNeighborhoodList)(nil), (*softwarecomposition.NetworkNeighborhoodList)(nil), func(a, b interface{}, scope conversion.Scope) error { - return Convert_v1beta1_NetworkNeighborhoodList_To_softwarecomposition_NetworkNeighborhoodList(a.(*NetworkNeighborhoodList), b.(*softwarecomposition.NetworkNeighborhoodList), scope) - }); err != nil { - return err - } - if err := s.AddGeneratedConversionFunc((*softwarecomposition.NetworkNeighborhoodList)(nil), (*NetworkNeighborhoodList)(nil), func(a, b interface{}, scope conversion.Scope) error { - return Convert_softwarecomposition_NetworkNeighborhoodList_To_v1beta1_NetworkNeighborhoodList(a.(*softwarecomposition.NetworkNeighborhoodList), b.(*NetworkNeighborhoodList), scope) - }); err != nil { - return err - } - if err := s.AddGeneratedConversionFunc((*NetworkNeighborhoodSpec)(nil), (*softwarecomposition.NetworkNeighborhoodSpec)(nil), func(a, b interface{}, scope conversion.Scope) error { - return Convert_v1beta1_NetworkNeighborhoodSpec_To_softwarecomposition_NetworkNeighborhoodSpec(a.(*NetworkNeighborhoodSpec), b.(*softwarecomposition.NetworkNeighborhoodSpec), scope) - }); err != nil { - return err - } - if err := s.AddGeneratedConversionFunc((*softwarecomposition.NetworkNeighborhoodSpec)(nil), (*NetworkNeighborhoodSpec)(nil), func(a, b interface{}, scope conversion.Scope) error { - return Convert_softwarecomposition_NetworkNeighborhoodSpec_To_v1beta1_NetworkNeighborhoodSpec(a.(*softwarecomposition.NetworkNeighborhoodSpec), b.(*NetworkNeighborhoodSpec), scope) - }); err != nil { - return err - } if err := s.AddGeneratedConversionFunc((*NetworkPolicy)(nil), (*softwarecomposition.NetworkPolicy)(nil), func(a, b interface{}, scope conversion.Scope) error { return Convert_v1beta1_NetworkPolicy_To_softwarecomposition_NetworkPolicy(a.(*NetworkPolicy), b.(*softwarecomposition.NetworkPolicy), scope) }); err != nil { @@ -1766,170 +1676,6 @@ func Convert_softwarecomposition_Advisory_To_v1beta1_Advisory(in *softwarecompos return autoConvert_softwarecomposition_Advisory_To_v1beta1_Advisory(in, out, s) } -func autoConvert_v1beta1_ApplicationProfile_To_softwarecomposition_ApplicationProfile(in *ApplicationProfile, out *softwarecomposition.ApplicationProfile, s conversion.Scope) error { - out.ObjectMeta = in.ObjectMeta - if err := Convert_v1beta1_ApplicationProfileSpec_To_softwarecomposition_ApplicationProfileSpec(&in.Spec, &out.Spec, s); err != nil { - return err - } - if err := Convert_v1beta1_ApplicationProfileStatus_To_softwarecomposition_ApplicationProfileStatus(&in.Status, &out.Status, s); err != nil { - return err - } - return nil -} - -// Convert_v1beta1_ApplicationProfile_To_softwarecomposition_ApplicationProfile is an autogenerated conversion function. -func Convert_v1beta1_ApplicationProfile_To_softwarecomposition_ApplicationProfile(in *ApplicationProfile, out *softwarecomposition.ApplicationProfile, s conversion.Scope) error { - return autoConvert_v1beta1_ApplicationProfile_To_softwarecomposition_ApplicationProfile(in, out, s) -} - -func autoConvert_softwarecomposition_ApplicationProfile_To_v1beta1_ApplicationProfile(in *softwarecomposition.ApplicationProfile, out *ApplicationProfile, s conversion.Scope) error { - out.ObjectMeta = in.ObjectMeta - // INFO: in.Parts opted out of conversion generation - // INFO: in.SchemaVersion opted out of conversion generation - if err := Convert_softwarecomposition_ApplicationProfileSpec_To_v1beta1_ApplicationProfileSpec(&in.Spec, &out.Spec, s); err != nil { - return err - } - if err := Convert_softwarecomposition_ApplicationProfileStatus_To_v1beta1_ApplicationProfileStatus(&in.Status, &out.Status, s); err != nil { - return err - } - return nil -} - -// Convert_softwarecomposition_ApplicationProfile_To_v1beta1_ApplicationProfile is an autogenerated conversion function. -func Convert_softwarecomposition_ApplicationProfile_To_v1beta1_ApplicationProfile(in *softwarecomposition.ApplicationProfile, out *ApplicationProfile, s conversion.Scope) error { - return autoConvert_softwarecomposition_ApplicationProfile_To_v1beta1_ApplicationProfile(in, out, s) -} - -func autoConvert_v1beta1_ApplicationProfileContainer_To_softwarecomposition_ApplicationProfileContainer(in *ApplicationProfileContainer, out *softwarecomposition.ApplicationProfileContainer, s conversion.Scope) error { - out.Name = in.Name - out.Capabilities = *(*[]string)(unsafe.Pointer(&in.Capabilities)) - out.Execs = *(*[]softwarecomposition.ExecCalls)(unsafe.Pointer(&in.Execs)) - out.Opens = *(*[]softwarecomposition.OpenCalls)(unsafe.Pointer(&in.Opens)) - out.Syscalls = *(*[]string)(unsafe.Pointer(&in.Syscalls)) - if err := Convert_v1beta1_SingleSeccompProfile_To_softwarecomposition_SingleSeccompProfile(&in.SeccompProfile, &out.SeccompProfile, s); err != nil { - return err - } - out.Endpoints = *(*[]softwarecomposition.HTTPEndpoint)(unsafe.Pointer(&in.Endpoints)) - out.ImageID = in.ImageID - out.ImageTag = in.ImageTag - out.PolicyByRuleId = *(*map[string]softwarecomposition.RulePolicy)(unsafe.Pointer(&in.PolicyByRuleId)) - out.IdentifiedCallStacks = *(*[]softwarecomposition.IdentifiedCallStack)(unsafe.Pointer(&in.IdentifiedCallStacks)) - return nil -} - -// Convert_v1beta1_ApplicationProfileContainer_To_softwarecomposition_ApplicationProfileContainer is an autogenerated conversion function. -func Convert_v1beta1_ApplicationProfileContainer_To_softwarecomposition_ApplicationProfileContainer(in *ApplicationProfileContainer, out *softwarecomposition.ApplicationProfileContainer, s conversion.Scope) error { - return autoConvert_v1beta1_ApplicationProfileContainer_To_softwarecomposition_ApplicationProfileContainer(in, out, s) -} - -func autoConvert_softwarecomposition_ApplicationProfileContainer_To_v1beta1_ApplicationProfileContainer(in *softwarecomposition.ApplicationProfileContainer, out *ApplicationProfileContainer, s conversion.Scope) error { - out.Name = in.Name - out.Capabilities = *(*[]string)(unsafe.Pointer(&in.Capabilities)) - out.Execs = *(*[]ExecCalls)(unsafe.Pointer(&in.Execs)) - out.Opens = *(*[]OpenCalls)(unsafe.Pointer(&in.Opens)) - out.Syscalls = *(*[]string)(unsafe.Pointer(&in.Syscalls)) - if err := Convert_softwarecomposition_SingleSeccompProfile_To_v1beta1_SingleSeccompProfile(&in.SeccompProfile, &out.SeccompProfile, s); err != nil { - return err - } - out.Endpoints = *(*[]HTTPEndpoint)(unsafe.Pointer(&in.Endpoints)) - out.ImageID = in.ImageID - out.ImageTag = in.ImageTag - out.PolicyByRuleId = *(*map[string]RulePolicy)(unsafe.Pointer(&in.PolicyByRuleId)) - out.IdentifiedCallStacks = *(*[]IdentifiedCallStack)(unsafe.Pointer(&in.IdentifiedCallStacks)) - return nil -} - -// Convert_softwarecomposition_ApplicationProfileContainer_To_v1beta1_ApplicationProfileContainer is an autogenerated conversion function. -func Convert_softwarecomposition_ApplicationProfileContainer_To_v1beta1_ApplicationProfileContainer(in *softwarecomposition.ApplicationProfileContainer, out *ApplicationProfileContainer, s conversion.Scope) error { - return autoConvert_softwarecomposition_ApplicationProfileContainer_To_v1beta1_ApplicationProfileContainer(in, out, s) -} - -func autoConvert_v1beta1_ApplicationProfileList_To_softwarecomposition_ApplicationProfileList(in *ApplicationProfileList, out *softwarecomposition.ApplicationProfileList, s conversion.Scope) error { - out.ListMeta = in.ListMeta - if in.Items != nil { - in, out := &in.Items, &out.Items - *out = make([]softwarecomposition.ApplicationProfile, len(*in)) - for i := range *in { - if err := Convert_v1beta1_ApplicationProfile_To_softwarecomposition_ApplicationProfile(&(*in)[i], &(*out)[i], s); err != nil { - return err - } - } - } else { - out.Items = nil - } - return nil -} - -// Convert_v1beta1_ApplicationProfileList_To_softwarecomposition_ApplicationProfileList is an autogenerated conversion function. -func Convert_v1beta1_ApplicationProfileList_To_softwarecomposition_ApplicationProfileList(in *ApplicationProfileList, out *softwarecomposition.ApplicationProfileList, s conversion.Scope) error { - return autoConvert_v1beta1_ApplicationProfileList_To_softwarecomposition_ApplicationProfileList(in, out, s) -} - -func autoConvert_softwarecomposition_ApplicationProfileList_To_v1beta1_ApplicationProfileList(in *softwarecomposition.ApplicationProfileList, out *ApplicationProfileList, s conversion.Scope) error { - out.ListMeta = in.ListMeta - if in.Items != nil { - in, out := &in.Items, &out.Items - *out = make([]ApplicationProfile, len(*in)) - for i := range *in { - if err := Convert_softwarecomposition_ApplicationProfile_To_v1beta1_ApplicationProfile(&(*in)[i], &(*out)[i], s); err != nil { - return err - } - } - } else { - out.Items = nil - } - return nil -} - -// Convert_softwarecomposition_ApplicationProfileList_To_v1beta1_ApplicationProfileList is an autogenerated conversion function. -func Convert_softwarecomposition_ApplicationProfileList_To_v1beta1_ApplicationProfileList(in *softwarecomposition.ApplicationProfileList, out *ApplicationProfileList, s conversion.Scope) error { - return autoConvert_softwarecomposition_ApplicationProfileList_To_v1beta1_ApplicationProfileList(in, out, s) -} - -func autoConvert_v1beta1_ApplicationProfileSpec_To_softwarecomposition_ApplicationProfileSpec(in *ApplicationProfileSpec, out *softwarecomposition.ApplicationProfileSpec, s conversion.Scope) error { - out.Architectures = *(*[]string)(unsafe.Pointer(&in.Architectures)) - out.Containers = *(*[]softwarecomposition.ApplicationProfileContainer)(unsafe.Pointer(&in.Containers)) - out.InitContainers = *(*[]softwarecomposition.ApplicationProfileContainer)(unsafe.Pointer(&in.InitContainers)) - out.EphemeralContainers = *(*[]softwarecomposition.ApplicationProfileContainer)(unsafe.Pointer(&in.EphemeralContainers)) - return nil -} - -// Convert_v1beta1_ApplicationProfileSpec_To_softwarecomposition_ApplicationProfileSpec is an autogenerated conversion function. -func Convert_v1beta1_ApplicationProfileSpec_To_softwarecomposition_ApplicationProfileSpec(in *ApplicationProfileSpec, out *softwarecomposition.ApplicationProfileSpec, s conversion.Scope) error { - return autoConvert_v1beta1_ApplicationProfileSpec_To_softwarecomposition_ApplicationProfileSpec(in, out, s) -} - -func autoConvert_softwarecomposition_ApplicationProfileSpec_To_v1beta1_ApplicationProfileSpec(in *softwarecomposition.ApplicationProfileSpec, out *ApplicationProfileSpec, s conversion.Scope) error { - out.Architectures = *(*[]string)(unsafe.Pointer(&in.Architectures)) - out.Containers = *(*[]ApplicationProfileContainer)(unsafe.Pointer(&in.Containers)) - out.InitContainers = *(*[]ApplicationProfileContainer)(unsafe.Pointer(&in.InitContainers)) - out.EphemeralContainers = *(*[]ApplicationProfileContainer)(unsafe.Pointer(&in.EphemeralContainers)) - return nil -} - -// Convert_softwarecomposition_ApplicationProfileSpec_To_v1beta1_ApplicationProfileSpec is an autogenerated conversion function. -func Convert_softwarecomposition_ApplicationProfileSpec_To_v1beta1_ApplicationProfileSpec(in *softwarecomposition.ApplicationProfileSpec, out *ApplicationProfileSpec, s conversion.Scope) error { - return autoConvert_softwarecomposition_ApplicationProfileSpec_To_v1beta1_ApplicationProfileSpec(in, out, s) -} - -func autoConvert_v1beta1_ApplicationProfileStatus_To_softwarecomposition_ApplicationProfileStatus(in *ApplicationProfileStatus, out *softwarecomposition.ApplicationProfileStatus, s conversion.Scope) error { - return nil -} - -// Convert_v1beta1_ApplicationProfileStatus_To_softwarecomposition_ApplicationProfileStatus is an autogenerated conversion function. -func Convert_v1beta1_ApplicationProfileStatus_To_softwarecomposition_ApplicationProfileStatus(in *ApplicationProfileStatus, out *softwarecomposition.ApplicationProfileStatus, s conversion.Scope) error { - return autoConvert_v1beta1_ApplicationProfileStatus_To_softwarecomposition_ApplicationProfileStatus(in, out, s) -} - -func autoConvert_softwarecomposition_ApplicationProfileStatus_To_v1beta1_ApplicationProfileStatus(in *softwarecomposition.ApplicationProfileStatus, out *ApplicationProfileStatus, s conversion.Scope) error { - return nil -} - -// Convert_softwarecomposition_ApplicationProfileStatus_To_v1beta1_ApplicationProfileStatus is an autogenerated conversion function. -func Convert_softwarecomposition_ApplicationProfileStatus_To_v1beta1_ApplicationProfileStatus(in *softwarecomposition.ApplicationProfileStatus, out *ApplicationProfileStatus, s conversion.Scope) error { - return autoConvert_softwarecomposition_ApplicationProfileStatus_To_v1beta1_ApplicationProfileStatus(in, out, s) -} - func autoConvert_v1beta1_Arg_To_softwarecomposition_Arg(in *Arg, out *softwarecomposition.Arg, s conversion.Scope) error { out.Index = in.Index out.Value = in.Value @@ -3834,126 +3580,6 @@ func Convert_softwarecomposition_NetworkNeighbor_To_v1beta1_NetworkNeighbor(in * return autoConvert_softwarecomposition_NetworkNeighbor_To_v1beta1_NetworkNeighbor(in, out, s) } -func autoConvert_v1beta1_NetworkNeighborhood_To_softwarecomposition_NetworkNeighborhood(in *NetworkNeighborhood, out *softwarecomposition.NetworkNeighborhood, s conversion.Scope) error { - out.ObjectMeta = in.ObjectMeta - if err := Convert_v1beta1_NetworkNeighborhoodSpec_To_softwarecomposition_NetworkNeighborhoodSpec(&in.Spec, &out.Spec, s); err != nil { - return err - } - return nil -} - -// Convert_v1beta1_NetworkNeighborhood_To_softwarecomposition_NetworkNeighborhood is an autogenerated conversion function. -func Convert_v1beta1_NetworkNeighborhood_To_softwarecomposition_NetworkNeighborhood(in *NetworkNeighborhood, out *softwarecomposition.NetworkNeighborhood, s conversion.Scope) error { - return autoConvert_v1beta1_NetworkNeighborhood_To_softwarecomposition_NetworkNeighborhood(in, out, s) -} - -func autoConvert_softwarecomposition_NetworkNeighborhood_To_v1beta1_NetworkNeighborhood(in *softwarecomposition.NetworkNeighborhood, out *NetworkNeighborhood, s conversion.Scope) error { - out.ObjectMeta = in.ObjectMeta - // INFO: in.Parts opted out of conversion generation - // INFO: in.SchemaVersion opted out of conversion generation - if err := Convert_softwarecomposition_NetworkNeighborhoodSpec_To_v1beta1_NetworkNeighborhoodSpec(&in.Spec, &out.Spec, s); err != nil { - return err - } - return nil -} - -// Convert_softwarecomposition_NetworkNeighborhood_To_v1beta1_NetworkNeighborhood is an autogenerated conversion function. -func Convert_softwarecomposition_NetworkNeighborhood_To_v1beta1_NetworkNeighborhood(in *softwarecomposition.NetworkNeighborhood, out *NetworkNeighborhood, s conversion.Scope) error { - return autoConvert_softwarecomposition_NetworkNeighborhood_To_v1beta1_NetworkNeighborhood(in, out, s) -} - -func autoConvert_v1beta1_NetworkNeighborhoodContainer_To_softwarecomposition_NetworkNeighborhoodContainer(in *NetworkNeighborhoodContainer, out *softwarecomposition.NetworkNeighborhoodContainer, s conversion.Scope) error { - out.Name = in.Name - out.Ingress = *(*[]softwarecomposition.NetworkNeighbor)(unsafe.Pointer(&in.Ingress)) - out.Egress = *(*[]softwarecomposition.NetworkNeighbor)(unsafe.Pointer(&in.Egress)) - return nil -} - -// Convert_v1beta1_NetworkNeighborhoodContainer_To_softwarecomposition_NetworkNeighborhoodContainer is an autogenerated conversion function. -func Convert_v1beta1_NetworkNeighborhoodContainer_To_softwarecomposition_NetworkNeighborhoodContainer(in *NetworkNeighborhoodContainer, out *softwarecomposition.NetworkNeighborhoodContainer, s conversion.Scope) error { - return autoConvert_v1beta1_NetworkNeighborhoodContainer_To_softwarecomposition_NetworkNeighborhoodContainer(in, out, s) -} - -func autoConvert_softwarecomposition_NetworkNeighborhoodContainer_To_v1beta1_NetworkNeighborhoodContainer(in *softwarecomposition.NetworkNeighborhoodContainer, out *NetworkNeighborhoodContainer, s conversion.Scope) error { - out.Name = in.Name - out.Ingress = *(*[]NetworkNeighbor)(unsafe.Pointer(&in.Ingress)) - out.Egress = *(*[]NetworkNeighbor)(unsafe.Pointer(&in.Egress)) - return nil -} - -// Convert_softwarecomposition_NetworkNeighborhoodContainer_To_v1beta1_NetworkNeighborhoodContainer is an autogenerated conversion function. -func Convert_softwarecomposition_NetworkNeighborhoodContainer_To_v1beta1_NetworkNeighborhoodContainer(in *softwarecomposition.NetworkNeighborhoodContainer, out *NetworkNeighborhoodContainer, s conversion.Scope) error { - return autoConvert_softwarecomposition_NetworkNeighborhoodContainer_To_v1beta1_NetworkNeighborhoodContainer(in, out, s) -} - -func autoConvert_v1beta1_NetworkNeighborhoodList_To_softwarecomposition_NetworkNeighborhoodList(in *NetworkNeighborhoodList, out *softwarecomposition.NetworkNeighborhoodList, s conversion.Scope) error { - out.ListMeta = in.ListMeta - if in.Items != nil { - in, out := &in.Items, &out.Items - *out = make([]softwarecomposition.NetworkNeighborhood, len(*in)) - for i := range *in { - if err := Convert_v1beta1_NetworkNeighborhood_To_softwarecomposition_NetworkNeighborhood(&(*in)[i], &(*out)[i], s); err != nil { - return err - } - } - } else { - out.Items = nil - } - return nil -} - -// Convert_v1beta1_NetworkNeighborhoodList_To_softwarecomposition_NetworkNeighborhoodList is an autogenerated conversion function. -func Convert_v1beta1_NetworkNeighborhoodList_To_softwarecomposition_NetworkNeighborhoodList(in *NetworkNeighborhoodList, out *softwarecomposition.NetworkNeighborhoodList, s conversion.Scope) error { - return autoConvert_v1beta1_NetworkNeighborhoodList_To_softwarecomposition_NetworkNeighborhoodList(in, out, s) -} - -func autoConvert_softwarecomposition_NetworkNeighborhoodList_To_v1beta1_NetworkNeighborhoodList(in *softwarecomposition.NetworkNeighborhoodList, out *NetworkNeighborhoodList, s conversion.Scope) error { - out.ListMeta = in.ListMeta - if in.Items != nil { - in, out := &in.Items, &out.Items - *out = make([]NetworkNeighborhood, len(*in)) - for i := range *in { - if err := Convert_softwarecomposition_NetworkNeighborhood_To_v1beta1_NetworkNeighborhood(&(*in)[i], &(*out)[i], s); err != nil { - return err - } - } - } else { - out.Items = nil - } - return nil -} - -// Convert_softwarecomposition_NetworkNeighborhoodList_To_v1beta1_NetworkNeighborhoodList is an autogenerated conversion function. -func Convert_softwarecomposition_NetworkNeighborhoodList_To_v1beta1_NetworkNeighborhoodList(in *softwarecomposition.NetworkNeighborhoodList, out *NetworkNeighborhoodList, s conversion.Scope) error { - return autoConvert_softwarecomposition_NetworkNeighborhoodList_To_v1beta1_NetworkNeighborhoodList(in, out, s) -} - -func autoConvert_v1beta1_NetworkNeighborhoodSpec_To_softwarecomposition_NetworkNeighborhoodSpec(in *NetworkNeighborhoodSpec, out *softwarecomposition.NetworkNeighborhoodSpec, s conversion.Scope) error { - out.LabelSelector = in.LabelSelector - out.Containers = *(*[]softwarecomposition.NetworkNeighborhoodContainer)(unsafe.Pointer(&in.Containers)) - out.InitContainers = *(*[]softwarecomposition.NetworkNeighborhoodContainer)(unsafe.Pointer(&in.InitContainers)) - out.EphemeralContainers = *(*[]softwarecomposition.NetworkNeighborhoodContainer)(unsafe.Pointer(&in.EphemeralContainers)) - return nil -} - -// Convert_v1beta1_NetworkNeighborhoodSpec_To_softwarecomposition_NetworkNeighborhoodSpec is an autogenerated conversion function. -func Convert_v1beta1_NetworkNeighborhoodSpec_To_softwarecomposition_NetworkNeighborhoodSpec(in *NetworkNeighborhoodSpec, out *softwarecomposition.NetworkNeighborhoodSpec, s conversion.Scope) error { - return autoConvert_v1beta1_NetworkNeighborhoodSpec_To_softwarecomposition_NetworkNeighborhoodSpec(in, out, s) -} - -func autoConvert_softwarecomposition_NetworkNeighborhoodSpec_To_v1beta1_NetworkNeighborhoodSpec(in *softwarecomposition.NetworkNeighborhoodSpec, out *NetworkNeighborhoodSpec, s conversion.Scope) error { - out.LabelSelector = in.LabelSelector - out.Containers = *(*[]NetworkNeighborhoodContainer)(unsafe.Pointer(&in.Containers)) - out.InitContainers = *(*[]NetworkNeighborhoodContainer)(unsafe.Pointer(&in.InitContainers)) - out.EphemeralContainers = *(*[]NetworkNeighborhoodContainer)(unsafe.Pointer(&in.EphemeralContainers)) - return nil -} - -// Convert_softwarecomposition_NetworkNeighborhoodSpec_To_v1beta1_NetworkNeighborhoodSpec is an autogenerated conversion function. -func Convert_softwarecomposition_NetworkNeighborhoodSpec_To_v1beta1_NetworkNeighborhoodSpec(in *softwarecomposition.NetworkNeighborhoodSpec, out *NetworkNeighborhoodSpec, s conversion.Scope) error { - return autoConvert_softwarecomposition_NetworkNeighborhoodSpec_To_v1beta1_NetworkNeighborhoodSpec(in, out, s) -} - func autoConvert_v1beta1_NetworkPolicy_To_softwarecomposition_NetworkPolicy(in *NetworkPolicy, out *softwarecomposition.NetworkPolicy, s conversion.Scope) error { out.Kind = in.Kind out.APIVersion = in.APIVersion diff --git a/pkg/apis/softwarecomposition/v1beta1/zz_generated.deepcopy.go b/pkg/apis/softwarecomposition/v1beta1/zz_generated.deepcopy.go index fc71852b5..bf14f3226 100644 --- a/pkg/apis/softwarecomposition/v1beta1/zz_generated.deepcopy.go +++ b/pkg/apis/softwarecomposition/v1beta1/zz_generated.deepcopy.go @@ -45,187 +45,6 @@ func (in *Advisory) DeepCopy() *Advisory { return out } -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *ApplicationProfile) DeepCopyInto(out *ApplicationProfile) { - *out = *in - out.TypeMeta = in.TypeMeta - in.ObjectMeta.DeepCopyInto(&out.ObjectMeta) - in.Spec.DeepCopyInto(&out.Spec) - out.Status = in.Status - return -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ApplicationProfile. -func (in *ApplicationProfile) DeepCopy() *ApplicationProfile { - if in == nil { - return nil - } - out := new(ApplicationProfile) - in.DeepCopyInto(out) - return out -} - -// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object. -func (in *ApplicationProfile) DeepCopyObject() runtime.Object { - if c := in.DeepCopy(); c != nil { - return c - } - return nil -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *ApplicationProfileContainer) DeepCopyInto(out *ApplicationProfileContainer) { - *out = *in - if in.Capabilities != nil { - in, out := &in.Capabilities, &out.Capabilities - *out = make([]string, len(*in)) - copy(*out, *in) - } - if in.Execs != nil { - in, out := &in.Execs, &out.Execs - *out = make([]ExecCalls, len(*in)) - for i := range *in { - (*in)[i].DeepCopyInto(&(*out)[i]) - } - } - if in.Opens != nil { - in, out := &in.Opens, &out.Opens - *out = make([]OpenCalls, len(*in)) - for i := range *in { - (*in)[i].DeepCopyInto(&(*out)[i]) - } - } - if in.Syscalls != nil { - in, out := &in.Syscalls, &out.Syscalls - *out = make([]string, len(*in)) - copy(*out, *in) - } - in.SeccompProfile.DeepCopyInto(&out.SeccompProfile) - if in.Endpoints != nil { - in, out := &in.Endpoints, &out.Endpoints - *out = make([]HTTPEndpoint, len(*in)) - for i := range *in { - (*in)[i].DeepCopyInto(&(*out)[i]) - } - } - if in.PolicyByRuleId != nil { - in, out := &in.PolicyByRuleId, &out.PolicyByRuleId - *out = make(map[string]RulePolicy, len(*in)) - for key, val := range *in { - (*out)[key] = *val.DeepCopy() - } - } - if in.IdentifiedCallStacks != nil { - in, out := &in.IdentifiedCallStacks, &out.IdentifiedCallStacks - *out = make([]IdentifiedCallStack, len(*in)) - for i := range *in { - (*in)[i].DeepCopyInto(&(*out)[i]) - } - } - return -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ApplicationProfileContainer. -func (in *ApplicationProfileContainer) DeepCopy() *ApplicationProfileContainer { - if in == nil { - return nil - } - out := new(ApplicationProfileContainer) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *ApplicationProfileList) DeepCopyInto(out *ApplicationProfileList) { - *out = *in - out.TypeMeta = in.TypeMeta - in.ListMeta.DeepCopyInto(&out.ListMeta) - if in.Items != nil { - in, out := &in.Items, &out.Items - *out = make([]ApplicationProfile, len(*in)) - for i := range *in { - (*in)[i].DeepCopyInto(&(*out)[i]) - } - } - return -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ApplicationProfileList. -func (in *ApplicationProfileList) DeepCopy() *ApplicationProfileList { - if in == nil { - return nil - } - out := new(ApplicationProfileList) - in.DeepCopyInto(out) - return out -} - -// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object. -func (in *ApplicationProfileList) DeepCopyObject() runtime.Object { - if c := in.DeepCopy(); c != nil { - return c - } - return nil -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *ApplicationProfileSpec) DeepCopyInto(out *ApplicationProfileSpec) { - *out = *in - if in.Architectures != nil { - in, out := &in.Architectures, &out.Architectures - *out = make([]string, len(*in)) - copy(*out, *in) - } - if in.Containers != nil { - in, out := &in.Containers, &out.Containers - *out = make([]ApplicationProfileContainer, len(*in)) - for i := range *in { - (*in)[i].DeepCopyInto(&(*out)[i]) - } - } - if in.InitContainers != nil { - in, out := &in.InitContainers, &out.InitContainers - *out = make([]ApplicationProfileContainer, len(*in)) - for i := range *in { - (*in)[i].DeepCopyInto(&(*out)[i]) - } - } - if in.EphemeralContainers != nil { - in, out := &in.EphemeralContainers, &out.EphemeralContainers - *out = make([]ApplicationProfileContainer, len(*in)) - for i := range *in { - (*in)[i].DeepCopyInto(&(*out)[i]) - } - } - return -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ApplicationProfileSpec. -func (in *ApplicationProfileSpec) DeepCopy() *ApplicationProfileSpec { - if in == nil { - return nil - } - out := new(ApplicationProfileSpec) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *ApplicationProfileStatus) DeepCopyInto(out *ApplicationProfileStatus) { - *out = *in - return -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ApplicationProfileStatus. -func (in *ApplicationProfileStatus) DeepCopy() *ApplicationProfileStatus { - if in == nil { - return nil - } - out := new(ApplicationProfileStatus) - in.DeepCopyInto(out) - return out -} - // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *Arg) DeepCopyInto(out *Arg) { *out = *in @@ -2078,134 +1897,6 @@ func (in *NetworkNeighbor) DeepCopy() *NetworkNeighbor { return out } -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *NetworkNeighborhood) DeepCopyInto(out *NetworkNeighborhood) { - *out = *in - out.TypeMeta = in.TypeMeta - in.ObjectMeta.DeepCopyInto(&out.ObjectMeta) - in.Spec.DeepCopyInto(&out.Spec) - return -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new NetworkNeighborhood. -func (in *NetworkNeighborhood) DeepCopy() *NetworkNeighborhood { - if in == nil { - return nil - } - out := new(NetworkNeighborhood) - in.DeepCopyInto(out) - return out -} - -// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object. -func (in *NetworkNeighborhood) DeepCopyObject() runtime.Object { - if c := in.DeepCopy(); c != nil { - return c - } - return nil -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *NetworkNeighborhoodContainer) DeepCopyInto(out *NetworkNeighborhoodContainer) { - *out = *in - if in.Ingress != nil { - in, out := &in.Ingress, &out.Ingress - *out = make([]NetworkNeighbor, len(*in)) - for i := range *in { - (*in)[i].DeepCopyInto(&(*out)[i]) - } - } - if in.Egress != nil { - in, out := &in.Egress, &out.Egress - *out = make([]NetworkNeighbor, len(*in)) - for i := range *in { - (*in)[i].DeepCopyInto(&(*out)[i]) - } - } - return -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new NetworkNeighborhoodContainer. -func (in *NetworkNeighborhoodContainer) DeepCopy() *NetworkNeighborhoodContainer { - if in == nil { - return nil - } - out := new(NetworkNeighborhoodContainer) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *NetworkNeighborhoodList) DeepCopyInto(out *NetworkNeighborhoodList) { - *out = *in - out.TypeMeta = in.TypeMeta - in.ListMeta.DeepCopyInto(&out.ListMeta) - if in.Items != nil { - in, out := &in.Items, &out.Items - *out = make([]NetworkNeighborhood, len(*in)) - for i := range *in { - (*in)[i].DeepCopyInto(&(*out)[i]) - } - } - return -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new NetworkNeighborhoodList. -func (in *NetworkNeighborhoodList) DeepCopy() *NetworkNeighborhoodList { - if in == nil { - return nil - } - out := new(NetworkNeighborhoodList) - in.DeepCopyInto(out) - return out -} - -// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object. -func (in *NetworkNeighborhoodList) DeepCopyObject() runtime.Object { - if c := in.DeepCopy(); c != nil { - return c - } - return nil -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *NetworkNeighborhoodSpec) DeepCopyInto(out *NetworkNeighborhoodSpec) { - *out = *in - in.LabelSelector.DeepCopyInto(&out.LabelSelector) - if in.Containers != nil { - in, out := &in.Containers, &out.Containers - *out = make([]NetworkNeighborhoodContainer, len(*in)) - for i := range *in { - (*in)[i].DeepCopyInto(&(*out)[i]) - } - } - if in.InitContainers != nil { - in, out := &in.InitContainers, &out.InitContainers - *out = make([]NetworkNeighborhoodContainer, len(*in)) - for i := range *in { - (*in)[i].DeepCopyInto(&(*out)[i]) - } - } - if in.EphemeralContainers != nil { - in, out := &in.EphemeralContainers, &out.EphemeralContainers - *out = make([]NetworkNeighborhoodContainer, len(*in)) - for i := range *in { - (*in)[i].DeepCopyInto(&(*out)[i]) - } - } - return -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new NetworkNeighborhoodSpec. -func (in *NetworkNeighborhoodSpec) DeepCopy() *NetworkNeighborhoodSpec { - if in == nil { - return nil - } - out := new(NetworkNeighborhoodSpec) - in.DeepCopyInto(out) - return out -} - // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *NetworkPolicy) DeepCopyInto(out *NetworkPolicy) { *out = *in diff --git a/pkg/apis/softwarecomposition/v1beta1/zz_generated.model_name.go b/pkg/apis/softwarecomposition/v1beta1/zz_generated.model_name.go index 394d16b65..6826353e2 100644 --- a/pkg/apis/softwarecomposition/v1beta1/zz_generated.model_name.go +++ b/pkg/apis/softwarecomposition/v1beta1/zz_generated.model_name.go @@ -26,31 +26,6 @@ func (in Advisory) OpenAPIModelName() string { return "com.github.kubescape.storage.pkg.apis.softwarecomposition.v1beta1.Advisory" } -// OpenAPIModelName returns the OpenAPI model name for this type. -func (in ApplicationProfile) OpenAPIModelName() string { - return "com.github.kubescape.storage.pkg.apis.softwarecomposition.v1beta1.ApplicationProfile" -} - -// OpenAPIModelName returns the OpenAPI model name for this type. -func (in ApplicationProfileContainer) OpenAPIModelName() string { - return "com.github.kubescape.storage.pkg.apis.softwarecomposition.v1beta1.ApplicationProfileContainer" -} - -// OpenAPIModelName returns the OpenAPI model name for this type. -func (in ApplicationProfileList) OpenAPIModelName() string { - return "com.github.kubescape.storage.pkg.apis.softwarecomposition.v1beta1.ApplicationProfileList" -} - -// OpenAPIModelName returns the OpenAPI model name for this type. -func (in ApplicationProfileSpec) OpenAPIModelName() string { - return "com.github.kubescape.storage.pkg.apis.softwarecomposition.v1beta1.ApplicationProfileSpec" -} - -// OpenAPIModelName returns the OpenAPI model name for this type. -func (in ApplicationProfileStatus) OpenAPIModelName() string { - return "com.github.kubescape.storage.pkg.apis.softwarecomposition.v1beta1.ApplicationProfileStatus" -} - // OpenAPIModelName returns the OpenAPI model name for this type. func (in Arg) OpenAPIModelName() string { return "com.github.kubescape.storage.pkg.apis.softwarecomposition.v1beta1.Arg" @@ -411,26 +386,6 @@ func (in NetworkNeighbor) OpenAPIModelName() string { return "com.github.kubescape.storage.pkg.apis.softwarecomposition.v1beta1.NetworkNeighbor" } -// OpenAPIModelName returns the OpenAPI model name for this type. -func (in NetworkNeighborhood) OpenAPIModelName() string { - return "com.github.kubescape.storage.pkg.apis.softwarecomposition.v1beta1.NetworkNeighborhood" -} - -// OpenAPIModelName returns the OpenAPI model name for this type. -func (in NetworkNeighborhoodContainer) OpenAPIModelName() string { - return "com.github.kubescape.storage.pkg.apis.softwarecomposition.v1beta1.NetworkNeighborhoodContainer" -} - -// OpenAPIModelName returns the OpenAPI model name for this type. -func (in NetworkNeighborhoodList) OpenAPIModelName() string { - return "com.github.kubescape.storage.pkg.apis.softwarecomposition.v1beta1.NetworkNeighborhoodList" -} - -// OpenAPIModelName returns the OpenAPI model name for this type. -func (in NetworkNeighborhoodSpec) OpenAPIModelName() string { - return "com.github.kubescape.storage.pkg.apis.softwarecomposition.v1beta1.NetworkNeighborhoodSpec" -} - // OpenAPIModelName returns the OpenAPI model name for this type. func (in NetworkPolicy) OpenAPIModelName() string { return "com.github.kubescape.storage.pkg.apis.softwarecomposition.v1beta1.NetworkPolicy" diff --git a/pkg/apis/softwarecomposition/zz_generated.deepcopy.go b/pkg/apis/softwarecomposition/zz_generated.deepcopy.go index 3176c2c13..7ce140bea 100644 --- a/pkg/apis/softwarecomposition/zz_generated.deepcopy.go +++ b/pkg/apis/softwarecomposition/zz_generated.deepcopy.go @@ -45,194 +45,6 @@ func (in *Advisory) DeepCopy() *Advisory { return out } -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *ApplicationProfile) DeepCopyInto(out *ApplicationProfile) { - *out = *in - out.TypeMeta = in.TypeMeta - in.ObjectMeta.DeepCopyInto(&out.ObjectMeta) - if in.Parts != nil { - in, out := &in.Parts, &out.Parts - *out = make(map[string]string, len(*in)) - for key, val := range *in { - (*out)[key] = val - } - } - in.Spec.DeepCopyInto(&out.Spec) - out.Status = in.Status - return -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ApplicationProfile. -func (in *ApplicationProfile) DeepCopy() *ApplicationProfile { - if in == nil { - return nil - } - out := new(ApplicationProfile) - in.DeepCopyInto(out) - return out -} - -// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object. -func (in *ApplicationProfile) DeepCopyObject() runtime.Object { - if c := in.DeepCopy(); c != nil { - return c - } - return nil -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *ApplicationProfileContainer) DeepCopyInto(out *ApplicationProfileContainer) { - *out = *in - if in.Capabilities != nil { - in, out := &in.Capabilities, &out.Capabilities - *out = make([]string, len(*in)) - copy(*out, *in) - } - if in.Execs != nil { - in, out := &in.Execs, &out.Execs - *out = make([]ExecCalls, len(*in)) - for i := range *in { - (*in)[i].DeepCopyInto(&(*out)[i]) - } - } - if in.Opens != nil { - in, out := &in.Opens, &out.Opens - *out = make([]OpenCalls, len(*in)) - for i := range *in { - (*in)[i].DeepCopyInto(&(*out)[i]) - } - } - if in.Syscalls != nil { - in, out := &in.Syscalls, &out.Syscalls - *out = make([]string, len(*in)) - copy(*out, *in) - } - in.SeccompProfile.DeepCopyInto(&out.SeccompProfile) - if in.Endpoints != nil { - in, out := &in.Endpoints, &out.Endpoints - *out = make([]HTTPEndpoint, len(*in)) - for i := range *in { - (*in)[i].DeepCopyInto(&(*out)[i]) - } - } - if in.PolicyByRuleId != nil { - in, out := &in.PolicyByRuleId, &out.PolicyByRuleId - *out = make(map[string]RulePolicy, len(*in)) - for key, val := range *in { - (*out)[key] = *val.DeepCopy() - } - } - if in.IdentifiedCallStacks != nil { - in, out := &in.IdentifiedCallStacks, &out.IdentifiedCallStacks - *out = make([]IdentifiedCallStack, len(*in)) - for i := range *in { - (*in)[i].DeepCopyInto(&(*out)[i]) - } - } - return -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ApplicationProfileContainer. -func (in *ApplicationProfileContainer) DeepCopy() *ApplicationProfileContainer { - if in == nil { - return nil - } - out := new(ApplicationProfileContainer) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *ApplicationProfileList) DeepCopyInto(out *ApplicationProfileList) { - *out = *in - out.TypeMeta = in.TypeMeta - in.ListMeta.DeepCopyInto(&out.ListMeta) - if in.Items != nil { - in, out := &in.Items, &out.Items - *out = make([]ApplicationProfile, len(*in)) - for i := range *in { - (*in)[i].DeepCopyInto(&(*out)[i]) - } - } - return -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ApplicationProfileList. -func (in *ApplicationProfileList) DeepCopy() *ApplicationProfileList { - if in == nil { - return nil - } - out := new(ApplicationProfileList) - in.DeepCopyInto(out) - return out -} - -// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object. -func (in *ApplicationProfileList) DeepCopyObject() runtime.Object { - if c := in.DeepCopy(); c != nil { - return c - } - return nil -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *ApplicationProfileSpec) DeepCopyInto(out *ApplicationProfileSpec) { - *out = *in - if in.Architectures != nil { - in, out := &in.Architectures, &out.Architectures - *out = make([]string, len(*in)) - copy(*out, *in) - } - if in.Containers != nil { - in, out := &in.Containers, &out.Containers - *out = make([]ApplicationProfileContainer, len(*in)) - for i := range *in { - (*in)[i].DeepCopyInto(&(*out)[i]) - } - } - if in.InitContainers != nil { - in, out := &in.InitContainers, &out.InitContainers - *out = make([]ApplicationProfileContainer, len(*in)) - for i := range *in { - (*in)[i].DeepCopyInto(&(*out)[i]) - } - } - if in.EphemeralContainers != nil { - in, out := &in.EphemeralContainers, &out.EphemeralContainers - *out = make([]ApplicationProfileContainer, len(*in)) - for i := range *in { - (*in)[i].DeepCopyInto(&(*out)[i]) - } - } - return -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ApplicationProfileSpec. -func (in *ApplicationProfileSpec) DeepCopy() *ApplicationProfileSpec { - if in == nil { - return nil - } - out := new(ApplicationProfileSpec) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *ApplicationProfileStatus) DeepCopyInto(out *ApplicationProfileStatus) { - *out = *in - return -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ApplicationProfileStatus. -func (in *ApplicationProfileStatus) DeepCopy() *ApplicationProfileStatus { - if in == nil { - return nil - } - out := new(ApplicationProfileStatus) - in.DeepCopyInto(out) - return out -} - // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *Arg) DeepCopyInto(out *Arg) { *out = *in @@ -2090,13 +1902,6 @@ func (in *NetworkNeighborhood) DeepCopyInto(out *NetworkNeighborhood) { *out = *in out.TypeMeta = in.TypeMeta in.ObjectMeta.DeepCopyInto(&out.ObjectMeta) - if in.Parts != nil { - in, out := &in.Parts, &out.Parts - *out = make(map[string]string, len(*in)) - for key, val := range *in { - (*out)[key] = val - } - } in.Spec.DeepCopyInto(&out.Spec) return } @@ -2111,14 +1916,6 @@ func (in *NetworkNeighborhood) DeepCopy() *NetworkNeighborhood { return out } -// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object. -func (in *NetworkNeighborhood) DeepCopyObject() runtime.Object { - if c := in.DeepCopy(); c != nil { - return c - } - return nil -} - // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *NetworkNeighborhoodContainer) DeepCopyInto(out *NetworkNeighborhoodContainer) { *out = *in @@ -2149,39 +1946,6 @@ func (in *NetworkNeighborhoodContainer) DeepCopy() *NetworkNeighborhoodContainer return out } -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *NetworkNeighborhoodList) DeepCopyInto(out *NetworkNeighborhoodList) { - *out = *in - out.TypeMeta = in.TypeMeta - in.ListMeta.DeepCopyInto(&out.ListMeta) - if in.Items != nil { - in, out := &in.Items, &out.Items - *out = make([]NetworkNeighborhood, len(*in)) - for i := range *in { - (*in)[i].DeepCopyInto(&(*out)[i]) - } - } - return -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new NetworkNeighborhoodList. -func (in *NetworkNeighborhoodList) DeepCopy() *NetworkNeighborhoodList { - if in == nil { - return nil - } - out := new(NetworkNeighborhoodList) - in.DeepCopyInto(out) - return out -} - -// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object. -func (in *NetworkNeighborhoodList) DeepCopyObject() runtime.Object { - if c := in.DeepCopy(); c != nil { - return c - } - return nil -} - // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *NetworkNeighborhoodSpec) DeepCopyInto(out *NetworkNeighborhoodSpec) { *out = *in diff --git a/pkg/apiserver/apiserver.go b/pkg/apiserver/apiserver.go index 506dd78d2..f4719f322 100644 --- a/pkg/apiserver/apiserver.go +++ b/pkg/apiserver/apiserver.go @@ -23,13 +23,11 @@ import ( "github.com/kubescape/storage/pkg/registry" sbomregistry "github.com/kubescape/storage/pkg/registry" "github.com/kubescape/storage/pkg/registry/file" - "github.com/kubescape/storage/pkg/registry/softwarecomposition/applicationprofile" "github.com/kubescape/storage/pkg/registry/softwarecomposition/collapseconfiguration" "github.com/kubescape/storage/pkg/registry/softwarecomposition/configurationscansummary" "github.com/kubescape/storage/pkg/registry/softwarecomposition/containerprofile" "github.com/kubescape/storage/pkg/registry/softwarecomposition/generatednetworkpolicy" knownserver "github.com/kubescape/storage/pkg/registry/softwarecomposition/knownservers" - "github.com/kubescape/storage/pkg/registry/softwarecomposition/networkneighborhood" "github.com/kubescape/storage/pkg/registry/softwarecomposition/openvulnerabilityexchange" "github.com/kubescape/storage/pkg/registry/softwarecomposition/sbomsyftfiltereds" "github.com/kubescape/storage/pkg/registry/softwarecomposition/sbomsyfts" @@ -144,20 +142,15 @@ func (c completedConfig) New() (*WardleServer, error) { // CRD provider into them AFTER the application/container storage // backends are built — chicken-and-egg: the provider needs storage to // read the CR, processors are baked into the storage backend. - applicationProfileProcessor := file.NewApplicationProfileProcessor(c.ExtraConfig.StorageConfig) containerProfileProcessor := file.NewContainerProfileProcessor(c.ExtraConfig.StorageConfig, c.ExtraConfig.CleanupHandler) - networkNeighborhoodProcessor := file.NewNetworkNeighborhoodProcessor(c.ExtraConfig.StorageConfig) var ( storageImpl = file.NewStorageImpl(c.ExtraConfig.OsFs, file.DefaultStorageRoot, c.ExtraConfig.Pool, c.ExtraConfig.WatchDispatcher, Scheme) - applicationProfileStorageBackend = file.NewStorageImplWithCollector(c.ExtraConfig.OsFs, file.DefaultStorageRoot, c.ExtraConfig.Pool, c.ExtraConfig.WatchDispatcher, Scheme, applicationProfileProcessor) - applicationProfileStorageImpl = file.NewApplicationProfileStorage(applicationProfileStorageBackend) - containerProfileStorageImpl = file.NewContainerProfileRESTStorage(file.NewStorageImplWithCollector(c.ExtraConfig.OsFs, file.DefaultStorageRoot, c.ExtraConfig.Pool, c.ExtraConfig.WatchDispatcher, Scheme, containerProfileProcessor)) - networkNeighborhoodStorageImpl = file.NewNetworkNeighborhoodStorage(file.NewStorageImplWithCollector(c.ExtraConfig.OsFs, file.DefaultStorageRoot, c.ExtraConfig.Pool, c.ExtraConfig.WatchDispatcher, Scheme, networkNeighborhoodProcessor)) - configScanStorageImpl = file.NewConfigurationScanSummaryStorage(storageImpl) - vulnerabilitySummaryStorage = file.NewVulnerabilitySummaryStorage(storageImpl) - generatedNetworkPolicyStorage = file.NewGeneratedNetworkPolicyStorage(storageImpl, networkNeighborhoodStorageImpl) + containerProfileStorageImpl = file.NewContainerProfileRESTStorage(file.NewStorageImplWithCollector(c.ExtraConfig.OsFs, file.DefaultStorageRoot, c.ExtraConfig.Pool, c.ExtraConfig.WatchDispatcher, Scheme, containerProfileProcessor)) + configScanStorageImpl = file.NewConfigurationScanSummaryStorage(storageImpl) + vulnerabilitySummaryStorage = file.NewVulnerabilitySummaryStorage(storageImpl) + generatedNetworkPolicyStorage = file.NewGeneratedNetworkPolicyStorage(storageImpl) // REST endpoint registration, defaults to storageImpl. ep = func(f func(*runtime.Scheme, storage.Interface, generic.RESTOptionsGetter) (*registry.REST, error), s ...storage.Interface) *registry.REST { @@ -179,18 +172,14 @@ func (c completedConfig) New() (*WardleServer, error) { // // One shared provider closure is wired into both processors so a single // CR update affects both compaction paths consistently. - collapseSettingsFromCRD := file.NewCRDCollapseSettingsProvider(applicationProfileStorageBackend) - applicationProfileProcessor.SetCollapseSettings(collapseSettingsFromCRD) + collapseSettingsFromCRD := file.NewCRDCollapseSettingsProvider(storageImpl) containerProfileProcessor.CollapseSettings = collapseSettingsFromCRD - networkNeighborhoodProcessor.SetCollapseSettings(collapseSettingsFromCRD) apiGroupInfo.VersionedResourcesStorageMap["v1beta1"] = map[string]rest.Storage{ - "applicationprofiles": ep(applicationprofile.NewREST, applicationProfileStorageImpl), "collapseconfigurations": ep(collapseconfiguration.NewREST), "configurationscansummaries": ep(configurationscansummary.NewREST, configScanStorageImpl), "containerprofiles": ep(containerprofile.NewREST, containerProfileStorageImpl), "generatednetworkpolicies": ep(generatednetworkpolicy.NewREST, generatedNetworkPolicyStorage), "knownservers": ep(knownserver.NewREST), - "networkneighborhoods": ep(networkneighborhood.NewREST, networkNeighborhoodStorageImpl), "openvulnerabilityexchangecontainers": ep(openvulnerabilityexchange.NewREST), "sbomsyftfiltereds": ep(sbomsyftfiltereds.NewREST), "sbomsyfts": ep(sbomsyfts.NewREST), diff --git a/pkg/config/config.go b/pkg/config/config.go index 9239f2915..24c1df1f2 100644 --- a/pkg/config/config.go +++ b/pkg/config/config.go @@ -22,7 +22,6 @@ type Config struct { DisableSeccompProfileEndpoint bool `mapstructure:"disableSeccompProfileEndpoint"` ExcludeJsonPaths []string `mapstructure:"excludeJsonPaths"` MaxApplicationProfileSize int `mapstructure:"maxApplicationProfileSize"` - MaxNetworkNeighborhoodSize int `mapstructure:"maxNetworkNeighborhoodSize"` MaxSniffingTime time.Duration `mapstructure:"maxSniffingTimePerContainer"` RateLimitPerClient float64 `mapstructure:"rateLimitPerClient"` RateLimitTotal int `mapstructure:"rateLimitTotal"` @@ -55,7 +54,6 @@ func LoadConfig(path string) (Config, error) { v.SetDefault("cleanupInterval", 24*time.Hour) v.SetDefault("defaultNamespace", "kubescape") v.SetDefault("maxApplicationProfileSize", 40000) - v.SetDefault("maxNetworkNeighborhoodSize", 40000) v.SetDefault("rateLimitTotal", 10) v.SetDefault("serverBindAddress", "::") v.SetDefault("serverBindPort", 8443) diff --git a/pkg/config/config_test.go b/pkg/config/config_test.go index ebfe4989f..44ab7b794 100644 --- a/pkg/config/config_test.go +++ b/pkg/config/config_test.go @@ -25,8 +25,7 @@ func TestLoadConfig(t *testing.T) { DefaultNamespace: "kubescape", HostType: armotypes.HostTypeKubernetes, ExcludeJsonPaths: []string{".containers[*].env[?(@.name==\"KUBECONFIG\")]"}, - MaxApplicationProfileSize: 40000, - MaxNetworkNeighborhoodSize: 40000, + MaxApplicationProfileSize: 40000, RateLimitTotal: 10, ServerBindAddress: "::", ServerBindPort: 8443, diff --git a/pkg/generated/applyconfiguration/softwarecomposition/v1beta1/applicationprofile.go b/pkg/generated/applyconfiguration/softwarecomposition/v1beta1/applicationprofile.go deleted file mode 100644 index 54be26fcb..000000000 --- a/pkg/generated/applyconfiguration/softwarecomposition/v1beta1/applicationprofile.go +++ /dev/null @@ -1,244 +0,0 @@ -/* -Copyright The Kubernetes Authors. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -*/ - -// Code generated by applyconfiguration-gen. DO NOT EDIT. - -package v1beta1 - -import ( - softwarecompositionv1beta1 "github.com/kubescape/storage/pkg/apis/softwarecomposition/v1beta1" - metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" - types "k8s.io/apimachinery/pkg/types" - v1 "k8s.io/client-go/applyconfigurations/meta/v1" -) - -// ApplicationProfileApplyConfiguration represents a declarative configuration of the ApplicationProfile type for use -// with apply. -type ApplicationProfileApplyConfiguration struct { - v1.TypeMetaApplyConfiguration `json:",inline"` - *v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"` - Spec *ApplicationProfileSpecApplyConfiguration `json:"spec,omitempty"` - Status *softwarecompositionv1beta1.ApplicationProfileStatus `json:"status,omitempty"` -} - -// ApplicationProfile constructs a declarative configuration of the ApplicationProfile type for use with -// apply. -func ApplicationProfile(name, namespace string) *ApplicationProfileApplyConfiguration { - b := &ApplicationProfileApplyConfiguration{} - b.WithName(name) - b.WithNamespace(namespace) - b.WithKind("ApplicationProfile") - b.WithAPIVersion("spdx.softwarecomposition.kubescape.io/v1beta1") - return b -} - -func (b ApplicationProfileApplyConfiguration) IsApplyConfiguration() {} - -// WithKind sets the Kind field in the declarative configuration to the given value -// and returns the receiver, so that objects can be built by chaining "With" function invocations. -// If called multiple times, the Kind field is set to the value of the last call. -func (b *ApplicationProfileApplyConfiguration) WithKind(value string) *ApplicationProfileApplyConfiguration { - b.TypeMetaApplyConfiguration.Kind = &value - return b -} - -// WithAPIVersion sets the APIVersion field in the declarative configuration to the given value -// and returns the receiver, so that objects can be built by chaining "With" function invocations. -// If called multiple times, the APIVersion field is set to the value of the last call. -func (b *ApplicationProfileApplyConfiguration) WithAPIVersion(value string) *ApplicationProfileApplyConfiguration { - b.TypeMetaApplyConfiguration.APIVersion = &value - return b -} - -// WithName sets the Name field in the declarative configuration to the given value -// and returns the receiver, so that objects can be built by chaining "With" function invocations. -// If called multiple times, the Name field is set to the value of the last call. -func (b *ApplicationProfileApplyConfiguration) WithName(value string) *ApplicationProfileApplyConfiguration { - b.ensureObjectMetaApplyConfigurationExists() - b.ObjectMetaApplyConfiguration.Name = &value - return b -} - -// WithGenerateName sets the GenerateName field in the declarative configuration to the given value -// and returns the receiver, so that objects can be built by chaining "With" function invocations. -// If called multiple times, the GenerateName field is set to the value of the last call. -func (b *ApplicationProfileApplyConfiguration) WithGenerateName(value string) *ApplicationProfileApplyConfiguration { - b.ensureObjectMetaApplyConfigurationExists() - b.ObjectMetaApplyConfiguration.GenerateName = &value - return b -} - -// WithNamespace sets the Namespace field in the declarative configuration to the given value -// and returns the receiver, so that objects can be built by chaining "With" function invocations. -// If called multiple times, the Namespace field is set to the value of the last call. -func (b *ApplicationProfileApplyConfiguration) WithNamespace(value string) *ApplicationProfileApplyConfiguration { - b.ensureObjectMetaApplyConfigurationExists() - b.ObjectMetaApplyConfiguration.Namespace = &value - return b -} - -// WithUID sets the UID field in the declarative configuration to the given value -// and returns the receiver, so that objects can be built by chaining "With" function invocations. -// If called multiple times, the UID field is set to the value of the last call. -func (b *ApplicationProfileApplyConfiguration) WithUID(value types.UID) *ApplicationProfileApplyConfiguration { - b.ensureObjectMetaApplyConfigurationExists() - b.ObjectMetaApplyConfiguration.UID = &value - return b -} - -// WithResourceVersion sets the ResourceVersion field in the declarative configuration to the given value -// and returns the receiver, so that objects can be built by chaining "With" function invocations. -// If called multiple times, the ResourceVersion field is set to the value of the last call. -func (b *ApplicationProfileApplyConfiguration) WithResourceVersion(value string) *ApplicationProfileApplyConfiguration { - b.ensureObjectMetaApplyConfigurationExists() - b.ObjectMetaApplyConfiguration.ResourceVersion = &value - return b -} - -// WithGeneration sets the Generation field in the declarative configuration to the given value -// and returns the receiver, so that objects can be built by chaining "With" function invocations. -// If called multiple times, the Generation field is set to the value of the last call. -func (b *ApplicationProfileApplyConfiguration) WithGeneration(value int64) *ApplicationProfileApplyConfiguration { - b.ensureObjectMetaApplyConfigurationExists() - b.ObjectMetaApplyConfiguration.Generation = &value - return b -} - -// WithCreationTimestamp sets the CreationTimestamp field in the declarative configuration to the given value -// and returns the receiver, so that objects can be built by chaining "With" function invocations. -// If called multiple times, the CreationTimestamp field is set to the value of the last call. -func (b *ApplicationProfileApplyConfiguration) WithCreationTimestamp(value metav1.Time) *ApplicationProfileApplyConfiguration { - b.ensureObjectMetaApplyConfigurationExists() - b.ObjectMetaApplyConfiguration.CreationTimestamp = &value - return b -} - -// WithDeletionTimestamp sets the DeletionTimestamp field in the declarative configuration to the given value -// and returns the receiver, so that objects can be built by chaining "With" function invocations. -// If called multiple times, the DeletionTimestamp field is set to the value of the last call. -func (b *ApplicationProfileApplyConfiguration) WithDeletionTimestamp(value metav1.Time) *ApplicationProfileApplyConfiguration { - b.ensureObjectMetaApplyConfigurationExists() - b.ObjectMetaApplyConfiguration.DeletionTimestamp = &value - return b -} - -// WithDeletionGracePeriodSeconds sets the DeletionGracePeriodSeconds field in the declarative configuration to the given value -// and returns the receiver, so that objects can be built by chaining "With" function invocations. -// If called multiple times, the DeletionGracePeriodSeconds field is set to the value of the last call. -func (b *ApplicationProfileApplyConfiguration) WithDeletionGracePeriodSeconds(value int64) *ApplicationProfileApplyConfiguration { - b.ensureObjectMetaApplyConfigurationExists() - b.ObjectMetaApplyConfiguration.DeletionGracePeriodSeconds = &value - return b -} - -// WithLabels puts the entries into the Labels field in the declarative configuration -// and returns the receiver, so that objects can be build by chaining "With" function invocations. -// If called multiple times, the entries provided by each call will be put on the Labels field, -// overwriting an existing map entries in Labels field with the same key. -func (b *ApplicationProfileApplyConfiguration) WithLabels(entries map[string]string) *ApplicationProfileApplyConfiguration { - b.ensureObjectMetaApplyConfigurationExists() - if b.ObjectMetaApplyConfiguration.Labels == nil && len(entries) > 0 { - b.ObjectMetaApplyConfiguration.Labels = make(map[string]string, len(entries)) - } - for k, v := range entries { - b.ObjectMetaApplyConfiguration.Labels[k] = v - } - return b -} - -// WithAnnotations puts the entries into the Annotations field in the declarative configuration -// and returns the receiver, so that objects can be build by chaining "With" function invocations. -// If called multiple times, the entries provided by each call will be put on the Annotations field, -// overwriting an existing map entries in Annotations field with the same key. -func (b *ApplicationProfileApplyConfiguration) WithAnnotations(entries map[string]string) *ApplicationProfileApplyConfiguration { - b.ensureObjectMetaApplyConfigurationExists() - if b.ObjectMetaApplyConfiguration.Annotations == nil && len(entries) > 0 { - b.ObjectMetaApplyConfiguration.Annotations = make(map[string]string, len(entries)) - } - for k, v := range entries { - b.ObjectMetaApplyConfiguration.Annotations[k] = v - } - return b -} - -// WithOwnerReferences adds the given value to the OwnerReferences field in the declarative configuration -// and returns the receiver, so that objects can be build by chaining "With" function invocations. -// If called multiple times, values provided by each call will be appended to the OwnerReferences field. -func (b *ApplicationProfileApplyConfiguration) WithOwnerReferences(values ...*v1.OwnerReferenceApplyConfiguration) *ApplicationProfileApplyConfiguration { - b.ensureObjectMetaApplyConfigurationExists() - for i := range values { - if values[i] == nil { - panic("nil value passed to WithOwnerReferences") - } - b.ObjectMetaApplyConfiguration.OwnerReferences = append(b.ObjectMetaApplyConfiguration.OwnerReferences, *values[i]) - } - return b -} - -// WithFinalizers adds the given value to the Finalizers field in the declarative configuration -// and returns the receiver, so that objects can be build by chaining "With" function invocations. -// If called multiple times, values provided by each call will be appended to the Finalizers field. -func (b *ApplicationProfileApplyConfiguration) WithFinalizers(values ...string) *ApplicationProfileApplyConfiguration { - b.ensureObjectMetaApplyConfigurationExists() - for i := range values { - b.ObjectMetaApplyConfiguration.Finalizers = append(b.ObjectMetaApplyConfiguration.Finalizers, values[i]) - } - return b -} - -func (b *ApplicationProfileApplyConfiguration) ensureObjectMetaApplyConfigurationExists() { - if b.ObjectMetaApplyConfiguration == nil { - b.ObjectMetaApplyConfiguration = &v1.ObjectMetaApplyConfiguration{} - } -} - -// WithSpec sets the Spec field in the declarative configuration to the given value -// and returns the receiver, so that objects can be built by chaining "With" function invocations. -// If called multiple times, the Spec field is set to the value of the last call. -func (b *ApplicationProfileApplyConfiguration) WithSpec(value *ApplicationProfileSpecApplyConfiguration) *ApplicationProfileApplyConfiguration { - b.Spec = value - return b -} - -// WithStatus sets the Status field in the declarative configuration to the given value -// and returns the receiver, so that objects can be built by chaining "With" function invocations. -// If called multiple times, the Status field is set to the value of the last call. -func (b *ApplicationProfileApplyConfiguration) WithStatus(value softwarecompositionv1beta1.ApplicationProfileStatus) *ApplicationProfileApplyConfiguration { - b.Status = &value - return b -} - -// GetKind retrieves the value of the Kind field in the declarative configuration. -func (b *ApplicationProfileApplyConfiguration) GetKind() *string { - return b.TypeMetaApplyConfiguration.Kind -} - -// GetAPIVersion retrieves the value of the APIVersion field in the declarative configuration. -func (b *ApplicationProfileApplyConfiguration) GetAPIVersion() *string { - return b.TypeMetaApplyConfiguration.APIVersion -} - -// GetName retrieves the value of the Name field in the declarative configuration. -func (b *ApplicationProfileApplyConfiguration) GetName() *string { - b.ensureObjectMetaApplyConfigurationExists() - return b.ObjectMetaApplyConfiguration.Name -} - -// GetNamespace retrieves the value of the Namespace field in the declarative configuration. -func (b *ApplicationProfileApplyConfiguration) GetNamespace() *string { - b.ensureObjectMetaApplyConfigurationExists() - return b.ObjectMetaApplyConfiguration.Namespace -} diff --git a/pkg/generated/applyconfiguration/softwarecomposition/v1beta1/applicationprofilecontainer.go b/pkg/generated/applyconfiguration/softwarecomposition/v1beta1/applicationprofilecontainer.go deleted file mode 100644 index da0d6be9f..000000000 --- a/pkg/generated/applyconfiguration/softwarecomposition/v1beta1/applicationprofilecontainer.go +++ /dev/null @@ -1,159 +0,0 @@ -/* -Copyright The Kubernetes Authors. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -*/ - -// Code generated by applyconfiguration-gen. DO NOT EDIT. - -package v1beta1 - -// ApplicationProfileContainerApplyConfiguration represents a declarative configuration of the ApplicationProfileContainer type for use -// with apply. -type ApplicationProfileContainerApplyConfiguration struct { - Name *string `json:"name,omitempty"` - Capabilities []string `json:"capabilities,omitempty"` - Execs []ExecCallsApplyConfiguration `json:"execs,omitempty"` - Opens []OpenCallsApplyConfiguration `json:"opens,omitempty"` - Syscalls []string `json:"syscalls,omitempty"` - SeccompProfile *SingleSeccompProfileApplyConfiguration `json:"seccompProfile,omitempty"` - Endpoints []HTTPEndpointApplyConfiguration `json:"endpoints,omitempty"` - ImageID *string `json:"imageID,omitempty"` - ImageTag *string `json:"imageTag,omitempty"` - PolicyByRuleId map[string]RulePolicyApplyConfiguration `json:"rulePolicies,omitempty"` - IdentifiedCallStacks []IdentifiedCallStackApplyConfiguration `json:"identifiedCallStacks,omitempty"` -} - -// ApplicationProfileContainerApplyConfiguration constructs a declarative configuration of the ApplicationProfileContainer type for use with -// apply. -func ApplicationProfileContainer() *ApplicationProfileContainerApplyConfiguration { - return &ApplicationProfileContainerApplyConfiguration{} -} - -// WithName sets the Name field in the declarative configuration to the given value -// and returns the receiver, so that objects can be built by chaining "With" function invocations. -// If called multiple times, the Name field is set to the value of the last call. -func (b *ApplicationProfileContainerApplyConfiguration) WithName(value string) *ApplicationProfileContainerApplyConfiguration { - b.Name = &value - return b -} - -// WithCapabilities adds the given value to the Capabilities field in the declarative configuration -// and returns the receiver, so that objects can be build by chaining "With" function invocations. -// If called multiple times, values provided by each call will be appended to the Capabilities field. -func (b *ApplicationProfileContainerApplyConfiguration) WithCapabilities(values ...string) *ApplicationProfileContainerApplyConfiguration { - for i := range values { - b.Capabilities = append(b.Capabilities, values[i]) - } - return b -} - -// WithExecs adds the given value to the Execs field in the declarative configuration -// and returns the receiver, so that objects can be build by chaining "With" function invocations. -// If called multiple times, values provided by each call will be appended to the Execs field. -func (b *ApplicationProfileContainerApplyConfiguration) WithExecs(values ...*ExecCallsApplyConfiguration) *ApplicationProfileContainerApplyConfiguration { - for i := range values { - if values[i] == nil { - panic("nil value passed to WithExecs") - } - b.Execs = append(b.Execs, *values[i]) - } - return b -} - -// WithOpens adds the given value to the Opens field in the declarative configuration -// and returns the receiver, so that objects can be build by chaining "With" function invocations. -// If called multiple times, values provided by each call will be appended to the Opens field. -func (b *ApplicationProfileContainerApplyConfiguration) WithOpens(values ...*OpenCallsApplyConfiguration) *ApplicationProfileContainerApplyConfiguration { - for i := range values { - if values[i] == nil { - panic("nil value passed to WithOpens") - } - b.Opens = append(b.Opens, *values[i]) - } - return b -} - -// WithSyscalls adds the given value to the Syscalls field in the declarative configuration -// and returns the receiver, so that objects can be build by chaining "With" function invocations. -// If called multiple times, values provided by each call will be appended to the Syscalls field. -func (b *ApplicationProfileContainerApplyConfiguration) WithSyscalls(values ...string) *ApplicationProfileContainerApplyConfiguration { - for i := range values { - b.Syscalls = append(b.Syscalls, values[i]) - } - return b -} - -// WithSeccompProfile sets the SeccompProfile field in the declarative configuration to the given value -// and returns the receiver, so that objects can be built by chaining "With" function invocations. -// If called multiple times, the SeccompProfile field is set to the value of the last call. -func (b *ApplicationProfileContainerApplyConfiguration) WithSeccompProfile(value *SingleSeccompProfileApplyConfiguration) *ApplicationProfileContainerApplyConfiguration { - b.SeccompProfile = value - return b -} - -// WithEndpoints adds the given value to the Endpoints field in the declarative configuration -// and returns the receiver, so that objects can be build by chaining "With" function invocations. -// If called multiple times, values provided by each call will be appended to the Endpoints field. -func (b *ApplicationProfileContainerApplyConfiguration) WithEndpoints(values ...*HTTPEndpointApplyConfiguration) *ApplicationProfileContainerApplyConfiguration { - for i := range values { - if values[i] == nil { - panic("nil value passed to WithEndpoints") - } - b.Endpoints = append(b.Endpoints, *values[i]) - } - return b -} - -// WithImageID sets the ImageID field in the declarative configuration to the given value -// and returns the receiver, so that objects can be built by chaining "With" function invocations. -// If called multiple times, the ImageID field is set to the value of the last call. -func (b *ApplicationProfileContainerApplyConfiguration) WithImageID(value string) *ApplicationProfileContainerApplyConfiguration { - b.ImageID = &value - return b -} - -// WithImageTag sets the ImageTag field in the declarative configuration to the given value -// and returns the receiver, so that objects can be built by chaining "With" function invocations. -// If called multiple times, the ImageTag field is set to the value of the last call. -func (b *ApplicationProfileContainerApplyConfiguration) WithImageTag(value string) *ApplicationProfileContainerApplyConfiguration { - b.ImageTag = &value - return b -} - -// WithPolicyByRuleId puts the entries into the PolicyByRuleId field in the declarative configuration -// and returns the receiver, so that objects can be build by chaining "With" function invocations. -// If called multiple times, the entries provided by each call will be put on the PolicyByRuleId field, -// overwriting an existing map entries in PolicyByRuleId field with the same key. -func (b *ApplicationProfileContainerApplyConfiguration) WithPolicyByRuleId(entries map[string]RulePolicyApplyConfiguration) *ApplicationProfileContainerApplyConfiguration { - if b.PolicyByRuleId == nil && len(entries) > 0 { - b.PolicyByRuleId = make(map[string]RulePolicyApplyConfiguration, len(entries)) - } - for k, v := range entries { - b.PolicyByRuleId[k] = v - } - return b -} - -// WithIdentifiedCallStacks adds the given value to the IdentifiedCallStacks field in the declarative configuration -// and returns the receiver, so that objects can be build by chaining "With" function invocations. -// If called multiple times, values provided by each call will be appended to the IdentifiedCallStacks field. -func (b *ApplicationProfileContainerApplyConfiguration) WithIdentifiedCallStacks(values ...*IdentifiedCallStackApplyConfiguration) *ApplicationProfileContainerApplyConfiguration { - for i := range values { - if values[i] == nil { - panic("nil value passed to WithIdentifiedCallStacks") - } - b.IdentifiedCallStacks = append(b.IdentifiedCallStacks, *values[i]) - } - return b -} diff --git a/pkg/generated/applyconfiguration/softwarecomposition/v1beta1/applicationprofilespec.go b/pkg/generated/applyconfiguration/softwarecomposition/v1beta1/applicationprofilespec.go deleted file mode 100644 index 7f3370614..000000000 --- a/pkg/generated/applyconfiguration/softwarecomposition/v1beta1/applicationprofilespec.go +++ /dev/null @@ -1,83 +0,0 @@ -/* -Copyright The Kubernetes Authors. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -*/ - -// Code generated by applyconfiguration-gen. DO NOT EDIT. - -package v1beta1 - -// ApplicationProfileSpecApplyConfiguration represents a declarative configuration of the ApplicationProfileSpec type for use -// with apply. -type ApplicationProfileSpecApplyConfiguration struct { - Architectures []string `json:"architectures,omitempty"` - Containers []ApplicationProfileContainerApplyConfiguration `json:"containers,omitempty"` - InitContainers []ApplicationProfileContainerApplyConfiguration `json:"initContainers,omitempty"` - EphemeralContainers []ApplicationProfileContainerApplyConfiguration `json:"ephemeralContainers,omitempty"` -} - -// ApplicationProfileSpecApplyConfiguration constructs a declarative configuration of the ApplicationProfileSpec type for use with -// apply. -func ApplicationProfileSpec() *ApplicationProfileSpecApplyConfiguration { - return &ApplicationProfileSpecApplyConfiguration{} -} - -// WithArchitectures adds the given value to the Architectures field in the declarative configuration -// and returns the receiver, so that objects can be build by chaining "With" function invocations. -// If called multiple times, values provided by each call will be appended to the Architectures field. -func (b *ApplicationProfileSpecApplyConfiguration) WithArchitectures(values ...string) *ApplicationProfileSpecApplyConfiguration { - for i := range values { - b.Architectures = append(b.Architectures, values[i]) - } - return b -} - -// WithContainers adds the given value to the Containers field in the declarative configuration -// and returns the receiver, so that objects can be build by chaining "With" function invocations. -// If called multiple times, values provided by each call will be appended to the Containers field. -func (b *ApplicationProfileSpecApplyConfiguration) WithContainers(values ...*ApplicationProfileContainerApplyConfiguration) *ApplicationProfileSpecApplyConfiguration { - for i := range values { - if values[i] == nil { - panic("nil value passed to WithContainers") - } - b.Containers = append(b.Containers, *values[i]) - } - return b -} - -// WithInitContainers adds the given value to the InitContainers field in the declarative configuration -// and returns the receiver, so that objects can be build by chaining "With" function invocations. -// If called multiple times, values provided by each call will be appended to the InitContainers field. -func (b *ApplicationProfileSpecApplyConfiguration) WithInitContainers(values ...*ApplicationProfileContainerApplyConfiguration) *ApplicationProfileSpecApplyConfiguration { - for i := range values { - if values[i] == nil { - panic("nil value passed to WithInitContainers") - } - b.InitContainers = append(b.InitContainers, *values[i]) - } - return b -} - -// WithEphemeralContainers adds the given value to the EphemeralContainers field in the declarative configuration -// and returns the receiver, so that objects can be build by chaining "With" function invocations. -// If called multiple times, values provided by each call will be appended to the EphemeralContainers field. -func (b *ApplicationProfileSpecApplyConfiguration) WithEphemeralContainers(values ...*ApplicationProfileContainerApplyConfiguration) *ApplicationProfileSpecApplyConfiguration { - for i := range values { - if values[i] == nil { - panic("nil value passed to WithEphemeralContainers") - } - b.EphemeralContainers = append(b.EphemeralContainers, *values[i]) - } - return b -} diff --git a/pkg/generated/applyconfiguration/softwarecomposition/v1beta1/networkneighborhood.go b/pkg/generated/applyconfiguration/softwarecomposition/v1beta1/networkneighborhood.go deleted file mode 100644 index 85ad99962..000000000 --- a/pkg/generated/applyconfiguration/softwarecomposition/v1beta1/networkneighborhood.go +++ /dev/null @@ -1,236 +0,0 @@ -/* -Copyright The Kubernetes Authors. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -*/ - -// Code generated by applyconfiguration-gen. DO NOT EDIT. - -package v1beta1 - -import ( - metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" - types "k8s.io/apimachinery/pkg/types" - v1 "k8s.io/client-go/applyconfigurations/meta/v1" -) - -// NetworkNeighborhoodApplyConfiguration represents a declarative configuration of the NetworkNeighborhood type for use -// with apply. -// -// NetworkNeighborhood represents a list of network communications for a specific workload. -type NetworkNeighborhoodApplyConfiguration struct { - v1.TypeMetaApplyConfiguration `json:",inline"` - *v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"` - Spec *NetworkNeighborhoodSpecApplyConfiguration `json:"spec,omitempty"` -} - -// NetworkNeighborhood constructs a declarative configuration of the NetworkNeighborhood type for use with -// apply. -func NetworkNeighborhood(name, namespace string) *NetworkNeighborhoodApplyConfiguration { - b := &NetworkNeighborhoodApplyConfiguration{} - b.WithName(name) - b.WithNamespace(namespace) - b.WithKind("NetworkNeighborhood") - b.WithAPIVersion("spdx.softwarecomposition.kubescape.io/v1beta1") - return b -} - -func (b NetworkNeighborhoodApplyConfiguration) IsApplyConfiguration() {} - -// WithKind sets the Kind field in the declarative configuration to the given value -// and returns the receiver, so that objects can be built by chaining "With" function invocations. -// If called multiple times, the Kind field is set to the value of the last call. -func (b *NetworkNeighborhoodApplyConfiguration) WithKind(value string) *NetworkNeighborhoodApplyConfiguration { - b.TypeMetaApplyConfiguration.Kind = &value - return b -} - -// WithAPIVersion sets the APIVersion field in the declarative configuration to the given value -// and returns the receiver, so that objects can be built by chaining "With" function invocations. -// If called multiple times, the APIVersion field is set to the value of the last call. -func (b *NetworkNeighborhoodApplyConfiguration) WithAPIVersion(value string) *NetworkNeighborhoodApplyConfiguration { - b.TypeMetaApplyConfiguration.APIVersion = &value - return b -} - -// WithName sets the Name field in the declarative configuration to the given value -// and returns the receiver, so that objects can be built by chaining "With" function invocations. -// If called multiple times, the Name field is set to the value of the last call. -func (b *NetworkNeighborhoodApplyConfiguration) WithName(value string) *NetworkNeighborhoodApplyConfiguration { - b.ensureObjectMetaApplyConfigurationExists() - b.ObjectMetaApplyConfiguration.Name = &value - return b -} - -// WithGenerateName sets the GenerateName field in the declarative configuration to the given value -// and returns the receiver, so that objects can be built by chaining "With" function invocations. -// If called multiple times, the GenerateName field is set to the value of the last call. -func (b *NetworkNeighborhoodApplyConfiguration) WithGenerateName(value string) *NetworkNeighborhoodApplyConfiguration { - b.ensureObjectMetaApplyConfigurationExists() - b.ObjectMetaApplyConfiguration.GenerateName = &value - return b -} - -// WithNamespace sets the Namespace field in the declarative configuration to the given value -// and returns the receiver, so that objects can be built by chaining "With" function invocations. -// If called multiple times, the Namespace field is set to the value of the last call. -func (b *NetworkNeighborhoodApplyConfiguration) WithNamespace(value string) *NetworkNeighborhoodApplyConfiguration { - b.ensureObjectMetaApplyConfigurationExists() - b.ObjectMetaApplyConfiguration.Namespace = &value - return b -} - -// WithUID sets the UID field in the declarative configuration to the given value -// and returns the receiver, so that objects can be built by chaining "With" function invocations. -// If called multiple times, the UID field is set to the value of the last call. -func (b *NetworkNeighborhoodApplyConfiguration) WithUID(value types.UID) *NetworkNeighborhoodApplyConfiguration { - b.ensureObjectMetaApplyConfigurationExists() - b.ObjectMetaApplyConfiguration.UID = &value - return b -} - -// WithResourceVersion sets the ResourceVersion field in the declarative configuration to the given value -// and returns the receiver, so that objects can be built by chaining "With" function invocations. -// If called multiple times, the ResourceVersion field is set to the value of the last call. -func (b *NetworkNeighborhoodApplyConfiguration) WithResourceVersion(value string) *NetworkNeighborhoodApplyConfiguration { - b.ensureObjectMetaApplyConfigurationExists() - b.ObjectMetaApplyConfiguration.ResourceVersion = &value - return b -} - -// WithGeneration sets the Generation field in the declarative configuration to the given value -// and returns the receiver, so that objects can be built by chaining "With" function invocations. -// If called multiple times, the Generation field is set to the value of the last call. -func (b *NetworkNeighborhoodApplyConfiguration) WithGeneration(value int64) *NetworkNeighborhoodApplyConfiguration { - b.ensureObjectMetaApplyConfigurationExists() - b.ObjectMetaApplyConfiguration.Generation = &value - return b -} - -// WithCreationTimestamp sets the CreationTimestamp field in the declarative configuration to the given value -// and returns the receiver, so that objects can be built by chaining "With" function invocations. -// If called multiple times, the CreationTimestamp field is set to the value of the last call. -func (b *NetworkNeighborhoodApplyConfiguration) WithCreationTimestamp(value metav1.Time) *NetworkNeighborhoodApplyConfiguration { - b.ensureObjectMetaApplyConfigurationExists() - b.ObjectMetaApplyConfiguration.CreationTimestamp = &value - return b -} - -// WithDeletionTimestamp sets the DeletionTimestamp field in the declarative configuration to the given value -// and returns the receiver, so that objects can be built by chaining "With" function invocations. -// If called multiple times, the DeletionTimestamp field is set to the value of the last call. -func (b *NetworkNeighborhoodApplyConfiguration) WithDeletionTimestamp(value metav1.Time) *NetworkNeighborhoodApplyConfiguration { - b.ensureObjectMetaApplyConfigurationExists() - b.ObjectMetaApplyConfiguration.DeletionTimestamp = &value - return b -} - -// WithDeletionGracePeriodSeconds sets the DeletionGracePeriodSeconds field in the declarative configuration to the given value -// and returns the receiver, so that objects can be built by chaining "With" function invocations. -// If called multiple times, the DeletionGracePeriodSeconds field is set to the value of the last call. -func (b *NetworkNeighborhoodApplyConfiguration) WithDeletionGracePeriodSeconds(value int64) *NetworkNeighborhoodApplyConfiguration { - b.ensureObjectMetaApplyConfigurationExists() - b.ObjectMetaApplyConfiguration.DeletionGracePeriodSeconds = &value - return b -} - -// WithLabels puts the entries into the Labels field in the declarative configuration -// and returns the receiver, so that objects can be build by chaining "With" function invocations. -// If called multiple times, the entries provided by each call will be put on the Labels field, -// overwriting an existing map entries in Labels field with the same key. -func (b *NetworkNeighborhoodApplyConfiguration) WithLabels(entries map[string]string) *NetworkNeighborhoodApplyConfiguration { - b.ensureObjectMetaApplyConfigurationExists() - if b.ObjectMetaApplyConfiguration.Labels == nil && len(entries) > 0 { - b.ObjectMetaApplyConfiguration.Labels = make(map[string]string, len(entries)) - } - for k, v := range entries { - b.ObjectMetaApplyConfiguration.Labels[k] = v - } - return b -} - -// WithAnnotations puts the entries into the Annotations field in the declarative configuration -// and returns the receiver, so that objects can be build by chaining "With" function invocations. -// If called multiple times, the entries provided by each call will be put on the Annotations field, -// overwriting an existing map entries in Annotations field with the same key. -func (b *NetworkNeighborhoodApplyConfiguration) WithAnnotations(entries map[string]string) *NetworkNeighborhoodApplyConfiguration { - b.ensureObjectMetaApplyConfigurationExists() - if b.ObjectMetaApplyConfiguration.Annotations == nil && len(entries) > 0 { - b.ObjectMetaApplyConfiguration.Annotations = make(map[string]string, len(entries)) - } - for k, v := range entries { - b.ObjectMetaApplyConfiguration.Annotations[k] = v - } - return b -} - -// WithOwnerReferences adds the given value to the OwnerReferences field in the declarative configuration -// and returns the receiver, so that objects can be build by chaining "With" function invocations. -// If called multiple times, values provided by each call will be appended to the OwnerReferences field. -func (b *NetworkNeighborhoodApplyConfiguration) WithOwnerReferences(values ...*v1.OwnerReferenceApplyConfiguration) *NetworkNeighborhoodApplyConfiguration { - b.ensureObjectMetaApplyConfigurationExists() - for i := range values { - if values[i] == nil { - panic("nil value passed to WithOwnerReferences") - } - b.ObjectMetaApplyConfiguration.OwnerReferences = append(b.ObjectMetaApplyConfiguration.OwnerReferences, *values[i]) - } - return b -} - -// WithFinalizers adds the given value to the Finalizers field in the declarative configuration -// and returns the receiver, so that objects can be build by chaining "With" function invocations. -// If called multiple times, values provided by each call will be appended to the Finalizers field. -func (b *NetworkNeighborhoodApplyConfiguration) WithFinalizers(values ...string) *NetworkNeighborhoodApplyConfiguration { - b.ensureObjectMetaApplyConfigurationExists() - for i := range values { - b.ObjectMetaApplyConfiguration.Finalizers = append(b.ObjectMetaApplyConfiguration.Finalizers, values[i]) - } - return b -} - -func (b *NetworkNeighborhoodApplyConfiguration) ensureObjectMetaApplyConfigurationExists() { - if b.ObjectMetaApplyConfiguration == nil { - b.ObjectMetaApplyConfiguration = &v1.ObjectMetaApplyConfiguration{} - } -} - -// WithSpec sets the Spec field in the declarative configuration to the given value -// and returns the receiver, so that objects can be built by chaining "With" function invocations. -// If called multiple times, the Spec field is set to the value of the last call. -func (b *NetworkNeighborhoodApplyConfiguration) WithSpec(value *NetworkNeighborhoodSpecApplyConfiguration) *NetworkNeighborhoodApplyConfiguration { - b.Spec = value - return b -} - -// GetKind retrieves the value of the Kind field in the declarative configuration. -func (b *NetworkNeighborhoodApplyConfiguration) GetKind() *string { - return b.TypeMetaApplyConfiguration.Kind -} - -// GetAPIVersion retrieves the value of the APIVersion field in the declarative configuration. -func (b *NetworkNeighborhoodApplyConfiguration) GetAPIVersion() *string { - return b.TypeMetaApplyConfiguration.APIVersion -} - -// GetName retrieves the value of the Name field in the declarative configuration. -func (b *NetworkNeighborhoodApplyConfiguration) GetName() *string { - b.ensureObjectMetaApplyConfigurationExists() - return b.ObjectMetaApplyConfiguration.Name -} - -// GetNamespace retrieves the value of the Namespace field in the declarative configuration. -func (b *NetworkNeighborhoodApplyConfiguration) GetNamespace() *string { - b.ensureObjectMetaApplyConfigurationExists() - return b.ObjectMetaApplyConfiguration.Namespace -} diff --git a/pkg/generated/applyconfiguration/softwarecomposition/v1beta1/networkneighborhoodcontainer.go b/pkg/generated/applyconfiguration/softwarecomposition/v1beta1/networkneighborhoodcontainer.go deleted file mode 100644 index dc2eeb148..000000000 --- a/pkg/generated/applyconfiguration/softwarecomposition/v1beta1/networkneighborhoodcontainer.go +++ /dev/null @@ -1,67 +0,0 @@ -/* -Copyright The Kubernetes Authors. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -*/ - -// Code generated by applyconfiguration-gen. DO NOT EDIT. - -package v1beta1 - -// NetworkNeighborhoodContainerApplyConfiguration represents a declarative configuration of the NetworkNeighborhoodContainer type for use -// with apply. -type NetworkNeighborhoodContainerApplyConfiguration struct { - Name *string `json:"name,omitempty"` - Ingress []NetworkNeighborApplyConfiguration `json:"ingress,omitempty"` - Egress []NetworkNeighborApplyConfiguration `json:"egress,omitempty"` -} - -// NetworkNeighborhoodContainerApplyConfiguration constructs a declarative configuration of the NetworkNeighborhoodContainer type for use with -// apply. -func NetworkNeighborhoodContainer() *NetworkNeighborhoodContainerApplyConfiguration { - return &NetworkNeighborhoodContainerApplyConfiguration{} -} - -// WithName sets the Name field in the declarative configuration to the given value -// and returns the receiver, so that objects can be built by chaining "With" function invocations. -// If called multiple times, the Name field is set to the value of the last call. -func (b *NetworkNeighborhoodContainerApplyConfiguration) WithName(value string) *NetworkNeighborhoodContainerApplyConfiguration { - b.Name = &value - return b -} - -// WithIngress adds the given value to the Ingress field in the declarative configuration -// and returns the receiver, so that objects can be build by chaining "With" function invocations. -// If called multiple times, values provided by each call will be appended to the Ingress field. -func (b *NetworkNeighborhoodContainerApplyConfiguration) WithIngress(values ...*NetworkNeighborApplyConfiguration) *NetworkNeighborhoodContainerApplyConfiguration { - for i := range values { - if values[i] == nil { - panic("nil value passed to WithIngress") - } - b.Ingress = append(b.Ingress, *values[i]) - } - return b -} - -// WithEgress adds the given value to the Egress field in the declarative configuration -// and returns the receiver, so that objects can be build by chaining "With" function invocations. -// If called multiple times, values provided by each call will be appended to the Egress field. -func (b *NetworkNeighborhoodContainerApplyConfiguration) WithEgress(values ...*NetworkNeighborApplyConfiguration) *NetworkNeighborhoodContainerApplyConfiguration { - for i := range values { - if values[i] == nil { - panic("nil value passed to WithEgress") - } - b.Egress = append(b.Egress, *values[i]) - } - return b -} diff --git a/pkg/generated/applyconfiguration/softwarecomposition/v1beta1/networkneighborhoodspec.go b/pkg/generated/applyconfiguration/softwarecomposition/v1beta1/networkneighborhoodspec.go deleted file mode 100644 index d78889c62..000000000 --- a/pkg/generated/applyconfiguration/softwarecomposition/v1beta1/networkneighborhoodspec.go +++ /dev/null @@ -1,104 +0,0 @@ -/* -Copyright The Kubernetes Authors. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -*/ - -// Code generated by applyconfiguration-gen. DO NOT EDIT. - -package v1beta1 - -import ( - v1 "k8s.io/client-go/applyconfigurations/meta/v1" -) - -// NetworkNeighborhoodSpecApplyConfiguration represents a declarative configuration of the NetworkNeighborhoodSpec type for use -// with apply. -type NetworkNeighborhoodSpecApplyConfiguration struct { - v1.LabelSelectorApplyConfiguration `json:",inline"` - Containers []NetworkNeighborhoodContainerApplyConfiguration `json:"containers,omitempty"` - InitContainers []NetworkNeighborhoodContainerApplyConfiguration `json:"initContainers,omitempty"` - EphemeralContainers []NetworkNeighborhoodContainerApplyConfiguration `json:"ephemeralContainers,omitempty"` -} - -// NetworkNeighborhoodSpecApplyConfiguration constructs a declarative configuration of the NetworkNeighborhoodSpec type for use with -// apply. -func NetworkNeighborhoodSpec() *NetworkNeighborhoodSpecApplyConfiguration { - return &NetworkNeighborhoodSpecApplyConfiguration{} -} - -// WithMatchLabels puts the entries into the MatchLabels field in the declarative configuration -// and returns the receiver, so that objects can be build by chaining "With" function invocations. -// If called multiple times, the entries provided by each call will be put on the MatchLabels field, -// overwriting an existing map entries in MatchLabels field with the same key. -func (b *NetworkNeighborhoodSpecApplyConfiguration) WithMatchLabels(entries map[string]string) *NetworkNeighborhoodSpecApplyConfiguration { - if b.LabelSelectorApplyConfiguration.MatchLabels == nil && len(entries) > 0 { - b.LabelSelectorApplyConfiguration.MatchLabels = make(map[string]string, len(entries)) - } - for k, v := range entries { - b.LabelSelectorApplyConfiguration.MatchLabels[k] = v - } - return b -} - -// WithMatchExpressions adds the given value to the MatchExpressions field in the declarative configuration -// and returns the receiver, so that objects can be build by chaining "With" function invocations. -// If called multiple times, values provided by each call will be appended to the MatchExpressions field. -func (b *NetworkNeighborhoodSpecApplyConfiguration) WithMatchExpressions(values ...*v1.LabelSelectorRequirementApplyConfiguration) *NetworkNeighborhoodSpecApplyConfiguration { - for i := range values { - if values[i] == nil { - panic("nil value passed to WithMatchExpressions") - } - b.LabelSelectorApplyConfiguration.MatchExpressions = append(b.LabelSelectorApplyConfiguration.MatchExpressions, *values[i]) - } - return b -} - -// WithContainers adds the given value to the Containers field in the declarative configuration -// and returns the receiver, so that objects can be build by chaining "With" function invocations. -// If called multiple times, values provided by each call will be appended to the Containers field. -func (b *NetworkNeighborhoodSpecApplyConfiguration) WithContainers(values ...*NetworkNeighborhoodContainerApplyConfiguration) *NetworkNeighborhoodSpecApplyConfiguration { - for i := range values { - if values[i] == nil { - panic("nil value passed to WithContainers") - } - b.Containers = append(b.Containers, *values[i]) - } - return b -} - -// WithInitContainers adds the given value to the InitContainers field in the declarative configuration -// and returns the receiver, so that objects can be build by chaining "With" function invocations. -// If called multiple times, values provided by each call will be appended to the InitContainers field. -func (b *NetworkNeighborhoodSpecApplyConfiguration) WithInitContainers(values ...*NetworkNeighborhoodContainerApplyConfiguration) *NetworkNeighborhoodSpecApplyConfiguration { - for i := range values { - if values[i] == nil { - panic("nil value passed to WithInitContainers") - } - b.InitContainers = append(b.InitContainers, *values[i]) - } - return b -} - -// WithEphemeralContainers adds the given value to the EphemeralContainers field in the declarative configuration -// and returns the receiver, so that objects can be build by chaining "With" function invocations. -// If called multiple times, values provided by each call will be appended to the EphemeralContainers field. -func (b *NetworkNeighborhoodSpecApplyConfiguration) WithEphemeralContainers(values ...*NetworkNeighborhoodContainerApplyConfiguration) *NetworkNeighborhoodSpecApplyConfiguration { - for i := range values { - if values[i] == nil { - panic("nil value passed to WithEphemeralContainers") - } - b.EphemeralContainers = append(b.EphemeralContainers, *values[i]) - } - return b -} diff --git a/pkg/generated/applyconfiguration/utils.go b/pkg/generated/applyconfiguration/utils.go index bf88e2b57..7ac68a116 100644 --- a/pkg/generated/applyconfiguration/utils.go +++ b/pkg/generated/applyconfiguration/utils.go @@ -34,12 +34,6 @@ func ForKind(kind schema.GroupVersionKind) interface{} { // Group=spdx.softwarecomposition.kubescape.io, Version=v1beta1 case v1beta1.SchemeGroupVersion.WithKind("Advisory"): return &softwarecompositionv1beta1.AdvisoryApplyConfiguration{} - case v1beta1.SchemeGroupVersion.WithKind("ApplicationProfile"): - return &softwarecompositionv1beta1.ApplicationProfileApplyConfiguration{} - case v1beta1.SchemeGroupVersion.WithKind("ApplicationProfileContainer"): - return &softwarecompositionv1beta1.ApplicationProfileContainerApplyConfiguration{} - case v1beta1.SchemeGroupVersion.WithKind("ApplicationProfileSpec"): - return &softwarecompositionv1beta1.ApplicationProfileSpecApplyConfiguration{} case v1beta1.SchemeGroupVersion.WithKind("Arg"): return &softwarecompositionv1beta1.ArgApplyConfiguration{} case v1beta1.SchemeGroupVersion.WithKind("CallStack"): @@ -134,12 +128,6 @@ func ForKind(kind schema.GroupVersionKind) interface{} { return &softwarecompositionv1beta1.MetadataApplyConfiguration{} case v1beta1.SchemeGroupVersion.WithKind("NetworkNeighbor"): return &softwarecompositionv1beta1.NetworkNeighborApplyConfiguration{} - case v1beta1.SchemeGroupVersion.WithKind("NetworkNeighborhood"): - return &softwarecompositionv1beta1.NetworkNeighborhoodApplyConfiguration{} - case v1beta1.SchemeGroupVersion.WithKind("NetworkNeighborhoodContainer"): - return &softwarecompositionv1beta1.NetworkNeighborhoodContainerApplyConfiguration{} - case v1beta1.SchemeGroupVersion.WithKind("NetworkNeighborhoodSpec"): - return &softwarecompositionv1beta1.NetworkNeighborhoodSpecApplyConfiguration{} case v1beta1.SchemeGroupVersion.WithKind("NetworkPolicy"): return &softwarecompositionv1beta1.NetworkPolicyApplyConfiguration{} case v1beta1.SchemeGroupVersion.WithKind("NetworkPolicyEgressRule"): diff --git a/pkg/generated/clientset/versioned/typed/softwarecomposition/v1beta1/applicationprofile.go b/pkg/generated/clientset/versioned/typed/softwarecomposition/v1beta1/applicationprofile.go deleted file mode 100644 index 383a6a54f..000000000 --- a/pkg/generated/clientset/versioned/typed/softwarecomposition/v1beta1/applicationprofile.go +++ /dev/null @@ -1,78 +0,0 @@ -/* -Copyright The Kubernetes Authors. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -*/ - -// Code generated by client-gen. DO NOT EDIT. - -package v1beta1 - -import ( - context "context" - - softwarecompositionv1beta1 "github.com/kubescape/storage/pkg/apis/softwarecomposition/v1beta1" - applyconfigurationsoftwarecompositionv1beta1 "github.com/kubescape/storage/pkg/generated/applyconfiguration/softwarecomposition/v1beta1" - scheme "github.com/kubescape/storage/pkg/generated/clientset/versioned/scheme" - v1 "k8s.io/apimachinery/pkg/apis/meta/v1" - types "k8s.io/apimachinery/pkg/types" - watch "k8s.io/apimachinery/pkg/watch" - gentype "k8s.io/client-go/gentype" -) - -// ApplicationProfilesGetter has a method to return a ApplicationProfileInterface. -// A group's client should implement this interface. -type ApplicationProfilesGetter interface { - ApplicationProfiles(namespace string) ApplicationProfileInterface -} - -// ApplicationProfileInterface has methods to work with ApplicationProfile resources. -type ApplicationProfileInterface interface { - Create(ctx context.Context, applicationProfile *softwarecompositionv1beta1.ApplicationProfile, opts v1.CreateOptions) (*softwarecompositionv1beta1.ApplicationProfile, error) - Update(ctx context.Context, applicationProfile *softwarecompositionv1beta1.ApplicationProfile, opts v1.UpdateOptions) (*softwarecompositionv1beta1.ApplicationProfile, error) - // Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus(). - UpdateStatus(ctx context.Context, applicationProfile *softwarecompositionv1beta1.ApplicationProfile, opts v1.UpdateOptions) (*softwarecompositionv1beta1.ApplicationProfile, error) - Delete(ctx context.Context, name string, opts v1.DeleteOptions) error - DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error - Get(ctx context.Context, name string, opts v1.GetOptions) (*softwarecompositionv1beta1.ApplicationProfile, error) - List(ctx context.Context, opts v1.ListOptions) (*softwarecompositionv1beta1.ApplicationProfileList, error) - Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) - Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *softwarecompositionv1beta1.ApplicationProfile, err error) - Apply(ctx context.Context, applicationProfile *applyconfigurationsoftwarecompositionv1beta1.ApplicationProfileApplyConfiguration, opts v1.ApplyOptions) (result *softwarecompositionv1beta1.ApplicationProfile, err error) - // Add a +genclient:noStatus comment above the type to avoid generating ApplyStatus(). - ApplyStatus(ctx context.Context, applicationProfile *applyconfigurationsoftwarecompositionv1beta1.ApplicationProfileApplyConfiguration, opts v1.ApplyOptions) (result *softwarecompositionv1beta1.ApplicationProfile, err error) - ApplicationProfileExpansion -} - -// applicationProfiles implements ApplicationProfileInterface -type applicationProfiles struct { - *gentype.ClientWithListAndApply[*softwarecompositionv1beta1.ApplicationProfile, *softwarecompositionv1beta1.ApplicationProfileList, *applyconfigurationsoftwarecompositionv1beta1.ApplicationProfileApplyConfiguration] -} - -// newApplicationProfiles returns a ApplicationProfiles -func newApplicationProfiles(c *SpdxV1beta1Client, namespace string) *applicationProfiles { - return &applicationProfiles{ - gentype.NewClientWithListAndApply[*softwarecompositionv1beta1.ApplicationProfile, *softwarecompositionv1beta1.ApplicationProfileList, *applyconfigurationsoftwarecompositionv1beta1.ApplicationProfileApplyConfiguration]( - "applicationprofiles", - c.RESTClient(), - scheme.ParameterCodec, - namespace, - func() *softwarecompositionv1beta1.ApplicationProfile { - return &softwarecompositionv1beta1.ApplicationProfile{} - }, - func() *softwarecompositionv1beta1.ApplicationProfileList { - return &softwarecompositionv1beta1.ApplicationProfileList{} - }, - ), - } -} diff --git a/pkg/generated/clientset/versioned/typed/softwarecomposition/v1beta1/fake/fake_applicationprofile.go b/pkg/generated/clientset/versioned/typed/softwarecomposition/v1beta1/fake/fake_applicationprofile.go deleted file mode 100644 index 028bcfda6..000000000 --- a/pkg/generated/clientset/versioned/typed/softwarecomposition/v1beta1/fake/fake_applicationprofile.go +++ /dev/null @@ -1,53 +0,0 @@ -/* -Copyright The Kubernetes Authors. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -*/ - -// Code generated by client-gen. DO NOT EDIT. - -package fake - -import ( - v1beta1 "github.com/kubescape/storage/pkg/apis/softwarecomposition/v1beta1" - softwarecompositionv1beta1 "github.com/kubescape/storage/pkg/generated/applyconfiguration/softwarecomposition/v1beta1" - typedsoftwarecompositionv1beta1 "github.com/kubescape/storage/pkg/generated/clientset/versioned/typed/softwarecomposition/v1beta1" - gentype "k8s.io/client-go/gentype" -) - -// fakeApplicationProfiles implements ApplicationProfileInterface -type fakeApplicationProfiles struct { - *gentype.FakeClientWithListAndApply[*v1beta1.ApplicationProfile, *v1beta1.ApplicationProfileList, *softwarecompositionv1beta1.ApplicationProfileApplyConfiguration] - Fake *FakeSpdxV1beta1 -} - -func newFakeApplicationProfiles(fake *FakeSpdxV1beta1, namespace string) typedsoftwarecompositionv1beta1.ApplicationProfileInterface { - return &fakeApplicationProfiles{ - gentype.NewFakeClientWithListAndApply[*v1beta1.ApplicationProfile, *v1beta1.ApplicationProfileList, *softwarecompositionv1beta1.ApplicationProfileApplyConfiguration]( - fake.Fake, - namespace, - v1beta1.SchemeGroupVersion.WithResource("applicationprofiles"), - v1beta1.SchemeGroupVersion.WithKind("ApplicationProfile"), - func() *v1beta1.ApplicationProfile { return &v1beta1.ApplicationProfile{} }, - func() *v1beta1.ApplicationProfileList { return &v1beta1.ApplicationProfileList{} }, - func(dst, src *v1beta1.ApplicationProfileList) { dst.ListMeta = src.ListMeta }, - func(list *v1beta1.ApplicationProfileList) []*v1beta1.ApplicationProfile { - return gentype.ToPointerSlice(list.Items) - }, - func(list *v1beta1.ApplicationProfileList, items []*v1beta1.ApplicationProfile) { - list.Items = gentype.FromPointerSlice(items) - }, - ), - fake, - } -} diff --git a/pkg/generated/clientset/versioned/typed/softwarecomposition/v1beta1/fake/fake_networkneighborhood.go b/pkg/generated/clientset/versioned/typed/softwarecomposition/v1beta1/fake/fake_networkneighborhood.go deleted file mode 100644 index 63e9003c9..000000000 --- a/pkg/generated/clientset/versioned/typed/softwarecomposition/v1beta1/fake/fake_networkneighborhood.go +++ /dev/null @@ -1,53 +0,0 @@ -/* -Copyright The Kubernetes Authors. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -*/ - -// Code generated by client-gen. DO NOT EDIT. - -package fake - -import ( - v1beta1 "github.com/kubescape/storage/pkg/apis/softwarecomposition/v1beta1" - softwarecompositionv1beta1 "github.com/kubescape/storage/pkg/generated/applyconfiguration/softwarecomposition/v1beta1" - typedsoftwarecompositionv1beta1 "github.com/kubescape/storage/pkg/generated/clientset/versioned/typed/softwarecomposition/v1beta1" - gentype "k8s.io/client-go/gentype" -) - -// fakeNetworkNeighborhoods implements NetworkNeighborhoodInterface -type fakeNetworkNeighborhoods struct { - *gentype.FakeClientWithListAndApply[*v1beta1.NetworkNeighborhood, *v1beta1.NetworkNeighborhoodList, *softwarecompositionv1beta1.NetworkNeighborhoodApplyConfiguration] - Fake *FakeSpdxV1beta1 -} - -func newFakeNetworkNeighborhoods(fake *FakeSpdxV1beta1, namespace string) typedsoftwarecompositionv1beta1.NetworkNeighborhoodInterface { - return &fakeNetworkNeighborhoods{ - gentype.NewFakeClientWithListAndApply[*v1beta1.NetworkNeighborhood, *v1beta1.NetworkNeighborhoodList, *softwarecompositionv1beta1.NetworkNeighborhoodApplyConfiguration]( - fake.Fake, - namespace, - v1beta1.SchemeGroupVersion.WithResource("networkneighborhoods"), - v1beta1.SchemeGroupVersion.WithKind("NetworkNeighborhood"), - func() *v1beta1.NetworkNeighborhood { return &v1beta1.NetworkNeighborhood{} }, - func() *v1beta1.NetworkNeighborhoodList { return &v1beta1.NetworkNeighborhoodList{} }, - func(dst, src *v1beta1.NetworkNeighborhoodList) { dst.ListMeta = src.ListMeta }, - func(list *v1beta1.NetworkNeighborhoodList) []*v1beta1.NetworkNeighborhood { - return gentype.ToPointerSlice(list.Items) - }, - func(list *v1beta1.NetworkNeighborhoodList, items []*v1beta1.NetworkNeighborhood) { - list.Items = gentype.FromPointerSlice(items) - }, - ), - fake, - } -} diff --git a/pkg/generated/clientset/versioned/typed/softwarecomposition/v1beta1/fake/fake_softwarecomposition_client.go b/pkg/generated/clientset/versioned/typed/softwarecomposition/v1beta1/fake/fake_softwarecomposition_client.go index 090d2f59a..c38aa6028 100644 --- a/pkg/generated/clientset/versioned/typed/softwarecomposition/v1beta1/fake/fake_softwarecomposition_client.go +++ b/pkg/generated/clientset/versioned/typed/softwarecomposition/v1beta1/fake/fake_softwarecomposition_client.go @@ -28,10 +28,6 @@ type FakeSpdxV1beta1 struct { *testing.Fake } -func (c *FakeSpdxV1beta1) ApplicationProfiles(namespace string) v1beta1.ApplicationProfileInterface { - return newFakeApplicationProfiles(c, namespace) -} - func (c *FakeSpdxV1beta1) CollapseConfigurations() v1beta1.CollapseConfigurationInterface { return newFakeCollapseConfigurations(c) } @@ -52,10 +48,6 @@ func (c *FakeSpdxV1beta1) KnownServers(namespace string) v1beta1.KnownServerInte return newFakeKnownServers(c, namespace) } -func (c *FakeSpdxV1beta1) NetworkNeighborhoods(namespace string) v1beta1.NetworkNeighborhoodInterface { - return newFakeNetworkNeighborhoods(c, namespace) -} - func (c *FakeSpdxV1beta1) OpenVulnerabilityExchangeContainers(namespace string) v1beta1.OpenVulnerabilityExchangeContainerInterface { return newFakeOpenVulnerabilityExchangeContainers(c, namespace) } diff --git a/pkg/generated/clientset/versioned/typed/softwarecomposition/v1beta1/generated_expansion.go b/pkg/generated/clientset/versioned/typed/softwarecomposition/v1beta1/generated_expansion.go index d53465a69..a4087de8a 100644 --- a/pkg/generated/clientset/versioned/typed/softwarecomposition/v1beta1/generated_expansion.go +++ b/pkg/generated/clientset/versioned/typed/softwarecomposition/v1beta1/generated_expansion.go @@ -18,8 +18,6 @@ limitations under the License. package v1beta1 -type ApplicationProfileExpansion interface{} - type CollapseConfigurationExpansion interface{} type ConfigurationScanSummaryExpansion interface{} @@ -30,8 +28,6 @@ type GeneratedNetworkPolicyExpansion interface{} type KnownServerExpansion interface{} -type NetworkNeighborhoodExpansion interface{} - type OpenVulnerabilityExchangeContainerExpansion interface{} type SBOMSyftExpansion interface{} diff --git a/pkg/generated/clientset/versioned/typed/softwarecomposition/v1beta1/networkneighborhood.go b/pkg/generated/clientset/versioned/typed/softwarecomposition/v1beta1/networkneighborhood.go deleted file mode 100644 index 374108bed..000000000 --- a/pkg/generated/clientset/versioned/typed/softwarecomposition/v1beta1/networkneighborhood.go +++ /dev/null @@ -1,74 +0,0 @@ -/* -Copyright The Kubernetes Authors. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -*/ - -// Code generated by client-gen. DO NOT EDIT. - -package v1beta1 - -import ( - context "context" - - softwarecompositionv1beta1 "github.com/kubescape/storage/pkg/apis/softwarecomposition/v1beta1" - applyconfigurationsoftwarecompositionv1beta1 "github.com/kubescape/storage/pkg/generated/applyconfiguration/softwarecomposition/v1beta1" - scheme "github.com/kubescape/storage/pkg/generated/clientset/versioned/scheme" - v1 "k8s.io/apimachinery/pkg/apis/meta/v1" - types "k8s.io/apimachinery/pkg/types" - watch "k8s.io/apimachinery/pkg/watch" - gentype "k8s.io/client-go/gentype" -) - -// NetworkNeighborhoodsGetter has a method to return a NetworkNeighborhoodInterface. -// A group's client should implement this interface. -type NetworkNeighborhoodsGetter interface { - NetworkNeighborhoods(namespace string) NetworkNeighborhoodInterface -} - -// NetworkNeighborhoodInterface has methods to work with NetworkNeighborhood resources. -type NetworkNeighborhoodInterface interface { - Create(ctx context.Context, networkNeighborhood *softwarecompositionv1beta1.NetworkNeighborhood, opts v1.CreateOptions) (*softwarecompositionv1beta1.NetworkNeighborhood, error) - Update(ctx context.Context, networkNeighborhood *softwarecompositionv1beta1.NetworkNeighborhood, opts v1.UpdateOptions) (*softwarecompositionv1beta1.NetworkNeighborhood, error) - Delete(ctx context.Context, name string, opts v1.DeleteOptions) error - DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error - Get(ctx context.Context, name string, opts v1.GetOptions) (*softwarecompositionv1beta1.NetworkNeighborhood, error) - List(ctx context.Context, opts v1.ListOptions) (*softwarecompositionv1beta1.NetworkNeighborhoodList, error) - Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) - Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *softwarecompositionv1beta1.NetworkNeighborhood, err error) - Apply(ctx context.Context, networkNeighborhood *applyconfigurationsoftwarecompositionv1beta1.NetworkNeighborhoodApplyConfiguration, opts v1.ApplyOptions) (result *softwarecompositionv1beta1.NetworkNeighborhood, err error) - NetworkNeighborhoodExpansion -} - -// networkNeighborhoods implements NetworkNeighborhoodInterface -type networkNeighborhoods struct { - *gentype.ClientWithListAndApply[*softwarecompositionv1beta1.NetworkNeighborhood, *softwarecompositionv1beta1.NetworkNeighborhoodList, *applyconfigurationsoftwarecompositionv1beta1.NetworkNeighborhoodApplyConfiguration] -} - -// newNetworkNeighborhoods returns a NetworkNeighborhoods -func newNetworkNeighborhoods(c *SpdxV1beta1Client, namespace string) *networkNeighborhoods { - return &networkNeighborhoods{ - gentype.NewClientWithListAndApply[*softwarecompositionv1beta1.NetworkNeighborhood, *softwarecompositionv1beta1.NetworkNeighborhoodList, *applyconfigurationsoftwarecompositionv1beta1.NetworkNeighborhoodApplyConfiguration]( - "networkneighborhoods", - c.RESTClient(), - scheme.ParameterCodec, - namespace, - func() *softwarecompositionv1beta1.NetworkNeighborhood { - return &softwarecompositionv1beta1.NetworkNeighborhood{} - }, - func() *softwarecompositionv1beta1.NetworkNeighborhoodList { - return &softwarecompositionv1beta1.NetworkNeighborhoodList{} - }, - ), - } -} diff --git a/pkg/generated/clientset/versioned/typed/softwarecomposition/v1beta1/softwarecomposition_client.go b/pkg/generated/clientset/versioned/typed/softwarecomposition/v1beta1/softwarecomposition_client.go index 2eeee8013..a896ca15c 100644 --- a/pkg/generated/clientset/versioned/typed/softwarecomposition/v1beta1/softwarecomposition_client.go +++ b/pkg/generated/clientset/versioned/typed/softwarecomposition/v1beta1/softwarecomposition_client.go @@ -28,13 +28,11 @@ import ( type SpdxV1beta1Interface interface { RESTClient() rest.Interface - ApplicationProfilesGetter CollapseConfigurationsGetter ConfigurationScanSummariesGetter ContainerProfilesGetter GeneratedNetworkPoliciesGetter KnownServersGetter - NetworkNeighborhoodsGetter OpenVulnerabilityExchangeContainersGetter SBOMSyftsGetter SBOMSyftFilteredsGetter @@ -51,10 +49,6 @@ type SpdxV1beta1Client struct { restClient rest.Interface } -func (c *SpdxV1beta1Client) ApplicationProfiles(namespace string) ApplicationProfileInterface { - return newApplicationProfiles(c, namespace) -} - func (c *SpdxV1beta1Client) CollapseConfigurations() CollapseConfigurationInterface { return newCollapseConfigurations(c) } @@ -75,10 +69,6 @@ func (c *SpdxV1beta1Client) KnownServers(namespace string) KnownServerInterface return newKnownServers(c, namespace) } -func (c *SpdxV1beta1Client) NetworkNeighborhoods(namespace string) NetworkNeighborhoodInterface { - return newNetworkNeighborhoods(c, namespace) -} - func (c *SpdxV1beta1Client) OpenVulnerabilityExchangeContainers(namespace string) OpenVulnerabilityExchangeContainerInterface { return newOpenVulnerabilityExchangeContainers(c, namespace) } diff --git a/pkg/generated/informers/externalversions/generic.go b/pkg/generated/informers/externalversions/generic.go index 935aebaa9..f76dc0ff8 100644 --- a/pkg/generated/informers/externalversions/generic.go +++ b/pkg/generated/informers/externalversions/generic.go @@ -53,8 +53,6 @@ func (f *genericInformer) Lister() cache.GenericLister { func (f *sharedInformerFactory) ForResource(resource schema.GroupVersionResource) (GenericInformer, error) { switch resource { // Group=spdx.softwarecomposition.kubescape.io, Version=v1beta1 - case v1beta1.SchemeGroupVersion.WithResource("applicationprofiles"): - return &genericInformer{resource: resource.GroupResource(), informer: f.Spdx().V1beta1().ApplicationProfiles().Informer()}, nil case v1beta1.SchemeGroupVersion.WithResource("collapseconfigurations"): return &genericInformer{resource: resource.GroupResource(), informer: f.Spdx().V1beta1().CollapseConfigurations().Informer()}, nil case v1beta1.SchemeGroupVersion.WithResource("configurationscansummaries"): @@ -65,8 +63,6 @@ func (f *sharedInformerFactory) ForResource(resource schema.GroupVersionResource return &genericInformer{resource: resource.GroupResource(), informer: f.Spdx().V1beta1().GeneratedNetworkPolicies().Informer()}, nil case v1beta1.SchemeGroupVersion.WithResource("knownservers"): return &genericInformer{resource: resource.GroupResource(), informer: f.Spdx().V1beta1().KnownServers().Informer()}, nil - case v1beta1.SchemeGroupVersion.WithResource("networkneighborhoods"): - return &genericInformer{resource: resource.GroupResource(), informer: f.Spdx().V1beta1().NetworkNeighborhoods().Informer()}, nil case v1beta1.SchemeGroupVersion.WithResource("openvulnerabilityexchangecontainers"): return &genericInformer{resource: resource.GroupResource(), informer: f.Spdx().V1beta1().OpenVulnerabilityExchangeContainers().Informer()}, nil case v1beta1.SchemeGroupVersion.WithResource("sbomsyfts"): diff --git a/pkg/generated/informers/externalversions/softwarecomposition/v1beta1/applicationprofile.go b/pkg/generated/informers/externalversions/softwarecomposition/v1beta1/applicationprofile.go deleted file mode 100644 index 453a58f6a..000000000 --- a/pkg/generated/informers/externalversions/softwarecomposition/v1beta1/applicationprofile.go +++ /dev/null @@ -1,102 +0,0 @@ -/* -Copyright The Kubernetes Authors. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -*/ - -// Code generated by informer-gen. DO NOT EDIT. - -package v1beta1 - -import ( - context "context" - time "time" - - apissoftwarecompositionv1beta1 "github.com/kubescape/storage/pkg/apis/softwarecomposition/v1beta1" - versioned "github.com/kubescape/storage/pkg/generated/clientset/versioned" - internalinterfaces "github.com/kubescape/storage/pkg/generated/informers/externalversions/internalinterfaces" - softwarecompositionv1beta1 "github.com/kubescape/storage/pkg/generated/listers/softwarecomposition/v1beta1" - v1 "k8s.io/apimachinery/pkg/apis/meta/v1" - runtime "k8s.io/apimachinery/pkg/runtime" - watch "k8s.io/apimachinery/pkg/watch" - cache "k8s.io/client-go/tools/cache" -) - -// ApplicationProfileInformer provides access to a shared informer and lister for -// ApplicationProfiles. -type ApplicationProfileInformer interface { - Informer() cache.SharedIndexInformer - Lister() softwarecompositionv1beta1.ApplicationProfileLister -} - -type applicationProfileInformer struct { - factory internalinterfaces.SharedInformerFactory - tweakListOptions internalinterfaces.TweakListOptionsFunc - namespace string -} - -// NewApplicationProfileInformer constructs a new informer for ApplicationProfile type. -// Always prefer using an informer factory to get a shared informer instead of getting an independent -// one. This reduces memory footprint and number of connections to the server. -func NewApplicationProfileInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer { - return NewFilteredApplicationProfileInformer(client, namespace, resyncPeriod, indexers, nil) -} - -// NewFilteredApplicationProfileInformer constructs a new informer for ApplicationProfile type. -// Always prefer using an informer factory to get a shared informer instead of getting an independent -// one. This reduces memory footprint and number of connections to the server. -func NewFilteredApplicationProfileInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer { - return cache.NewSharedIndexInformer( - cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{ - ListFunc: func(options v1.ListOptions) (runtime.Object, error) { - if tweakListOptions != nil { - tweakListOptions(&options) - } - return client.SpdxV1beta1().ApplicationProfiles(namespace).List(context.Background(), options) - }, - WatchFunc: func(options v1.ListOptions) (watch.Interface, error) { - if tweakListOptions != nil { - tweakListOptions(&options) - } - return client.SpdxV1beta1().ApplicationProfiles(namespace).Watch(context.Background(), options) - }, - ListWithContextFunc: func(ctx context.Context, options v1.ListOptions) (runtime.Object, error) { - if tweakListOptions != nil { - tweakListOptions(&options) - } - return client.SpdxV1beta1().ApplicationProfiles(namespace).List(ctx, options) - }, - WatchFuncWithContext: func(ctx context.Context, options v1.ListOptions) (watch.Interface, error) { - if tweakListOptions != nil { - tweakListOptions(&options) - } - return client.SpdxV1beta1().ApplicationProfiles(namespace).Watch(ctx, options) - }, - }, client), - &apissoftwarecompositionv1beta1.ApplicationProfile{}, - resyncPeriod, - indexers, - ) -} - -func (f *applicationProfileInformer) defaultInformer(client versioned.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer { - return NewFilteredApplicationProfileInformer(client, f.namespace, resyncPeriod, cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, f.tweakListOptions) -} - -func (f *applicationProfileInformer) Informer() cache.SharedIndexInformer { - return f.factory.InformerFor(&apissoftwarecompositionv1beta1.ApplicationProfile{}, f.defaultInformer) -} - -func (f *applicationProfileInformer) Lister() softwarecompositionv1beta1.ApplicationProfileLister { - return softwarecompositionv1beta1.NewApplicationProfileLister(f.Informer().GetIndexer()) -} diff --git a/pkg/generated/informers/externalversions/softwarecomposition/v1beta1/interface.go b/pkg/generated/informers/externalversions/softwarecomposition/v1beta1/interface.go index cdd3bcc00..78d9045fd 100644 --- a/pkg/generated/informers/externalversions/softwarecomposition/v1beta1/interface.go +++ b/pkg/generated/informers/externalversions/softwarecomposition/v1beta1/interface.go @@ -24,8 +24,6 @@ import ( // Interface provides access to all the informers in this group version. type Interface interface { - // ApplicationProfiles returns a ApplicationProfileInformer. - ApplicationProfiles() ApplicationProfileInformer // CollapseConfigurations returns a CollapseConfigurationInformer. CollapseConfigurations() CollapseConfigurationInformer // ConfigurationScanSummaries returns a ConfigurationScanSummaryInformer. @@ -36,8 +34,6 @@ type Interface interface { GeneratedNetworkPolicies() GeneratedNetworkPolicyInformer // KnownServers returns a KnownServerInformer. KnownServers() KnownServerInformer - // NetworkNeighborhoods returns a NetworkNeighborhoodInformer. - NetworkNeighborhoods() NetworkNeighborhoodInformer // OpenVulnerabilityExchangeContainers returns a OpenVulnerabilityExchangeContainerInformer. OpenVulnerabilityExchangeContainers() OpenVulnerabilityExchangeContainerInformer // SBOMSyfts returns a SBOMSyftInformer. @@ -69,11 +65,6 @@ func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakList return &version{factory: f, namespace: namespace, tweakListOptions: tweakListOptions} } -// ApplicationProfiles returns a ApplicationProfileInformer. -func (v *version) ApplicationProfiles() ApplicationProfileInformer { - return &applicationProfileInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions} -} - // CollapseConfigurations returns a CollapseConfigurationInformer. func (v *version) CollapseConfigurations() CollapseConfigurationInformer { return &collapseConfigurationInformer{factory: v.factory, tweakListOptions: v.tweakListOptions} @@ -99,11 +90,6 @@ func (v *version) KnownServers() KnownServerInformer { return &knownServerInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions} } -// NetworkNeighborhoods returns a NetworkNeighborhoodInformer. -func (v *version) NetworkNeighborhoods() NetworkNeighborhoodInformer { - return &networkNeighborhoodInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions} -} - // OpenVulnerabilityExchangeContainers returns a OpenVulnerabilityExchangeContainerInformer. func (v *version) OpenVulnerabilityExchangeContainers() OpenVulnerabilityExchangeContainerInformer { return &openVulnerabilityExchangeContainerInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions} diff --git a/pkg/generated/informers/externalversions/softwarecomposition/v1beta1/networkneighborhood.go b/pkg/generated/informers/externalversions/softwarecomposition/v1beta1/networkneighborhood.go deleted file mode 100644 index 19d04eb2e..000000000 --- a/pkg/generated/informers/externalversions/softwarecomposition/v1beta1/networkneighborhood.go +++ /dev/null @@ -1,102 +0,0 @@ -/* -Copyright The Kubernetes Authors. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -*/ - -// Code generated by informer-gen. DO NOT EDIT. - -package v1beta1 - -import ( - context "context" - time "time" - - apissoftwarecompositionv1beta1 "github.com/kubescape/storage/pkg/apis/softwarecomposition/v1beta1" - versioned "github.com/kubescape/storage/pkg/generated/clientset/versioned" - internalinterfaces "github.com/kubescape/storage/pkg/generated/informers/externalversions/internalinterfaces" - softwarecompositionv1beta1 "github.com/kubescape/storage/pkg/generated/listers/softwarecomposition/v1beta1" - v1 "k8s.io/apimachinery/pkg/apis/meta/v1" - runtime "k8s.io/apimachinery/pkg/runtime" - watch "k8s.io/apimachinery/pkg/watch" - cache "k8s.io/client-go/tools/cache" -) - -// NetworkNeighborhoodInformer provides access to a shared informer and lister for -// NetworkNeighborhoods. -type NetworkNeighborhoodInformer interface { - Informer() cache.SharedIndexInformer - Lister() softwarecompositionv1beta1.NetworkNeighborhoodLister -} - -type networkNeighborhoodInformer struct { - factory internalinterfaces.SharedInformerFactory - tweakListOptions internalinterfaces.TweakListOptionsFunc - namespace string -} - -// NewNetworkNeighborhoodInformer constructs a new informer for NetworkNeighborhood type. -// Always prefer using an informer factory to get a shared informer instead of getting an independent -// one. This reduces memory footprint and number of connections to the server. -func NewNetworkNeighborhoodInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer { - return NewFilteredNetworkNeighborhoodInformer(client, namespace, resyncPeriod, indexers, nil) -} - -// NewFilteredNetworkNeighborhoodInformer constructs a new informer for NetworkNeighborhood type. -// Always prefer using an informer factory to get a shared informer instead of getting an independent -// one. This reduces memory footprint and number of connections to the server. -func NewFilteredNetworkNeighborhoodInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer { - return cache.NewSharedIndexInformer( - cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{ - ListFunc: func(options v1.ListOptions) (runtime.Object, error) { - if tweakListOptions != nil { - tweakListOptions(&options) - } - return client.SpdxV1beta1().NetworkNeighborhoods(namespace).List(context.Background(), options) - }, - WatchFunc: func(options v1.ListOptions) (watch.Interface, error) { - if tweakListOptions != nil { - tweakListOptions(&options) - } - return client.SpdxV1beta1().NetworkNeighborhoods(namespace).Watch(context.Background(), options) - }, - ListWithContextFunc: func(ctx context.Context, options v1.ListOptions) (runtime.Object, error) { - if tweakListOptions != nil { - tweakListOptions(&options) - } - return client.SpdxV1beta1().NetworkNeighborhoods(namespace).List(ctx, options) - }, - WatchFuncWithContext: func(ctx context.Context, options v1.ListOptions) (watch.Interface, error) { - if tweakListOptions != nil { - tweakListOptions(&options) - } - return client.SpdxV1beta1().NetworkNeighborhoods(namespace).Watch(ctx, options) - }, - }, client), - &apissoftwarecompositionv1beta1.NetworkNeighborhood{}, - resyncPeriod, - indexers, - ) -} - -func (f *networkNeighborhoodInformer) defaultInformer(client versioned.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer { - return NewFilteredNetworkNeighborhoodInformer(client, f.namespace, resyncPeriod, cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, f.tweakListOptions) -} - -func (f *networkNeighborhoodInformer) Informer() cache.SharedIndexInformer { - return f.factory.InformerFor(&apissoftwarecompositionv1beta1.NetworkNeighborhood{}, f.defaultInformer) -} - -func (f *networkNeighborhoodInformer) Lister() softwarecompositionv1beta1.NetworkNeighborhoodLister { - return softwarecompositionv1beta1.NewNetworkNeighborhoodLister(f.Informer().GetIndexer()) -} diff --git a/pkg/generated/listers/softwarecomposition/v1beta1/applicationprofile.go b/pkg/generated/listers/softwarecomposition/v1beta1/applicationprofile.go deleted file mode 100644 index 993c3f304..000000000 --- a/pkg/generated/listers/softwarecomposition/v1beta1/applicationprofile.go +++ /dev/null @@ -1,70 +0,0 @@ -/* -Copyright The Kubernetes Authors. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -*/ - -// Code generated by lister-gen. DO NOT EDIT. - -package v1beta1 - -import ( - softwarecompositionv1beta1 "github.com/kubescape/storage/pkg/apis/softwarecomposition/v1beta1" - labels "k8s.io/apimachinery/pkg/labels" - listers "k8s.io/client-go/listers" - cache "k8s.io/client-go/tools/cache" -) - -// ApplicationProfileLister helps list ApplicationProfiles. -// All objects returned here must be treated as read-only. -type ApplicationProfileLister interface { - // List lists all ApplicationProfiles in the indexer. - // Objects returned here must be treated as read-only. - List(selector labels.Selector) (ret []*softwarecompositionv1beta1.ApplicationProfile, err error) - // ApplicationProfiles returns an object that can list and get ApplicationProfiles. - ApplicationProfiles(namespace string) ApplicationProfileNamespaceLister - ApplicationProfileListerExpansion -} - -// applicationProfileLister implements the ApplicationProfileLister interface. -type applicationProfileLister struct { - listers.ResourceIndexer[*softwarecompositionv1beta1.ApplicationProfile] -} - -// NewApplicationProfileLister returns a new ApplicationProfileLister. -func NewApplicationProfileLister(indexer cache.Indexer) ApplicationProfileLister { - return &applicationProfileLister{listers.New[*softwarecompositionv1beta1.ApplicationProfile](indexer, softwarecompositionv1beta1.Resource("applicationprofile"))} -} - -// ApplicationProfiles returns an object that can list and get ApplicationProfiles. -func (s *applicationProfileLister) ApplicationProfiles(namespace string) ApplicationProfileNamespaceLister { - return applicationProfileNamespaceLister{listers.NewNamespaced[*softwarecompositionv1beta1.ApplicationProfile](s.ResourceIndexer, namespace)} -} - -// ApplicationProfileNamespaceLister helps list and get ApplicationProfiles. -// All objects returned here must be treated as read-only. -type ApplicationProfileNamespaceLister interface { - // List lists all ApplicationProfiles in the indexer for a given namespace. - // Objects returned here must be treated as read-only. - List(selector labels.Selector) (ret []*softwarecompositionv1beta1.ApplicationProfile, err error) - // Get retrieves the ApplicationProfile from the indexer for a given namespace and name. - // Objects returned here must be treated as read-only. - Get(name string) (*softwarecompositionv1beta1.ApplicationProfile, error) - ApplicationProfileNamespaceListerExpansion -} - -// applicationProfileNamespaceLister implements the ApplicationProfileNamespaceLister -// interface. -type applicationProfileNamespaceLister struct { - listers.ResourceIndexer[*softwarecompositionv1beta1.ApplicationProfile] -} diff --git a/pkg/generated/listers/softwarecomposition/v1beta1/expansion_generated.go b/pkg/generated/listers/softwarecomposition/v1beta1/expansion_generated.go index 64fe9fc09..57fd0c09a 100644 --- a/pkg/generated/listers/softwarecomposition/v1beta1/expansion_generated.go +++ b/pkg/generated/listers/softwarecomposition/v1beta1/expansion_generated.go @@ -18,14 +18,6 @@ limitations under the License. package v1beta1 -// ApplicationProfileListerExpansion allows custom methods to be added to -// ApplicationProfileLister. -type ApplicationProfileListerExpansion interface{} - -// ApplicationProfileNamespaceListerExpansion allows custom methods to be added to -// ApplicationProfileNamespaceLister. -type ApplicationProfileNamespaceListerExpansion interface{} - // CollapseConfigurationListerExpansion allows custom methods to be added to // CollapseConfigurationLister. type CollapseConfigurationListerExpansion interface{} @@ -62,14 +54,6 @@ type KnownServerListerExpansion interface{} // KnownServerNamespaceLister. type KnownServerNamespaceListerExpansion interface{} -// NetworkNeighborhoodListerExpansion allows custom methods to be added to -// NetworkNeighborhoodLister. -type NetworkNeighborhoodListerExpansion interface{} - -// NetworkNeighborhoodNamespaceListerExpansion allows custom methods to be added to -// NetworkNeighborhoodNamespaceLister. -type NetworkNeighborhoodNamespaceListerExpansion interface{} - // OpenVulnerabilityExchangeContainerListerExpansion allows custom methods to be added to // OpenVulnerabilityExchangeContainerLister. type OpenVulnerabilityExchangeContainerListerExpansion interface{} diff --git a/pkg/generated/listers/softwarecomposition/v1beta1/networkneighborhood.go b/pkg/generated/listers/softwarecomposition/v1beta1/networkneighborhood.go deleted file mode 100644 index 6ca6aff2f..000000000 --- a/pkg/generated/listers/softwarecomposition/v1beta1/networkneighborhood.go +++ /dev/null @@ -1,70 +0,0 @@ -/* -Copyright The Kubernetes Authors. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -*/ - -// Code generated by lister-gen. DO NOT EDIT. - -package v1beta1 - -import ( - softwarecompositionv1beta1 "github.com/kubescape/storage/pkg/apis/softwarecomposition/v1beta1" - labels "k8s.io/apimachinery/pkg/labels" - listers "k8s.io/client-go/listers" - cache "k8s.io/client-go/tools/cache" -) - -// NetworkNeighborhoodLister helps list NetworkNeighborhoods. -// All objects returned here must be treated as read-only. -type NetworkNeighborhoodLister interface { - // List lists all NetworkNeighborhoods in the indexer. - // Objects returned here must be treated as read-only. - List(selector labels.Selector) (ret []*softwarecompositionv1beta1.NetworkNeighborhood, err error) - // NetworkNeighborhoods returns an object that can list and get NetworkNeighborhoods. - NetworkNeighborhoods(namespace string) NetworkNeighborhoodNamespaceLister - NetworkNeighborhoodListerExpansion -} - -// networkNeighborhoodLister implements the NetworkNeighborhoodLister interface. -type networkNeighborhoodLister struct { - listers.ResourceIndexer[*softwarecompositionv1beta1.NetworkNeighborhood] -} - -// NewNetworkNeighborhoodLister returns a new NetworkNeighborhoodLister. -func NewNetworkNeighborhoodLister(indexer cache.Indexer) NetworkNeighborhoodLister { - return &networkNeighborhoodLister{listers.New[*softwarecompositionv1beta1.NetworkNeighborhood](indexer, softwarecompositionv1beta1.Resource("networkneighborhood"))} -} - -// NetworkNeighborhoods returns an object that can list and get NetworkNeighborhoods. -func (s *networkNeighborhoodLister) NetworkNeighborhoods(namespace string) NetworkNeighborhoodNamespaceLister { - return networkNeighborhoodNamespaceLister{listers.NewNamespaced[*softwarecompositionv1beta1.NetworkNeighborhood](s.ResourceIndexer, namespace)} -} - -// NetworkNeighborhoodNamespaceLister helps list and get NetworkNeighborhoods. -// All objects returned here must be treated as read-only. -type NetworkNeighborhoodNamespaceLister interface { - // List lists all NetworkNeighborhoods in the indexer for a given namespace. - // Objects returned here must be treated as read-only. - List(selector labels.Selector) (ret []*softwarecompositionv1beta1.NetworkNeighborhood, err error) - // Get retrieves the NetworkNeighborhood from the indexer for a given namespace and name. - // Objects returned here must be treated as read-only. - Get(name string) (*softwarecompositionv1beta1.NetworkNeighborhood, error) - NetworkNeighborhoodNamespaceListerExpansion -} - -// networkNeighborhoodNamespaceLister implements the NetworkNeighborhoodNamespaceLister -// interface. -type networkNeighborhoodNamespaceLister struct { - listers.ResourceIndexer[*softwarecompositionv1beta1.NetworkNeighborhood] -} diff --git a/pkg/generated/openapi/zz_generated.openapi.go b/pkg/generated/openapi/zz_generated.openapi.go index 7c9f2d3a4..44cf0cb73 100644 --- a/pkg/generated/openapi/zz_generated.openapi.go +++ b/pkg/generated/openapi/zz_generated.openapi.go @@ -34,11 +34,6 @@ import ( func GetOpenAPIDefinitions(ref common.ReferenceCallback) map[string]common.OpenAPIDefinition { return map[string]common.OpenAPIDefinition{ v1beta1.Advisory{}.OpenAPIModelName(): schema_pkg_apis_softwarecomposition_v1beta1_Advisory(ref), - v1beta1.ApplicationProfile{}.OpenAPIModelName(): schema_pkg_apis_softwarecomposition_v1beta1_ApplicationProfile(ref), - v1beta1.ApplicationProfileContainer{}.OpenAPIModelName(): schema_pkg_apis_softwarecomposition_v1beta1_ApplicationProfileContainer(ref), - v1beta1.ApplicationProfileList{}.OpenAPIModelName(): schema_pkg_apis_softwarecomposition_v1beta1_ApplicationProfileList(ref), - v1beta1.ApplicationProfileSpec{}.OpenAPIModelName(): schema_pkg_apis_softwarecomposition_v1beta1_ApplicationProfileSpec(ref), - v1beta1.ApplicationProfileStatus{}.OpenAPIModelName(): schema_pkg_apis_softwarecomposition_v1beta1_ApplicationProfileStatus(ref), v1beta1.Arg{}.OpenAPIModelName(): schema_pkg_apis_softwarecomposition_v1beta1_Arg(ref), v1beta1.CPE{}.OpenAPIModelName(): schema_pkg_apis_softwarecomposition_v1beta1_CPE(ref), v1beta1.CallStack{}.OpenAPIModelName(): schema_pkg_apis_softwarecomposition_v1beta1_CallStack(ref), @@ -111,10 +106,6 @@ func GetOpenAPIDefinitions(ref common.ReferenceCallback) map[string]common.OpenA v1beta1.MatchDetails{}.OpenAPIModelName(): schema_pkg_apis_softwarecomposition_v1beta1_MatchDetails(ref), v1beta1.Metadata{}.OpenAPIModelName(): schema_pkg_apis_softwarecomposition_v1beta1_Metadata(ref), v1beta1.NetworkNeighbor{}.OpenAPIModelName(): schema_pkg_apis_softwarecomposition_v1beta1_NetworkNeighbor(ref), - v1beta1.NetworkNeighborhood{}.OpenAPIModelName(): schema_pkg_apis_softwarecomposition_v1beta1_NetworkNeighborhood(ref), - v1beta1.NetworkNeighborhoodContainer{}.OpenAPIModelName(): schema_pkg_apis_softwarecomposition_v1beta1_NetworkNeighborhoodContainer(ref), - v1beta1.NetworkNeighborhoodList{}.OpenAPIModelName(): schema_pkg_apis_softwarecomposition_v1beta1_NetworkNeighborhoodList(ref), - v1beta1.NetworkNeighborhoodSpec{}.OpenAPIModelName(): schema_pkg_apis_softwarecomposition_v1beta1_NetworkNeighborhoodSpec(ref), v1beta1.NetworkPolicy{}.OpenAPIModelName(): schema_pkg_apis_softwarecomposition_v1beta1_NetworkPolicy(ref), v1beta1.NetworkPolicyEgressRule{}.OpenAPIModelName(): schema_pkg_apis_softwarecomposition_v1beta1_NetworkPolicyEgressRule(ref), v1beta1.NetworkPolicyIngressRule{}.OpenAPIModelName(): schema_pkg_apis_softwarecomposition_v1beta1_NetworkPolicyIngressRule(ref), @@ -287,355 +278,6 @@ func schema_pkg_apis_softwarecomposition_v1beta1_Advisory(ref common.ReferenceCa } } -func schema_pkg_apis_softwarecomposition_v1beta1_ApplicationProfile(ref common.ReferenceCallback) common.OpenAPIDefinition { - return common.OpenAPIDefinition{ - Schema: spec.Schema{ - SchemaProps: spec.SchemaProps{ - Type: []string{"object"}, - Properties: map[string]spec.Schema{ - "kind": { - SchemaProps: spec.SchemaProps{ - Description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", - Type: []string{"string"}, - Format: "", - }, - }, - "apiVersion": { - SchemaProps: spec.SchemaProps{ - Description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", - Type: []string{"string"}, - Format: "", - }, - }, - "metadata": { - SchemaProps: spec.SchemaProps{ - Default: map[string]interface{}{}, - Ref: ref(v1.ObjectMeta{}.OpenAPIModelName()), - }, - }, - "spec": { - SchemaProps: spec.SchemaProps{ - Default: map[string]interface{}{}, - Ref: ref(v1beta1.ApplicationProfileSpec{}.OpenAPIModelName()), - }, - }, - "status": { - SchemaProps: spec.SchemaProps{ - Default: map[string]interface{}{}, - Ref: ref(v1beta1.ApplicationProfileStatus{}.OpenAPIModelName()), - }, - }, - }, - }, - }, - Dependencies: []string{ - v1beta1.ApplicationProfileSpec{}.OpenAPIModelName(), v1beta1.ApplicationProfileStatus{}.OpenAPIModelName(), v1.ObjectMeta{}.OpenAPIModelName()}, - } -} - -func schema_pkg_apis_softwarecomposition_v1beta1_ApplicationProfileContainer(ref common.ReferenceCallback) common.OpenAPIDefinition { - return common.OpenAPIDefinition{ - Schema: spec.Schema{ - SchemaProps: spec.SchemaProps{ - Type: []string{"object"}, - Properties: map[string]spec.Schema{ - "name": { - SchemaProps: spec.SchemaProps{ - Type: []string{"string"}, - Format: "", - }, - }, - "capabilities": { - SchemaProps: spec.SchemaProps{ - Type: []string{"array"}, - Items: &spec.SchemaOrArray{ - Schema: &spec.Schema{ - SchemaProps: spec.SchemaProps{ - Default: "", - Type: []string{"string"}, - Format: "", - }, - }, - }, - }, - }, - "execs": { - VendorExtensible: spec.VendorExtensible{ - Extensions: spec.Extensions{ - "x-kubernetes-patch-merge-key": "path", - "x-kubernetes-patch-strategy": "merge", - }, - }, - SchemaProps: spec.SchemaProps{ - Type: []string{"array"}, - Items: &spec.SchemaOrArray{ - Schema: &spec.Schema{ - SchemaProps: spec.SchemaProps{ - Default: map[string]interface{}{}, - Ref: ref(v1beta1.ExecCalls{}.OpenAPIModelName()), - }, - }, - }, - }, - }, - "opens": { - VendorExtensible: spec.VendorExtensible{ - Extensions: spec.Extensions{ - "x-kubernetes-patch-merge-key": "path", - "x-kubernetes-patch-strategy": "merge", - }, - }, - SchemaProps: spec.SchemaProps{ - Type: []string{"array"}, - Items: &spec.SchemaOrArray{ - Schema: &spec.Schema{ - SchemaProps: spec.SchemaProps{ - Default: map[string]interface{}{}, - Ref: ref(v1beta1.OpenCalls{}.OpenAPIModelName()), - }, - }, - }, - }, - }, - "syscalls": { - SchemaProps: spec.SchemaProps{ - Type: []string{"array"}, - Items: &spec.SchemaOrArray{ - Schema: &spec.Schema{ - SchemaProps: spec.SchemaProps{ - Default: "", - Type: []string{"string"}, - Format: "", - }, - }, - }, - }, - }, - "seccompProfile": { - SchemaProps: spec.SchemaProps{ - Default: map[string]interface{}{}, - Ref: ref(v1beta1.SingleSeccompProfile{}.OpenAPIModelName()), - }, - }, - "endpoints": { - VendorExtensible: spec.VendorExtensible{ - Extensions: spec.Extensions{ - "x-kubernetes-patch-merge-key": "endpoint", - "x-kubernetes-patch-strategy": "merge", - }, - }, - SchemaProps: spec.SchemaProps{ - Type: []string{"array"}, - Items: &spec.SchemaOrArray{ - Schema: &spec.Schema{ - SchemaProps: spec.SchemaProps{ - Default: map[string]interface{}{}, - Ref: ref(v1beta1.HTTPEndpoint{}.OpenAPIModelName()), - }, - }, - }, - }, - }, - "imageID": { - SchemaProps: spec.SchemaProps{ - Default: "", - Type: []string{"string"}, - Format: "", - }, - }, - "imageTag": { - SchemaProps: spec.SchemaProps{ - Default: "", - Type: []string{"string"}, - Format: "", - }, - }, - "rulePolicies": { - VendorExtensible: spec.VendorExtensible{ - Extensions: spec.Extensions{ - "x-kubernetes-patch-merge-key": "ruleId", - "x-kubernetes-patch-strategy": "merge", - }, - }, - SchemaProps: spec.SchemaProps{ - Type: []string{"object"}, - AdditionalProperties: &spec.SchemaOrBool{ - Allows: true, - Schema: &spec.Schema{ - SchemaProps: spec.SchemaProps{ - Default: map[string]interface{}{}, - Ref: ref(v1beta1.RulePolicy{}.OpenAPIModelName()), - }, - }, - }, - }, - }, - "identifiedCallStacks": { - SchemaProps: spec.SchemaProps{ - Type: []string{"array"}, - Items: &spec.SchemaOrArray{ - Schema: &spec.Schema{ - SchemaProps: spec.SchemaProps{ - Default: map[string]interface{}{}, - Ref: ref(v1beta1.IdentifiedCallStack{}.OpenAPIModelName()), - }, - }, - }, - }, - }, - }, - Required: []string{"capabilities", "execs", "opens", "syscalls", "endpoints", "imageID", "imageTag", "rulePolicies", "identifiedCallStacks"}, - }, - }, - Dependencies: []string{ - v1beta1.ExecCalls{}.OpenAPIModelName(), v1beta1.HTTPEndpoint{}.OpenAPIModelName(), v1beta1.IdentifiedCallStack{}.OpenAPIModelName(), v1beta1.OpenCalls{}.OpenAPIModelName(), v1beta1.RulePolicy{}.OpenAPIModelName(), v1beta1.SingleSeccompProfile{}.OpenAPIModelName()}, - } -} - -func schema_pkg_apis_softwarecomposition_v1beta1_ApplicationProfileList(ref common.ReferenceCallback) common.OpenAPIDefinition { - return common.OpenAPIDefinition{ - Schema: spec.Schema{ - SchemaProps: spec.SchemaProps{ - Type: []string{"object"}, - Properties: map[string]spec.Schema{ - "kind": { - SchemaProps: spec.SchemaProps{ - Description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", - Type: []string{"string"}, - Format: "", - }, - }, - "apiVersion": { - SchemaProps: spec.SchemaProps{ - Description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", - Type: []string{"string"}, - Format: "", - }, - }, - "metadata": { - SchemaProps: spec.SchemaProps{ - Default: map[string]interface{}{}, - Ref: ref(v1.ListMeta{}.OpenAPIModelName()), - }, - }, - "items": { - SchemaProps: spec.SchemaProps{ - Type: []string{"array"}, - Items: &spec.SchemaOrArray{ - Schema: &spec.Schema{ - SchemaProps: spec.SchemaProps{ - Default: map[string]interface{}{}, - Ref: ref(v1beta1.ApplicationProfile{}.OpenAPIModelName()), - }, - }, - }, - }, - }, - }, - Required: []string{"items"}, - }, - }, - Dependencies: []string{ - v1beta1.ApplicationProfile{}.OpenAPIModelName(), v1.ListMeta{}.OpenAPIModelName()}, - } -} - -func schema_pkg_apis_softwarecomposition_v1beta1_ApplicationProfileSpec(ref common.ReferenceCallback) common.OpenAPIDefinition { - return common.OpenAPIDefinition{ - Schema: spec.Schema{ - SchemaProps: spec.SchemaProps{ - Type: []string{"object"}, - Properties: map[string]spec.Schema{ - "architectures": { - SchemaProps: spec.SchemaProps{ - Type: []string{"array"}, - Items: &spec.SchemaOrArray{ - Schema: &spec.Schema{ - SchemaProps: spec.SchemaProps{ - Default: "", - Type: []string{"string"}, - Format: "", - }, - }, - }, - }, - }, - "containers": { - VendorExtensible: spec.VendorExtensible{ - Extensions: spec.Extensions{ - "x-kubernetes-patch-merge-key": "name", - "x-kubernetes-patch-strategy": "merge", - }, - }, - SchemaProps: spec.SchemaProps{ - Type: []string{"array"}, - Items: &spec.SchemaOrArray{ - Schema: &spec.Schema{ - SchemaProps: spec.SchemaProps{ - Default: map[string]interface{}{}, - Ref: ref(v1beta1.ApplicationProfileContainer{}.OpenAPIModelName()), - }, - }, - }, - }, - }, - "initContainers": { - VendorExtensible: spec.VendorExtensible{ - Extensions: spec.Extensions{ - "x-kubernetes-patch-merge-key": "name", - "x-kubernetes-patch-strategy": "merge", - }, - }, - SchemaProps: spec.SchemaProps{ - Type: []string{"array"}, - Items: &spec.SchemaOrArray{ - Schema: &spec.Schema{ - SchemaProps: spec.SchemaProps{ - Default: map[string]interface{}{}, - Ref: ref(v1beta1.ApplicationProfileContainer{}.OpenAPIModelName()), - }, - }, - }, - }, - }, - "ephemeralContainers": { - VendorExtensible: spec.VendorExtensible{ - Extensions: spec.Extensions{ - "x-kubernetes-patch-merge-key": "name", - "x-kubernetes-patch-strategy": "merge", - }, - }, - SchemaProps: spec.SchemaProps{ - Type: []string{"array"}, - Items: &spec.SchemaOrArray{ - Schema: &spec.Schema{ - SchemaProps: spec.SchemaProps{ - Default: map[string]interface{}{}, - Ref: ref(v1beta1.ApplicationProfileContainer{}.OpenAPIModelName()), - }, - }, - }, - }, - }, - }, - Required: []string{"architectures"}, - }, - }, - Dependencies: []string{ - v1beta1.ApplicationProfileContainer{}.OpenAPIModelName()}, - } -} - -func schema_pkg_apis_softwarecomposition_v1beta1_ApplicationProfileStatus(ref common.ReferenceCallback) common.OpenAPIDefinition { - return common.OpenAPIDefinition{ - Schema: spec.Schema{ - SchemaProps: spec.SchemaProps{ - Type: []string{"object"}, - }, - }, - } -} - func schema_pkg_apis_softwarecomposition_v1beta1_Arg(ref common.ReferenceCallback) common.OpenAPIDefinition { return common.OpenAPIDefinition{ Schema: spec.Schema{ @@ -3973,234 +3615,6 @@ func schema_pkg_apis_softwarecomposition_v1beta1_NetworkNeighbor(ref common.Refe } } -func schema_pkg_apis_softwarecomposition_v1beta1_NetworkNeighborhood(ref common.ReferenceCallback) common.OpenAPIDefinition { - return common.OpenAPIDefinition{ - Schema: spec.Schema{ - SchemaProps: spec.SchemaProps{ - Description: "NetworkNeighborhood represents a list of network communications for a specific workload.", - Type: []string{"object"}, - Properties: map[string]spec.Schema{ - "kind": { - SchemaProps: spec.SchemaProps{ - Description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", - Type: []string{"string"}, - Format: "", - }, - }, - "apiVersion": { - SchemaProps: spec.SchemaProps{ - Description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", - Type: []string{"string"}, - Format: "", - }, - }, - "metadata": { - SchemaProps: spec.SchemaProps{ - Default: map[string]interface{}{}, - Ref: ref(v1.ObjectMeta{}.OpenAPIModelName()), - }, - }, - "spec": { - SchemaProps: spec.SchemaProps{ - Default: map[string]interface{}{}, - Ref: ref(v1beta1.NetworkNeighborhoodSpec{}.OpenAPIModelName()), - }, - }, - }, - Required: []string{"spec"}, - }, - }, - Dependencies: []string{ - v1beta1.NetworkNeighborhoodSpec{}.OpenAPIModelName(), v1.ObjectMeta{}.OpenAPIModelName()}, - } -} - -func schema_pkg_apis_softwarecomposition_v1beta1_NetworkNeighborhoodContainer(ref common.ReferenceCallback) common.OpenAPIDefinition { - return common.OpenAPIDefinition{ - Schema: spec.Schema{ - SchemaProps: spec.SchemaProps{ - Type: []string{"object"}, - Properties: map[string]spec.Schema{ - "name": { - SchemaProps: spec.SchemaProps{ - Default: "", - Type: []string{"string"}, - Format: "", - }, - }, - "ingress": { - SchemaProps: spec.SchemaProps{ - Type: []string{"array"}, - Items: &spec.SchemaOrArray{ - Schema: &spec.Schema{ - SchemaProps: spec.SchemaProps{ - Default: map[string]interface{}{}, - Ref: ref(v1beta1.NetworkNeighbor{}.OpenAPIModelName()), - }, - }, - }, - }, - }, - "egress": { - SchemaProps: spec.SchemaProps{ - Type: []string{"array"}, - Items: &spec.SchemaOrArray{ - Schema: &spec.Schema{ - SchemaProps: spec.SchemaProps{ - Default: map[string]interface{}{}, - Ref: ref(v1beta1.NetworkNeighbor{}.OpenAPIModelName()), - }, - }, - }, - }, - }, - }, - Required: []string{"name", "ingress", "egress"}, - }, - }, - Dependencies: []string{ - v1beta1.NetworkNeighbor{}.OpenAPIModelName()}, - } -} - -func schema_pkg_apis_softwarecomposition_v1beta1_NetworkNeighborhoodList(ref common.ReferenceCallback) common.OpenAPIDefinition { - return common.OpenAPIDefinition{ - Schema: spec.Schema{ - SchemaProps: spec.SchemaProps{ - Description: "NetworkNeighborhoodList is a list of NetworkNeighborhoods.", - Type: []string{"object"}, - Properties: map[string]spec.Schema{ - "kind": { - SchemaProps: spec.SchemaProps{ - Description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", - Type: []string{"string"}, - Format: "", - }, - }, - "apiVersion": { - SchemaProps: spec.SchemaProps{ - Description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", - Type: []string{"string"}, - Format: "", - }, - }, - "metadata": { - SchemaProps: spec.SchemaProps{ - Default: map[string]interface{}{}, - Ref: ref(v1.ListMeta{}.OpenAPIModelName()), - }, - }, - "items": { - SchemaProps: spec.SchemaProps{ - Type: []string{"array"}, - Items: &spec.SchemaOrArray{ - Schema: &spec.Schema{ - SchemaProps: spec.SchemaProps{ - Default: map[string]interface{}{}, - Ref: ref(v1beta1.NetworkNeighborhood{}.OpenAPIModelName()), - }, - }, - }, - }, - }, - }, - Required: []string{"items"}, - }, - }, - Dependencies: []string{ - v1beta1.NetworkNeighborhood{}.OpenAPIModelName(), v1.ListMeta{}.OpenAPIModelName()}, - } -} - -func schema_pkg_apis_softwarecomposition_v1beta1_NetworkNeighborhoodSpec(ref common.ReferenceCallback) common.OpenAPIDefinition { - return common.OpenAPIDefinition{ - Schema: spec.Schema{ - SchemaProps: spec.SchemaProps{ - Type: []string{"object"}, - Properties: map[string]spec.Schema{ - "matchLabels": { - SchemaProps: spec.SchemaProps{ - Description: "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is \"key\", the operator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", - Type: []string{"object"}, - AdditionalProperties: &spec.SchemaOrBool{ - Allows: true, - Schema: &spec.Schema{ - SchemaProps: spec.SchemaProps{ - Default: "", - Type: []string{"string"}, - Format: "", - }, - }, - }, - }, - }, - "matchExpressions": { - VendorExtensible: spec.VendorExtensible{ - Extensions: spec.Extensions{ - "x-kubernetes-list-type": "atomic", - }, - }, - SchemaProps: spec.SchemaProps{ - Description: "matchExpressions is a list of label selector requirements. The requirements are ANDed.", - Type: []string{"array"}, - Items: &spec.SchemaOrArray{ - Schema: &spec.Schema{ - SchemaProps: spec.SchemaProps{ - Default: map[string]interface{}{}, - Ref: ref(v1.LabelSelectorRequirement{}.OpenAPIModelName()), - }, - }, - }, - }, - }, - "containers": { - SchemaProps: spec.SchemaProps{ - Type: []string{"array"}, - Items: &spec.SchemaOrArray{ - Schema: &spec.Schema{ - SchemaProps: spec.SchemaProps{ - Default: map[string]interface{}{}, - Ref: ref(v1beta1.NetworkNeighborhoodContainer{}.OpenAPIModelName()), - }, - }, - }, - }, - }, - "initContainers": { - SchemaProps: spec.SchemaProps{ - Type: []string{"array"}, - Items: &spec.SchemaOrArray{ - Schema: &spec.Schema{ - SchemaProps: spec.SchemaProps{ - Default: map[string]interface{}{}, - Ref: ref(v1beta1.NetworkNeighborhoodContainer{}.OpenAPIModelName()), - }, - }, - }, - }, - }, - "ephemeralContainers": { - SchemaProps: spec.SchemaProps{ - Type: []string{"array"}, - Items: &spec.SchemaOrArray{ - Schema: &spec.Schema{ - SchemaProps: spec.SchemaProps{ - Default: map[string]interface{}{}, - Ref: ref(v1beta1.NetworkNeighborhoodContainer{}.OpenAPIModelName()), - }, - }, - }, - }, - }, - }, - Required: []string{"containers", "initContainers", "ephemeralContainers"}, - }, - }, - Dependencies: []string{ - v1beta1.NetworkNeighborhoodContainer{}.OpenAPIModelName(), v1.LabelSelectorRequirement{}.OpenAPIModelName()}, - } -} - func schema_pkg_apis_softwarecomposition_v1beta1_NetworkPolicy(ref common.ReferenceCallback) common.OpenAPIDefinition { return common.OpenAPIDefinition{ Schema: spec.Schema{ diff --git a/pkg/registry/file/applicationprofile_processor.go b/pkg/registry/file/applicationprofile_processor.go deleted file mode 100644 index 10d7923d2..000000000 --- a/pkg/registry/file/applicationprofile_processor.go +++ /dev/null @@ -1,162 +0,0 @@ -package file - -import ( - "context" - "fmt" - "strconv" - - mapset "github.com/deckarep/golang-set/v2" - "github.com/kubescape/go-logger" - loggerhelpers "github.com/kubescape/go-logger/helpers" - "github.com/kubescape/k8s-interface/instanceidhandler/v1/helpers" - "github.com/kubescape/k8s-interface/names" - "github.com/kubescape/storage/pkg/apis/softwarecomposition" - "github.com/kubescape/storage/pkg/config" - "github.com/kubescape/storage/pkg/registry/file/callstack" - "github.com/kubescape/storage/pkg/registry/file/dynamicpathdetector" - "k8s.io/apimachinery/pkg/runtime" -) - -// Thresholds are defined in dynamicpathdetector.OpenDynamicThreshold and -// dynamicpathdetector.EndpointDynamicThreshold (single source of truth). - -type ApplicationProfileProcessor struct { - defaultNamespace string - maxApplicationProfileSize int - storageImpl ContainerProfileStorage - // collapseSettings is the lookup hook the deflate path consults for - // per-prefix thresholds. Defaults to dynamicpathdetector.DefaultCollapseSettings; - // production wiring may override via SetCollapseSettings to a provider that - // reads the cluster-scoped CollapseConfiguration "default" CR. - collapseSettings dynamicpathdetector.CollapseSettingsProvider -} - -func NewApplicationProfileProcessor(cfg config.Config) *ApplicationProfileProcessor { - return &ApplicationProfileProcessor{ - defaultNamespace: cfg.DefaultNamespace, - maxApplicationProfileSize: cfg.MaxApplicationProfileSize, - collapseSettings: dynamicpathdetector.DefaultCollapseSettings, - } -} - -// SetCollapseSettings overrides the provider the deflate path uses to fetch -// effective thresholds. Pass dynamicpathdetector.DefaultCollapseSettings to -// fall back to compiled-in defaults; production wiring passes a provider -// that reads the CollapseConfiguration CR. -func (a *ApplicationProfileProcessor) SetCollapseSettings(p dynamicpathdetector.CollapseSettingsProvider) { - if p == nil { - a.collapseSettings = dynamicpathdetector.DefaultCollapseSettings - return - } - a.collapseSettings = p -} - -// effectiveCollapseSettings is the safe accessor for the deflate path. It -// returns the result of the configured provider, or — when the processor -// was constructed without using NewApplicationProfileProcessor (zero-value -// field, no factory call) — the compiled-in defaults. Without this guard, -// any direct struct-literal construction would nil-deref at deflate time. -// CodeRabbit upstream PR #326 finding #3. -func (a *ApplicationProfileProcessor) effectiveCollapseSettings() dynamicpathdetector.CollapseSettings { - if a.collapseSettings == nil { - return dynamicpathdetector.DefaultCollapseSettings() - } - return a.collapseSettings() -} - -var _ Processor = (*ApplicationProfileProcessor)(nil) - -func (a *ApplicationProfileProcessor) AfterCreate(_ context.Context, _ runtime.Object) error { - return nil -} - -func (a *ApplicationProfileProcessor) PreSave(ctx context.Context, object runtime.Object) error { - profile, ok := object.(*softwarecomposition.ApplicationProfile) - if !ok { - return fmt.Errorf("given object is not an ApplicationProfile") - } - - // set schema version - profile.SchemaVersion = SchemaVersion - - // size is the sum of all fields in all containers - var size int - - // Define a function to process a slice of containers - processContainers := func(containers []softwarecomposition.ApplicationProfileContainer) []softwarecomposition.ApplicationProfileContainer { - for i, container := range containers { - var sbomSet mapset.Set[string] - // get files from corresponding sbom - sbomName, err := names.ImageInfoToSlug(container.ImageTag, container.ImageID) - if err == nil { - key := K8sKeysToPath("", "spdx.softwarecomposition.kubescape.io", "sbomsyft", "", a.defaultNamespace, sbomName) - if sbom, err := a.storageImpl.GetSbom(ctx, key); err == nil { - // fill sbomSet - sbomSet = mapset.NewSet[string]() - for _, f := range sbom.Spec.Syft.Files { - sbomSet.Add(f.Location.RealPath) - } - } else { - logger.L().Debug("failed to get sbom", loggerhelpers.Error(err), loggerhelpers.String("key", key)) - } - } else { - logger.L().Debug("failed to get sbom name", loggerhelpers.Error(err), loggerhelpers.String("imageTag", container.ImageTag), loggerhelpers.String("imageID", container.ImageID)) - } - containers[i] = deflateApplicationProfileContainer(container, sbomSet, a.effectiveCollapseSettings()) - size += len(containers[i].Execs) - size += len(containers[i].Opens) - size += len(containers[i].Syscalls) - size += len(containers[i].Capabilities) - size += len(containers[i].Endpoints) - size += len(containers[i].IdentifiedCallStacks) - } - return containers - } - - // Use the function for InitContainers, EphemeralContainers and Containers - profile.Spec.EphemeralContainers = processContainers(profile.Spec.EphemeralContainers) - profile.Spec.InitContainers = processContainers(profile.Spec.InitContainers) - profile.Spec.Containers = processContainers(profile.Spec.Containers) - - profile.Spec.Architectures = DeflateSortString(profile.Spec.Architectures) - - // check the size of the profile - if size > a.maxApplicationProfileSize { - return fmt.Errorf("application profile size exceeds the limit of %d: %w", a.maxApplicationProfileSize, ObjectTooLargeError) - } - - // make sure annotations are initialized - if profile.Annotations == nil { - profile.Annotations = make(map[string]string) - } - profile.Annotations[helpers.ResourceSizeMetadataKey] = strconv.Itoa(size) - return nil -} - -func (a *ApplicationProfileProcessor) SetStorage(containerProfileStorage ContainerProfileStorage) { - a.storageImpl = containerProfileStorage -} - -func deflateApplicationProfileContainer(container softwarecomposition.ApplicationProfileContainer, sbomSet mapset.Set[string], settings dynamicpathdetector.CollapseSettings) softwarecomposition.ApplicationProfileContainer { - opens, err := dynamicpathdetector.AnalyzeOpens(container.Opens, dynamicpathdetector.NewPathAnalyzerWithConfigs(settings.OpenDynamicThreshold, settings.CollapseConfigs), sbomSet) - if err != nil { - logger.L().Debug("falling back to DeflateStringer for opens", loggerhelpers.Error(err)) - opens = DeflateStringer(container.Opens) - } - endpoints := dynamicpathdetector.AnalyzeEndpoints(&container.Endpoints, dynamicpathdetector.NewPathAnalyzerWithConfigs(settings.EndpointDynamicThreshold, settings.CollapseConfigs)) - identifiedCallStacks := callstack.UnifyIdentifiedCallStacks(container.IdentifiedCallStacks) - - return softwarecomposition.ApplicationProfileContainer{ - Name: container.Name, - Capabilities: DeflateSortString(container.Capabilities), - Execs: DeflateStringer(container.Execs), - Opens: opens, - Syscalls: DeflateSortString(container.Syscalls), - SeccompProfile: container.SeccompProfile, - Endpoints: endpoints, - ImageTag: container.ImageTag, - ImageID: container.ImageID, - PolicyByRuleId: DeflateRulePolicies(container.PolicyByRuleId), - IdentifiedCallStacks: identifiedCallStacks, - } -} diff --git a/pkg/registry/file/applicationprofile_processor_collapse_provider_test.go b/pkg/registry/file/applicationprofile_processor_collapse_provider_test.go deleted file mode 100644 index 262ce43f4..000000000 --- a/pkg/registry/file/applicationprofile_processor_collapse_provider_test.go +++ /dev/null @@ -1,243 +0,0 @@ -/* -Copyright 2024 The Kubescape Authors. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -*/ - -package file - -import ( - "fmt" - "testing" - - "github.com/kubescape/storage/pkg/apis/softwarecomposition" - "github.com/kubescape/storage/pkg/config" - "github.com/kubescape/storage/pkg/registry/file/dynamicpathdetector" - "github.com/stretchr/testify/assert" - "github.com/stretchr/testify/require" -) - -// TestApplicationProfileProcessor_DefaultCollapseSettings_Wired pins that -// a freshly-constructed ApplicationProfileProcessor uses the compiled -// defaults — i.e. the deflate path collapses /etc paths at the default -// /etc threshold, not at some accidental zero value. Also pins that -// the constructor wires the provider field (no nil-pointer panic on -// PreSave when the cluster has no CollapseConfiguration CR). -func TestApplicationProfileProcessor_DefaultCollapseSettings_Wired(t *testing.T) { - a := NewApplicationProfileProcessor(config.Config{DefaultNamespace: "kubescape", MaxApplicationProfileSize: 40000}) - assert.NotNil(t, a) - // The provider field should have been initialised — test by deflating - // a small profile and asserting the result has the expected shape. - // We can't directly inspect the unexported field, so we exercise it. - settings := dynamicpathdetector.DefaultCollapseSettings() - require := assertSettingsMatchProcessor(t, a, settings) - _ = require -} - -// TestApplicationProfileProcessor_SetCollapseSettings_NilFallsBack pins -// the defensive nil-handling on the setter — passing a nil provider -// must NOT replace the working default with nil (which would crash on -// PreSave). It must restore the compiled defaults. -func TestApplicationProfileProcessor_SetCollapseSettings_NilFallsBack(t *testing.T) { - a := NewApplicationProfileProcessor(config.Config{DefaultNamespace: "kubescape", MaxApplicationProfileSize: 40000}) - - // Override with a custom provider that returns custom settings. - a.SetCollapseSettings(func() dynamicpathdetector.CollapseSettings { - return dynamicpathdetector.CollapseSettings{OpenDynamicThreshold: 7} - }) - // Now pass nil — must restore defaults, not crash. - a.SetCollapseSettings(nil) - - // Pull what the processor would actually pass to deflate at PreSave time. - // If the setter had stored nil, this call would panic. - got := a.collapseSettings() - want := dynamicpathdetector.DefaultCollapseSettings() - assert.Equal(t, want.OpenDynamicThreshold, got.OpenDynamicThreshold, - "nil provider must restore default OpenDynamicThreshold, not the prior custom 7") - assert.Equal(t, want.EndpointDynamicThreshold, got.EndpointDynamicThreshold) -} - -// TestApplicationProfileProcessor_SetCollapseSettings_CustomProviderUsed -// pins that a custom provider's settings actually reach the deflate -// path *via the processor's collapseSettings field*. We deflate twice -// against the same input — once before SetCollapseSettings (defaults, -// no collapse) and once after (custom threshold 3, collapse). Both -// calls fetch settings via `a.collapseSettings()`, so the assertion -// exercises the wiring CodeRabbit flagged. -func TestApplicationProfileProcessor_SetCollapseSettings_CustomProviderUsed(t *testing.T) { - a := NewApplicationProfileProcessor(config.Config{DefaultNamespace: "kubescape", MaxApplicationProfileSize: 40000}) - - // Build a container whose Opens has 4 distinct /etc children. - container := softwarecomposition.ApplicationProfileContainer{ - Name: "test", - Opens: []softwarecomposition.OpenCalls{ - {Path: "/etc/file1", Flags: []string{"O_RDONLY"}}, - {Path: "/etc/file2", Flags: []string{"O_RDONLY"}}, - {Path: "/etc/file3", Flags: []string{"O_RDONLY"}}, - {Path: "/etc/file4", Flags: []string{"O_RDONLY"}}, - }, - } - - // Default provider (threshold 100 for /etc) — paths stay distinct. - // The settings come from the processor's wired-up provider. - defResult := deflateApplicationProfileContainer(container, nil, a.collapseSettings()) - assert.Greater(t, len(defResult.Opens), 1, "with default /etc threshold of 100, four files should NOT collapse") - - // Now install a custom provider with a tight /etc threshold and re-deflate. - a.SetCollapseSettings(func() dynamicpathdetector.CollapseSettings { - return dynamicpathdetector.CollapseSettings{ - OpenDynamicThreshold: 50, - EndpointDynamicThreshold: 100, - CollapseConfigs: []dynamicpathdetector.CollapseConfig{ - {Prefix: "/etc", Threshold: 3}, - }, - } - }) - customResult := deflateApplicationProfileContainer(container, nil, a.collapseSettings()) - collapsed := false - for _, o := range customResult.Opens { - if o.Path == "/etc/"+dynamicpathdetector.DynamicIdentifier { - collapsed = true - break - } - } - assert.True(t, collapsed, - "after SetCollapseSettings(threshold 3), four /etc files MUST collapse to /etc/⋯ via the processor's provider") -} - -// TestDeflateApplicationProfileContainer_EndpointsHonorCollapseConfigs pins -// the blocker fix: CollapseConfiguration.collapseConfigs must drive endpoint -// compaction, not only opens. Before the fix the endpoint analyzer was -// constructed with a nil configs slice, so per-prefix overrides from the CRD -// were silently ignored for endpoints. -func TestDeflateApplicationProfileContainer_EndpointsHonorCollapseConfigs(t *testing.T) { - container := softwarecomposition.ApplicationProfileContainer{Name: "test"} - for i := 0; i < 6; i++ { - container.Endpoints = append(container.Endpoints, softwarecomposition.HTTPEndpoint{ - Endpoint: fmt.Sprintf(":80/api/user%d", i), - Methods: []string{"GET"}, - }) - } - - // Default settings: EndpointDynamicThreshold 100 and no /api override — - // the six /api children stay distinct. - defResult := deflateApplicationProfileContainer(container, nil, dynamicpathdetector.DefaultCollapseSettings()) - assert.Len(t, defResult.Endpoints, 6, "with default endpoint threshold the six /api children stay distinct") - - // A tight /api CollapseConfig MUST now reach the endpoint analyzer and - // collapse the children to :80/api/⋯. - custom := dynamicpathdetector.CollapseSettings{ - OpenDynamicThreshold: 100, - EndpointDynamicThreshold: 100, - CollapseConfigs: []dynamicpathdetector.CollapseConfig{ - {Prefix: "/api", Threshold: 3}, - }, - } - customResult := deflateApplicationProfileContainer(container, nil, custom) - collapsed := false - for _, e := range customResult.Endpoints { - if e.Endpoint == ":80/api/"+dynamicpathdetector.DynamicIdentifier { - collapsed = true - break - } - } - assert.True(t, collapsed, - "endpoints under /api MUST collapse to :80/api/⋯ once collapseConfigs is honored for endpoints; got %+v", customResult.Endpoints) - assert.Less(t, len(customResult.Endpoints), 6, "collapsing must reduce the endpoint count") -} - -// TestApplicationProfileProcessor_SetCollapseSettings_DefensiveSetterCopy -// pins that the setter does not store a reference to a slice the caller -// can later mutate. The provider is a function value so by Go semantics -// it captures the closure's referenced state — defensiveness lives in -// the PROVIDER's body. This test documents that contract by installing -// a provider that returns a captured slice, mutating that slice, and -// verifying the deflate path uses the MUTATED state — i.e. the contract -// is "the provider is the source of truth at every call". A wrapper -// provider that wants snapshot semantics must clone its captured slice. -func TestApplicationProfileProcessor_SetCollapseSettings_DefensiveSetterCopy(t *testing.T) { - captured := []dynamicpathdetector.CollapseConfig{{Prefix: "/etc", Threshold: 3}} - a := NewApplicationProfileProcessor(config.Config{DefaultNamespace: "kubescape", MaxApplicationProfileSize: 40000}) - a.SetCollapseSettings(func() dynamicpathdetector.CollapseSettings { - return dynamicpathdetector.CollapseSettings{ - OpenDynamicThreshold: 50, - CollapseConfigs: captured, - } - }) - - // Mutate the captured slice — the provider sees the new threshold on - // the next call. Documenting this in a test makes the contract explicit - // for production wiring (informer-backed providers should always - // snapshot). - captured[0].Threshold = 999 - - // Build 5 /etc paths. - container := softwarecomposition.ApplicationProfileContainer{Name: "test"} - for i := 0; i < 5; i++ { - container.Opens = append(container.Opens, softwarecomposition.OpenCalls{ - Path: fmt.Sprintf("/etc/file%d", i), - Flags: []string{"O_RDONLY"}, - }) - } - // With threshold now 999, paths should NOT collapse. - result := deflateApplicationProfileContainer(container, nil, a.collapseSettings()) - assert.Equal(t, 5, len(result.Opens), - "after mutating the captured slice, the provider returns the new threshold and paths stay distinct") -} - -// TestApplicationProfileProcessor_ZeroValue_NoPanicOnCollapseSettings pins -// the defensive contract that a zero-valued ApplicationProfileProcessor -// — constructed with `&ApplicationProfileProcessor{...}` instead of via -// the NewApplicationProfileProcessor factory — must not panic when -// PreSave reaches the deflate path. The compiled-in defaults are an -// acceptable fallback; a nil-function dereference is not. CodeRabbit -// upstream PR #326 finding #3 (applicationprofile_processor.go:92). -func TestApplicationProfileProcessor_ZeroValue_NoPanicOnCollapseSettings(t *testing.T) { - // Direct struct literal — collapseSettings is left as the zero value (nil). - a := &ApplicationProfileProcessor{} - - // The safe accessor must NOT panic. The result must match the - // compiled-in defaults across ALL fields, not just OpenDynamicThreshold — - // otherwise a regression that resets EndpointDynamicThreshold (or any - // future field added to CollapseSettings) to its zero value would - // silently pass this guard. CodeRabbit follow-up review on storage PR #33. - require.NotPanics(t, func() { - got := a.effectiveCollapseSettings() - want := dynamicpathdetector.DefaultCollapseSettings() - assert.Equal(t, want, got, - "zero-valued processor must fall back to the FULL DefaultCollapseSettings struct, got %+v want %+v", - got, want) - }) - - // Direct field-call still panics — that's an "I know what I'm doing" - // path. The contract is only that the safe accessor (used by PreSave - // → deflate) is panic-free. - assert.Panics(t, func() { _ = a.collapseSettings() }, - "raw field-call on zero-valued processor still panics; only the safe accessor is guarded") -} - -// assertSettingsMatchProcessor is a placeholder for richer wiring assertions. -// The function exercises a non-nil-provider invocation as a smoke test. -func assertSettingsMatchProcessor(t *testing.T, a *ApplicationProfileProcessor, want dynamicpathdetector.CollapseSettings) bool { - t.Helper() - got := a.collapseSettings() - if got.OpenDynamicThreshold != want.OpenDynamicThreshold { - t.Errorf("OpenDynamicThreshold = %d, want %d", got.OpenDynamicThreshold, want.OpenDynamicThreshold) - return false - } - if got.EndpointDynamicThreshold != want.EndpointDynamicThreshold { - t.Errorf("EndpointDynamicThreshold = %d, want %d", got.EndpointDynamicThreshold, want.EndpointDynamicThreshold) - return false - } - return true -} diff --git a/pkg/registry/file/applicationprofile_processor_test.go b/pkg/registry/file/applicationprofile_processor_test.go deleted file mode 100644 index d7ebe3b97..000000000 --- a/pkg/registry/file/applicationprofile_processor_test.go +++ /dev/null @@ -1,458 +0,0 @@ -package file - -import ( - "context" - "fmt" - "slices" - "strings" - "testing" - - mapset "github.com/deckarep/golang-set/v2" - "github.com/kubescape/k8s-interface/instanceidhandler/v1/helpers" - "github.com/kubescape/storage/pkg/apis/softwarecomposition" - "github.com/kubescape/storage/pkg/apis/softwarecomposition/consts" - "github.com/kubescape/storage/pkg/config" - "github.com/kubescape/storage/pkg/registry/file/dynamicpathdetector" - "github.com/stretchr/testify/assert" - v1 "k8s.io/apimachinery/pkg/apis/meta/v1" - "k8s.io/apimachinery/pkg/runtime" -) - -// openThreshold returns the collapse threshold used by deflateApplicationProfileContainer -// for file-open paths. NewPathAnalyzerWithConfigs uses OpenDynamicThreshold as the default. -func openThreshold() int { - return dynamicpathdetector.OpenDynamicThreshold -} - -var ap = softwarecomposition.ApplicationProfile{ - ObjectMeta: v1.ObjectMeta{ - Annotations: map[string]string{}, - }, - Spec: softwarecomposition.ApplicationProfileSpec{ - Architectures: []string{"amd64", "arm64", "amd64"}, - EphemeralContainers: []softwarecomposition.ApplicationProfileContainer{ - { - Name: "ephemeralContainer", - Execs: []softwarecomposition.ExecCalls{ - {Path: "/bin/bash", Args: []string{"-c", "echo abc"}}, - }, - }, - }, - InitContainers: []softwarecomposition.ApplicationProfileContainer{ - { - Name: "initContainer", - Execs: []softwarecomposition.ExecCalls{ - {Path: "/bin/bash", Args: []string{"-c", "echo hello"}}, - }, - }, - }, - Containers: []softwarecomposition.ApplicationProfileContainer{ - { - Name: "container1", - Execs: []softwarecomposition.ExecCalls{ - {Path: "/usr/bin/ls", Args: []string{"-l", "/tmp"}}, - {Path: "/usr/bin/ls", Args: []string{"-l", "/home"}}, - {Path: "/usr/bin/ls", Args: []string{"-l", "/tmp"}}, - }, - }, - { - Name: "container2", - Execs: []softwarecomposition.ExecCalls{ - {Path: "/usr/bin/ping", Args: []string{"localhost"}}, - }, - Opens: []softwarecomposition.OpenCalls{ - {Path: "/etc/hosts", Flags: []string{"O_CLOEXEC", "O_RDONLY"}}, - }, - Endpoints: []softwarecomposition.HTTPEndpoint{ - { - Endpoint: ":443/abc", - Methods: []string{"GET"}, - Internal: false, - Direction: consts.Inbound, - Headers: []byte{}, - }, - }, - }, - }, - }, -} - -func TestApplicationProfileProcessor_PreSave(t *testing.T) { - tests := []struct { - name string - maxApplicationProfileSize int - object runtime.Object - want runtime.Object - wantErr assert.ErrorAssertionFunc - }{ - { - name: "ApplicationProfile with initContainers and ephemeralContainers", - maxApplicationProfileSize: 40000, - object: &ap, - want: &softwarecomposition.ApplicationProfile{ - ObjectMeta: v1.ObjectMeta{ - Annotations: map[string]string{ - helpers.ResourceSizeMetadataKey: "7", - }, - }, - SchemaVersion: 1, - Spec: softwarecomposition.ApplicationProfileSpec{ - Architectures: []string{"amd64", "arm64"}, - EphemeralContainers: []softwarecomposition.ApplicationProfileContainer{ - { - Name: "ephemeralContainer", - Execs: []softwarecomposition.ExecCalls{ - {Path: "/bin/bash", Args: []string{"-c", "echo abc"}}, - }, - }, - }, - InitContainers: []softwarecomposition.ApplicationProfileContainer{ - { - Name: "initContainer", - Execs: []softwarecomposition.ExecCalls{ - {Path: "/bin/bash", Args: []string{"-c", "echo hello"}}, - }, - }, - }, - Containers: []softwarecomposition.ApplicationProfileContainer{ - { - Name: "container1", - Execs: []softwarecomposition.ExecCalls{ - {Path: "/usr/bin/ls", Args: []string{"-l", "/tmp"}}, - {Path: "/usr/bin/ls", Args: []string{"-l", "/home"}}, - }, - }, - { - Name: "container2", - Execs: []softwarecomposition.ExecCalls{ - {Path: "/usr/bin/ping", Args: []string{"localhost"}}, - }, - Opens: []softwarecomposition.OpenCalls{ - {Path: "/etc/hosts", Flags: []string{"O_CLOEXEC", "O_RDONLY"}}, - }, - Endpoints: []softwarecomposition.HTTPEndpoint{ - { - Endpoint: ":443/abc", - Methods: []string{"GET"}, - Internal: false, - Direction: consts.Inbound, - Headers: []byte{}, - }, - }, - }, - }, - }, - }, - wantErr: assert.NoError, - }, - { - name: "ApplicationProfile too big", - maxApplicationProfileSize: 5, - object: &ap, - want: &ap, - wantErr: assert.Error, - }, - } - for _, tt := range tests { - t.Run(tt.name, func(t *testing.T) { - a := NewApplicationProfileProcessor(config.Config{DefaultNamespace: "kubescape", MaxApplicationProfileSize: tt.maxApplicationProfileSize}) - tt.wantErr(t, a.PreSave(context.TODO(), tt.object), fmt.Sprintf("PreSave(%v)", tt.object)) - slices.Sort(tt.object.(*softwarecomposition.ApplicationProfile).Spec.Architectures) - assert.Equal(t, tt.want, tt.object) - }) - } -} - -func TestDeflateRulePolicies(t *testing.T) { - tests := []struct { - name string - in map[string]softwarecomposition.RulePolicy - want map[string]softwarecomposition.RulePolicy - }{ - { - name: "nil map", - in: nil, - want: nil, - }, - { - name: "empty map", - in: map[string]softwarecomposition.RulePolicy{}, - want: map[string]softwarecomposition.RulePolicy{}, - }, - { - name: "single rule with unsorted processes", - in: map[string]softwarecomposition.RulePolicy{ - "rule1": { - AllowedProcesses: []string{"cat", "bash", "ls"}, - AllowedContainer: true, - }, - }, - want: map[string]softwarecomposition.RulePolicy{ - "rule1": { - AllowedProcesses: []string{"bash", "cat", "ls"}, - AllowedContainer: true, - }, - }, - }, - { - name: "multiple rules with duplicate processes", - in: map[string]softwarecomposition.RulePolicy{ - "rule1": { - AllowedProcesses: []string{"cat", "bash", "ls", "bash"}, - AllowedContainer: true, - }, - "rule2": { - AllowedProcesses: []string{"nginx", "nginx", "python"}, - AllowedContainer: false, - }, - }, - want: map[string]softwarecomposition.RulePolicy{ - "rule1": { - AllowedProcesses: []string{"bash", "cat", "ls"}, - AllowedContainer: true, - }, - "rule2": { - AllowedProcesses: []string{"nginx", "python"}, - AllowedContainer: false, - }, - }, - }, - { - name: "rule with empty processes", - in: map[string]softwarecomposition.RulePolicy{ - "rule1": { - AllowedProcesses: []string{}, - AllowedContainer: true, - }, - }, - want: map[string]softwarecomposition.RulePolicy{ - "rule1": { - AllowedProcesses: []string{}, - AllowedContainer: true, - }, - }, - }, - { - name: "rule with nil processes", - in: map[string]softwarecomposition.RulePolicy{ - "rule1": { - AllowedProcesses: nil, - AllowedContainer: true, - }, - }, - want: map[string]softwarecomposition.RulePolicy{ - "rule1": { - AllowedProcesses: nil, - AllowedContainer: true, - }, - }, - }, - } - - for _, tt := range tests { - t.Run(tt.name, func(t *testing.T) { - got := DeflateRulePolicies(tt.in) - assert.Equal(t, tt.want, got) - }) - } -} - -// generateSOOpens creates N unique .so OpenCalls under /usr/lib/x86_64-linux-gnu/ -func generateSOOpens(n int) []softwarecomposition.OpenCalls { - opens := make([]softwarecomposition.OpenCalls, n) - for i := 0; i < n; i++ { - opens[i] = softwarecomposition.OpenCalls{ - Path: fmt.Sprintf("/usr/lib/x86_64-linux-gnu/lib%d.so.%d", i, i%5), - Flags: []string{"O_RDONLY", "O_CLOEXEC"}, - } - } - return opens -} - -func TestDeflateApplicationProfileContainer_CollapsesManyOpens(t *testing.T) { - // Generate enough opens to exceed the default threshold used by NewPathAnalyzerWithConfigs - numOpens := openThreshold() + 1 - opens := generateSOOpens(numOpens) - - container := softwarecomposition.ApplicationProfileContainer{ - Name: "test-container", - Opens: opens, - } - - result := deflateApplicationProfileContainer(container, nil, dynamicpathdetector.DefaultCollapseSettings()) - - assert.Less(t, len(result.Opens), numOpens, - "%d .so files should be collapsed, got %d opens", numOpens, len(result.Opens)) - - // Verify collapsed paths contain dynamic or wildcard segments - for _, open := range result.Opens { - if strings.HasPrefix(open.Path, "/usr/lib/x86_64-linux-gnu/") { - assert.True(t, - strings.Contains(open.Path, "\u22ef") || strings.Contains(open.Path, "*"), - "path %q should contain a dynamic or wildcard segment", open.Path) - } - } - - // Flags should be preserved and merged - for _, open := range result.Opens { - assert.NotEmpty(t, open.Flags, "flags should be preserved after collapse") - } -} - -func TestDeflateApplicationProfileContainer_SbomPathsPreserved(t *testing.T) { - numOpens := openThreshold() + 1 - opens := generateSOOpens(numOpens) - - // Build sbomSet containing ALL the .so paths (realistic scenario: - // these are library files referenced by the SBOM for vulnerability scanning) - sbomSet := mapset.NewSet[string]() - for _, open := range opens { - sbomSet.Add(open.Path) - } - - container := softwarecomposition.ApplicationProfileContainer{ - Name: "test-container", - Opens: opens, - } - - result := deflateApplicationProfileContainer(container, sbomSet, dynamicpathdetector.DefaultCollapseSettings()) - - // SBOM paths must NEVER be collapsed — they map to specific library files - // used for vulnerability scanning. Collapsing them makes vuln results - // non-reproducible. - assert.Equal(t, numOpens, len(result.Opens), - "SBOM paths must be preserved verbatim, got %d opens (expected %d)", len(result.Opens), numOpens) - resultPaths := make(map[string]bool) - for _, r := range result.Opens { - resultPaths[r.Path] = true - } - for _, open := range opens { - assert.True(t, resultPaths[open.Path], - "SBOM path %q must be preserved in output", open.Path) - } -} - -func TestDeflateApplicationProfileContainer_MixedPathsCollapse(t *testing.T) { - var opens []softwarecomposition.OpenCalls - - // /usr/lib uses the default threshold from NewPathAnalyzerWithConfigs(OpenDynamicThreshold, ...) - usrLibThreshold := openThreshold() - for i := 0; i < usrLibThreshold+1; i++ { - opens = append(opens, softwarecomposition.OpenCalls{ - Path: fmt.Sprintf("/usr/lib/lib%d.so", i), - Flags: []string{"O_RDONLY"}, - }) - } - - // /etc uses the /etc config threshold from DefaultCollapseConfigs. - // Derive from the live config so this test stays in sync if the - // production threshold for /etc ever changes — hardcoding 100 here - // previously meant the test would silently pass even when - // DefaultCollapseConfigs drifted (CodeRabbit C5). - etcAnalyzer := dynamicpathdetector.NewPathAnalyzerWithConfigs( - dynamicpathdetector.OpenDynamicThreshold, - dynamicpathdetector.DefaultCollapseConfigs(), - ) - etcThreshold := etcAnalyzer.FindConfigForPath("/etc/file").Threshold - for i := 0; i < etcThreshold+1; i++ { - opens = append(opens, softwarecomposition.OpenCalls{ - Path: fmt.Sprintf("/etc/conf%d.cfg", i), - Flags: []string{"O_RDONLY"}, - }) - } - - opens = append(opens, - softwarecomposition.OpenCalls{Path: "/tmp/file1.txt", Flags: []string{"O_RDWR"}}, - softwarecomposition.OpenCalls{Path: "/tmp/file2.txt", Flags: []string{"O_RDWR"}}, - ) - - container := softwarecomposition.ApplicationProfileContainer{ - Name: "test-container", - Opens: opens, - } - - result := deflateApplicationProfileContainer(container, nil, dynamicpathdetector.DefaultCollapseSettings()) - - // Count paths by prefix - var usrLibPaths, etcPaths, tmpPaths int - for _, open := range result.Opens { - switch { - case strings.HasPrefix(open.Path, "/usr/lib/"): - usrLibPaths++ - case strings.HasPrefix(open.Path, "/etc/"): - etcPaths++ - case strings.HasPrefix(open.Path, "/tmp/"): - tmpPaths++ - } - } - - assert.LessOrEqual(t, usrLibPaths, 1, "/usr/lib/ paths should collapse to 1, got %d", usrLibPaths) - assert.LessOrEqual(t, etcPaths, 1, "/etc/ paths should collapse to 1, got %d", etcPaths) - assert.Equal(t, 2, tmpPaths, "/tmp/ paths should remain individual (below threshold)") -} - -// TestDeflateApplicationProfileContainer_NilSbomNoError verifies that nil sbomSet -// with a small number of opens (below threshold) works without error. -func TestDeflateApplicationProfileContainer_NilSbomNoError(t *testing.T) { - container := softwarecomposition.ApplicationProfileContainer{ - Name: "test-container", - Opens: []softwarecomposition.OpenCalls{ - {Path: "/etc/hosts", Flags: []string{"O_RDONLY"}}, - {Path: "/etc/resolv.conf", Flags: []string{"O_RDONLY"}}, - {Path: "/usr/lib/libc.so.6", Flags: []string{"O_RDONLY", "O_CLOEXEC"}}, - }, - } - - result := deflateApplicationProfileContainer(container, nil, dynamicpathdetector.DefaultCollapseSettings()) - - // All 3 paths should remain (below any threshold) - assert.Equal(t, 3, len(result.Opens), "paths below threshold should not collapse") - // Paths should be sorted - for i := 1; i < len(result.Opens); i++ { - assert.True(t, result.Opens[i-1].Path <= result.Opens[i].Path, - "opens should be sorted, got %q before %q", result.Opens[i-1].Path, result.Opens[i].Path) - } -} - -// TestDeflateApplicationProfileContainer_PreSaveEndToEnd verifies the full -// PreSave flow with an ApplicationProfile containing many opens that should collapse. -func TestDeflateApplicationProfileContainer_PreSaveEndToEnd(t *testing.T) { - numOpens := openThreshold() + 1 - opens := generateSOOpens(numOpens) - - profile := &softwarecomposition.ApplicationProfile{ - ObjectMeta: v1.ObjectMeta{ - Annotations: map[string]string{}, - }, - Spec: softwarecomposition.ApplicationProfileSpec{ - Containers: []softwarecomposition.ApplicationProfileContainer{ - { - Name: "main", - Opens: opens, - }, - }, - }, - } - - processor := NewApplicationProfileProcessor(config.Config{ - DefaultNamespace: "kubescape", - MaxApplicationProfileSize: 100000, - }) - - err := processor.PreSave(context.TODO(), profile) - assert.NoError(t, err) - - resultOpens := profile.Spec.Containers[0].Opens - assert.Less(t, len(resultOpens), numOpens, - "PreSave should collapse %d .so files, got %d opens", numOpens, len(resultOpens)) - - // The collapsed path should contain dynamic or wildcard segments - hasCollapsed := false - for _, open := range resultOpens { - if strings.Contains(open.Path, "\u22ef") || strings.Contains(open.Path, "*") { - hasCollapsed = true - break - } - } - assert.True(t, hasCollapsed, "at least one path should contain a dynamic/wildcard segment after PreSave") -} diff --git a/pkg/registry/file/applicationprofile_storage.go b/pkg/registry/file/applicationprofile_storage.go deleted file mode 100644 index dc1272c06..000000000 --- a/pkg/registry/file/applicationprofile_storage.go +++ /dev/null @@ -1,129 +0,0 @@ -package file - -import ( - "context" - "fmt" - "strconv" - - "github.com/kubescape/go-logger" - loggerhelpers "github.com/kubescape/go-logger/helpers" - helpersv1 "github.com/kubescape/k8s-interface/instanceidhandler/v1/helpers" - "github.com/kubescape/storage/pkg/apis/softwarecomposition" - "k8s.io/apimachinery/pkg/runtime" - "k8s.io/apimachinery/pkg/watch" - "k8s.io/apiserver/pkg/storage" -) - -type ApplicationProfileStorage struct { - realStore StorageQuerier -} - -func (a ApplicationProfileStorage) EnableResourceSizeEstimation(keysFunc storage.KeysFunc) error { - return nil -} - -func (a ApplicationProfileStorage) Stats(_ context.Context) (storage.Stats, error) { - return storage.Stats{}, fmt.Errorf("unimplemented") -} - -func (a ApplicationProfileStorage) SetKeysFunc(_ storage.KeysFunc) {} - -func (a ApplicationProfileStorage) CompactRevision() int64 { - return 0 -} - -var _ storage.Interface = (*ApplicationProfileStorage)(nil) - -func NewApplicationProfileStorage(realStore StorageQuerier) storage.Interface { - return &ApplicationProfileStorage{realStore: realStore} -} - -func (a ApplicationProfileStorage) GetCurrentResourceVersion(_ context.Context) (uint64, error) { - return 0, nil -} - -func (a ApplicationProfileStorage) Versioner() storage.Versioner { - return a.realStore.Versioner() -} - -func (a ApplicationProfileStorage) Create(ctx context.Context, key string, obj, out runtime.Object, ttl uint64) error { - return a.realStore.Create(ctx, key, obj, out, ttl) -} - -func (a ApplicationProfileStorage) Delete(ctx context.Context, key string, out runtime.Object, preconditions *storage.Preconditions, validateDeletion storage.ValidateObjectFunc, cachedExistingObject runtime.Object, opts storage.DeleteOptions) error { - return a.realStore.Delete(ctx, key, out, preconditions, validateDeletion, cachedExistingObject, opts) -} - -func (a ApplicationProfileStorage) Watch(ctx context.Context, key string, opts storage.ListOptions) (watch.Interface, error) { - return a.realStore.Watch(ctx, key, opts) -} - -func (a ApplicationProfileStorage) Get(ctx context.Context, key string, opts storage.GetOptions, objPtr runtime.Object) error { - if err := a.realStore.Get(ctx, key, opts, objPtr); err != nil { - return err - } - ap, ok := objPtr.(*softwarecomposition.ApplicationProfile) - if !ok { - return fmt.Errorf("object is not an ApplicationProfile") - } - if len(ap.Parts) > 0 { - var architectures []string - var size int - for cpKey := range ap.Parts { - cp := &softwarecomposition.ContainerProfile{} - if err := a.realStore.Get(ctx, cpKey, opts, cp); err != nil { - logger.L().Debug("ApplicationProfileStorage.Get - get cp object", loggerhelpers.Error(err)) - return nil - } - architectures = append(architectures, cp.Spec.Architectures...) - if i, err := strconv.Atoi(cp.Annotations[helpersv1.ResourceSizeMetadataKey]); err == nil { - size += i - } - container := softwarecomposition.ApplicationProfileContainer{ - Name: cp.Labels[helpersv1.ContainerNameMetadataKey], - Capabilities: cp.Spec.Capabilities, - Execs: cp.Spec.Execs, - Opens: cp.Spec.Opens, - Syscalls: cp.Spec.Syscalls, - SeccompProfile: cp.Spec.SeccompProfile, - Endpoints: cp.Spec.Endpoints, - ImageID: cp.Spec.ImageID, - ImageTag: cp.Spec.ImageTag, - PolicyByRuleId: cp.Spec.PolicyByRuleId, - IdentifiedCallStacks: cp.Spec.IdentifiedCallStacks, - } - switch cp.Annotations[helpersv1.ContainerTypeMetadataKey] { - case "containers": - ap.Spec.Containers = append(ap.Spec.Containers, container) - case "initContainers": - ap.Spec.InitContainers = append(ap.Spec.InitContainers, container) - case "ephemeralContainers": - ap.Spec.EphemeralContainers = append(ap.Spec.EphemeralContainers, container) - default: - return fmt.Errorf("unknown container type: %s", cp.Annotations[helpersv1.ContainerTypeMetadataKey]) - } - } - ap.Spec.Architectures = DeflateSortString(architectures) - ap.Annotations[helpersv1.ResourceSizeMetadataKey] = strconv.Itoa(size) - } - return nil -} - -func (a ApplicationProfileStorage) GetList(ctx context.Context, key string, opts storage.ListOptions, listObj runtime.Object) error { - if opts.ResourceVersion == softwarecomposition.ResourceVersionFullSpec { - return fmt.Errorf("GetList with %s is not allowed for ApplicationProfiles", softwarecomposition.ResourceVersionFullSpec) - } - return a.realStore.GetList(ctx, key, opts, listObj) -} - -func (a ApplicationProfileStorage) GuaranteedUpdate(ctx context.Context, key string, destination runtime.Object, ignoreNotFound bool, preconditions *storage.Preconditions, tryUpdate storage.UpdateFunc, cachedExistingObject runtime.Object) error { - return a.realStore.GuaranteedUpdate(ctx, key, destination, ignoreNotFound, preconditions, tryUpdate, cachedExistingObject) -} - -func (a ApplicationProfileStorage) ReadinessCheck() error { - return a.realStore.ReadinessCheck() -} - -func (a ApplicationProfileStorage) RequestWatchProgress(ctx context.Context) error { - return a.realStore.RequestWatchProgress(ctx) -} diff --git a/pkg/registry/file/containerprofile_processor.go b/pkg/registry/file/containerprofile_processor.go index 0fd79279e..3110acf33 100644 --- a/pkg/registry/file/containerprofile_processor.go +++ b/pkg/registry/file/containerprofile_processor.go @@ -263,14 +263,12 @@ func (a *ContainerProfileProcessor) cleanup() error { } a.LastCleanup = time.Now() resourceToKindHandler := map[string][]TypeCleanupHandlerFunc{ - "applicationprofiles": {deleteWrongSchemaVersion, deleteByTemplateHashOrWlid}, - "containerprofiles": {deleteByTemplateHashOrWlid}, + "containerprofiles": {deleteByTemplateHashOrWlid}, // The merged (effective) CP carries the same templateHash/wlid metadata // as its observed sibling, so the same predicate retires orphans. This // covers workloads that get age-cleaned without going through the REST // Delete path (which already cascades to the merged sibling). ContainerProfileMergedKind: {deleteByTemplateHashOrWlid}, - "networkneighborhoods": {deleteWrongSchemaVersion, deleteByTemplateHashOrWlid}, } return a.CleanupHandler.CleanupTask(context.TODO(), resourceToKindHandler) } @@ -562,25 +560,13 @@ func (a *ContainerProfileProcessor) updateProfile(ctx context.Context, timeSerie // Completed workloads — the previous design short-circuited here and // stranded the merged artifact. refreshMergedProfile rebuilds from scratch // from (observed, ug-AP, ug-NN), so retractions land naturally. - effective, err := a.refreshMergedProfile(ctx, &profile, id, key) - if err != nil { + if _, err := a.refreshMergedProfile(ctx, &profile, id, key); err != nil { // Refresh failures are surfaced so the transaction rolls back; a half- // applied merged write paired with a successful observed save would be // worse than retrying the whole tick. return nil, err } - // Aggregated AP/NN derive from the effective CP so all downstream outputs - // stay aligned with what node-agent actually reads (step 6 of the review). - // Still gated on newData to preserve the existing 30s aggregation cadence — - // ug-only changes propagate via the merged refresh above; the AP/NN - // aggregator already serves a different (downstream-policy) audience. - if newData { - if err := a.updateAggregatedProfiles(ctx, key, effective, prefix, root, id, creationTimestamp); err != nil { - return nil, err - } - } - return processed, nil } @@ -798,36 +784,6 @@ func (a *ContainerProfileProcessor) updateProfileStatus(ctx context.Context, key return newTimeSeries, false, nil } -// updateAggregatedProfiles updates the application profile and network neighborhood -func (a *ContainerProfileProcessor) updateAggregatedProfiles(ctx context.Context, - key string, profile *softwarecomposition.ContainerProfile, prefix, root string, id armotypes.ProfileIdentifier, - creationTimestamp metav1.Time) error { - - instanceID, err := instanceidhandlerv1.GenerateInstanceIDFromString(profile.Annotations[helpers.InstanceIDMetadataKey]) - if err != nil { - return fmt.Errorf("failed to create instance ID: %w", err) - } - - slug, err := instanceID.GetSlug(true) - if err != nil { - return fmt.Errorf("failed to get slug: %w", err) - } - - wlid := profile.Annotations[helpers.WlidMetadataKey] - - // Update application profile - if err := a.ContainerProfileStorage.UpdateApplicationProfile(ctx, key, prefix, root, id, slug, wlid, instanceID, profile, creationTimestamp); err != nil { - return err - } - - // Update network neighborhood - if err := a.ContainerProfileStorage.UpdateNetworkNeighborhood(ctx, key, prefix, root, id, slug, wlid, instanceID, profile, creationTimestamp); err != nil { - return err - } - - return nil -} - // getAggregatedData computes various data of the aggregated profile. // A profile status is completed only if all its main containers are completed. // A profile completion is full only if all its init/main containers are full. diff --git a/pkg/registry/file/containerprofile_processor_test.go b/pkg/registry/file/containerprofile_processor_test.go index af9fe4199..aef1baa15 100644 --- a/pkg/registry/file/containerprofile_processor_test.go +++ b/pkg/registry/file/containerprofile_processor_test.go @@ -56,8 +56,8 @@ func TestDeflateContainerProfileSpec_NetworkNeighborsCollapse(t *testing.T) { assert.Equal(t, []string{"10.0.0.0/26"}, result.Ingress[0].IPAddresses) assert.Equal(t, []softwarecomposition.NetworkPort{{Name: "80"}}, result.Ingress[0].Ports) - // Confirm both call sites (NetworkNeighborhoodProcessor's deflateNetworkNeighbors - // and DeflateContainerProfileSpec's) collapse identically given the same settings. + // Confirm both call sites (the deflateNetworkNeighbors helper and + // DeflateContainerProfileSpec) collapse identically given the same settings. directResult := deflateNetworkNeighbors(newIngress(), settings) assert.Equal(t, directResult, result.Ingress) } @@ -126,29 +126,8 @@ func TestConsolidateData(t *testing.T) { require.NoError(t, err) defer pool.Put(conn) - applicationProfile := softwarecomposition.ApplicationProfile{} - key := "/spdx.softwarecomposition.kubescape.io/applicationprofiles/node-agent-test-hjjz/replicaset-multiple-containers-deployment-d4b8dd5fd" - err = s.GetWithConn(ctx, conn, key, storage.GetOptions{}, &applicationProfile) - assert.NoError(t, err) - delete(applicationProfile.Annotations, helpersv1.SyncChecksumMetadataKey) // checksum depends on creation time - assert.Equal(t, map[string]string{ - helpersv1.CompletionMetadataKey: helpersv1.Full, - helpersv1.InstanceIDMetadataKey: "apiVersion-apps/v1/namespace-node-agent-test-hjjz/kind-ReplicaSet/name-multiple-containers-deployment-d4b8dd5fd", - helpersv1.StatusMetadataKey: helpersv1.Completed, - helpersv1.WlidMetadataKey: "wlid://cluster-kind-kind/namespace-node-agent-test-hjjz/deployment-multiple-containers-deployment", - }, applicationProfile.Annotations) - assert.Equal(t, map[string]string{ - helpersv1.TemplateHashKey: "d4b8dd5fd", - helpersv1.ApiGroupMetadataKey: "apps", - helpersv1.ApiVersionMetadataKey: "v1", - helpersv1.RelatedKindMetadataKey: "Deployment", - helpersv1.RelatedNameMetadataKey: "multiple-containers-deployment", - helpersv1.RelatedNamespaceMetadataKey: "node-agent-test-hjjz", - helpersv1.ResourceVersionMetadataKey: "1448", - }, applicationProfile.Labels) - containerProfile := softwarecomposition.ContainerProfile{} - key = "/spdx.softwarecomposition.kubescape.io/containerprofile/kube-system/replicaset-coredns-5d78c9869d-coredns-185f-129c" + key := "/spdx.softwarecomposition.kubescape.io/containerprofile/kube-system/replicaset-coredns-5d78c9869d-coredns-185f-129c" err = s.GetWithConn(ctx, conn, key, storage.GetOptions{}, &containerProfile) assert.NoError(t, err) assert.Equal(t, softwarecomposition.CallID("test-call-id"), containerProfile.Spec.IdentifiedCallStacks[0].CallID) @@ -248,21 +227,6 @@ func TestConsolidateTimeSeries_Concurrent_NoDeadlock(t *testing.T) { create("testdata/p12.json") consolidate() - // The multiple-containers workload consolidated correctly into one application profile. - ap := softwarecomposition.ApplicationProfile{} - conn, err := pool.Take(ctx) - require.NoError(t, err) - err = s.GetWithConn(ctx, conn, "/spdx.softwarecomposition.kubescape.io/applicationprofiles/node-agent-test-hjjz/replicaset-multiple-containers-deployment-d4b8dd5fd", storage.GetOptions{}, &ap) - pool.Put(conn) - require.NoError(t, err) - delete(ap.Annotations, helpersv1.SyncChecksumMetadataKey) - assert.Equal(t, map[string]string{ - helpersv1.CompletionMetadataKey: helpersv1.Full, - helpersv1.InstanceIDMetadataKey: "apiVersion-apps/v1/namespace-node-agent-test-hjjz/kind-ReplicaSet/name-multiple-containers-deployment-d4b8dd5fd", - helpersv1.StatusMetadataKey: helpersv1.Completed, - helpersv1.WlidMetadataKey: "wlid://cluster-kind-kind/namespace-node-agent-test-hjjz/deployment-multiple-containers-deployment", - }, ap.Annotations) - // No connection leak: every pool connection must be re-acquirable promptly. acqCtx, acqCancel := context.WithTimeout(ctx, 3*time.Second) defer acqCancel() diff --git a/pkg/registry/file/containerprofile_storage.go b/pkg/registry/file/containerprofile_storage.go index 958c5fd63..777ac3ca3 100644 --- a/pkg/registry/file/containerprofile_storage.go +++ b/pkg/registry/file/containerprofile_storage.go @@ -7,11 +7,8 @@ import ( "strings" "time" - "github.com/armosec/armoapi-go/armotypes" "github.com/kubescape/k8s-interface/instanceidhandler/v1/helpers" "github.com/kubescape/storage/pkg/apis/softwarecomposition" - "github.com/kubescape/storage/pkg/utils" - metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" "k8s.io/apimachinery/pkg/runtime" "k8s.io/apiserver/pkg/storage" "zombiezen.com/go/sqlite" @@ -230,116 +227,6 @@ func (c *ContainerProfileStorageImpl) DeleteMergedContainerProfile(ctx context.C return c.storageImpl.DeleteWithConn(ctx, conn, mergedKey, &softwarecomposition.ContainerProfile{}, nil, nil, nil, storage.DeleteOptions{}) } -func (c *ContainerProfileStorageImpl) UpdateApplicationProfile(ctx context.Context, key, prefix, root string, id armotypes.ProfileIdentifier, slug, wlid string, instanceID interface{ GetStringNoContainer() string }, profile *softwarecomposition.ContainerProfile, creationTimestamp metav1.Time) error { - conn := ctx.Value(connKey).(*sqlite.Conn) - - id.Name = slug - apKey := BuildContainerProfileKey(id, "applicationprofiles") - var apChecksum string - - tryUpdate := func(input runtime.Object, res storage.ResponseMeta) (runtime.Object, *uint64, error) { - output := input.DeepCopyObject() - ap, ok := output.(*softwarecomposition.ApplicationProfile) - if !ok { - return nil, nil, fmt.Errorf("given object is not an ApplicationProfile") - } - - ap.Name = slug - if id.HostType == armotypes.HostTypeKubernetes { - ap.Namespace = id.Namespace - } - if ap.CreationTimestamp.IsZero() { - ap.CreationTimestamp = creationTimestamp - } - ap.SchemaVersion = SchemaVersion - if ap.Parts == nil { - ap.Parts = map[string]string{} - } - ap.Parts[key] = "" // checksum will be updated by getAggregatedData - - status, completion, checksum := ComputeAggregatedData(c, ctx, key, ap.Parts) - apChecksum = checksum - - ap.Annotations = map[string]string{ - helpers.CompletionMetadataKey: completion, - helpers.InstanceIDMetadataKey: instanceID.GetStringNoContainer(), - helpers.StatusMetadataKey: status, - helpers.WlidMetadataKey: wlid, - } - ap.Labels = map[string]string{} - utils.MergeMaps(ap.Labels, profile.Labels) - delete(ap.Labels, helpers.ContainerNameMetadataKey) - - return output, nil, nil - } - - apCtx, apCancel := context.WithTimeout(ctx, 5*time.Second) - defer apCancel() - - err := c.storageImpl.GuaranteedUpdateWithConn(apCtx, conn, apKey, &softwarecomposition.ApplicationProfile{}, - true, nil, tryUpdate, nil, apChecksum) - if err != nil { - return fmt.Errorf("failed to update application profile: %w", err) - } - - return nil -} - -func (c *ContainerProfileStorageImpl) UpdateNetworkNeighborhood(ctx context.Context, key, prefix, root string, id armotypes.ProfileIdentifier, slug, wlid string, instanceID interface{ GetStringNoContainer() string }, profile *softwarecomposition.ContainerProfile, creationTimestamp metav1.Time) error { - conn := ctx.Value(connKey).(*sqlite.Conn) - - id.Name = slug - nnKey := BuildContainerProfileKey(id, "networkneighborhoods") - var nnChecksum string - - tryUpdate := func(input runtime.Object, res storage.ResponseMeta) (runtime.Object, *uint64, error) { - output := input.DeepCopyObject() - nn, ok := output.(*softwarecomposition.NetworkNeighborhood) - if !ok { - return nil, nil, fmt.Errorf("given object is not an NetworkNeighborhood") - } - - nn.Name = slug - if id.HostType == armotypes.HostTypeKubernetes { - nn.Namespace = id.Namespace - } - if nn.CreationTimestamp.IsZero() { - nn.CreationTimestamp = creationTimestamp - } - nn.SchemaVersion = SchemaVersion - if nn.Parts == nil { - nn.Parts = map[string]string{} - } - nn.Parts[key] = "" // checksum will be updated by getAggregatedData - - status, completion, checksum := ComputeAggregatedData(c, ctx, key, nn.Parts) - nnChecksum = checksum - - nn.Annotations = map[string]string{ - helpers.CompletionMetadataKey: completion, - helpers.InstanceIDMetadataKey: instanceID.GetStringNoContainer(), - helpers.StatusMetadataKey: status, - helpers.WlidMetadataKey: wlid, - } - nn.Labels = map[string]string{} - utils.MergeMaps(nn.Labels, profile.Labels) - delete(nn.Labels, helpers.ContainerNameMetadataKey) - - return output, nil, nil - } - - nnCtx, nnCancel := context.WithTimeout(ctx, 5*time.Second) - defer nnCancel() - - err := c.storageImpl.GuaranteedUpdateWithConn(nnCtx, conn, nnKey, &softwarecomposition.NetworkNeighborhood{}, - true, nil, tryUpdate, nil, nnChecksum) - if err != nil { - return fmt.Errorf("failed to update network neighborhood: %w", err) - } - - return nil -} - // Time Series Operations func (c *ContainerProfileStorageImpl) ListTimeSeriesExpired(ctx context.Context, threshold time.Duration) ([]string, error) { diff --git a/pkg/registry/file/containerprofile_storage_interface.go b/pkg/registry/file/containerprofile_storage_interface.go index 6c3b77f8c..626072758 100644 --- a/pkg/registry/file/containerprofile_storage_interface.go +++ b/pkg/registry/file/containerprofile_storage_interface.go @@ -4,9 +4,7 @@ import ( "context" "time" - "github.com/armosec/armoapi-go/armotypes" "github.com/kubescape/storage/pkg/apis/softwarecomposition" - metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" ) // ContainerProfileStorage defines the storage operations for container profiles. @@ -75,12 +73,6 @@ type ContainerProfileStorage interface { // DeleteMergedContainerProfile removes the merged container profile that // corresponds to observedKey. Idempotent: not-found is not an error. DeleteMergedContainerProfile(ctx context.Context, observedKey string) error - - // UpdateApplicationProfile updates the application profile associated with a container profile. - UpdateApplicationProfile(ctx context.Context, key, prefix, root string, id armotypes.ProfileIdentifier, slug, wlid string, instanceID interface{ GetStringNoContainer() string }, profile *softwarecomposition.ContainerProfile, creationTimestamp metav1.Time) error - - // UpdateNetworkNeighborhood updates the network neighborhood associated with a container profile. - UpdateNetworkNeighborhood(ctx context.Context, key, prefix, root string, id armotypes.ProfileIdentifier, slug, wlid string, instanceID interface{ GetStringNoContainer() string }, profile *softwarecomposition.ContainerProfile, creationTimestamp metav1.Time) error } // TransactionManager handles database connection and transaction lifecycle. diff --git a/pkg/registry/file/containerprofile_user_managed.go b/pkg/registry/file/containerprofile_user_managed.go index 3b162bb40..4f91d8f88 100644 --- a/pkg/registry/file/containerprofile_user_managed.go +++ b/pkg/registry/file/containerprofile_user_managed.go @@ -34,13 +34,6 @@ const ( // present at merge time. mergedSourceUserCPKey = "kubescape.io/merged-source-ug-cp" - // Deprecated: the ug- overlay is now a single ContainerProfile; use - // mergedSourceUserCPKey. mergedSourceUserAPKey / mergedSourceUserNNKey recorded - // the storage keys of the ug- AP / NN that contributed to the merge under the - // legacy AP+NN overlay model. Retained for backward-compatibility views. - mergedSourceUserAPKey = "kubescape.io/merged-source-ug-ap" - mergedSourceUserNNKey = "kubescape.io/merged-source-ug-nn" - // mergedSourceUserCPRVKey / mergedSourceObservedRVKey snapshot the // ResourceVersions of each input. They give a quick signal when debugging // "is this merged stale vs the live ug- / observed?" without re-reading the @@ -55,12 +48,6 @@ const ( // even when nothing changed (kubescape/storage#315 review). mergedSourceUserCPRVKey = "kubescape.io/merged-source-ug-cp-rv" - // Deprecated: use mergedSourceUserCPRVKey. mergedSourceUserAPRVKey / - // mergedSourceUserNNRVKey snapshotted the ResourceVersions of the legacy ug- - // AP / NN inputs. Retained for backward-compatibility views. - mergedSourceUserAPRVKey = "kubescape.io/merged-source-ug-ap-rv" - mergedSourceUserNNRVKey = "kubescape.io/merged-source-ug-nn-rv" - mergedSourceObservedRVKey = "kubescape.io/merged-source-observed-rv" ) @@ -231,67 +218,6 @@ func mergeUserCPIntoCP(cp *softwarecomposition.ContainerProfile, userCP *softwar cp.Spec.LabelSelector.MatchExpressions = appendDedupSortedMatchExpressions(cp.Spec.LabelSelector.MatchExpressions, u.Spec.LabelSelector.MatchExpressions) } -// Deprecated: superseded by mergeUserCPIntoCP; the ug- overlay is now a single -// ContainerProfile. Retained for backward-compatibility views and tests. -// -// mergeUserAPIntoCP locates the ApplicationProfileContainer in userAP whose -// Name matches containerName and appends its fields onto cp.Spec. PolicyByRuleId -// entries are merged via mergePolicies on collision (same union semantics as -// the time-series merge). -// -// IdentifiedCallStacks is intentionally NOT merged — node-agent's -// projection.go (the reference implementation) does not project them either, -// so server- and client-side merges stay in sync. -func mergeUserAPIntoCP(cp *softwarecomposition.ContainerProfile, userAP *softwarecomposition.ApplicationProfile, containerName string) { - matched := findUserAPContainerByName(userAP, containerName) - if matched == nil { - return - } - // Defensive copy: the returned matched.* slices alias userAP, which is - // the caller's CRD object. DeepCopy isolates the merge from concurrent - // reads of the same cached object. - c := matched.DeepCopy() - cp.Spec.Capabilities = append(cp.Spec.Capabilities, c.Capabilities...) - cp.Spec.Execs = append(cp.Spec.Execs, c.Execs...) - cp.Spec.Opens = append(cp.Spec.Opens, c.Opens...) - cp.Spec.Syscalls = append(cp.Spec.Syscalls, c.Syscalls...) - cp.Spec.Endpoints = append(cp.Spec.Endpoints, c.Endpoints...) - if cp.Spec.PolicyByRuleId == nil && len(c.PolicyByRuleId) > 0 { - cp.Spec.PolicyByRuleId = make(map[string]softwarecomposition.RulePolicy, len(c.PolicyByRuleId)) - } - for k, v := range c.PolicyByRuleId { - if existing, ok := cp.Spec.PolicyByRuleId[k]; ok { - cp.Spec.PolicyByRuleId[k] = mergePolicies(existing, v) - } else { - cp.Spec.PolicyByRuleId[k] = v - } - } -} - -// Deprecated: superseded by mergeUserCPIntoCP; the ug- overlay is now a single -// ContainerProfile. Retained for backward-compatibility views and tests. -// -// mergeUserNNIntoCP merges the matching NetworkNeighborhoodContainer's -// Ingress/Egress and the NN's pod LabelSelector into cp.Spec. Ingress/Egress -// entries are unioned by Identifier; matching entries are deep-merged via -// mergeUserNetworkNeighbor (DNS names are set-unioned and sorted, ports are -// keyed by Name with user values winning on collision, selectors are -// field-merged with user keys overriding base). -func mergeUserNNIntoCP(cp *softwarecomposition.ContainerProfile, userNN *softwarecomposition.NetworkNeighborhood, containerName string) { - matched := findUserNNContainerByName(userNN, containerName) - if matched != nil { - c := matched.DeepCopy() - cp.Spec.Ingress = mergeUserNetworkNeighbors(cp.Spec.Ingress, c.Ingress) - cp.Spec.Egress = mergeUserNetworkNeighbors(cp.Spec.Egress, c.Egress) - } - - // NetworkNeighborhoodSpec embeds metav1.LabelSelector; ContainerProfileSpec - // stores the same selector denormalised as MatchLabels/MatchExpressions - // inside Spec.LabelSelector. - cp.Spec.LabelSelector.MatchLabels = overrideMerge(cp.Spec.LabelSelector.MatchLabels, userNN.Spec.LabelSelector.MatchLabels) - cp.Spec.LabelSelector.MatchExpressions = appendDedupSortedMatchExpressions(cp.Spec.LabelSelector.MatchExpressions, userNN.Spec.LabelSelector.MatchExpressions) -} - // overrideMerge returns base extended with user's keys; on key collision the // user value wins. Distinct from utils.MergeMaps which preserves base on // collision (other callers depend on that semantic, so we don't change it). @@ -370,56 +296,6 @@ func joinSorted(vs []string) string { return b.String() } -// Deprecated: superseded by mergeUserCPIntoCP; the ug- overlay is now a single -// ContainerProfile with no per-container lookup. Retained for the deprecated -// AP/NN merge helpers and their tests. -func findUserAPContainerByName(userAP *softwarecomposition.ApplicationProfile, name string) *softwarecomposition.ApplicationProfileContainer { - if userAP == nil { - return nil - } - for i := range userAP.Spec.Containers { - if userAP.Spec.Containers[i].Name == name { - return &userAP.Spec.Containers[i] - } - } - for i := range userAP.Spec.InitContainers { - if userAP.Spec.InitContainers[i].Name == name { - return &userAP.Spec.InitContainers[i] - } - } - for i := range userAP.Spec.EphemeralContainers { - if userAP.Spec.EphemeralContainers[i].Name == name { - return &userAP.Spec.EphemeralContainers[i] - } - } - return nil -} - -// Deprecated: superseded by mergeUserCPIntoCP; the ug- overlay is now a single -// ContainerProfile with no per-container lookup. Retained for the deprecated -// AP/NN merge helpers and their tests. -func findUserNNContainerByName(userNN *softwarecomposition.NetworkNeighborhood, name string) *softwarecomposition.NetworkNeighborhoodContainer { - if userNN == nil { - return nil - } - for i := range userNN.Spec.Containers { - if userNN.Spec.Containers[i].Name == name { - return &userNN.Spec.Containers[i] - } - } - for i := range userNN.Spec.InitContainers { - if userNN.Spec.InitContainers[i].Name == name { - return &userNN.Spec.InitContainers[i] - } - } - for i := range userNN.Spec.EphemeralContainers { - if userNN.Spec.EphemeralContainers[i].Name == name { - return &userNN.Spec.EphemeralContainers[i] - } - } - return nil -} - func mergeUserNetworkNeighbors(base, user []softwarecomposition.NetworkNeighbor) []softwarecomposition.NetworkNeighbor { idx := make(map[string]int, len(base)) for i, n := range base { diff --git a/pkg/registry/file/containerprofile_user_managed_test.go b/pkg/registry/file/containerprofile_user_managed_test.go index 828b205f1..a76f05d93 100644 --- a/pkg/registry/file/containerprofile_user_managed_test.go +++ b/pkg/registry/file/containerprofile_user_managed_test.go @@ -6,7 +6,6 @@ import ( "errors" "os" "path" - "sort" "testing" "time" @@ -28,196 +27,6 @@ import ( "zombiezen.com/go/sqlite/sqlitemigration" ) -// Tests for the user-managed (ug-) merge logic. The merge fans out across all -// three container slices and is additive: status/completion annotations are -// untouched, spec slices receive new entries, and matching PolicyByRuleId / -// NetworkNeighbor / NetworkPort entries are unioned by key. - -func TestMergeUserAPIntoCP_ContainerSlicesAndPolicy(t *testing.T) { - cp := &softwarecomposition.ContainerProfile{ - Spec: softwarecomposition.ContainerProfileSpec{ - Capabilities: []string{"NET_ADMIN"}, - Syscalls: []string{"read"}, - PolicyByRuleId: map[string]softwarecomposition.RulePolicy{ - "R1": {AllowedProcesses: []string{"a"}}, - }, - }, - } - userAP := &softwarecomposition.ApplicationProfile{ - Spec: softwarecomposition.ApplicationProfileSpec{ - Containers: []softwarecomposition.ApplicationProfileContainer{ - { - Name: "main", - Capabilities: []string{"SYS_PTRACE"}, - Syscalls: []string{"write"}, - PolicyByRuleId: map[string]softwarecomposition.RulePolicy{ - "R1": {AllowedProcesses: []string{"b"}}, - "R2": {AllowedContainer: true}, - }, - }, - }, - InitContainers: []softwarecomposition.ApplicationProfileContainer{ - {Name: "init", Capabilities: []string{"INIT_CAP"}}, - }, - }, - } - - mergeUserAPIntoCP(cp, userAP, "main") - - assert.ElementsMatch(t, []string{"NET_ADMIN", "SYS_PTRACE"}, cp.Spec.Capabilities) - assert.ElementsMatch(t, []string{"read", "write"}, cp.Spec.Syscalls) - r1Procs := cp.Spec.PolicyByRuleId["R1"].AllowedProcesses - sort.Strings(r1Procs) - assert.Equal(t, []string{"a", "b"}, r1Procs) - assert.True(t, cp.Spec.PolicyByRuleId["R2"].AllowedContainer) -} - -func TestMergeUserAPIntoCP_MatchesInitAndEphemeral(t *testing.T) { - userAP := &softwarecomposition.ApplicationProfile{ - Spec: softwarecomposition.ApplicationProfileSpec{ - InitContainers: []softwarecomposition.ApplicationProfileContainer{ - {Name: "init", Capabilities: []string{"INIT_CAP"}}, - }, - EphemeralContainers: []softwarecomposition.ApplicationProfileContainer{ - {Name: "debug", Capabilities: []string{"DBG_CAP"}}, - }, - }, - } - - cpInit := &softwarecomposition.ContainerProfile{} - mergeUserAPIntoCP(cpInit, userAP, "init") - assert.Equal(t, []string{"INIT_CAP"}, cpInit.Spec.Capabilities) - - cpEph := &softwarecomposition.ContainerProfile{} - mergeUserAPIntoCP(cpEph, userAP, "debug") - assert.Equal(t, []string{"DBG_CAP"}, cpEph.Spec.Capabilities) -} - -func TestMergeUserAPIntoCP_NoMatchIsNoOp(t *testing.T) { - cp := &softwarecomposition.ContainerProfile{ - Spec: softwarecomposition.ContainerProfileSpec{Capabilities: []string{"X"}}, - } - userAP := &softwarecomposition.ApplicationProfile{ - Spec: softwarecomposition.ApplicationProfileSpec{ - Containers: []softwarecomposition.ApplicationProfileContainer{ - {Name: "other", Capabilities: []string{"SHOULD_NOT_APPEAR"}}, - }, - }, - } - mergeUserAPIntoCP(cp, userAP, "missing") - assert.Equal(t, []string{"X"}, cp.Spec.Capabilities) -} - -func TestMergeUserAPIntoCP_UserSlicesNotAliased(t *testing.T) { - // Ensure the merge does not alias the caller's CRD slices. A subsequent - // mutation on the user CRD must not bleed into the merged CP. - userAP := &softwarecomposition.ApplicationProfile{ - Spec: softwarecomposition.ApplicationProfileSpec{ - Containers: []softwarecomposition.ApplicationProfileContainer{ - {Name: "main", Capabilities: []string{"A"}}, - }, - }, - } - cp := &softwarecomposition.ContainerProfile{} - mergeUserAPIntoCP(cp, userAP, "main") - - userAP.Spec.Containers[0].Capabilities[0] = "MUTATED" - assert.Equal(t, []string{"A"}, cp.Spec.Capabilities) -} - -func TestMergeUserNNIntoCP_IngressUnionByIdentifier(t *testing.T) { - cp := &softwarecomposition.ContainerProfile{ - Spec: softwarecomposition.ContainerProfileSpec{ - Ingress: []softwarecomposition.NetworkNeighbor{ - {Identifier: "n1", DNSNames: []string{"a.example"}}, - }, - }, - } - userNN := &softwarecomposition.NetworkNeighborhood{ - Spec: softwarecomposition.NetworkNeighborhoodSpec{ - Containers: []softwarecomposition.NetworkNeighborhoodContainer{ - { - Name: "main", - Ingress: []softwarecomposition.NetworkNeighbor{ - {Identifier: "n1", DNSNames: []string{"b.example"}}, - {Identifier: "n2", DNSNames: []string{"c.example"}}, - }, - }, - }, - }, - } - mergeUserNNIntoCP(cp, userNN, "main") - - require.Len(t, cp.Spec.Ingress, 2) - var n1 *softwarecomposition.NetworkNeighbor - for i := range cp.Spec.Ingress { - if cp.Spec.Ingress[i].Identifier == "n1" { - n1 = &cp.Spec.Ingress[i] - } - } - require.NotNil(t, n1) - sort.Strings(n1.DNSNames) - assert.Equal(t, []string{"a.example", "b.example"}, n1.DNSNames) -} - -func TestMergeUserNNIntoCP_PortUserWinsOnCollision(t *testing.T) { - port80 := int32(80) - port8080 := int32(8080) - cp := &softwarecomposition.ContainerProfile{ - Spec: softwarecomposition.ContainerProfileSpec{ - Ingress: []softwarecomposition.NetworkNeighbor{ - { - Identifier: "n1", - Ports: []softwarecomposition.NetworkPort{ - {Name: "tcp-80", Port: &port80}, - }, - }, - }, - }, - } - userNN := &softwarecomposition.NetworkNeighborhood{ - Spec: softwarecomposition.NetworkNeighborhoodSpec{ - Containers: []softwarecomposition.NetworkNeighborhoodContainer{ - { - Name: "main", - Ingress: []softwarecomposition.NetworkNeighbor{ - { - Identifier: "n1", - Ports: []softwarecomposition.NetworkPort{ - {Name: "tcp-80", Port: &port8080}, // user wins - }, - }, - }, - }, - }, - }, - } - mergeUserNNIntoCP(cp, userNN, "main") - - require.Len(t, cp.Spec.Ingress, 1) - require.Len(t, cp.Spec.Ingress[0].Ports, 1) - require.NotNil(t, cp.Spec.Ingress[0].Ports[0].Port) - assert.Equal(t, int32(8080), *cp.Spec.Ingress[0].Ports[0].Port) -} - -func TestMergeUserNNIntoCP_LabelSelectorMerged(t *testing.T) { - cp := &softwarecomposition.ContainerProfile{ - Spec: softwarecomposition.ContainerProfileSpec{ - LabelSelector: metav1.LabelSelector{ - MatchLabels: map[string]string{"app": "x"}, - }, - }, - } - userNN := &softwarecomposition.NetworkNeighborhood{ - Spec: softwarecomposition.NetworkNeighborhoodSpec{ - LabelSelector: metav1.LabelSelector{ - MatchLabels: map[string]string{"tier": "backend"}, - }, - }, - } - mergeUserNNIntoCP(cp, userNN, "missing") - assert.Equal(t, map[string]string{"app": "x", "tier": "backend"}, cp.Spec.LabelSelector.MatchLabels) -} // End-to-end consolidation test plumbing. @@ -233,20 +42,6 @@ const ( e2eContainerCPName = e2eWorkloadSlug + "-coredns-185f-129c" ) -func e2eUgAPKey() string { - return BuildContainerProfileKey(armotypes.ProfileIdentifier{ - ProfileScope: armotypes.ProfileScope{HostType: armotypes.HostTypeKubernetes, Namespace: e2eNS}, - Name: e2eWorkloadUg, - }, "applicationprofiles") -} - -func e2eUgNNKey() string { - return BuildContainerProfileKey(armotypes.ProfileIdentifier{ - ProfileScope: armotypes.ProfileScope{HostType: armotypes.HostTypeKubernetes, Namespace: e2eNS}, - Name: e2eWorkloadUg, - }, "networkneighborhoods") -} - // e2eUgCPKey is the key of the single user-managed (ug-) ContainerProfile // overlay for the e2e workload. buildMergedProfile fetches this object under the // "containerprofiles" kind, keyed by the shared "ug-" prefix + workload slug. @@ -371,27 +166,6 @@ func (h *e2eHarness) seedNonCP(key string, obj runtime.Object) { require.NoError(h.t, h.s.Create(h.ctx, key, obj, nil, 0)) } -// replaceUserAP swaps the spec of an existing ug- AP via GuaranteedUpdate so -// the versioner bumps the object's ResourceVersion (saveObject does -// existing.RV+1). This mirrors how a kube-apiserver-driven update lands in -// storage. A fresh Create after Delete would reset RV to 1, defeating the -// purpose of the RV-marker test. -func (h *e2eHarness) replaceUserAP(spec softwarecomposition.ApplicationProfileSpec) { - h.t.Helper() - prev := h.s.processor - h.s.processor = DefaultProcessor{} - defer func() { h.s.processor = prev }() - - tryUpdate := func(input runtime.Object, _ storage.ResponseMeta) (runtime.Object, *uint64, error) { - out := input.DeepCopyObject().(*softwarecomposition.ApplicationProfile) - out.Spec = spec - return out, nil, nil - } - require.NoError(h.t, h.s.GuaranteedUpdateWithConn( - h.ctx, h.conn, e2eUgAPKey(), &softwarecomposition.ApplicationProfile{}, - false, nil, tryUpdate, nil, "")) -} - // replaceUserCP swaps the spec of an existing ug- ContainerProfile via // GuaranteedUpdate so the versioner bumps the object's ResourceVersion (the CP // analogue of replaceUserAP). This mirrors how a kube-apiserver-driven update @@ -911,29 +685,6 @@ func TestConsolidateUserManagedPreservesStatus(t *testing.T) { assert.NotEqual(t, "should-not-overwrite", cp.Annotations[helpersv1.CompletionMetadataKey]) } -// TestMergeUserNNIntoCP_LabelSelectorUserOverridesBase verifies the override -// semantics introduced by overrideMerge: when both base and user supply a -// MatchLabels value for the same key, the user value wins. Distinct from -// utils.MergeMaps which preserves base on collision. -func TestMergeUserNNIntoCP_LabelSelectorUserOverridesBase(t *testing.T) { - cp := &softwarecomposition.ContainerProfile{ - Spec: softwarecomposition.ContainerProfileSpec{ - LabelSelector: metav1.LabelSelector{ - MatchLabels: map[string]string{"app": "x", "keep": "me"}, - }, - }, - } - userNN := &softwarecomposition.NetworkNeighborhood{ - Spec: softwarecomposition.NetworkNeighborhoodSpec{ - LabelSelector: metav1.LabelSelector{ - MatchLabels: map[string]string{"app": "y", "tier": "backend"}, - }, - }, - } - mergeUserNNIntoCP(cp, userNN, "missing") - assert.Equal(t, map[string]string{"app": "y", "keep": "me", "tier": "backend"}, cp.Spec.LabelSelector.MatchLabels) -} - // TestConsolidateUserManagedCPNetworkRVBump mirrors TestConsolidateUserManagedRVBump // for the ug- ContainerProfile's network fields: bumping the ug- CP's // ResourceVersion must cause the next consolidation to re-merge the egress set. diff --git a/pkg/registry/file/dynamicpathdetector/tests/compare_exec_args_test.go b/pkg/registry/file/dynamicpathdetector/tests/compare_exec_args_test.go index 37d762e56..c36c51d3e 100644 --- a/pkg/registry/file/dynamicpathdetector/tests/compare_exec_args_test.go +++ b/pkg/registry/file/dynamicpathdetector/tests/compare_exec_args_test.go @@ -29,9 +29,8 @@ func TestCompareExecArgs_LiteralMatch(t *testing.T) { }{ // Empty profileArgs = "no argv constraint" — matches any runtime. // Pinned this way so path-only Execs entries in user-defined - // ApplicationProfiles don't silently trigger R0040 when the rule - // consults was_executed_with_args. See storage/node-agent issue - // where Test_28 (and others using path-only entries) failed because + // profiles don't silently trigger R0040 when the rule consults + // was_executed_with_args. Path-only entries previously failed because // the strict empty-empty match was firing R0040 on every legit exec. {"both empty", nil, nil, true}, {"empty profile, non-empty runtime", nil, []string{"a"}, true}, diff --git a/pkg/registry/file/dynamicpathdetector/tests/coverage_test.go b/pkg/registry/file/dynamicpathdetector/tests/coverage_test.go index dcd4587a7..4b65d2ca8 100644 --- a/pkg/registry/file/dynamicpathdetector/tests/coverage_test.go +++ b/pkg/registry/file/dynamicpathdetector/tests/coverage_test.go @@ -246,8 +246,8 @@ func TestCollapseConfig(t *testing.T) { // TestProcessSegments_WildcardWiringRegressions pins three correctness // properties of processSegments that were broken in the zero-alloc rewrite -// of analyzer.go and caused node-agent component-test Test_27 -// (ApplicationProfileOpens) to fail at runtime. +// of analyzer.go and caused a node-agent component-test covering recorded +// container opens to fail at runtime. // // Each sub-case is small, self-contained, and would fail against the // broken implementation — keeping them here means a future refactor of diff --git a/pkg/registry/file/dynamicpathdetector/tests/execargs_wildcard_ap_test.go b/pkg/registry/file/dynamicpathdetector/tests/execargs_wildcard_ap_test.go index 464122b21..aef08f633 100644 --- a/pkg/registry/file/dynamicpathdetector/tests/execargs_wildcard_ap_test.go +++ b/pkg/registry/file/dynamicpathdetector/tests/execargs_wildcard_ap_test.go @@ -7,38 +7,30 @@ import ( dp "github.com/kubescape/storage/pkg/registry/file/dynamicpathdetector" ) -// These tests build real ApplicationProfile objects whose recorded exec args +// These tests build real ContainerProfile objects whose recorded exec args // carry either a WILDCARD ("⋯" = any one arg/segment, "⋯⋯" = zero-or-more args) // or a LITERAL "*", and drive the production matcher through them exactly as // node-agent's was_executed_with_args does (per-vector MatchExecArgs with // ArgsRequired=true). The point: a "*" recorded in argv is data and does NOT // broaden, while the dedicated "⋯"/"⋯⋯" sentinels are the only wildcards. -// execAP builds a one-container ApplicationProfile with a single recorded exec. -func execAP(args []string) *types.ApplicationProfile { - return &types.ApplicationProfile{ - Spec: types.ApplicationProfileSpec{ - Containers: []types.ApplicationProfileContainer{{ - Name: "app", - Execs: []types.ExecCalls{ - {Path: "/usr/bin/tool", Args: args, ArgsRequired: true}, - }, - }}, +// execCP builds a ContainerProfile with a single recorded exec. +func execCP(args []string) *types.ContainerProfile { + return &types.ContainerProfile{ + Spec: types.ContainerProfileSpec{ + Execs: []types.ExecCalls{ + {Path: "/usr/bin/tool", Args: args, ArgsRequired: true}, + }, }, } } -// matchAP mimics node-agent: for each recorded exec vector in the container, +// matchCP mimics node-agent: for each recorded exec vector in the profile, // MatchExecArgs(profileArgs, true, runtimeArgs); allowed if ANY vector matches. -func matchAP(ap *types.ApplicationProfile, container string, runtime []string) bool { - for _, c := range ap.Spec.Containers { - if c.Name != container { - continue - } - for _, e := range c.Execs { - if dp.MatchExecArgs(e.Args, e.ArgsRequired, runtime) { - return true - } +func matchCP(cp *types.ContainerProfile, runtime []string) bool { + for _, e := range cp.Spec.Execs { + if dp.MatchExecArgs(e.Args, e.ArgsRequired, runtime) { + return true } } return false @@ -47,7 +39,7 @@ func matchAP(ap *types.ApplicationProfile, container string, runtime []string) b func TestAP_LiteralStarArg_DoesNotBroaden(t *testing.T) { // Recorded: the tool was invoked with the LITERAL arg "/plugins/*" // (e.g. a shell glob that didn't expand). Stored verbatim — "*" is data. - ap := execAP([]string{"/usr/bin/tool", "--load", "/plugins/*"}) + cp := execCP([]string{"/usr/bin/tool", "--load", "/plugins/*"}) cases := []struct { name string @@ -60,8 +52,8 @@ func TestAP_LiteralStarArg_DoesNotBroaden(t *testing.T) { } for _, c := range cases { t.Run(c.name, func(t *testing.T) { - if got := matchAP(ap, "app", c.runtime); got != c.allowed { - t.Errorf("literal-* AP match(%q) = %v, want %v", c.runtime, got, c.allowed) + if got := matchCP(cp, c.runtime); got != c.allowed { + t.Errorf("literal-* match(%q) = %v, want %v", c.runtime, got, c.allowed) } }) } @@ -69,7 +61,7 @@ func TestAP_LiteralStarArg_DoesNotBroaden(t *testing.T) { func TestAP_DynamicArg_IsSingleSegmentWildcard(t *testing.T) { // Authored as a real wildcard: any single plugin filename under /plugins/. - ap := execAP([]string{"/usr/bin/tool", "--load", "/plugins/⋯"}) + cp := execCP([]string{"/usr/bin/tool", "--load", "/plugins/⋯"}) cases := []struct { name string @@ -83,8 +75,8 @@ func TestAP_DynamicArg_IsSingleSegmentWildcard(t *testing.T) { } for _, c := range cases { t.Run(c.name, func(t *testing.T) { - if got := matchAP(ap, "app", c.runtime); got != c.allowed { - t.Errorf("⋯-arg AP match(%q) = %v, want %v", c.runtime, got, c.allowed) + if got := matchCP(cp, c.runtime); got != c.allowed { + t.Errorf("⋯-arg match(%q) = %v, want %v", c.runtime, got, c.allowed) } }) } @@ -92,7 +84,7 @@ func TestAP_DynamicArg_IsSingleSegmentWildcard(t *testing.T) { func TestAP_MultiArgWildcard_AbsorbsTail(t *testing.T) { // Authored: tool --load . - ap := execAP([]string{"/usr/bin/tool", "--load", "⋯", dp.ExecArgsWildcard}) + cp := execCP([]string{"/usr/bin/tool", "--load", "⋯", dp.ExecArgsWildcard}) cases := []struct { name string @@ -106,8 +98,8 @@ func TestAP_MultiArgWildcard_AbsorbsTail(t *testing.T) { } for _, c := range cases { t.Run(c.name, func(t *testing.T) { - if got := matchAP(ap, "app", c.runtime); got != c.allowed { - t.Errorf("⋯⋯-tail AP match(%q) = %v, want %v", c.runtime, got, c.allowed) + if got := matchCP(cp, c.runtime); got != c.allowed { + t.Errorf("⋯⋯-tail match(%q) = %v, want %v", c.runtime, got, c.allowed) } }) } @@ -118,13 +110,13 @@ func TestAP_MultiArgWildcard_AbsorbsTail(t *testing.T) { // ALLOWED by the "⋯"-wildcard profile — "*" is data, "⋯" is the wildcard. func TestAP_LiteralStarVsDynamic_DivergeOnSameInput(t *testing.T) { runtime := []string{"/usr/bin/tool", "--load", "/plugins/evil.so"} - literalStar := execAP([]string{"/usr/bin/tool", "--load", "/plugins/*"}) - dynamic := execAP([]string{"/usr/bin/tool", "--load", "/plugins/⋯"}) + literalStar := execCP([]string{"/usr/bin/tool", "--load", "/plugins/*"}) + dynamic := execCP([]string{"/usr/bin/tool", "--load", "/plugins/⋯"}) - if matchAP(literalStar, "app", runtime) { - t.Error("literal-* AP must NOT allow /plugins/evil.so (R0040 fires)") + if matchCP(literalStar, runtime) { + t.Error("literal-* profile must NOT allow /plugins/evil.so (R0040 fires)") } - if !matchAP(dynamic, "app", runtime) { - t.Error("⋯-wildcard AP must allow /plugins/evil.so") + if !matchCP(dynamic, runtime) { + t.Error("⋯-wildcard profile must allow /plugins/evil.so") } } diff --git a/pkg/registry/file/generatednetworkpolicy.go b/pkg/registry/file/generatednetworkpolicy.go index 70a78f6b1..01baa9a47 100644 --- a/pkg/registry/file/generatednetworkpolicy.go +++ b/pkg/registry/file/generatednetworkpolicy.go @@ -7,6 +7,7 @@ import ( "github.com/kubescape/go-logger" "github.com/kubescape/go-logger/helpers" + helpersv1 "github.com/kubescape/k8s-interface/instanceidhandler/v1/helpers" "github.com/kubescape/storage/pkg/apis/softwarecomposition" "github.com/kubescape/storage/pkg/apis/softwarecomposition/networkpolicy/v2" "go.opentelemetry.io/otel" @@ -17,15 +18,14 @@ import ( ) const ( - networkNeighborhoodResource = "networkneighborhoods" - knownServersResource = "knownservers" + containerProfilesResource = "containerprofiles" + knownServersResource = "knownservers" ) // GeneratedNetworkPolicyStorage offers a storage solution for GeneratedNetworkPolicy objects, implementing custom business logic for these objects and using the underlying default storage implementation. type GeneratedNetworkPolicyStorage struct { immutableStorage realStore StorageQuerier - nnStore storage.Interface } func (s *GeneratedNetworkPolicyStorage) EnableResourceSizeEstimation(keysFunc storage.KeysFunc) error { @@ -44,9 +44,8 @@ func (s *GeneratedNetworkPolicyStorage) CompactRevision() int64 { var _ storage.Interface = (*GeneratedNetworkPolicyStorage)(nil) -func NewGeneratedNetworkPolicyStorage(realStore StorageQuerier, nnStore storage.Interface) storage.Interface { +func NewGeneratedNetworkPolicyStorage(realStore StorageQuerier) storage.Interface { return &GeneratedNetworkPolicyStorage{ - nnStore: nnStore, realStore: realStore, } } @@ -55,6 +54,37 @@ func (s *GeneratedNetworkPolicyStorage) GetCurrentResourceVersion(_ context.Cont return 0, nil } +// containerProfileToNetworkNeighborhood projects a ContainerProfile into the +// in-process NetworkNeighborhood-shaped intermediate consumed by the network +// policy generator. This is the projection that previously lived in the (now +// removed) NetworkNeighborhoodStorage: the container's ingress/egress and the +// workload label selector are copied into a single-container neighborhood, +// bucketed by the container type annotation. +func containerProfileToNetworkNeighborhood(cp *softwarecomposition.ContainerProfile) *softwarecomposition.NetworkNeighborhood { + nn := &softwarecomposition.NetworkNeighborhood{ + TypeMeta: cp.TypeMeta, + ObjectMeta: *cp.ObjectMeta.DeepCopy(), + } + nn.Spec.MatchLabels = cp.Spec.MatchLabels + nn.Spec.MatchExpressions = cp.Spec.MatchExpressions + + container := softwarecomposition.NetworkNeighborhoodContainer{ + Name: cp.Labels[helpersv1.ContainerNameMetadataKey], + Ingress: cp.Spec.Ingress, + Egress: cp.Spec.Egress, + } + switch cp.Annotations[helpersv1.ContainerTypeMetadataKey] { + case "initContainers": + nn.Spec.InitContainers = append(nn.Spec.InitContainers, container) + case "ephemeralContainers": + nn.Spec.EphemeralContainers = append(nn.Spec.EphemeralContainers, container) + default: + // "containers" and the empty/back-compat case both land here. + nn.Spec.Containers = append(nn.Spec.Containers, container) + } + return nn +} + // Get generates and returns a single GeneratedNetworkPolicy object func (s *GeneratedNetworkPolicyStorage) Get(ctx context.Context, key string, opts storage.GetOptions, objPtr runtime.Object) error { ctx, span := otel.Tracer("").Start(ctx, "GeneratedNetworkPolicyStorage.Get") @@ -63,15 +93,18 @@ func (s *GeneratedNetworkPolicyStorage) Get(ctx context.Context, key string, opt logger.L().Debug("GeneratedNetworkPolicyStorage.Get", helpers.String("key", key)) - // retrieve network neighbor with the same name - networkNeighborhoodObjPtr := &softwarecomposition.NetworkNeighborhood{} + // retrieve the container profile with the same name and project it into a + // NetworkNeighborhood-shaped intermediate in-process. + containerProfileObjPtr := &softwarecomposition.ContainerProfile{} - key = replaceKeyForKind(key, networkNeighborhoodResource) + key = replaceKeyForKind(key, containerProfilesResource) - if err := s.nnStore.Get(ctx, key, opts, networkNeighborhoodObjPtr); err != nil { + if err := s.realStore.Get(ctx, key, opts, containerProfileObjPtr); err != nil { return err } + networkNeighborhoodObjPtr := containerProfileToNetworkNeighborhood(containerProfileObjPtr) + knownServersListObjPtr := &softwarecomposition.KnownServerList{} if err := s.realStore.GetByCluster(ctx, softwarecomposition.GroupName, knownServersResource, knownServersListObjPtr); err != nil { @@ -105,14 +138,15 @@ func (s *GeneratedNetworkPolicyStorage) GetList(ctx context.Context, key string, }, } - // get all network neighborhood on namespace - networkNeighborhoodObjListPtr := &softwarecomposition.NetworkNeighborhoodList{} - if err := s.realStore.GetList(ctx, replaceKeyForKind(key, networkNeighborhoodResource), opts, networkNeighborhoodObjListPtr); err != nil { + // get all container profiles on namespace + containerProfileObjListPtr := &softwarecomposition.ContainerProfileList{} + if err := s.realStore.GetList(ctx, replaceKeyForKind(key, containerProfilesResource), opts, containerProfileObjListPtr); err != nil { return err } - for _, nn := range networkNeighborhoodObjListPtr.Items { - if !networkpolicy.IsAvailable(&nn) { + for i := range containerProfileObjListPtr.Items { + nn := containerProfileToNetworkNeighborhood(&containerProfileObjListPtr.Items[i]) + if !networkpolicy.IsAvailable(nn) { continue } generatedNetworkPolicyList.Items = append(generatedNetworkPolicyList.Items, softwarecomposition.GeneratedNetworkPolicy{ diff --git a/pkg/registry/file/generatednetworkpolicy_test.go b/pkg/registry/file/generatednetworkpolicy_test.go index c819cfad3..9d882b0ae 100644 --- a/pkg/registry/file/generatednetworkpolicy_test.go +++ b/pkg/registry/file/generatednetworkpolicy_test.go @@ -37,7 +37,7 @@ func TestGeneratedNetworkPolicyStorage_Get(t *testing.T) { args: args{ key: "/spdx.softwarecomposition.kubescape.io/generatednetworkpolicies/kubescape/toto", }, - expectedError: storage.NewKeyNotFoundError("/spdx.softwarecomposition.kubescape.io/networkneighborhoods/kubescape/toto", 0), + expectedError: storage.NewKeyNotFoundError("/spdx.softwarecomposition.kubescape.io/containerprofiles/kubescape/toto", 0), }, { name: "existing object is returned", @@ -146,13 +146,17 @@ func TestGeneratedNetworkPolicyStorage_Get(t *testing.T) { sch := scheme.Scheme require.NoError(t, softwarecomposition.AddToScheme(sch)) realStorage := NewStorageImpl(afero.NewMemMapFs(), "/", pool, nil, sch) - generatedNetworkPolicyStorage := NewGeneratedNetworkPolicyStorage(realStorage, realStorage) + generatedNetworkPolicyStorage := NewGeneratedNetworkPolicyStorage(realStorage) ctx, cancel := context.WithTimeout(context.TODO(), 5*time.Second) defer cancel() if tt.create { - wlObj := &softwarecomposition.NetworkNeighborhood{ + // The GeneratedNetworkPolicy is now generated from the + // ContainerProfile with the matching key (projected in-process + // into the network-neighborhood-shaped intermediate the + // generator consumes). + wlObj := &softwarecomposition.ContainerProfile{ TypeMeta: v1.TypeMeta{ - Kind: "NetworkNeighborhood", + Kind: "ContainerProfile", APIVersion: "spdx.softwarecomposition.kubescape.io/v1beta1", }, ObjectMeta: v1.ObjectMeta{ @@ -170,7 +174,7 @@ func TestGeneratedNetworkPolicyStorage_Get(t *testing.T) { if tt.noWorkloadName { delete(wlObj.ObjectMeta.Labels, helpersv1.RelatedNameMetadataKey) } - err := realStorage.Create(ctx, "/spdx.softwarecomposition.kubescape.io/networkneighborhoods/kubescape/toto", wlObj, nil, 0) + err := realStorage.Create(ctx, "/spdx.softwarecomposition.kubescape.io/containerprofiles/kubescape/toto", wlObj, nil, 0) require.NoError(t, err) } @@ -190,7 +194,7 @@ func TestGeneratedNetworkPolicyStorage_Get(t *testing.T) { func TestGeneratedNetworkPolicyStorage_Create(t *testing.T) { storageImpl := NewStorageImpl(afero.NewMemMapFs(), "", nil, nil, nil) - generatedNetworkPolicyStorage := NewGeneratedNetworkPolicyStorage(storageImpl, storageImpl) + generatedNetworkPolicyStorage := NewGeneratedNetworkPolicyStorage(storageImpl) err := generatedNetworkPolicyStorage.Create(context.TODO(), "", nil, nil, 0) @@ -201,7 +205,7 @@ func TestGeneratedNetworkPolicyStorage_Create(t *testing.T) { func TestGeneratedNetworkPolicyStorage_Delete(t *testing.T) { storageImpl := NewStorageImpl(afero.NewMemMapFs(), "", nil, nil, nil) - generatedNetworkPolicyStorage := NewGeneratedNetworkPolicyStorage(storageImpl, storageImpl) + generatedNetworkPolicyStorage := NewGeneratedNetworkPolicyStorage(storageImpl) err := generatedNetworkPolicyStorage.Delete(context.TODO(), "", nil, nil, nil, nil, storage.DeleteOptions{}) @@ -212,7 +216,7 @@ func TestGeneratedNetworkPolicyStorage_Delete(t *testing.T) { func TestGeneratedNetworkPolicyStorage_Watch(t *testing.T) { storageImpl := NewStorageImpl(afero.NewMemMapFs(), "", nil, nil, nil) - generatedNetworkPolicyStorage := NewGeneratedNetworkPolicyStorage(storageImpl, storageImpl) + generatedNetworkPolicyStorage := NewGeneratedNetworkPolicyStorage(storageImpl) _, err := generatedNetworkPolicyStorage.Watch(context.TODO(), "", storage.ListOptions{}) assert.NoError(t, err) @@ -220,7 +224,7 @@ func TestGeneratedNetworkPolicyStorage_Watch(t *testing.T) { func TestGeneratedNetworkPolicyStorage_GuaranteedUpdate(t *testing.T) { storageImpl := NewStorageImpl(afero.NewMemMapFs(), "", nil, nil, nil) - generatedNetworkPolicyStorage := NewGeneratedNetworkPolicyStorage(storageImpl, storageImpl) + generatedNetworkPolicyStorage := NewGeneratedNetworkPolicyStorage(storageImpl) err := generatedNetworkPolicyStorage.GuaranteedUpdate(context.TODO(), "", nil, false, nil, nil, nil) diff --git a/pkg/registry/file/networkneighborhood_ipcollapse.go b/pkg/registry/file/networkneighborhood_ipcollapse.go index 8a21bd1c0..85330d8a0 100644 --- a/pkg/registry/file/networkneighborhood_ipcollapse.go +++ b/pkg/registry/file/networkneighborhood_ipcollapse.go @@ -7,6 +7,7 @@ import ( "sort" "strings" + mapset "github.com/deckarep/golang-set/v2" "github.com/kubescape/storage/pkg/apis/softwarecomposition" "github.com/kubescape/storage/pkg/registry/file/dynamicpathdetector" "go4.org/netipx" @@ -15,6 +16,36 @@ import ( const ipCollapseFieldSep = "\x00" +// deflateNetworkNeighbors merges NetworkNeighbor entries on Identifier +// (DNSNames deduplicated, Ports merged on Name), then collapses groups of +// entries differing only by IP into CIDR-bearing entries once their count +// exceeds settings.NetworkIPGroupThreshold (see collapseIPGroups). The second +// pass is a fixpoint, so repeated saves are idempotent. Shared by the container +// profile deflate path. +func deflateNetworkNeighbors(in []softwarecomposition.NetworkNeighbor, settings dynamicpathdetector.CollapseSettings) []softwarecomposition.NetworkNeighbor { + if in == nil { + return nil + } + out := make([]softwarecomposition.NetworkNeighbor, 0) + seen := map[string]int{} + toDeflate := mapset.NewThreadUnsafeSet[int]() + for _, item := range in { + if index, ok := seen[item.Identifier]; ok { + out[index].DNSNames = append(out[index].DNSNames, item.DNSNames...) + out[index].Ports = append(out[index].Ports, item.Ports...) + toDeflate.Add(index) + } else { + out = append(out, item) + seen[item.Identifier] = len(out) - 1 // index of the appended item + } + } + for _, i := range mapset.Sorted(toDeflate) { + out[i].DNSNames = DeflateSortString(out[i].DNSNames) + out[i].Ports = DeflateStringer(out[i].Ports) + } + return collapseIPGroups(out, settings) +} + // collapseIPGroups aggregates NetworkNeighbor entries that differ only by IP // into a small number of CIDR-bearing entries. Entries are grouped by // (Type, DNS, NamespaceSelector, PodSelector); within a group whose count of diff --git a/pkg/registry/file/networkneighborhood_processor.go b/pkg/registry/file/networkneighborhood_processor.go deleted file mode 100644 index f7430218f..000000000 --- a/pkg/registry/file/networkneighborhood_processor.go +++ /dev/null @@ -1,143 +0,0 @@ -package file - -import ( - "context" - "fmt" - "strconv" - - mapset "github.com/deckarep/golang-set/v2" - "github.com/kubescape/k8s-interface/instanceidhandler/v1/helpers" - "github.com/kubescape/storage/pkg/apis/softwarecomposition" - "github.com/kubescape/storage/pkg/config" - "github.com/kubescape/storage/pkg/registry/file/dynamicpathdetector" - "k8s.io/apimachinery/pkg/runtime" -) - -type NetworkNeighborhoodProcessor struct { - maxNetworkNeighborhoodSize int - // collapseSettings is the lookup hook the deflate path consults for - // per-prefix thresholds. Defaults to dynamicpathdetector.DefaultCollapseSettings; - // production wiring may override via SetCollapseSettings to a provider that - // reads the cluster-scoped CollapseConfiguration "default" CR. - collapseSettings dynamicpathdetector.CollapseSettingsProvider -} - -func NewNetworkNeighborhoodProcessor(cfg config.Config) *NetworkNeighborhoodProcessor { - return &NetworkNeighborhoodProcessor{ - maxNetworkNeighborhoodSize: cfg.MaxNetworkNeighborhoodSize, - collapseSettings: dynamicpathdetector.DefaultCollapseSettings, - } -} - -// SetCollapseSettings overrides the provider the deflate path uses to fetch -// effective thresholds. Pass dynamicpathdetector.DefaultCollapseSettings to -// fall back to compiled-in defaults; production wiring passes a provider -// that reads the CollapseConfiguration CR. -func (a *NetworkNeighborhoodProcessor) SetCollapseSettings(p dynamicpathdetector.CollapseSettingsProvider) { - if p == nil { - a.collapseSettings = dynamicpathdetector.DefaultCollapseSettings - return - } - a.collapseSettings = p -} - -// effectiveCollapseSettings is the safe accessor for the deflate path. It -// returns the result of the configured provider, or — when the processor -// was constructed without using NewNetworkNeighborhoodProcessor (zero-value -// field, no factory call) — the compiled-in defaults. -func (a NetworkNeighborhoodProcessor) effectiveCollapseSettings() dynamicpathdetector.CollapseSettings { - if a.collapseSettings == nil { - return dynamicpathdetector.DefaultCollapseSettings() - } - return a.collapseSettings() -} - -var _ Processor = (*NetworkNeighborhoodProcessor)(nil) - -func (a NetworkNeighborhoodProcessor) AfterCreate(_ context.Context, _ runtime.Object) error { - return nil -} - -func (a NetworkNeighborhoodProcessor) PreSave(_ context.Context, object runtime.Object) error { - profile, ok := object.(*softwarecomposition.NetworkNeighborhood) - if !ok { - return fmt.Errorf("given object is not an NetworkNeighborhood") - } - - // set schema version - profile.SchemaVersion = SchemaVersion - - // size is the sum of all ingress/egress in all containers - var size int - - settings := a.effectiveCollapseSettings() - - // Define a function to process a slice of containers - processContainers := func(containers []softwarecomposition.NetworkNeighborhoodContainer) []softwarecomposition.NetworkNeighborhoodContainer { - for i, container := range containers { - containers[i] = deflateNetworkNeighborhoodContainer(container, settings) - size += len(containers[i].Ingress) - size += len(containers[i].Egress) - } - return containers - } - - // Use the function for InitContainers, EphemeralContainers and Containers - profile.Spec.EphemeralContainers = processContainers(profile.Spec.EphemeralContainers) - profile.Spec.InitContainers = processContainers(profile.Spec.InitContainers) - profile.Spec.Containers = processContainers(profile.Spec.Containers) - - // check the size of the profile - if size > a.maxNetworkNeighborhoodSize { - return fmt.Errorf("application profile size exceeds the limit of %d: %w", a.maxNetworkNeighborhoodSize, ObjectTooLargeError) - } - - // make sure annotations are initialized - if profile.Annotations == nil { - profile.Annotations = make(map[string]string) - } - profile.Annotations[helpers.ResourceSizeMetadataKey] = strconv.Itoa(size) - return nil -} - -func (a NetworkNeighborhoodProcessor) SetStorage(_ ContainerProfileStorage) {} - -func deflateNetworkNeighborhoodContainer(container softwarecomposition.NetworkNeighborhoodContainer, settings dynamicpathdetector.CollapseSettings) softwarecomposition.NetworkNeighborhoodContainer { - return softwarecomposition.NetworkNeighborhoodContainer{ - Name: container.Name, - Ingress: deflateNetworkNeighbors(container.Ingress, settings), - Egress: deflateNetworkNeighbors(container.Egress, settings), - } -} - -// NetworkNeighbors are merged on Identifier -// DNSNames are deduplicated -// Ports are merged on Name -// Then, groups of entries differing only by IP are collapsed into CIDR-bearing -// entries once their count exceeds settings.NetworkIPGroupThreshold (see -// collapseIPGroups). That second pass is a fixpoint (AC10): re-running it on -// its own output leaves already-collapsed entries untouched, so repeated saves -// are idempotent. -func deflateNetworkNeighbors(in []softwarecomposition.NetworkNeighbor, settings dynamicpathdetector.CollapseSettings) []softwarecomposition.NetworkNeighbor { - if in == nil { - return nil - } - out := make([]softwarecomposition.NetworkNeighbor, 0) - seen := map[string]int{} - toDeflate := mapset.NewThreadUnsafeSet[int]() - for _, item := range in { - if index, ok := seen[item.Identifier]; ok { - out[index].DNSNames = append(out[index].DNSNames, item.DNSNames...) - out[index].Ports = append(out[index].Ports, item.Ports...) - toDeflate.Add(index) - } else { - out = append(out, item) - seen[item.Identifier] = len(out) - 1 // index of the appended item - } - } - for _, i := range mapset.Sorted(toDeflate) { - out[i].DNSNames = DeflateSortString(out[i].DNSNames) - out[i].Ports = DeflateStringer(out[i].Ports) - } - return collapseIPGroups(out, settings) -} diff --git a/pkg/registry/file/networkneighborhood_processor_test.go b/pkg/registry/file/networkneighborhood_processor_test.go deleted file mode 100644 index 6d5e0fc7c..000000000 --- a/pkg/registry/file/networkneighborhood_processor_test.go +++ /dev/null @@ -1,170 +0,0 @@ -package file - -import ( - "context" - "fmt" - "testing" - - "github.com/kubescape/k8s-interface/instanceidhandler/v1/helpers" - "github.com/kubescape/storage/pkg/apis/softwarecomposition" - "github.com/kubescape/storage/pkg/config" - "github.com/kubescape/storage/pkg/registry/file/dynamicpathdetector" - "github.com/stretchr/testify/assert" - v1 "k8s.io/apimachinery/pkg/apis/meta/v1" - "k8s.io/apimachinery/pkg/runtime" -) - -var nn = softwarecomposition.NetworkNeighborhood{ - ObjectMeta: v1.ObjectMeta{ - Annotations: map[string]string{}, - }, - Spec: softwarecomposition.NetworkNeighborhoodSpec{ - EphemeralContainers: []softwarecomposition.NetworkNeighborhoodContainer{ - { - Name: "ephemeralContainer", - Ingress: []softwarecomposition.NetworkNeighbor{ - {Identifier: "a", Ports: []softwarecomposition.NetworkPort{{Name: "80"}}}, - {Identifier: "b", Ports: []softwarecomposition.NetworkPort{{Name: "80"}}}, - {Identifier: "a", Ports: []softwarecomposition.NetworkPort{{Name: "443"}, {Name: "80"}}}, - {Identifier: "c", Ports: []softwarecomposition.NetworkPort{{Name: "80"}}}, - {Identifier: "c", Ports: []softwarecomposition.NetworkPort{{Name: "80"}}}, - }, - }, - }, - InitContainers: []softwarecomposition.NetworkNeighborhoodContainer{ - { - Name: "initContainer", - Ingress: []softwarecomposition.NetworkNeighbor{ - {Identifier: "a", Ports: []softwarecomposition.NetworkPort{{Name: "80"}}}, - {Identifier: "a", Ports: []softwarecomposition.NetworkPort{{Name: "80"}}}, - }, - }, - }, - Containers: []softwarecomposition.NetworkNeighborhoodContainer{ - { - Name: "container1", - Ingress: []softwarecomposition.NetworkNeighbor{ - {Identifier: "a", Ports: []softwarecomposition.NetworkPort{{Name: "80"}}}, - {Identifier: "c", Ports: []softwarecomposition.NetworkPort{{Name: "8080"}}}, - }, - }, - { - Name: "container2", - Ingress: []softwarecomposition.NetworkNeighbor{ - {Identifier: "a", Ports: []softwarecomposition.NetworkPort{{Name: "80"}}}, - }, - }, - }, - }, -} - -func TestNetworkNeighborhoodProcessor_PreSave(t *testing.T) { - tests := []struct { - name string - maxNetworkNeighborhoodSize int - object runtime.Object - want runtime.Object - wantErr assert.ErrorAssertionFunc - }{ - { - name: "NetworkNeighborhood with initContainers and ephemeralContainers", - maxNetworkNeighborhoodSize: 40000, - object: &nn, - want: &softwarecomposition.NetworkNeighborhood{ - ObjectMeta: v1.ObjectMeta{ - Annotations: map[string]string{ - helpers.ResourceSizeMetadataKey: "7", - }, - }, - SchemaVersion: 1, - Spec: softwarecomposition.NetworkNeighborhoodSpec{ - EphemeralContainers: []softwarecomposition.NetworkNeighborhoodContainer{ - { - Name: "ephemeralContainer", - Ingress: []softwarecomposition.NetworkNeighbor{ - {Identifier: "a", Ports: []softwarecomposition.NetworkPort{{Name: "80"}, {Name: "443"}}}, - {Identifier: "b", Ports: []softwarecomposition.NetworkPort{{Name: "80"}}}, - {Identifier: "c", Ports: []softwarecomposition.NetworkPort{{Name: "80"}}}, - }, - }, - }, - InitContainers: []softwarecomposition.NetworkNeighborhoodContainer{ - { - Name: "initContainer", - Ingress: []softwarecomposition.NetworkNeighbor{ - {Identifier: "a", Ports: []softwarecomposition.NetworkPort{{Name: "80"}}}, - }, - }, - }, - Containers: []softwarecomposition.NetworkNeighborhoodContainer{ - { - Name: "container1", - Ingress: []softwarecomposition.NetworkNeighbor{ - {Identifier: "a", Ports: []softwarecomposition.NetworkPort{{Name: "80"}}}, - {Identifier: "c", Ports: []softwarecomposition.NetworkPort{{Name: "8080"}}}, - }, - }, - { - Name: "container2", - Ingress: []softwarecomposition.NetworkNeighbor{ - {Identifier: "a", Ports: []softwarecomposition.NetworkPort{{Name: "80"}}}, - }, - }, - }, - }, - }, - wantErr: assert.NoError, - }, - { - name: "NetworkNeighborhood too big", - maxNetworkNeighborhoodSize: 5, - object: &nn, - want: &nn, - wantErr: assert.Error, - }, - } - for _, tt := range tests { - t.Run(tt.name, func(t *testing.T) { - a := NewNetworkNeighborhoodProcessor(config.Config{MaxNetworkNeighborhoodSize: tt.maxNetworkNeighborhoodSize}) - tt.wantErr(t, a.PreSave(context.TODO(), tt.object), fmt.Sprintf("PreSave(%v)", tt.object)) - assert.Equal(t, tt.want, tt.object) - }) - } -} - -func TestNetworkNeighborhoodProcessor_PreSave_IPCollapse(t *testing.T) { - const hostCount = 64 // a fully-observed /26 (10.0.0.0..10.0.0.63) - ingress := make([]softwarecomposition.NetworkNeighbor, 0, hostCount) - for i := 0; i < hostCount; i++ { - ingress = append(ingress, softwarecomposition.NetworkNeighbor{ - Identifier: fmt.Sprintf("external-%d", i), - Type: "external", - IPAddress: fmt.Sprintf("10.0.0.%d", i), - Ports: []softwarecomposition.NetworkPort{{Name: "80"}}, - }) - } - profile := &softwarecomposition.NetworkNeighborhood{ - ObjectMeta: v1.ObjectMeta{Annotations: map[string]string{}}, - Spec: softwarecomposition.NetworkNeighborhoodSpec{ - Containers: []softwarecomposition.NetworkNeighborhoodContainer{ - {Name: "container1", Ingress: ingress}, - }, - }, - } - - a := NewNetworkNeighborhoodProcessor(config.Config{MaxNetworkNeighborhoodSize: 40000}) - a.SetCollapseSettings(func() dynamicpathdetector.CollapseSettings { - return dynamicpathdetector.CollapseSettings{ - NetworkIPGroupThreshold: 10, - NetworkCIDRFloorBits: 24, - } - }) - - assert.NoError(t, a.PreSave(context.TODO(), profile)) - - got := profile.Spec.Containers[0].Ingress - assert.Len(t, got, 1, "expected all same-group host IPs to collapse into a single CIDR entry") - assert.Empty(t, got[0].IPAddress) - assert.Equal(t, []string{"10.0.0.0/26"}, got[0].IPAddresses) - assert.Equal(t, []softwarecomposition.NetworkPort{{Name: "80"}}, got[0].Ports) -} diff --git a/pkg/registry/file/networkneighborhood_storage.go b/pkg/registry/file/networkneighborhood_storage.go deleted file mode 100644 index 4b1c15bae..000000000 --- a/pkg/registry/file/networkneighborhood_storage.go +++ /dev/null @@ -1,120 +0,0 @@ -package file - -import ( - "context" - "fmt" - - "github.com/kubescape/go-logger" - loggerhelpers "github.com/kubescape/go-logger/helpers" - helpersv1 "github.com/kubescape/k8s-interface/instanceidhandler/v1/helpers" - "github.com/kubescape/storage/pkg/apis/softwarecomposition" - "github.com/kubescape/storage/pkg/utils" - metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" - "k8s.io/apimachinery/pkg/runtime" - "k8s.io/apimachinery/pkg/watch" - "k8s.io/apiserver/pkg/storage" -) - -type NetworkNeighborhoodStorage struct { - realStore StorageQuerier -} - -func (a NetworkNeighborhoodStorage) EnableResourceSizeEstimation(keysFunc storage.KeysFunc) error { - return nil -} - -func (a NetworkNeighborhoodStorage) Stats(_ context.Context) (storage.Stats, error) { - return storage.Stats{}, fmt.Errorf("unimplemented") -} - -func (a NetworkNeighborhoodStorage) SetKeysFunc(_ storage.KeysFunc) {} - -func (a NetworkNeighborhoodStorage) CompactRevision() int64 { - return 0 -} - -var _ storage.Interface = (*NetworkNeighborhoodStorage)(nil) - -func NewNetworkNeighborhoodStorage(realStore StorageQuerier) storage.Interface { - return &NetworkNeighborhoodStorage{realStore: realStore} -} - -func (a NetworkNeighborhoodStorage) GetCurrentResourceVersion(_ context.Context) (uint64, error) { - return 0, nil -} - -func (a NetworkNeighborhoodStorage) Versioner() storage.Versioner { - return a.realStore.Versioner() -} - -func (a NetworkNeighborhoodStorage) Create(ctx context.Context, key string, obj, out runtime.Object, ttl uint64) error { - return a.realStore.Create(ctx, key, obj, out, ttl) -} - -func (a NetworkNeighborhoodStorage) Delete(ctx context.Context, key string, out runtime.Object, preconditions *storage.Preconditions, validateDeletion storage.ValidateObjectFunc, cachedExistingObject runtime.Object, opts storage.DeleteOptions) error { - return a.realStore.Delete(ctx, key, out, preconditions, validateDeletion, cachedExistingObject, opts) -} - -func (a NetworkNeighborhoodStorage) Watch(ctx context.Context, key string, opts storage.ListOptions) (watch.Interface, error) { - return a.realStore.Watch(ctx, key, opts) -} - -func (a NetworkNeighborhoodStorage) Get(ctx context.Context, key string, opts storage.GetOptions, objPtr runtime.Object) error { - if err := a.realStore.Get(ctx, key, opts, objPtr); err != nil { - return err - } - nn, ok := objPtr.(*softwarecomposition.NetworkNeighborhood) - if !ok { - return fmt.Errorf("object is not an NetworkNeighborhood") - } - if len(nn.Parts) > 0 { - matchLabels := make(map[string]string) - var matchExpressions []metav1.LabelSelectorRequirement - for cpKey := range nn.Parts { - cp := &softwarecomposition.ContainerProfile{} - if err := a.realStore.Get(ctx, cpKey, opts, cp); err != nil { - logger.L().Debug("NetworkNeighborhoodStorage.Get - get cp object", loggerhelpers.Error(err)) - return nil - } - matchLabels = utils.MergeMaps(matchLabels, cp.Spec.MatchLabels) - matchExpressions = append(matchExpressions, cp.Spec.MatchExpressions...) - container := softwarecomposition.NetworkNeighborhoodContainer{ - Name: cp.Labels[helpersv1.ContainerNameMetadataKey], - Ingress: cp.Spec.Ingress, - Egress: cp.Spec.Egress, - } - switch cp.Annotations[helpersv1.ContainerTypeMetadataKey] { - case "containers": - nn.Spec.Containers = append(nn.Spec.Containers, container) - case "initContainers": - nn.Spec.InitContainers = append(nn.Spec.InitContainers, container) - case "ephemeralContainers": - nn.Spec.EphemeralContainers = append(nn.Spec.EphemeralContainers, container) - default: - return fmt.Errorf("unknown container type: %s", cp.Annotations[helpersv1.ContainerTypeMetadataKey]) - } - } - nn.Spec.MatchLabels = matchLabels - nn.Spec.MatchExpressions = DeflateLabelSelectorRequirement(matchExpressions) - } - return nil -} - -func (a NetworkNeighborhoodStorage) GetList(ctx context.Context, key string, opts storage.ListOptions, listObj runtime.Object) error { - if opts.ResourceVersion == softwarecomposition.ResourceVersionFullSpec { - return fmt.Errorf("GetList with %s is not allowed for NetworkNeighborhoods", softwarecomposition.ResourceVersionFullSpec) - } - return a.realStore.GetList(ctx, key, opts, listObj) -} - -func (a NetworkNeighborhoodStorage) GuaranteedUpdate(ctx context.Context, key string, destination runtime.Object, ignoreNotFound bool, preconditions *storage.Preconditions, tryUpdate storage.UpdateFunc, cachedExistingObject runtime.Object) error { - return a.realStore.GuaranteedUpdate(ctx, key, destination, ignoreNotFound, preconditions, tryUpdate, cachedExistingObject) -} - -func (a NetworkNeighborhoodStorage) ReadinessCheck() error { - return a.realStore.ReadinessCheck() -} - -func (a NetworkNeighborhoodStorage) RequestWatchProgress(ctx context.Context) error { - return a.realStore.RequestWatchProgress(ctx) -} diff --git a/pkg/registry/file/storage_test.go b/pkg/registry/file/storage_test.go index 69680331a..f3008f8ca 100644 --- a/pkg/registry/file/storage_test.go +++ b/pkg/registry/file/storage_test.go @@ -661,8 +661,8 @@ func Test_calculateChecksum(t *testing.T) { wantErr assert.ErrorAssertionFunc }{ { - name: "applicationprofile", - obj: &softwarecomposition.ApplicationProfile{ + name: "containerprofile", + obj: &softwarecomposition.ContainerProfile{ ObjectMeta: v1.ObjectMeta{ Name: "toto", Namespace: "default", @@ -670,17 +670,14 @@ func Test_calculateChecksum(t *testing.T) { "key": "value", }, }, - Spec: softwarecomposition.ApplicationProfileSpec{ + Spec: softwarecomposition.ContainerProfileSpec{ Architectures: []string{"amd64"}, - Containers: []softwarecomposition.ApplicationProfileContainer{{ - Name: "nginx", - Execs: []softwarecomposition.ExecCalls{{ - Path: "/usr/sbin/nginx", - }}, + Execs: []softwarecomposition.ExecCalls{{ + Path: "/usr/sbin/nginx", }}, }, }, - want: "cd4905299d95f0cf9d2337b7e674ea7ccff116e47ec6aa036f29a691a063a4ed", + want: "264ce846e489f0e32634241e41ecbd96d53a8c52331fc02db13b0f627aed9a25", wantErr: assert.NoError, }, } diff --git a/pkg/registry/file/testdata/expectedFilesToDelete.json b/pkg/registry/file/testdata/expectedFilesToDelete.json index 8b870bec6..f9e9de304 100644 --- a/pkg/registry/file/testdata/expectedFilesToDelete.json +++ b/pkg/registry/file/testdata/expectedFilesToDelete.json @@ -9,16 +9,6 @@ "/data/spdx.softwarecomposition.kubescape.io/applicationactivities/kubescape/kubescape-replicaset-synchronizer-79b57d5d67-6912-e9a6.g", "/data/spdx.softwarecomposition.kubescape.io/applicationactivities/kubescape/kubescape-statefulset-kollector-c1be-77d8.g", "/data/spdx.softwarecomposition.kubescape.io/applicationactivities/local-path-storage/local-path-storage-replicaset-local-path-provisioner-75f5b54ffd-763c-36ba.g", - "/data/spdx.softwarecomposition.kubescape.io/applicationprofiles/default/default-replicaset-nginx-748c667d99-cf81-0278.g", - "/data/spdx.softwarecomposition.kubescape.io/applicationprofiles/gadget/gadget-daemonset-gadget-0d7c-fd3c.g", - "/data/spdx.softwarecomposition.kubescape.io/applicationprofiles/kubescape/kubescape-replicaset-gateway-798c4c5f44-b8b1-1308.g", - "/data/spdx.softwarecomposition.kubescape.io/applicationprofiles/kubescape/kubescape-replicaset-kubescape-6cff94799d-8110-156a.g", - "/data/spdx.softwarecomposition.kubescape.io/applicationprofiles/kubescape/kubescape-replicaset-operator-575cf58d76-4ad4-39ec.g", - "/data/spdx.softwarecomposition.kubescape.io/applicationprofiles/kubescape/kubescape-replicaset-otel-collector-54648b7dbb-a539-eb0b.g", - "/data/spdx.softwarecomposition.kubescape.io/applicationprofiles/kubescape/kubescape-replicaset-storage-8f57967d7-d272-b1f5.g", - "/data/spdx.softwarecomposition.kubescape.io/applicationprofiles/kubescape/kubescape-replicaset-synchronizer-79b57d5d67-6912-e9a6.g", - "/data/spdx.softwarecomposition.kubescape.io/applicationprofiles/kubescape/kubescape-statefulset-kollector-c1be-77d8.g", - "/data/spdx.softwarecomposition.kubescape.io/applicationprofiles/local-path-storage/local-path-storage-replicaset-local-path-provisioner-75f5b54ffd-763c-36ba.g", "/data/spdx.softwarecomposition.kubescape.io/applicationprofilesummaries/default/default-replicaset-nginx-748c667d99-cf81-0278.g", "/data/spdx.softwarecomposition.kubescape.io/applicationprofilesummaries/gadget/gadget-daemonset-gadget-0d7c-fd3c.g", "/data/spdx.softwarecomposition.kubescape.io/applicationprofilesummaries/kubescape/kubescape-replicaset-gateway-798c4c5f44-b8b1-1308.g", diff --git a/pkg/registry/softwarecomposition/applicationprofile/etcd.go b/pkg/registry/softwarecomposition/applicationprofile/etcd.go deleted file mode 100644 index 47b25e194..000000000 --- a/pkg/registry/softwarecomposition/applicationprofile/etcd.go +++ /dev/null @@ -1,56 +0,0 @@ -/* -Copyright 2017 The Kubernetes Authors. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - -http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -*/ - -package applicationprofile - -import ( - "github.com/kubescape/storage/pkg/apis/softwarecomposition" - "github.com/kubescape/storage/pkg/registry" - "k8s.io/apimachinery/pkg/runtime" - "k8s.io/apiserver/pkg/registry/generic" - genericregistry "k8s.io/apiserver/pkg/registry/generic/registry" - "k8s.io/apiserver/pkg/registry/rest" - "k8s.io/apiserver/pkg/storage" -) - -// NewREST returns a RESTStorage object that will work against API services. -func NewREST(scheme *runtime.Scheme, storageImpl storage.Interface, optsGetter generic.RESTOptionsGetter) (*registry.REST, error) { - strategy := NewStrategy(scheme) - - dryRunnableStorage := genericregistry.DryRunnableStorage{Codec: nil, Storage: storageImpl} - - store := &genericregistry.Store{ - NewFunc: func() runtime.Object { return &softwarecomposition.ApplicationProfile{} }, - NewListFunc: func() runtime.Object { return &softwarecomposition.ApplicationProfileList{} }, - PredicateFunc: MatchApplicationProfile, - DefaultQualifiedResource: softwarecomposition.Resource("applicationprofiles"), - SingularQualifiedResource: softwarecomposition.Resource("applicationprofile"), - - Storage: dryRunnableStorage, - - CreateStrategy: strategy, - UpdateStrategy: strategy, - DeleteStrategy: strategy, - - // TODO: define table converter that exposes more than name/creation timestamp - TableConvertor: rest.NewDefaultTableConvertor(softwarecomposition.Resource("applicationprofiles")), - } - options := &generic.StoreOptions{RESTOptions: optsGetter, AttrFunc: GetAttrs} - if err := store.CompleteWithOptions(options); err != nil { - return nil, err - } - return ®istry.REST{Store: store}, nil -} diff --git a/pkg/registry/softwarecomposition/applicationprofile/strategy.go b/pkg/registry/softwarecomposition/applicationprofile/strategy.go deleted file mode 100644 index 92759b1f9..000000000 --- a/pkg/registry/softwarecomposition/applicationprofile/strategy.go +++ /dev/null @@ -1,145 +0,0 @@ -package applicationprofile - -import ( - "context" - "fmt" - - logHelpers "github.com/kubescape/go-logger/helpers" - "k8s.io/apimachinery/pkg/fields" - "k8s.io/apimachinery/pkg/labels" - "k8s.io/apimachinery/pkg/runtime" - "k8s.io/apimachinery/pkg/util/validation/field" - "k8s.io/apiserver/pkg/registry/generic" - "k8s.io/apiserver/pkg/storage" - "k8s.io/apiserver/pkg/storage/names" - - "github.com/kubescape/go-logger" - "github.com/kubescape/k8s-interface/instanceidhandler/v1/helpers" - "github.com/kubescape/storage/pkg/apis/softwarecomposition" - "github.com/kubescape/storage/pkg/registry/softwarecomposition/common" - "github.com/kubescape/storage/pkg/utils" -) - -// NewStrategy creates and returns a applicationProfileStrategy instance -func NewStrategy(typer runtime.ObjectTyper) ApplicationProfileStrategy { - return ApplicationProfileStrategy{typer, names.SimpleNameGenerator} -} - -// GetAttrs returns labels.Set, fields.Set, and error in case the given runtime.Object is not a Flunder -func GetAttrs(obj runtime.Object) (labels.Set, fields.Set, error) { - apiserver, ok := obj.(*softwarecomposition.ApplicationProfile) - if !ok { - return nil, nil, fmt.Errorf("given object is not a Flunder") - } - return apiserver.ObjectMeta.Labels, SelectableFields(apiserver), nil -} - -// MatchApplicationProfile is the filter used by the generic etcd backend to watch events -// from etcd to clients of the apiserver only interested in specific labels/fields. -func MatchApplicationProfile(label labels.Selector, field fields.Selector) storage.SelectionPredicate { - return storage.SelectionPredicate{ - Label: label, - Field: field, - GetAttrs: GetAttrs, - } -} - -// SelectableFields returns a field set that represents the object. -func SelectableFields(obj *softwarecomposition.ApplicationProfile) fields.Set { - return generic.ObjectMetaFieldsSet(&obj.ObjectMeta, true) -} - -type ApplicationProfileStrategy struct { - runtime.ObjectTyper - names.NameGenerator -} - -func (ApplicationProfileStrategy) NamespaceScoped() bool { - return true -} - -func (ApplicationProfileStrategy) PrepareForCreate(_ context.Context, _ runtime.Object) { -} - -func (ApplicationProfileStrategy) PrepareForUpdate(_ context.Context, obj, old runtime.Object) { - newAP := obj.(*softwarecomposition.ApplicationProfile) - oldAP := old.(*softwarecomposition.ApplicationProfile) - - // if we have an application profile that is marked as complete and completed, we do not allow any updates - if common.IsComplete(oldAP.Annotations, newAP.Annotations) { - logger.L().Debug("application profile is marked as complete and completed, rejecting update", - logHelpers.String("name", oldAP.Name), - logHelpers.String("namespace", oldAP.Namespace)) - *newAP = *oldAP // reset the new object to the old object - return - } - - // completion status cannot be transitioned from 'complete' -> 'partial' - // in such case, we reject status updates - if oldAP.Annotations[helpers.CompletionMetadataKey] == helpers.Full && newAP.Annotations[helpers.CompletionMetadataKey] == helpers.Partial { - logger.L().Debug("application profile completion status cannot be transitioned from 'complete' to 'partial', rejecting status updates", - logHelpers.String("name", oldAP.Name), - logHelpers.String("namespace", oldAP.Namespace)) - - newAP.Annotations[helpers.CompletionMetadataKey] = helpers.Full - - if v, ok := oldAP.Annotations[helpers.StatusMetadataKey]; ok { - newAP.Annotations[helpers.StatusMetadataKey] = v - } else { - delete(newAP.Annotations, helpers.StatusMetadataKey) - } - } -} - -func (ApplicationProfileStrategy) Validate(_ context.Context, obj runtime.Object) field.ErrorList { - ap := obj.(*softwarecomposition.ApplicationProfile) - - allErrors := field.ErrorList{} - - if err := utils.ValidateCompletionAnnotation(ap.Annotations); err != nil { - allErrors = append(allErrors, err) - } - - if err := utils.ValidateStatusAnnotation(ap.Annotations); err != nil { - allErrors = append(allErrors, err) - } - - return allErrors -} - -// WarningsOnCreate returns warnings for the creation of the given object. -func (ApplicationProfileStrategy) WarningsOnCreate(_ context.Context, _ runtime.Object) []string { - return nil -} - -func (ApplicationProfileStrategy) AllowCreateOnUpdate() bool { - return false -} - -func (ApplicationProfileStrategy) AllowUnconditionalUpdate() bool { - return false -} - -func (ApplicationProfileStrategy) Canonicalize(_ runtime.Object) { -} - -func (ApplicationProfileStrategy) ValidateUpdate(_ context.Context, obj, _ runtime.Object) field.ErrorList { - ap := obj.(*softwarecomposition.ApplicationProfile) - - allErrors := field.ErrorList{} - - if err := utils.ValidateCompletionAnnotation(ap.Annotations); err != nil { - allErrors = append(allErrors, err) - } - - if err := utils.ValidateStatusAnnotation(ap.Annotations); err != nil { - allErrors = append(allErrors, err) - } - - return allErrors -} - -// WarningsOnUpdate returns warnings for the given update. -func (ApplicationProfileStrategy) WarningsOnUpdate(_ context.Context, _, _ runtime.Object) []string { - return nil -} diff --git a/pkg/registry/softwarecomposition/applicationprofile/strategy_test.go b/pkg/registry/softwarecomposition/applicationprofile/strategy_test.go deleted file mode 100644 index b632c7cd2..000000000 --- a/pkg/registry/softwarecomposition/applicationprofile/strategy_test.go +++ /dev/null @@ -1,264 +0,0 @@ -package applicationprofile - -import ( - "context" - "testing" - - "github.com/kubescape/k8s-interface/instanceidhandler/v1/helpers" - "github.com/kubescape/storage/pkg/apis/softwarecomposition" - "github.com/stretchr/testify/assert" - metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" -) - -func TestPrepareForUpdateAnnotations(t *testing.T) { - tests := []struct { - name string - oldAnnotations map[string]string - newAnnotations map[string]string - expected map[string]string - }{ - { - name: "transition from complete (with status) to partial - rejected", - oldAnnotations: map[string]string{ - helpers.CompletionMetadataKey: "complete", - helpers.StatusMetadataKey: "initializing", - }, - newAnnotations: map[string]string{ - helpers.CompletionMetadataKey: "partial", - helpers.StatusMetadataKey: "ready", - }, - expected: map[string]string{ - helpers.CompletionMetadataKey: "complete", - helpers.StatusMetadataKey: "initializing", - }, - }, - { - name: "transition from partial (with status) to complete - accepted", - oldAnnotations: map[string]string{ - helpers.CompletionMetadataKey: "partial", - helpers.StatusMetadataKey: "initializing", - }, - newAnnotations: map[string]string{ - helpers.CompletionMetadataKey: "partial", - helpers.StatusMetadataKey: "ready", - }, - expected: map[string]string{ - helpers.CompletionMetadataKey: "partial", - helpers.StatusMetadataKey: "ready", - }, - }, - { - name: "transition from partial (without status) to complete - accepted", - oldAnnotations: map[string]string{ - helpers.CompletionMetadataKey: "partial", - }, - newAnnotations: map[string]string{ - helpers.CompletionMetadataKey: "complete", - helpers.StatusMetadataKey: "ready", - }, - expected: map[string]string{ - helpers.CompletionMetadataKey: "complete", - helpers.StatusMetadataKey: "ready", - }, - }, - { - name: "transition from complete (without status) to partial - rejected", - oldAnnotations: map[string]string{ - helpers.CompletionMetadataKey: "complete", - }, - newAnnotations: map[string]string{ - helpers.CompletionMetadataKey: "partial", - helpers.StatusMetadataKey: "initializing", - }, - expected: map[string]string{ - helpers.CompletionMetadataKey: "complete", - }, - }, - { - name: "transition from a final AP - all changes are rejected", - oldAnnotations: map[string]string{ - helpers.CompletionMetadataKey: "complete", - helpers.StatusMetadataKey: "completed", - }, - newAnnotations: map[string]string{ - helpers.CompletionMetadataKey: "partial", - helpers.StatusMetadataKey: "initializing", - }, - expected: map[string]string{ - helpers.CompletionMetadataKey: "complete", - helpers.StatusMetadataKey: "completed", - }, - }, - } - - for _, tt := range tests { - t.Run(tt.name, func(t *testing.T) { - s := ApplicationProfileStrategy{} - - obj := &softwarecomposition.ApplicationProfile{ObjectMeta: metav1.ObjectMeta{Annotations: tt.newAnnotations}} - old := &softwarecomposition.ApplicationProfile{ObjectMeta: metav1.ObjectMeta{Annotations: tt.oldAnnotations}} - - s.PrepareForUpdate(context.TODO(), obj, old) - assert.Equal(t, tt.expected, obj.Annotations) - }) - } -} - -func TestPrepareForUpdateFullObj(t *testing.T) { - tests := []struct { - name string - old *softwarecomposition.ApplicationProfile - new *softwarecomposition.ApplicationProfile - expected *softwarecomposition.ApplicationProfile - }{ - { - name: "transition from initializing to ready - changes are accepted", - old: &softwarecomposition.ApplicationProfile{ - ObjectMeta: metav1.ObjectMeta{ - Annotations: map[string]string{ - helpers.CompletionMetadataKey: "complete", - helpers.StatusMetadataKey: "initializing", - }, - }, - Spec: softwarecomposition.ApplicationProfileSpec{ - Containers: []softwarecomposition.ApplicationProfileContainer{ - { - Name: "container1", - Capabilities: []string{}, - Execs: []softwarecomposition.ExecCalls{ - {Path: "/usr/bin/ls", Args: []string{"-l", "/tmp"}}, - }, - }, - }, - }, - }, - new: &softwarecomposition.ApplicationProfile{ - ObjectMeta: metav1.ObjectMeta{ - Annotations: map[string]string{ - helpers.CompletionMetadataKey: "complete", - helpers.StatusMetadataKey: "ready", - }, - }, - Spec: softwarecomposition.ApplicationProfileSpec{ - Containers: []softwarecomposition.ApplicationProfileContainer{ - { - Name: "container1", - Capabilities: []string{}, - Execs: []softwarecomposition.ExecCalls{ - {Path: "/usr/bin/ls", Args: []string{"-l", "/tmp"}}, - }, - }, - { - Name: "container2", - Capabilities: []string{}, - Execs: []softwarecomposition.ExecCalls{ - {Path: "/usr/bin/ls", Args: []string{"-l", "/tmp"}}, - }, - }, - }, - }, - }, - expected: &softwarecomposition.ApplicationProfile{ - ObjectMeta: metav1.ObjectMeta{ - Annotations: map[string]string{ - helpers.CompletionMetadataKey: "complete", - helpers.StatusMetadataKey: "ready", - }, - }, - Spec: softwarecomposition.ApplicationProfileSpec{ - Containers: []softwarecomposition.ApplicationProfileContainer{ - { - Name: "container1", - Capabilities: []string{}, - Execs: []softwarecomposition.ExecCalls{ - {Path: "/usr/bin/ls", Args: []string{"-l", "/tmp"}}, - }, - }, - { - Name: "container2", - Capabilities: []string{}, - Execs: []softwarecomposition.ExecCalls{ - {Path: "/usr/bin/ls", Args: []string{"-l", "/tmp"}}, - }, - }, - }, - }, - }, - }, - { - name: "transition from a final AP - all changes are rejected", - old: &softwarecomposition.ApplicationProfile{ - ObjectMeta: metav1.ObjectMeta{ - Annotations: map[string]string{ - helpers.CompletionMetadataKey: "complete", - helpers.StatusMetadataKey: "completed", - }, - }, - Spec: softwarecomposition.ApplicationProfileSpec{ - Containers: []softwarecomposition.ApplicationProfileContainer{ - { - Name: "container1", - Capabilities: []string{}, - Execs: []softwarecomposition.ExecCalls{ - {Path: "/usr/bin/ls", Args: []string{"-l", "/tmp"}}, - }, - }, - }, - }, - }, - new: &softwarecomposition.ApplicationProfile{ - ObjectMeta: metav1.ObjectMeta{ - Annotations: map[string]string{ - helpers.CompletionMetadataKey: "partial", - helpers.StatusMetadataKey: "initializing", - }, - }, - Spec: softwarecomposition.ApplicationProfileSpec{ - Containers: []softwarecomposition.ApplicationProfileContainer{ - { - Name: "container1", - Capabilities: []string{}, - Execs: []softwarecomposition.ExecCalls{ - {Path: "/usr/bin/ls", Args: []string{"-l", "/tmp"}}, - }, - }, - { - Name: "container2", - Capabilities: []string{}, - Execs: []softwarecomposition.ExecCalls{ - {Path: "/usr/bin/ls", Args: []string{"-l", "/tmp"}}, - }, - }, - }, - }, - }, - expected: &softwarecomposition.ApplicationProfile{ - ObjectMeta: metav1.ObjectMeta{ - Annotations: map[string]string{ - helpers.CompletionMetadataKey: "complete", - helpers.StatusMetadataKey: "completed", - }, - }, - Spec: softwarecomposition.ApplicationProfileSpec{ - Containers: []softwarecomposition.ApplicationProfileContainer{ - { - Name: "container1", - Capabilities: []string{}, - Execs: []softwarecomposition.ExecCalls{ - {Path: "/usr/bin/ls", Args: []string{"-l", "/tmp"}}, - }, - }, - }, - }, - }, - }, - } - - for _, tt := range tests { - t.Run(tt.name, func(t *testing.T) { - s := ApplicationProfileStrategy{} - s.PrepareForUpdate(context.TODO(), tt.new, tt.old) - assert.Equal(t, tt.expected, tt.new) - }) - } -} diff --git a/pkg/registry/softwarecomposition/collapseconfiguration/strategy_test.go b/pkg/registry/softwarecomposition/collapseconfiguration/strategy_test.go index 7ebc4b021..367d09b0b 100644 --- a/pkg/registry/softwarecomposition/collapseconfiguration/strategy_test.go +++ b/pkg/registry/softwarecomposition/collapseconfiguration/strategy_test.go @@ -155,7 +155,7 @@ func TestValidate_EntryRules(t *testing.T) { func TestValidate_RejectsNonCC(t *testing.T) { s := NewStrategy(newScheme()) // Pass a different type to confirm the type assertion fails cleanly. - notACC := &softwarecomposition.ApplicationProfile{} + notACC := &softwarecomposition.ContainerProfile{} errs := s.Validate(context.Background(), notACC) if len(errs) != 1 { t.Fatalf("expected 1 internal error for type mismatch, got: %v", errs) @@ -198,7 +198,7 @@ func TestSelectableFieldsAndAttrs(t *testing.T) { } func TestGetAttrs_RejectsNonCC(t *testing.T) { - notACC := &softwarecomposition.ApplicationProfile{} + notACC := &softwarecomposition.ContainerProfile{} _, _, err := GetAttrs(notACC) if err == nil { t.Fatalf("GetAttrs should reject non-CollapseConfiguration objects") diff --git a/pkg/registry/softwarecomposition/networkneighborhood/etcd.go b/pkg/registry/softwarecomposition/networkneighborhood/etcd.go deleted file mode 100644 index 15e8c880c..000000000 --- a/pkg/registry/softwarecomposition/networkneighborhood/etcd.go +++ /dev/null @@ -1,56 +0,0 @@ -/* -Copyright 2017 The Kubernetes Authors. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - -http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -*/ - -package networkneighborhood - -import ( - "github.com/kubescape/storage/pkg/apis/softwarecomposition" - "github.com/kubescape/storage/pkg/registry" - "k8s.io/apimachinery/pkg/runtime" - "k8s.io/apiserver/pkg/registry/generic" - genericregistry "k8s.io/apiserver/pkg/registry/generic/registry" - "k8s.io/apiserver/pkg/registry/rest" - "k8s.io/apiserver/pkg/storage" -) - -// NewREST returns a RESTStorage object that will work against API services. -func NewREST(scheme *runtime.Scheme, storageImpl storage.Interface, optsGetter generic.RESTOptionsGetter) (*registry.REST, error) { - strategy := NewStrategy(scheme) - - dryRunnableStorage := genericregistry.DryRunnableStorage{Codec: nil, Storage: storageImpl} - - store := &genericregistry.Store{ - NewFunc: func() runtime.Object { return &softwarecomposition.NetworkNeighborhood{} }, - NewListFunc: func() runtime.Object { return &softwarecomposition.NetworkNeighborhoodList{} }, - PredicateFunc: MatchNetworkNeighborhood, - DefaultQualifiedResource: softwarecomposition.Resource("networkneighborhoods"), - SingularQualifiedResource: softwarecomposition.Resource("networkneighborhood"), - - Storage: dryRunnableStorage, - - CreateStrategy: strategy, - UpdateStrategy: strategy, - DeleteStrategy: strategy, - - // TODO: define table converter that exposes more than name/creation timestamp - TableConvertor: rest.NewDefaultTableConvertor(softwarecomposition.Resource("networkneighborhoods")), - } - options := &generic.StoreOptions{RESTOptions: optsGetter, AttrFunc: GetAttrs} - if err := store.CompleteWithOptions(options); err != nil { - return nil, err - } - return ®istry.REST{Store: store}, nil -} diff --git a/pkg/registry/softwarecomposition/networkneighborhood/strategy.go b/pkg/registry/softwarecomposition/networkneighborhood/strategy.go deleted file mode 100644 index 07447ecf0..000000000 --- a/pkg/registry/softwarecomposition/networkneighborhood/strategy.go +++ /dev/null @@ -1,217 +0,0 @@ -package networkneighborhood - -import ( - "context" - "fmt" - - logHelpers "github.com/kubescape/go-logger/helpers" - "k8s.io/apimachinery/pkg/fields" - "k8s.io/apimachinery/pkg/labels" - "k8s.io/apimachinery/pkg/runtime" - "k8s.io/apimachinery/pkg/util/validation/field" - "k8s.io/apiserver/pkg/registry/generic" - "k8s.io/apiserver/pkg/storage" - "k8s.io/apiserver/pkg/storage/names" - - "github.com/kubescape/go-logger" - "github.com/kubescape/k8s-interface/instanceidhandler/v1/helpers" - "github.com/kubescape/storage/pkg/apis/softwarecomposition" - "github.com/kubescape/storage/pkg/registry/file/networkmatch" - "github.com/kubescape/storage/pkg/registry/softwarecomposition/common" - "github.com/kubescape/storage/pkg/utils" -) - -// NewStrategy creates and returns a NetworkNeighborhoodStrategy instance -func NewStrategy(typer runtime.ObjectTyper) NetworkNeighborhoodStrategy { - return NetworkNeighborhoodStrategy{typer, names.SimpleNameGenerator} -} - -// GetAttrs returns labels.Set, fields.Set, and error in case the given runtime.Object is not a Flunder -func GetAttrs(obj runtime.Object) (labels.Set, fields.Set, error) { - apiserver, ok := obj.(*softwarecomposition.NetworkNeighborhood) - if !ok { - return nil, nil, fmt.Errorf("given object is not a NetworkNeighborhood") - } - return apiserver.ObjectMeta.Labels, SelectableFields(apiserver), nil -} - -// MatchNetworkNeighborhood is the filter used by the generic etcd backend to watch events -// from etcd to clients of the apiserver only interested in specific labels/fields. -func MatchNetworkNeighborhood(label labels.Selector, field fields.Selector) storage.SelectionPredicate { - return storage.SelectionPredicate{ - Label: label, - Field: field, - GetAttrs: GetAttrs, - } -} - -// SelectableFields returns a field set that represents the object. -func SelectableFields(obj *softwarecomposition.NetworkNeighborhood) fields.Set { - return generic.ObjectMetaFieldsSet(&obj.ObjectMeta, true) -} - -type NetworkNeighborhoodStrategy struct { - runtime.ObjectTyper - names.NameGenerator -} - -func (NetworkNeighborhoodStrategy) NamespaceScoped() bool { - return true -} - -func (NetworkNeighborhoodStrategy) PrepareForCreate(_ context.Context, _ runtime.Object) { -} - -func (NetworkNeighborhoodStrategy) PrepareForUpdate(_ context.Context, obj, old runtime.Object) { - newAP := obj.(*softwarecomposition.NetworkNeighborhood) - oldAP := old.(*softwarecomposition.NetworkNeighborhood) - - // if we have an network neighborhood that is marked as completed, we do not allow any updates - if common.IsComplete(oldAP.Annotations, newAP.Annotations) { - logger.L().Debug("network neighborhood is marked as completed, rejecting update", - logHelpers.String("name", oldAP.Name), - logHelpers.String("namespace", oldAP.Namespace)) - *newAP = *oldAP // reset the new object to the old object - return - } - - // completion status cannot be transitioned from 'complete' -> 'partial' - // in such case, we reject status updates - if oldAP.Annotations[helpers.CompletionMetadataKey] == helpers.Full && newAP.Annotations[helpers.CompletionMetadataKey] == helpers.Partial { - logger.L().Debug("network neighborhood completion status cannot be transitioned from 'complete' to 'partial', rejecting status updates", - logHelpers.String("name", oldAP.Name), - logHelpers.String("namespace", oldAP.Namespace)) - - newAP.Annotations[helpers.CompletionMetadataKey] = helpers.Full - - if v, ok := oldAP.Annotations[helpers.StatusMetadataKey]; ok { - newAP.Annotations[helpers.StatusMetadataKey] = v - } else { - delete(newAP.Annotations, helpers.StatusMetadataKey) - } - } -} - -func (NetworkNeighborhoodStrategy) Validate(_ context.Context, obj runtime.Object) field.ErrorList { - ap := obj.(*softwarecomposition.NetworkNeighborhood) - - allErrors := field.ErrorList{} - - if err := utils.ValidateCompletionAnnotation(ap.Annotations); err != nil { - allErrors = append(allErrors, err) - } - - if err := utils.ValidateStatusAnnotation(ap.Annotations); err != nil { - allErrors = append(allErrors, err) - } - - allErrors = append(allErrors, validateNetworkProfileEntries(&ap.Spec)...) - - return allErrors -} - -// validateNetworkProfileEntries walks every NetworkNeighbor in the spec and -// validates each IPAddresses[] and DNSNames[] entry against the v0.0.2 -// wildcard token grammar (spec §5.7, §5.8). -// -// This is the admission-time defence; runtime matchers also tolerate -// malformed entries so a misconfigured profile doesn't kill the -// detection path entirely. -func validateNetworkProfileEntries(spec *softwarecomposition.NetworkNeighborhoodSpec) field.ErrorList { - var errs field.ErrorList - specPath := field.NewPath("spec") - // Ordered slice rather than a map: Go map iteration is non-deterministic, - // and admission errors flow back to clients via the apiserver. Stable - // ordering keeps error messages reproducible across requests and across - // test runs. - groups := []struct { - name string - items []softwarecomposition.NetworkNeighborhoodContainer - }{ - {name: "containers", items: spec.Containers}, - {name: "initContainers", items: spec.InitContainers}, - {name: "ephemeralContainers", items: spec.EphemeralContainers}, - } - for _, g := range groups { - groupPath := specPath.Child(g.name) - for ci, c := range g.items { - containerPath := groupPath.Index(ci) - errs = append(errs, validateNeighborList(containerPath.Child("egress"), c.Egress)...) - errs = append(errs, validateNeighborList(containerPath.Child("ingress"), c.Ingress)...) - } - } - return errs -} - -func validateNeighborList(parent *field.Path, list []softwarecomposition.NetworkNeighbor) field.ErrorList { - var errs field.ErrorList - for ni, n := range list { - nPath := parent.Index(ni) - ipsPath := nPath.Child("ipAddresses") - for ei, e := range n.IPAddresses { - if err := networkmatch.ValidateIPEntry(e); err != nil { - errs = append(errs, field.Invalid(ipsPath.Index(ei), e, err.Error())) - } - } - // Deprecated singular IPAddress is still accepted; validate it too - // so malformed values can't slip past admission via the old form. - if n.IPAddress != "" { - if err := networkmatch.ValidateIPEntry(n.IPAddress); err != nil { - errs = append(errs, field.Invalid(nPath.Child("ipAddress"), n.IPAddress, err.Error())) - } - } - dnsPath := nPath.Child("dnsNames") - for ei, e := range n.DNSNames { - if err := networkmatch.ValidateDNSEntry(e); err != nil { - errs = append(errs, field.Invalid(dnsPath.Index(ei), e, err.Error())) - } - } - // Deprecated singular DNS is still accepted; validate it too, - // mirroring the IPAddress pattern above. - if n.DNS != "" { - if err := networkmatch.ValidateDNSEntry(n.DNS); err != nil { - errs = append(errs, field.Invalid(nPath.Child("dns"), n.DNS, err.Error())) - } - } - } - return errs -} - -// WarningsOnCreate returns warnings for the creation of the given object. -func (NetworkNeighborhoodStrategy) WarningsOnCreate(_ context.Context, _ runtime.Object) []string { - return nil -} - -func (NetworkNeighborhoodStrategy) AllowCreateOnUpdate() bool { - return false -} - -func (NetworkNeighborhoodStrategy) AllowUnconditionalUpdate() bool { - return false -} - -func (NetworkNeighborhoodStrategy) Canonicalize(_ runtime.Object) { -} - -func (NetworkNeighborhoodStrategy) ValidateUpdate(_ context.Context, obj, _ runtime.Object) field.ErrorList { - ap := obj.(*softwarecomposition.NetworkNeighborhood) - - allErrors := field.ErrorList{} - - if err := utils.ValidateCompletionAnnotation(ap.Annotations); err != nil { - allErrors = append(allErrors, err) - } - - if err := utils.ValidateStatusAnnotation(ap.Annotations); err != nil { - allErrors = append(allErrors, err) - } - - allErrors = append(allErrors, validateNetworkProfileEntries(&ap.Spec)...) - - return allErrors -} - -// WarningsOnUpdate returns warnings for the given update. -func (NetworkNeighborhoodStrategy) WarningsOnUpdate(_ context.Context, _, _ runtime.Object) []string { - return nil -} diff --git a/pkg/registry/softwarecomposition/networkneighborhood/strategy_test.go b/pkg/registry/softwarecomposition/networkneighborhood/strategy_test.go deleted file mode 100644 index bcec7a8aa..000000000 --- a/pkg/registry/softwarecomposition/networkneighborhood/strategy_test.go +++ /dev/null @@ -1,502 +0,0 @@ -package networkneighborhood - -import ( - "context" - "testing" - - "github.com/kubescape/k8s-interface/instanceidhandler/v1/helpers" - "github.com/kubescape/storage/pkg/apis/softwarecomposition" - "github.com/stretchr/testify/assert" - metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" - "k8s.io/utils/ptr" -) - -func TestPrepareForUpdate(t *testing.T) { - tests := []struct { - name string - oldAnnotations map[string]string - newAnnotations map[string]string - expected map[string]string - }{ - { - name: "transition from complete (with status) to partial - rejected", - oldAnnotations: map[string]string{ - helpers.CompletionMetadataKey: "complete", - helpers.StatusMetadataKey: "initializing", - }, - newAnnotations: map[string]string{ - helpers.CompletionMetadataKey: "partial", - helpers.StatusMetadataKey: "ready", - }, - expected: map[string]string{ - helpers.CompletionMetadataKey: "complete", - helpers.StatusMetadataKey: "initializing", - }, - }, - { - name: "transition from partial (with status) to complete - accepted", - oldAnnotations: map[string]string{ - helpers.CompletionMetadataKey: "partial", - helpers.StatusMetadataKey: "initializing", - }, - newAnnotations: map[string]string{ - helpers.CompletionMetadataKey: "partial", - helpers.StatusMetadataKey: "ready", - }, - expected: map[string]string{ - helpers.CompletionMetadataKey: "partial", - helpers.StatusMetadataKey: "ready", - }, - }, - { - name: "transition from partial (without status) to complete - accepted", - oldAnnotations: map[string]string{ - helpers.CompletionMetadataKey: "partial", - }, - newAnnotations: map[string]string{ - helpers.CompletionMetadataKey: "complete", - helpers.StatusMetadataKey: "ready", - }, - expected: map[string]string{ - helpers.CompletionMetadataKey: "complete", - helpers.StatusMetadataKey: "ready", - }, - }, - { - name: "transition from complete (without status) to partial - rejected", - oldAnnotations: map[string]string{ - helpers.CompletionMetadataKey: "complete", - }, - newAnnotations: map[string]string{ - helpers.CompletionMetadataKey: "partial", - helpers.StatusMetadataKey: "initializing", - }, - expected: map[string]string{ - helpers.CompletionMetadataKey: "complete", - }, - }, - { - name: "transition from a final AP - all changes are rejected", - oldAnnotations: map[string]string{ - helpers.CompletionMetadataKey: "complete", - helpers.StatusMetadataKey: "completed", - }, - newAnnotations: map[string]string{ - helpers.CompletionMetadataKey: "partial", - helpers.StatusMetadataKey: "initializing", - }, - expected: map[string]string{ - helpers.CompletionMetadataKey: "complete", - helpers.StatusMetadataKey: "completed", - }, - }, - } - - for _, tt := range tests { - t.Run(tt.name, func(t *testing.T) { - s := NetworkNeighborhoodStrategy{} - - obj := &softwarecomposition.NetworkNeighborhood{ObjectMeta: metav1.ObjectMeta{Annotations: tt.newAnnotations}} - old := &softwarecomposition.NetworkNeighborhood{ObjectMeta: metav1.ObjectMeta{Annotations: tt.oldAnnotations}} - - s.PrepareForUpdate(context.TODO(), obj, old) - assert.Equal(t, tt.expected, obj.Annotations) - }) - } -} - -func TestPrepareForUpdateFullObj(t *testing.T) { - tests := []struct { - name string - old *softwarecomposition.NetworkNeighborhood - new *softwarecomposition.NetworkNeighborhood - expected *softwarecomposition.NetworkNeighborhood - }{ - { - name: "transition from initializing to ready - changes are accepted", - old: &softwarecomposition.NetworkNeighborhood{ - ObjectMeta: metav1.ObjectMeta{ - Annotations: map[string]string{ - helpers.CompletionMetadataKey: "complete", - helpers.StatusMetadataKey: "initializing", - }, - }, - Spec: softwarecomposition.NetworkNeighborhoodSpec{ - Containers: []softwarecomposition.NetworkNeighborhoodContainer{ - { - Name: "container1", - Egress: []softwarecomposition.NetworkNeighbor{}, - Ingress: []softwarecomposition.NetworkNeighbor{ - { - IPAddress: "154.53.46.32", - Ports: []softwarecomposition.NetworkPort{ - { - Port: ptr.To(int32(80)), - Protocol: softwarecomposition.ProtocolTCP, - Name: "TCP-80", - }, - }, - }, - }, - }, - }, - }, - }, - new: &softwarecomposition.NetworkNeighborhood{ - ObjectMeta: metav1.ObjectMeta{ - Annotations: map[string]string{ - helpers.CompletionMetadataKey: "complete", - helpers.StatusMetadataKey: "ready", - }, - }, - Spec: softwarecomposition.NetworkNeighborhoodSpec{ - Containers: []softwarecomposition.NetworkNeighborhoodContainer{ - { - Name: "container1", - Egress: []softwarecomposition.NetworkNeighbor{}, - Ingress: []softwarecomposition.NetworkNeighbor{ - { - IPAddress: "154.53.46.32", - Ports: []softwarecomposition.NetworkPort{ - { - Port: ptr.To(int32(80)), - Protocol: softwarecomposition.ProtocolTCP, - Name: "TCP-80", - }, - }, - }, - }, - }, - { - Name: "container2", - Egress: []softwarecomposition.NetworkNeighbor{}, - Ingress: []softwarecomposition.NetworkNeighbor{ - { - IPAddress: "154.53.46.32", - Ports: []softwarecomposition.NetworkPort{ - { - Port: ptr.To(int32(80)), - Protocol: softwarecomposition.ProtocolTCP, - Name: "TCP-80", - }, - }, - }, - }, - }, - }, - }, - }, - expected: &softwarecomposition.NetworkNeighborhood{ - ObjectMeta: metav1.ObjectMeta{ - Annotations: map[string]string{ - helpers.CompletionMetadataKey: "complete", - helpers.StatusMetadataKey: "ready", - }, - }, - Spec: softwarecomposition.NetworkNeighborhoodSpec{ - Containers: []softwarecomposition.NetworkNeighborhoodContainer{ - { - Name: "container1", - Egress: []softwarecomposition.NetworkNeighbor{}, - Ingress: []softwarecomposition.NetworkNeighbor{ - { - IPAddress: "154.53.46.32", - Ports: []softwarecomposition.NetworkPort{ - { - Port: ptr.To(int32(80)), - Protocol: softwarecomposition.ProtocolTCP, - Name: "TCP-80", - }, - }, - }, - }, - }, - { - Name: "container2", - Egress: []softwarecomposition.NetworkNeighbor{}, - Ingress: []softwarecomposition.NetworkNeighbor{ - { - IPAddress: "154.53.46.32", - Ports: []softwarecomposition.NetworkPort{ - { - Port: ptr.To(int32(80)), - Protocol: softwarecomposition.ProtocolTCP, - Name: "TCP-80", - }, - }, - }, - }, - }, - }, - }, - }, - }, - { - name: "transition from a final AP - all changes are rejected", - old: &softwarecomposition.NetworkNeighborhood{ - ObjectMeta: metav1.ObjectMeta{ - Annotations: map[string]string{ - helpers.CompletionMetadataKey: "complete", - helpers.StatusMetadataKey: "completed", - }, - }, - Spec: softwarecomposition.NetworkNeighborhoodSpec{ - Containers: []softwarecomposition.NetworkNeighborhoodContainer{ - { - Name: "container1", - Egress: []softwarecomposition.NetworkNeighbor{}, - Ingress: []softwarecomposition.NetworkNeighbor{ - { - IPAddress: "154.53.46.32", - Ports: []softwarecomposition.NetworkPort{ - { - Port: ptr.To(int32(80)), - Protocol: softwarecomposition.ProtocolTCP, - Name: "TCP-80", - }, - }, - }, - }, - }, - }, - }, - }, - new: &softwarecomposition.NetworkNeighborhood{ - ObjectMeta: metav1.ObjectMeta{ - Annotations: map[string]string{ - helpers.CompletionMetadataKey: "partial", - helpers.StatusMetadataKey: "initializing", - }, - }, - Spec: softwarecomposition.NetworkNeighborhoodSpec{ - Containers: []softwarecomposition.NetworkNeighborhoodContainer{ - { - Name: "container1", - Egress: []softwarecomposition.NetworkNeighbor{}, - Ingress: []softwarecomposition.NetworkNeighbor{ - { - IPAddress: "154.53.46.32", - Ports: []softwarecomposition.NetworkPort{ - { - Port: ptr.To(int32(80)), - Protocol: softwarecomposition.ProtocolTCP, - Name: "TCP-80", - }, - }, - }, - }, - }, - { - Name: "container2", - Egress: []softwarecomposition.NetworkNeighbor{}, - Ingress: []softwarecomposition.NetworkNeighbor{ - { - IPAddress: "154.53.46.32", - Ports: []softwarecomposition.NetworkPort{ - { - Port: ptr.To(int32(80)), - Protocol: softwarecomposition.ProtocolTCP, - Name: "TCP-80", - }, - }, - }, - }, - }, - }, - }, - }, - expected: &softwarecomposition.NetworkNeighborhood{ - ObjectMeta: metav1.ObjectMeta{ - Annotations: map[string]string{ - helpers.CompletionMetadataKey: "complete", - helpers.StatusMetadataKey: "completed", - }, - }, - Spec: softwarecomposition.NetworkNeighborhoodSpec{ - Containers: []softwarecomposition.NetworkNeighborhoodContainer{ - { - Name: "container1", - Egress: []softwarecomposition.NetworkNeighbor{}, - Ingress: []softwarecomposition.NetworkNeighbor{ - { - IPAddress: "154.53.46.32", - Ports: []softwarecomposition.NetworkPort{ - { - Port: ptr.To(int32(80)), - Protocol: softwarecomposition.ProtocolTCP, - Name: "TCP-80", - }, - }, - }, - }, - }, - }, - }, - }, - }, - } - - for _, tt := range tests { - t.Run(tt.name, func(t *testing.T) { - s := NetworkNeighborhoodStrategy{} - s.PrepareForUpdate(context.TODO(), tt.new, tt.old) - assert.Equal(t, tt.expected, tt.new) - }) - } -} - -// TestValidate_NetworkProfileEntries pins the v0.0.2 admission contract: -// malformed IPAddresses[] / DNSNames[] entries cause Validate to return -// field errors that the apiserver translates into a 400 to the client. -// -// Runtime matchers tolerate malformed entries (silently skip), but -// admission rejects them so the next person reviewing the profile sees -// a clean document — and so the user gets fast feedback at write time. -func TestValidate_NetworkProfileEntries(t *testing.T) { - makeNN := func(neighbor softwarecomposition.NetworkNeighbor) *softwarecomposition.NetworkNeighborhood { - return &softwarecomposition.NetworkNeighborhood{ - ObjectMeta: metav1.ObjectMeta{ - Name: "test-nn", - Namespace: "default", - Annotations: map[string]string{helpers.CompletionMetadataKey: "complete", helpers.StatusMetadataKey: "ready"}, - }, - Spec: softwarecomposition.NetworkNeighborhoodSpec{ - Containers: []softwarecomposition.NetworkNeighborhoodContainer{ - {Name: "c", Egress: []softwarecomposition.NetworkNeighbor{neighbor}}, - }, - }, - } - } - - cases := []struct { - name string - neighbor softwarecomposition.NetworkNeighbor - // wantPaths is the multiset of expected error field paths. - // Asserting paths (not just count) pins the field-path contract - // — if validation starts emitting errors on the wrong field path, - // downstream tooling that surfaces these to users will break. - wantPaths []string - }{ - { - name: "all valid IPs and DNSNames", - neighbor: softwarecomposition.NetworkNeighbor{IPAddresses: []string{"10.0.0.0/8", "*", "1.2.3.4"}, DNSNames: []string{"*.example.com.", "api.partner.io."}}, - wantPaths: nil, - }, - { - name: "single malformed IP", - neighbor: softwarecomposition.NetworkNeighbor{IPAddresses: []string{"not-an-ip"}}, - wantPaths: []string{"spec.containers[0].egress[0].ipAddresses[0]"}, - }, - { - name: "single malformed CIDR", - neighbor: softwarecomposition.NetworkNeighbor{IPAddresses: []string{"10.0.0.0/40"}}, - wantPaths: []string{"spec.containers[0].egress[0].ipAddresses[0]"}, - }, - { - name: "recursive DNS wildcard rejected", - neighbor: softwarecomposition.NetworkNeighbor{DNSNames: []string{"**"}}, - wantPaths: []string{"spec.containers[0].egress[0].dnsNames[0]"}, - }, - { - name: "mid-position bare star rejected (must use ⋯)", - neighbor: softwarecomposition.NetworkNeighbor{DNSNames: []string{"foo.*.bar."}}, - wantPaths: []string{"spec.containers[0].egress[0].dnsNames[0]"}, - }, - { - name: "mixed: some good, some bad", - neighbor: softwarecomposition.NetworkNeighbor{IPAddresses: []string{"10.1.2.3", "garbage", "192.168.0.0/16"}, DNSNames: []string{"api.example.com.", "**", "*.example.com."}}, - wantPaths: []string{ - "spec.containers[0].egress[0].ipAddresses[1]", - "spec.containers[0].egress[0].dnsNames[1]", - }, - }, - { - name: "deprecated singular IPAddress malformed is also rejected", - neighbor: softwarecomposition.NetworkNeighbor{IPAddress: "not-an-ip"}, - wantPaths: []string{"spec.containers[0].egress[0].ipAddress"}, - }, - { - name: "deprecated singular DNS malformed is also rejected", - neighbor: softwarecomposition.NetworkNeighbor{DNS: "**"}, - wantPaths: []string{"spec.containers[0].egress[0].dns"}, - }, - } - - s := NetworkNeighborhoodStrategy{} - for _, tc := range cases { - t.Run(tc.name, func(t *testing.T) { - errs := s.Validate(context.TODO(), makeNN(tc.neighbor)) - if len(errs) != len(tc.wantPaths) { - t.Fatalf("Validate returned %d errors, want %d. errs: %v", len(errs), len(tc.wantPaths), errs) - } - gotPaths := make([]string, 0, len(errs)) - for _, e := range errs { - gotPaths = append(gotPaths, e.Field) - } - // Order-insensitive set comparison: build a multiset from each side. - gotSet := map[string]int{} - for _, p := range gotPaths { - gotSet[p]++ - } - wantSet := map[string]int{} - for _, p := range tc.wantPaths { - wantSet[p]++ - } - for p, n := range wantSet { - if gotSet[p] != n { - t.Errorf("expected %d errors at path %q, got %d (all paths: %v)", n, p, gotSet[p], gotPaths) - } - } - for p := range gotSet { - if _, ok := wantSet[p]; !ok { - t.Errorf("unexpected error at path %q (all paths: %v)", p, gotPaths) - } - } - }) - } -} - -// TestValidateUpdate_NetworkProfileEntries pins the same admission contract -// for the update path. CR (storage#30) caught that ValidateUpdate originally -// skipped network-profile validation, allowing malformed entries to land via -// PUT after a clean POST. -func TestValidateUpdate_NetworkProfileEntries(t *testing.T) { - bad := &softwarecomposition.NetworkNeighborhood{ - ObjectMeta: metav1.ObjectMeta{ - Name: "test-nn", - Namespace: "default", - Annotations: map[string]string{helpers.CompletionMetadataKey: "complete", helpers.StatusMetadataKey: "ready"}, - }, - Spec: softwarecomposition.NetworkNeighborhoodSpec{ - Containers: []softwarecomposition.NetworkNeighborhoodContainer{{ - Name: "c", - Egress: []softwarecomposition.NetworkNeighbor{ - {IPAddresses: []string{"not-an-ip"}, DNSNames: []string{"**"}}, - }, - }}, - }, - } - s := NetworkNeighborhoodStrategy{} - errs := s.ValidateUpdate(context.TODO(), bad, bad) - wantPaths := map[string]int{ - "spec.containers[0].egress[0].ipAddresses[0]": 1, - "spec.containers[0].egress[0].dnsNames[0]": 1, - } - if len(errs) != 2 { - t.Fatalf("ValidateUpdate returned %d errors, want 2. errs: %v", len(errs), errs) - } - gotSet := map[string]int{} - for _, e := range errs { - gotSet[e.Field]++ - } - for p, n := range wantPaths { - if gotSet[p] != n { - t.Errorf("expected %d errors at path %q, got %d (all: %v)", n, p, gotSet[p], errs) - } - } - for p := range gotSet { - if _, ok := wantPaths[p]; !ok { - t.Errorf("unexpected error at path %q (all: %v)", p, errs) - } - } -} From 9f687cdcee2daadbacc951700adcd8adda413c3b Mon Sep 17 00:00:00 2001 From: Entlein Date: Tue, 28 Jul 2026 18:31:43 +0200 Subject: [PATCH 03/17] fix: drop AP/NN queue defaults + cleanup handlers (finish CRD removal) The kindQueues default config still spun up applicationprofiles/networkneighborhoods queue workers, and the relevancy cleanup path still targeted applicationprofiles, after the CRDs were removed. Point them at containerprofiles. Signed-off-by: entlein --- pkg/config/config.go | 10 ---------- pkg/registry/file/cleanup.go | 5 +++-- 2 files changed, 3 insertions(+), 12 deletions(-) diff --git a/pkg/config/config.go b/pkg/config/config.go index 24c1df1f2..24e48c65a 100644 --- a/pkg/config/config.go +++ b/pkg/config/config.go @@ -65,21 +65,11 @@ func LoadConfig(path string) (Config, error) { v.SetDefault("queueTimeout", 60) v.SetDefault("queueProcessingStatsPrint", false) v.SetDefault("kindQueues", map[string]KindQueueConfig{ - "applicationprofiles": { - QueueLength: 50, - WorkerCount: 1, - MaxObjectSize: 20000000, - }, "containerprofiles": { QueueLength: 50, WorkerCount: 1, MaxObjectSize: 2500000, }, - "networkneighborhoods": { - QueueLength: 50, - WorkerCount: 1, - MaxObjectSize: 10000000, - }, "openvulnerabilityexchangecontainers": { QueueLength: 50, WorkerCount: 1, diff --git a/pkg/registry/file/cleanup.go b/pkg/registry/file/cleanup.go index 7c846b2eb..52f547a6b 100644 --- a/pkg/registry/file/cleanup.go +++ b/pkg/registry/file/cleanup.go @@ -69,10 +69,11 @@ func initResourceToKindHandler(relevancyEnabled bool) map[string][]TypeCleanupHa "workloadconfigurationscansummaries": {deleteByWlid}, } - // only if relevancy is enabled, we need to delete application profiles with missing instanceId or wlid annotations + // only if relevancy is enabled, delete container profiles with missing + // instanceId or wlid annotations. if relevancyEnabled { logger.L().Debug("relevancy is enabled, adding additional cleanup handlers") - resourceKindToHandler["applicationprofiles"] = append(resourceKindToHandler["applicationprofiles"], deleteMissingInstanceIdAnnotation, deleteMissingWlidAnnotation) + resourceKindToHandler["containerprofiles"] = append(resourceKindToHandler["containerprofiles"], deleteMissingInstanceIdAnnotation, deleteMissingWlidAnnotation) } return resourceKindToHandler } From 66746878825debc28a8e80869cb7cc0f10f6e0df Mon Sep 17 00:00:00 2001 From: Entlein Date: Tue, 28 Jul 2026 19:44:34 +0200 Subject: [PATCH 04/17] chore: finish AP/NN sweep (config field, migration tool, comments) Rename MaxApplicationProfileSize -> MaxContainerProfileSize; drop the ApplicationProfile decode path from cmd/migration; neutralize AP/NN comments and the dead gob type-name default. The intentional GNP ContainerProfile-> NetworkNeighborhood projection is retained. Signed-off-by: entlein --- cmd/migration/main.go | 72 +++++-------------- pkg/apis/softwarecomposition/types.go | 4 +- pkg/apis/softwarecomposition/v1beta1/types.go | 4 +- pkg/config/config.go | 4 +- pkg/config/config_test.go | 16 ++--- .../file/containerprofile_aggregator_test.go | 7 -- .../file/containerprofile_processor.go | 4 +- ...rofile_processor_collapse_provider_test.go | 12 ++-- .../file/dynamicpathdetector/types.go | 4 +- pkg/registry/file/storage.go | 12 ++-- .../collapseconfiguration/etcd.go | 2 +- 11 files changed, 48 insertions(+), 93 deletions(-) diff --git a/cmd/migration/main.go b/cmd/migration/main.go index 1b9584840..435f7f6c3 100644 --- a/cmd/migration/main.go +++ b/cmd/migration/main.go @@ -1,8 +1,8 @@ package main // migration is a standalone utility to decode legacy Gob data into JSON. -// It is used to handle breaking changes in the Gob format (e.g., transitioning -// fields from uint64 to int64) that cannot be handled by the main service +// It is used to handle breaking changes in the Gob format (e.g., transitioning +// fields from uint64 to int64) that cannot be handled by the main service // due to Go's global Gob type registration constraints. import ( @@ -42,38 +42,6 @@ type LegacyOpenCalls struct { Flags []string `json:"Flags"` } -type LegacyApplicationProfileContainer struct { - Name string `json:"Name"` - Capabilities []string `json:"Capabilities"` - Execs []LegacyExecCalls `json:"Execs"` - Opens []LegacyOpenCalls `json:"Opens"` - Syscalls []string `json:"Syscalls"` - SeccompProfile LegacySingleSeccompProfile `json:"SeccompProfile"` - Endpoints []softwarecomposition.HTTPEndpoint `json:"Endpoints"` - ImageID string `json:"ImageID"` - ImageTag string `json:"ImageTag"` - PolicyByRuleId map[string]softwarecomposition.RulePolicy `json:"PolicyByRuleId"` - IdentifiedCallStacks []softwarecomposition.IdentifiedCallStack `json:"IdentifiedCallStacks"` -} - -type LegacyApplicationProfileSpec struct { - Architectures []string `json:"Architectures,omitempty"` - Containers []LegacyApplicationProfileContainer `json:"Containers,omitempty"` - InitContainers []LegacyApplicationProfileContainer `json:"InitContainers,omitempty"` - EphemeralContainers []LegacyApplicationProfileContainer `json:"EphemeralContainers,omitempty"` -} - -type LegacyApplicationProfile struct { - metav1.TypeMeta `json:",inline"` - metav1.ObjectMeta `json:",inline"` - - // +k8s:conversion-gen=false - Parts map[string]string `json:"Parts,omitempty"` - // +k8s:conversion-gen=false - SchemaVersion int64 `json:"SchemaVersion,omitempty"` - Spec LegacyApplicationProfileSpec `json:"Spec,omitempty"` -} - type LegacySingleSeccompProfile struct { Name string `json:"Name"` Path string `json:"Path"` @@ -100,34 +68,34 @@ type LegacyContainerProfileSpec struct { ImageID string `json:"ImageID"` ImageTag string `json:"ImageTag"` PolicyByRuleId map[string]softwarecomposition.RulePolicy `json:"PolicyByRuleId"` - IdentifiedCallStacks []softwarecomposition.IdentifiedCallStack `json:"IdentifiedCallStacks"` + IdentifiedCallStacks []softwarecomposition.IdentifiedCallStack `json:"IdentifiedCallStacks"` metav1.LabelSelector `json:"LabelSelector"` - Ingress []LegacyNetworkNeighbor `json:"Ingress"` - Egress []LegacyNetworkNeighbor `json:"Egress"` + Ingress []LegacyNetworkNeighbor `json:"Ingress"` + Egress []LegacyNetworkNeighbor `json:"Egress"` } type LegacyContainerProfile struct { metav1.TypeMeta `json:",inline"` metav1.ObjectMeta `json:",inline"` - Spec LegacyContainerProfileSpec `json:"Spec,omitempty"` + Spec LegacyContainerProfileSpec `json:"Spec,omitempty"` Status softwarecomposition.ContainerProfileStatus `json:"Status,omitempty"` } type LegacyNetworkPort struct { Name string `json:"Name"` Protocol string `json:"Protocol"` - Port *int32 `json:"Port"` + Port *int32 `json:"Port"` } type LegacyNetworkNeighbor struct { - Identifier string `json:"Identifier"` - Type string `json:"Type"` - DNS string `json:"DNS"` - DNSNames []string `json:"DNSNames"` - Ports []LegacyNetworkPort `json:"Ports"` - PodSelector *metav1.LabelSelector `json:"PodSelector"` - NamespaceSelector *metav1.LabelSelector `json:"NamespaceSelector"` - IPAddress string `json:"IPAddress"` + Identifier string `json:"Identifier"` + Type string `json:"Type"` + DNS string `json:"DNS"` + DNSNames []string `json:"DNSNames"` + Ports []LegacyNetworkPort `json:"Ports"` + PodSelector *metav1.LabelSelector `json:"PodSelector"` + NamespaceSelector *metav1.LabelSelector `json:"NamespaceSelector"` + IPAddress string `json:"IPAddress"` } type LegacySeccompProfileSpec struct { @@ -139,17 +107,17 @@ type LegacySeccompProfileSpec struct { type LegacySeccompProfile struct { metav1.TypeMeta `json:",inline"` metav1.ObjectMeta `json:",inline"` - Spec LegacySeccompProfileSpec `json:"Spec,omitempty"` + Spec LegacySeccompProfileSpec `json:"Spec,omitempty"` Status softwarecomposition.SeccompProfileStatus `json:"Status,omitempty"` } func main() { filePath := flag.String("file", "", "Path to the gob file to decode") - typeName := flag.String("type", "ApplicationProfile", "Type to decode (ApplicationProfile, ContainerProfile, or SeccompProfile)") + typeName := flag.String("type", "ContainerProfile", "Type to decode (ContainerProfile or SeccompProfile)") flag.Parse() if *filePath == "" { - fmt.Fprintf(os.Stderr, "Usage: migration -file [-type ]\n") + fmt.Fprintf(os.Stderr, "Usage: migration -file [-type ]\n") os.Exit(1) } @@ -162,8 +130,6 @@ func main() { var result interface{} switch *typeName { - case "ApplicationProfile": - result = &LegacyApplicationProfile{} case "ContainerProfile": result = &LegacyContainerProfile{} case "SeccompProfile": @@ -176,7 +142,7 @@ func main() { // Important: We need to register types that might be in the gob stream // but are defined locally in this 'main' package to avoid name mismatches // although gob name matching is usually package-scoped. - // Since this is a separate binary, its 'main.LegacyApplicationProfile' + // Since this is a separate binary, its 'main.LegacyContainerProfile' // registration is isolated from the storage binary's registration. // Register common types that might be inside interface{} fields or nested structs diff --git a/pkg/apis/softwarecomposition/types.go b/pkg/apis/softwarecomposition/types.go index 73cb5b3bb..f93a31b3b 100644 --- a/pkg/apis/softwarecomposition/types.go +++ b/pkg/apis/softwarecomposition/types.go @@ -343,7 +343,7 @@ func (p *ContainerProfile) SetLearningStatus(ts TimeSeriesContainers) { } type ContainerProfileSpec struct { - // WARNING report fields from ApplicationProfileContainer here + // WARNING report the execution/profile fields here Architectures []string Capabilities []string Execs []ExecCalls @@ -355,7 +355,7 @@ type ContainerProfileSpec struct { ImageTag string PolicyByRuleId map[string]RulePolicy IdentifiedCallStacks []IdentifiedCallStack - // WARNING report fields from NetworkNeighborhoodContainer here + // WARNING report the network fields here metav1.LabelSelector // The labels which are inside spec.selector in the parent workload. Ingress []NetworkNeighbor Egress []NetworkNeighbor diff --git a/pkg/apis/softwarecomposition/v1beta1/types.go b/pkg/apis/softwarecomposition/v1beta1/types.go index c0535fcb8..0aff0a2b7 100644 --- a/pkg/apis/softwarecomposition/v1beta1/types.go +++ b/pkg/apis/softwarecomposition/v1beta1/types.go @@ -233,7 +233,7 @@ type ContainerProfile struct { } type ContainerProfileSpec struct { - // WARNING report fields from ApplicationProfileContainer here + // WARNING report the execution/profile fields here Architectures []string `json:"architectures" protobuf:"bytes,1,rep,name=architectures"` Capabilities []string `json:"capabilities" protobuf:"bytes,2,rep,name=capabilities"` // +patchMergeKey=path @@ -253,7 +253,7 @@ type ContainerProfileSpec struct { // +patchMergeKey=ruleId PolicyByRuleId map[string]RulePolicy `json:"rulePolicies" protobuf:"bytes,10,rep,name=rulePolicies" patchStrategy:"merge" patchMergeKey:"ruleId"` IdentifiedCallStacks []IdentifiedCallStack `json:"identifiedCallStacks" protobuf:"bytes,11,rep,name=identifiedCallStacks"` - // WARNING report fields from NetworkNeighborhoodContainer here, increment proto IDs by 100 + // WARNING report the network fields here, increment proto IDs by 100 metav1.LabelSelector `json:",inline" protobuf:"bytes,101,opt,name=labelSelector"` Ingress []NetworkNeighbor `json:"ingress" protobuf:"bytes,102,rep,name=ingress"` Egress []NetworkNeighbor `json:"egress" protobuf:"bytes,103,rep,name=egress"` diff --git a/pkg/config/config.go b/pkg/config/config.go index 24e48c65a..e557bc324 100644 --- a/pkg/config/config.go +++ b/pkg/config/config.go @@ -21,7 +21,7 @@ type Config struct { DisableVirtualCRDs bool `mapstructure:"disableVirtualCRDs"` DisableSeccompProfileEndpoint bool `mapstructure:"disableSeccompProfileEndpoint"` ExcludeJsonPaths []string `mapstructure:"excludeJsonPaths"` - MaxApplicationProfileSize int `mapstructure:"maxApplicationProfileSize"` + MaxContainerProfileSize int `mapstructure:"maxContainerProfileSize"` MaxSniffingTime time.Duration `mapstructure:"maxSniffingTimePerContainer"` RateLimitPerClient float64 `mapstructure:"rateLimitPerClient"` RateLimitTotal int `mapstructure:"rateLimitTotal"` @@ -53,7 +53,7 @@ func LoadConfig(path string) (Config, error) { v.SetDefault("cleanupInterval", 24*time.Hour) v.SetDefault("defaultNamespace", "kubescape") - v.SetDefault("maxApplicationProfileSize", 40000) + v.SetDefault("maxContainerProfileSize", 40000) v.SetDefault("rateLimitTotal", 10) v.SetDefault("serverBindAddress", "::") v.SetDefault("serverBindPort", 8443) diff --git a/pkg/config/config_test.go b/pkg/config/config_test.go index 44ab7b794..43b84f655 100644 --- a/pkg/config/config_test.go +++ b/pkg/config/config_test.go @@ -21,14 +21,14 @@ func TestLoadConfig(t *testing.T) { name: "TestLoadConfig", path: "../../configuration", want: Config{ - CleanupInterval: 24 * time.Hour, - DefaultNamespace: "kubescape", - HostType: armotypes.HostTypeKubernetes, - ExcludeJsonPaths: []string{".containers[*].env[?(@.name==\"KUBECONFIG\")]"}, - MaxApplicationProfileSize: 40000, - RateLimitTotal: 10, - ServerBindAddress: "::", - ServerBindPort: 8443, + CleanupInterval: 24 * time.Hour, + DefaultNamespace: "kubescape", + HostType: armotypes.HostTypeKubernetes, + ExcludeJsonPaths: []string{".containers[*].env[?(@.name==\"KUBECONFIG\")]"}, + MaxContainerProfileSize: 40000, + RateLimitTotal: 10, + ServerBindAddress: "::", + ServerBindPort: 8443, KindQueues: map[string]KindQueueConfig{ "applicationprofiles": { QueueLength: 50, diff --git a/pkg/registry/file/containerprofile_aggregator_test.go b/pkg/registry/file/containerprofile_aggregator_test.go index 27fe6a147..2f09b9f02 100644 --- a/pkg/registry/file/containerprofile_aggregator_test.go +++ b/pkg/registry/file/containerprofile_aggregator_test.go @@ -7,7 +7,6 @@ import ( "testing" "time" - "github.com/armosec/armoapi-go/armotypes" "github.com/kubescape/k8s-interface/instanceidhandler/v1/helpers" "github.com/kubescape/storage/pkg/apis/softwarecomposition" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" @@ -77,12 +76,6 @@ func (f *fakeStorage) GetMergedContainerProfile(ctx context.Context, observedKey func (f *fakeStorage) DeleteMergedContainerProfile(ctx context.Context, observedKey string) error { return nil } -func (f *fakeStorage) UpdateApplicationProfile(ctx context.Context, key, prefix, root string, id armotypes.ProfileIdentifier, slug, wlid string, instanceID interface{ GetStringNoContainer() string }, profile *softwarecomposition.ContainerProfile, creationTimestamp metav1.Time) error { - return nil -} -func (f *fakeStorage) UpdateNetworkNeighborhood(ctx context.Context, key, prefix, root string, id armotypes.ProfileIdentifier, slug, wlid string, instanceID interface{ GetStringNoContainer() string }, profile *softwarecomposition.ContainerProfile, creationTimestamp metav1.Time) error { - return nil -} func (f *fakeStorage) GetStorageImpl() *StorageImpl { return nil } diff --git a/pkg/registry/file/containerprofile_processor.go b/pkg/registry/file/containerprofile_processor.go index 3110acf33..a9f120478 100644 --- a/pkg/registry/file/containerprofile_processor.go +++ b/pkg/registry/file/containerprofile_processor.go @@ -73,7 +73,7 @@ func NewContainerProfileProcessor(cfg config.Config, cleanupHandler *ResourcesCl DeleteThreshold: 2 * cfg.MaxSniffingTime, HostType: hostType, Interval: 30 * time.Second, - MaxContainerProfileSize: cfg.MaxApplicationProfileSize, + MaxContainerProfileSize: cfg.MaxContainerProfileSize, CollapseSettings: dynamicpathdetector.DefaultCollapseSettings, Workers: max(1, DefaultPoolSize/4), } @@ -404,7 +404,7 @@ func (a *ContainerProfileProcessor) consolidateKeyTimeSeries(ctx context.Context } // sendConsolidatedSlugToChannel calculates the slug from the profile and sends it to the channel -// The slug is calculated for both ApplicationProfile and NetworkNeighborhood +// The slug is calculated from the ContainerProfile // Format: "namespace/name" to allow the ingester to extract both namespace and name func (a *ContainerProfileProcessor) sendConsolidatedSlugToChannel(ctx context.Context, profile softwarecomposition.ContainerProfile, id armotypes.ProfileIdentifier) error { if a.ConsolidatedSlugChannel == nil { diff --git a/pkg/registry/file/containerprofile_processor_collapse_provider_test.go b/pkg/registry/file/containerprofile_processor_collapse_provider_test.go index af0341876..e6014fd83 100644 --- a/pkg/registry/file/containerprofile_processor_collapse_provider_test.go +++ b/pkg/registry/file/containerprofile_processor_collapse_provider_test.go @@ -33,8 +33,8 @@ import ( // /etc thresholds shouldn't appear out of nowhere. func TestContainerProfileProcessor_CollapseSettings_NilProviderFallsBack(t *testing.T) { c := NewContainerProfileProcessor(config.Config{ - DefaultNamespace: "kubescape", - MaxApplicationProfileSize: 40000, + DefaultNamespace: "kubescape", + MaxContainerProfileSize: 40000, }, nil) // Force the field nil to simulate an external caller that bypassed the // constructor's defaulting. @@ -68,8 +68,8 @@ func TestContainerProfileProcessor_CollapseSettings_NilProviderFallsBack(t *test // flagged. func TestContainerProfileProcessor_CustomCollapseSettings_ReachDeflate(t *testing.T) { c := NewContainerProfileProcessor(config.Config{ - DefaultNamespace: "kubescape", - MaxApplicationProfileSize: 40000, + DefaultNamespace: "kubescape", + MaxContainerProfileSize: 40000, }, nil) spec := softwarecomposition.ContainerProfileSpec{} @@ -111,8 +111,8 @@ func TestContainerProfileProcessor_CustomCollapseSettings_ReachDeflate(t *testin // non-nil CollapseSettings provider that returns the compiled defaults. func TestContainerProfileProcessor_DefaultConstructorWiresProvider(t *testing.T) { c := NewContainerProfileProcessor(config.Config{ - DefaultNamespace: "kubescape", - MaxApplicationProfileSize: 40000, + DefaultNamespace: "kubescape", + MaxContainerProfileSize: 40000, }, nil) assert.NotNil(t, c.CollapseSettings, "constructor must wire a default provider") got := c.CollapseSettings() diff --git a/pkg/registry/file/dynamicpathdetector/types.go b/pkg/registry/file/dynamicpathdetector/types.go index 7489b943c..9cda07742 100644 --- a/pkg/registry/file/dynamicpathdetector/types.go +++ b/pkg/registry/file/dynamicpathdetector/types.go @@ -29,8 +29,8 @@ const ( // than the floor is split into floor-width children: up to 2^NetworkMaxCIDRSplitBits // blocks (4096 here). A prefix whose split would exceed that is kept as-is rather // than exploding the entry list. This bounds ONE block's fan-out (not the sum -// across a group — the whole neighborhood is separately capped by -// MaxNetworkNeighborhoodSize); it only bites when a held pass-through block is +// across a group — the whole set of network neighbors is separately capped by +// the container profile size limit); it only bites when a held pass-through block is // much broader than a tightened floor (e.g. a /16 under a /28 floor -> 4096 // children; a /16 under a /24 floor is only 256). Not currently exposed as a // CollapseConfiguration field. diff --git a/pkg/registry/file/storage.go b/pkg/registry/file/storage.go index e472bcb10..c1f3c856a 100644 --- a/pkg/registry/file/storage.go +++ b/pkg/registry/file/storage.go @@ -672,10 +672,8 @@ func (s *StorageImpl) migrateObject(ctx context.Context, conn *sqlite.Conn, path } } - typeName := "ApplicationProfile" - if _, ok := objPtr.(*softwarecomposition.ContainerProfile); ok { - typeName = "ContainerProfile" - } else if _, ok := objPtr.(*softwarecomposition.SeccompProfile); ok { + typeName := "ContainerProfile" + if _, ok := objPtr.(*softwarecomposition.SeccompProfile); ok { typeName = "SeccompProfile" } @@ -1186,10 +1184,8 @@ func (s *StorageImpl) appendGobObjectFromFile(ctx context.Context, path string, } } - typeName := "ApplicationProfile" - if _, ok := obj.(*softwarecomposition.ContainerProfile); ok { - typeName = "ContainerProfile" - } else if _, ok := obj.(*softwarecomposition.SeccompProfile); ok { + typeName := "ContainerProfile" + if _, ok := obj.(*softwarecomposition.SeccompProfile); ok { typeName = "SeccompProfile" } diff --git a/pkg/registry/softwarecomposition/collapseconfiguration/etcd.go b/pkg/registry/softwarecomposition/collapseconfiguration/etcd.go index 77fc01934..4cd32cfa1 100644 --- a/pkg/registry/softwarecomposition/collapseconfiguration/etcd.go +++ b/pkg/registry/softwarecomposition/collapseconfiguration/etcd.go @@ -29,7 +29,7 @@ import ( // NewREST returns a RESTStorage object that exposes CollapseConfiguration // resources. The CRD is cluster-scoped (NamespaceScoped() == false in // strategy.go) and is normally read by the storage server's deflate path -// at deflateApplicationProfileContainer / DeflateContainerProfileSpec time. +// at DeflateContainerProfileSpec time. func NewREST(scheme *runtime.Scheme, storageImpl storage.Interface, optsGetter generic.RESTOptionsGetter) (*registry.REST, error) { strategy := NewStrategy(scheme) From 2182ae5d26ef5f0bcf186770c763aa200d2c3ee1 Mon Sep 17 00:00:00 2001 From: Entlein Date: Wed, 29 Jul 2026 09:02:50 +0200 Subject: [PATCH 05/17] Remove ug- user-managed ContainerProfile merge The ug- user-managed merge (an additive overlay unioned onto the learned/observed ContainerProfile and republished as a derived merged profile) has no consumers. Remove the merge engine (buildMergedProfile/mergeUserCPIntoCP), the merged-first REST wrapper, the per-tick merged refresh + merged-CP GC, and the Save/Get/Delete Merged storage-interface methods and their wiring. The observed/learned ContainerProfile and the user-defined authoritative ContainerProfile remain the only profile mechanisms. Signed-off-by: entlein --- pkg/apiserver/apiserver.go | 2 +- .../file/containerprofile_aggregator_test.go | 10 - .../file/containerprofile_processor.go | 61 +- .../file/containerprofile_rest_storage.go | 152 -- pkg/registry/file/containerprofile_storage.go | 99 +- .../containerprofile_storage_interface.go | 17 - .../file/containerprofile_user_managed.go | 384 ------ .../containerprofile_user_managed_test.go | 1218 ----------------- 8 files changed, 4 insertions(+), 1939 deletions(-) delete mode 100644 pkg/registry/file/containerprofile_rest_storage.go delete mode 100644 pkg/registry/file/containerprofile_user_managed.go delete mode 100644 pkg/registry/file/containerprofile_user_managed_test.go diff --git a/pkg/apiserver/apiserver.go b/pkg/apiserver/apiserver.go index f4719f322..9233f008f 100644 --- a/pkg/apiserver/apiserver.go +++ b/pkg/apiserver/apiserver.go @@ -147,7 +147,7 @@ func (c completedConfig) New() (*WardleServer, error) { var ( storageImpl = file.NewStorageImpl(c.ExtraConfig.OsFs, file.DefaultStorageRoot, c.ExtraConfig.Pool, c.ExtraConfig.WatchDispatcher, Scheme) - containerProfileStorageImpl = file.NewContainerProfileRESTStorage(file.NewStorageImplWithCollector(c.ExtraConfig.OsFs, file.DefaultStorageRoot, c.ExtraConfig.Pool, c.ExtraConfig.WatchDispatcher, Scheme, containerProfileProcessor)) + containerProfileStorageImpl = file.NewStorageImplWithCollector(c.ExtraConfig.OsFs, file.DefaultStorageRoot, c.ExtraConfig.Pool, c.ExtraConfig.WatchDispatcher, Scheme, containerProfileProcessor) configScanStorageImpl = file.NewConfigurationScanSummaryStorage(storageImpl) vulnerabilitySummaryStorage = file.NewVulnerabilitySummaryStorage(storageImpl) generatedNetworkPolicyStorage = file.NewGeneratedNetworkPolicyStorage(storageImpl) diff --git a/pkg/registry/file/containerprofile_aggregator_test.go b/pkg/registry/file/containerprofile_aggregator_test.go index 2f09b9f02..1ee91d0c0 100644 --- a/pkg/registry/file/containerprofile_aggregator_test.go +++ b/pkg/registry/file/containerprofile_aggregator_test.go @@ -10,7 +10,6 @@ import ( "github.com/kubescape/k8s-interface/instanceidhandler/v1/helpers" "github.com/kubescape/storage/pkg/apis/softwarecomposition" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" - "k8s.io/apiserver/pkg/storage" ) // fakeStorage implements ContainerProfileStorage with minimal behavior for tests. @@ -67,15 +66,6 @@ func (f *fakeStorage) GetTsContainerProfile(ctx context.Context, key string) (so func (f *fakeStorage) SaveContainerProfile(ctx context.Context, key string, profile *softwarecomposition.ContainerProfile) error { return nil } -func (f *fakeStorage) SaveMergedContainerProfile(ctx context.Context, observedKey string, profile *softwarecomposition.ContainerProfile) error { - return nil -} -func (f *fakeStorage) GetMergedContainerProfile(ctx context.Context, observedKey string) (softwarecomposition.ContainerProfile, error) { - return softwarecomposition.ContainerProfile{}, storage.NewKeyNotFoundError(observedKey, 0) -} -func (f *fakeStorage) DeleteMergedContainerProfile(ctx context.Context, observedKey string) error { - return nil -} func (f *fakeStorage) GetStorageImpl() *StorageImpl { return nil } diff --git a/pkg/registry/file/containerprofile_processor.go b/pkg/registry/file/containerprofile_processor.go index a9f120478..dd9349e99 100644 --- a/pkg/registry/file/containerprofile_processor.go +++ b/pkg/registry/file/containerprofile_processor.go @@ -264,11 +264,6 @@ func (a *ContainerProfileProcessor) cleanup() error { a.LastCleanup = time.Now() resourceToKindHandler := map[string][]TypeCleanupHandlerFunc{ "containerprofiles": {deleteByTemplateHashOrWlid}, - // The merged (effective) CP carries the same templateHash/wlid metadata - // as its observed sibling, so the same predicate retires orphans. This - // covers workloads that get age-cleaned without going through the REST - // Delete path (which already cascades to the merged sibling). - ContainerProfileMergedKind: {deleteByTemplateHashOrWlid}, } return a.CleanupHandler.CleanupTask(context.TODO(), resourceToKindHandler) } @@ -536,14 +531,14 @@ func (a *ContainerProfileProcessor) updateProfile(ctx context.Context, timeSerie if _, ok := profile.Annotations[helpers.InstanceIDMetadataKey]; !ok { // Without an InstanceID annotation we cannot derive the workload slug, - // so neither the observed save nor the merged refresh have a target. + // so the observed save has no target. logger.L().Debug("ContainerProfileProcessor.updateProfile - skip saving invalid profile", loggerhelpers.String("key", key), loggerhelpers.Interface("profile", profile)) return processed, nil } // Persist the canonical observed CP only when time-series consolidation // produced new data this tick. The observed CP is the time-series-only - // view (kubescape/storage#315 review). It is never mutated by the ug- merge. + // view (kubescape/storage#315 review). if newData { if profile.CreationTimestamp.IsZero() { profile.CreationTimestamp = creationTimestamp @@ -555,61 +550,9 @@ func (a *ContainerProfileProcessor) updateProfile(ctx context.Context, timeSerie logger.L().Debug("ContainerProfileProcessor.updateProfile - no new data, observed CP unchanged", loggerhelpers.String("key", key)) } - // Refresh the merged (effective) CP every tick, even when !newData. This - // is what propagates user-managed (ug-) edits and deletes to idle or - // Completed workloads — the previous design short-circuited here and - // stranded the merged artifact. refreshMergedProfile rebuilds from scratch - // from (observed, ug-AP, ug-NN), so retractions land naturally. - if _, err := a.refreshMergedProfile(ctx, &profile, id, key); err != nil { - // Refresh failures are surfaced so the transaction rolls back; a half- - // applied merged write paired with a successful observed save would be - // worse than retrying the whole tick. - return nil, err - } - return processed, nil } -// refreshMergedProfile rebuilds the merged (effective) ContainerProfile from -// the observed CP plus the live user-managed (ug-) AP/NN overlay, and -// reconciles the persisted merged artifact with the result: -// -// - If at least one ug- input exists: write the freshly merged CP to the -// parallel containerprofile-merged key. -// - If no ug- input exists: delete the parallel key so consumers fall back -// to the observed CP. This is the retraction path that the previous -// in-place merge could not implement. -// -// Returns the "effective" CP — the merged one when ug- contributed, otherwise -// the observed CP itself. Callers pass this to downstream derivations -// (aggregated AP/NN) so all consumers see the same view node-agent will read. -func (a *ContainerProfileProcessor) refreshMergedProfile(ctx context.Context, observed *softwarecomposition.ContainerProfile, id armotypes.ProfileIdentifier, observedKey string) (*softwarecomposition.ContainerProfile, error) { - merged, hasOverlay, err := a.buildMergedProfile(ctx, observed, id) - if err != nil { - return observed, err - } - - if !hasOverlay { - // No ug- input. Delete any prior merged artifact so consumers fall back - // to observed. DeleteMergedContainerProfile is idempotent (it does a - // lock-free existence probe and treats not-found as success), so the - // common no-merged-yet path is quiet — no error log and no futile - // delete — without a separate existence probe here. A genuine delete - // failure is surfaced as a hard error so the tick rolls back and retries - // rather than leaving consumers reading a merged view the ug- overlay no - // longer backs. - if delErr := a.ContainerProfileStorage.DeleteMergedContainerProfile(ctx, observedKey); delErr != nil { - return observed, fmt.Errorf("failed to delete stale merged container profile: %w", delErr) - } - return observed, nil - } - - if saveErr := a.ContainerProfileStorage.SaveMergedContainerProfile(ctx, observedKey, merged); saveErr != nil { - return observed, fmt.Errorf("failed to save merged container profile: %w", saveErr) - } - return merged, nil -} - // timeSeriesProcessResult holds the results of processing a time series type timeSeriesProcessResult struct { processed []string diff --git a/pkg/registry/file/containerprofile_rest_storage.go b/pkg/registry/file/containerprofile_rest_storage.go deleted file mode 100644 index d58e5e1df..000000000 --- a/pkg/registry/file/containerprofile_rest_storage.go +++ /dev/null @@ -1,152 +0,0 @@ -package file - -import ( - "context" - "fmt" - - "github.com/kubescape/storage/pkg/apis/softwarecomposition" - "k8s.io/apimachinery/pkg/runtime" - "k8s.io/apimachinery/pkg/watch" - "k8s.io/apiserver/pkg/storage" -) - -// ContainerProfileRESTStorage wraps the generic file-backed storage with a -// merged-first read path for ContainerProfile. The consolidator continues to -// read and write the canonical observed CP through the lower-level -// ContainerProfileStorage interface; this wrapper only changes what apiserver -// consumers (notably node-agent) see when they GET a ContainerProfile. -// -// Read path: -// 1. Try the parallel containerprofile-merged key first. If a merged artifact -// exists, return it — it already embeds observed + ug- overlay. -// 2. On not-found, fall back to the canonical containerprofile key (the -// observed CP). This keeps the GET contract stable for workloads with no -// ug- AP/NN. -// -// Writes / List / Watch / Delete / GuaranteedUpdate pass straight through to -// the canonical key. The merged artifact is exclusively maintained by the -// consolidator (refreshMergedProfile), never by REST clients. -type ContainerProfileRESTStorage struct { - realStore StorageQuerier -} - -var _ storage.Interface = (*ContainerProfileRESTStorage)(nil) - -// NewContainerProfileRESTStorage wraps realStore with merged-first Get -// semantics for ContainerProfile resources. -func NewContainerProfileRESTStorage(realStore StorageQuerier) storage.Interface { - return &ContainerProfileRESTStorage{realStore: realStore} -} - -func (c ContainerProfileRESTStorage) EnableResourceSizeEstimation(keysFunc storage.KeysFunc) error { - return nil -} - -func (c ContainerProfileRESTStorage) Versioner() storage.Versioner { - return c.realStore.Versioner() -} - -func (c ContainerProfileRESTStorage) Create(ctx context.Context, key string, obj, out runtime.Object, ttl uint64) error { - return c.realStore.Create(ctx, key, obj, out, ttl) -} - -func (c ContainerProfileRESTStorage) Delete(ctx context.Context, key string, out runtime.Object, preconditions *storage.Preconditions, validateDeletion storage.ValidateObjectFunc, cachedExistingObject runtime.Object, opts storage.DeleteOptions) error { - // Delete the merged sibling first so a deleted CP doesn't leave a stale - // merged artifact that the next GET would surface. A not-found here is - // expected (most CPs have no ug- overlay, hence no merged sibling), but any - // other failure is surfaced as a hard error: swallowing it would orphan the - // merged artifact and let the merged-first read path keep serving a profile - // whose observed sibling is gone. The caller (apiserver) retries the delete. - if _, ok := out.(*softwarecomposition.ContainerProfile); ok { - mergedKey := MergedKeyFor(key) - if mergedKey != key { - if err := c.realStore.Delete(ctx, mergedKey, &softwarecomposition.ContainerProfile{}, nil, storage.ValidateAllObjectFunc, nil, storage.DeleteOptions{}); err != nil && !storage.IsNotFound(err) { - return fmt.Errorf("delete merged container profile sibling: %w", err) - } - } - } - return c.realStore.Delete(ctx, key, out, preconditions, validateDeletion, cachedExistingObject, opts) -} - -func (c ContainerProfileRESTStorage) Watch(ctx context.Context, key string, opts storage.ListOptions) (watch.Interface, error) { - return c.realStore.Watch(ctx, key, opts) -} - -func (c ContainerProfileRESTStorage) Get(ctx context.Context, key string, opts storage.GetOptions, objPtr runtime.Object) error { - if _, ok := objPtr.(*softwarecomposition.ContainerProfile); !ok { - // Defensive: this wrapper is registered for ContainerProfile only, but - // don't surprise an unexpected caller with a kind-segment rewrite. - return c.realStore.Get(ctx, key, opts, objPtr) - } - mergedKey := MergedKeyFor(key) - if mergedKey != key { - err := c.realStore.Get(ctx, mergedKey, opts, objPtr) - if err == nil { - return nil - } - if !storage.IsNotFound(err) { - // Surface unexpected errors (lock timeouts, decode failures) rather - // than silently falling back — a hard failure on the merged read - // likely means storage is unhealthy, and serving observed instead - // could mask the issue from clients. - return err - } - // merged not found, fall through to observed - if err := runtime.SetZeroValue(objPtr); err != nil { - return fmt.Errorf("reset object before observed fallback: %w", err) - } - } - return c.realStore.Get(ctx, key, opts, objPtr) -} - -func (c ContainerProfileRESTStorage) GetList(ctx context.Context, key string, opts storage.ListOptions, listObj runtime.Object) error { - // Listing currently returns the canonical observed CPs. Consumers that - // need the merged view will call Get per-item, which this wrapper handles. - // Scoping List to merged-first would require interleaving two kinds and - // reconciling per-item; the maintainer's review explicitly asked for the - // read-path fallback (step 4), not list rewriting. - return c.realStore.GetList(ctx, key, opts, listObj) -} - -func (c ContainerProfileRESTStorage) GuaranteedUpdate(ctx context.Context, key string, destination runtime.Object, ignoreNotFound bool, preconditions *storage.Preconditions, tryUpdate storage.UpdateFunc, cachedExistingObject runtime.Object) error { - return c.realStore.GuaranteedUpdate(ctx, key, destination, ignoreNotFound, preconditions, tryUpdate, cachedExistingObject) -} - -func (c ContainerProfileRESTStorage) ReadinessCheck() error { - return c.realStore.ReadinessCheck() -} - -func (c ContainerProfileRESTStorage) RequestWatchProgress(ctx context.Context) error { - return c.realStore.RequestWatchProgress(ctx) -} - -func (c ContainerProfileRESTStorage) GetCurrentResourceVersion(ctx context.Context) (uint64, error) { - if rv, ok := any(c.realStore).(interface { - GetCurrentResourceVersion(context.Context) (uint64, error) - }); ok { - return rv.GetCurrentResourceVersion(ctx) - } - return 0, nil -} - -func (c ContainerProfileRESTStorage) Stats(ctx context.Context) (storage.Stats, error) { - if s, ok := any(c.realStore).(interface { - Stats(context.Context) (storage.Stats, error) - }); ok { - return s.Stats(ctx) - } - return storage.Stats{}, fmt.Errorf("unimplemented") -} - -func (c ContainerProfileRESTStorage) SetKeysFunc(f storage.KeysFunc) { - if k, ok := any(c.realStore).(interface{ SetKeysFunc(storage.KeysFunc) }); ok { - k.SetKeysFunc(f) - } -} - -func (c ContainerProfileRESTStorage) CompactRevision() int64 { - if r, ok := any(c.realStore).(interface{ CompactRevision() int64 }); ok { - return r.CompactRevision() - } - return 0 -} diff --git a/pkg/registry/file/containerprofile_storage.go b/pkg/registry/file/containerprofile_storage.go index 777ac3ca3..253147928 100644 --- a/pkg/registry/file/containerprofile_storage.go +++ b/pkg/registry/file/containerprofile_storage.go @@ -2,12 +2,9 @@ package file import ( "context" - "errors" "fmt" - "strings" "time" - "github.com/kubescape/k8s-interface/instanceidhandler/v1/helpers" "github.com/kubescape/storage/pkg/apis/softwarecomposition" "k8s.io/apimachinery/pkg/runtime" "k8s.io/apiserver/pkg/storage" @@ -17,27 +14,12 @@ import ( ) // Storage kinds for container profile artifacts. ContainerProfileKind is the -// canonical observed CP produced by time-series consolidation. MergedKind is -// the derived "effective" CP — observed plus the user-managed ug- AP/NN -// overlay — written under a parallel key so consumers can prefer it without -// the consolidator ever reading it back. The split exists to preserve a -// canonical observed CP that retracts cleanly when a user edits or deletes -// a ug- CRD (kubescape/storage#315 review). +// canonical observed CP produced by time-series consolidation. const ( ContainerProfileKind = "containerprofile" ContainerProfileKindPlural = "containerprofiles" - ContainerProfileMergedKind = "containerprofile-merged" ) -// MergedKeyFor returns the merged-CP storage key corresponding to an -// observed-CP key. Replaces the kind segment "/containerprofile/" with -// "/containerprofile-merged/". The path layout from K8sKeysToPath / ECSKeysToPath -// / HostKeysToPath always places kind at the same segment, so a single replace -// is correct for every host type. -func MergedKeyFor(observedKey string) string { - return strings.Replace(observedKey, "/"+ContainerProfileKind+"/", "/"+ContainerProfileMergedKind+"/", 1) -} - // ContainerProfileStorageImpl implements ContainerProfileStorage using SQLite as the backend. type ContainerProfileStorageImpl struct { storageImpl *StorageImpl @@ -148,85 +130,6 @@ func (c *ContainerProfileStorageImpl) SaveContainerProfile(ctx context.Context, return nil } -func (c *ContainerProfileStorageImpl) SaveMergedContainerProfile(ctx context.Context, observedKey string, profile *softwarecomposition.ContainerProfile) error { - conn := ctx.Value(connKey).(*sqlite.Conn) - mergedKey := MergedKeyFor(observedKey) - - tryUpdate := func(input runtime.Object, res storage.ResponseMeta) (runtime.Object, *uint64, error) { - // The merged CP is rebuilt from observed.DeepCopy() every tick, so it - // carries the *observed* CP's identity (ResourceVersion, SyncChecksum, - // UID, creationTimestamp) rather than this merged key's own. Left as-is - // that mismatch makes GuaranteedUpdate's "same serialized contents" - // short-circuit miss every time, rewriting the merged CP — and firing a - // watch event to node-agent — on every consolidation tick even when the - // merged content is unchanged. Carry the persisted merged object's - // identity forward so an unchanged rebuild compares equal and the write - // is skipped (kubescape/storage#315 review). - out := profile.DeepCopy() - if existing, ok := input.(*softwarecomposition.ContainerProfile); ok && existing.ResourceVersion != "" { - out.ResourceVersion = existing.ResourceVersion - out.UID = existing.UID - out.CreationTimestamp = existing.CreationTimestamp - if cs, set := existing.Annotations[helpers.SyncChecksumMetadataKey]; set { - if out.Annotations == nil { - out.Annotations = map[string]string{} - } - // Align with the persisted checksum for the equality probe only. - // If content actually changed the probe fails and saveObject - // recomputes the real checksum, so this never persists a stale one. - out.Annotations[helpers.SyncChecksumMetadataKey] = cs - } - } - return out, nil, nil - } - - cpCtx, cpCancel := context.WithTimeout(ctx, 5*time.Second) - defer cpCancel() - - // cachedExistingObject is deliberately nil: a non-nil value (even an empty - // one) tells GuaranteedUpdate to treat it as the current state and skip the - // read-from-disk, which would make tryUpdate's `input` always empty and the - // no-op short-circuit never fire. We need the real persisted merged object - // here so an unchanged rebuild is recognised and the write is skipped. - if err := c.storageImpl.GuaranteedUpdateWithConn(cpCtx, conn, mergedKey, &softwarecomposition.ContainerProfile{}, - true, nil, tryUpdate, nil, ""); err != nil { - return fmt.Errorf("failed to update merged container profile: %w", err) - } - return nil -} - -func (c *ContainerProfileStorageImpl) GetMergedContainerProfile(ctx context.Context, observedKey string) (softwarecomposition.ContainerProfile, error) { - conn := ctx.Value(connKey).(*sqlite.Conn) - profile := softwarecomposition.ContainerProfile{} - err := c.storageImpl.GetWithConn(ctx, conn, MergedKeyFor(observedKey), storage.GetOptions{}, &profile) - return profile, err -} - -func (c *ContainerProfileStorageImpl) DeleteMergedContainerProfile(ctx context.Context, observedKey string) error { - conn := ctx.Value(connKey).(*sqlite.Conn) - mergedKey := MergedKeyFor(observedKey) - - // Lock-free existence probe (ReadMetadata takes no key lock) purely to stay - // quiet on the common no-merged case — every workload's early ticks before a - // ug- overlay exists. StorageImpl.delete logs at Error level for a missing - // key, so we only attempt the delete when the merged artifact actually - // exists; this removes the need for the caller's separate locked - // GetMergedContainerProfile probe (the "extra lock") without re-introducing - // the error-log spam. - if _, err := ReadMetadata(conn, mergedKey); err != nil { - if errors.Is(err, ErrMetadataNotFound) { - return nil // nothing to retract — idempotent - } - return fmt.Errorf("probe merged container profile for deletion: %w", err) - } - - // The delete itself goes through DeleteWithConn so it stays synchronized - // (write-locked) with concurrent Get/Save on the same key, consistent with - // GetMergedContainerProfile/SaveMergedContainerProfile — an unsynchronized - // delete risks SQLite busy / lock contention (kubescape/storage#315 review). - return c.storageImpl.DeleteWithConn(ctx, conn, mergedKey, &softwarecomposition.ContainerProfile{}, nil, nil, nil, storage.DeleteOptions{}) -} - // Time Series Operations func (c *ContainerProfileStorageImpl) ListTimeSeriesExpired(ctx context.Context, threshold time.Duration) ([]string, error) { diff --git a/pkg/registry/file/containerprofile_storage_interface.go b/pkg/registry/file/containerprofile_storage_interface.go index 626072758..96efd7adc 100644 --- a/pkg/registry/file/containerprofile_storage_interface.go +++ b/pkg/registry/file/containerprofile_storage_interface.go @@ -56,23 +56,6 @@ type ContainerProfileStorage interface { // SaveContainerProfile creates or updates a container profile. SaveContainerProfile(ctx context.Context, key string, profile *softwarecomposition.ContainerProfile) error - - // SaveMergedContainerProfile creates or updates the merged (effective) container - // profile derived from the observed CP plus the user-managed ug- AP/NN overlay. - // observedKey is the canonical containerprofile key; the merged artifact is - // stored under a parallel key (kind: containerprofile-merged) and consumers - // read it preferentially via the REST wrapper. - SaveMergedContainerProfile(ctx context.Context, observedKey string, profile *softwarecomposition.ContainerProfile) error - - // GetMergedContainerProfile retrieves the merged container profile that - // corresponds to observedKey. Returns storage.ErrCodeKeyNotFound when no - // merged artifact exists (the consumer-side fallback is to read the - // observed CP at observedKey). - GetMergedContainerProfile(ctx context.Context, observedKey string) (softwarecomposition.ContainerProfile, error) - - // DeleteMergedContainerProfile removes the merged container profile that - // corresponds to observedKey. Idempotent: not-found is not an error. - DeleteMergedContainerProfile(ctx context.Context, observedKey string) error } // TransactionManager handles database connection and transaction lifecycle. diff --git a/pkg/registry/file/containerprofile_user_managed.go b/pkg/registry/file/containerprofile_user_managed.go deleted file mode 100644 index 4f91d8f88..000000000 --- a/pkg/registry/file/containerprofile_user_managed.go +++ /dev/null @@ -1,384 +0,0 @@ -package file - -import ( - "context" - "sort" - "strings" - "sync" - "time" - - "github.com/armosec/armoapi-go/armotypes" - mapset "github.com/deckarep/golang-set/v2" - "github.com/kubescape/go-logger" - loggerhelpers "github.com/kubescape/go-logger/helpers" - instanceidhandlerv1 "github.com/kubescape/k8s-interface/instanceidhandler/v1" - "github.com/kubescape/k8s-interface/instanceidhandler/v1/helpers" - "github.com/kubescape/storage/pkg/apis/softwarecomposition" - metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" - "k8s.io/apiserver/pkg/storage" - "zombiezen.com/go/sqlite" -) - -// Provenance metadata stamped onto the merged (effective) ContainerProfile so -// it is easy to identify and debug. The label is for cheap filtering; the -// annotations carry the richer source-pointer detail (keys + ResourceVersions -// of the ug- AP/NN and the observed CP that fed this merge). -const ( - // MergedProfileLabelKey marks an object as the derived merged CP, distinct - // from the canonical observed CP that lives under the containerprofile kind. - MergedProfileLabelKey = "kubescape.io/profile-kind" - MergedProfileLabelValue = "merged" - - // mergedSourceUserCPKey records the storage key of the ug- ContainerProfile - // that contributed to this merge. Absent annotation means no ug- CP was - // present at merge time. - mergedSourceUserCPKey = "kubescape.io/merged-source-ug-cp" - - // mergedSourceUserCPRVKey / mergedSourceObservedRVKey snapshot the - // ResourceVersions of each input. They give a quick signal when debugging - // "is this merged stale vs the live ug- / observed?" without re-reading the - // source objects. - // - // These RVs are deliberately content-derived (they only change when an input - // actually changes), so re-merging unchanged inputs reproduces the exact same - // annotations. We intentionally do NOT stamp a wall-clock "merged-at" here: a - // per-tick timestamp would make every rebuild differ, defeating the - // GuaranteedUpdate no-op short-circuit and churning the merged CP's - // ResourceVersion (and firing spurious watch events) every consolidation tick - // even when nothing changed (kubescape/storage#315 review). - mergedSourceUserCPRVKey = "kubescape.io/merged-source-ug-cp-rv" - - mergedSourceObservedRVKey = "kubescape.io/merged-source-observed-rv" -) - -// userManagedConnWarnOnce makes the type-assert miss in userManagedConn surface -// loudly the first time it happens in a process — silent no-ops are fine in -// tests using a stub backend, but in production they would mask a config bug. -var userManagedConnWarnOnce sync.Once - -// buildMergedProfile builds the effective ContainerProfile from observed plus -// the user-managed (ug-) ContainerProfile overlay. -// -// Returns (merged, hasOverlay, err): -// - merged: a fresh DeepCopy of observed with the ug- ContainerProfile merged -// in, stamped with provenance metadata. Never aliases observed. -// - hasOverlay: true if a ug- ContainerProfile matched the workload and was -// merged in. When false, the caller treats the merged artifact as absent and -// should delete any prior merged on disk so ug- removals retract cleanly -// (kubescape/storage#315 review). -// - err: only returned for unexpected storage errors. NotFound on the ug- -// object is normal (most workloads have no exception) and produces -// hasOverlay=false with no error. -// -// The merge is a pure function of (observed, ug-CP). Re-running it with the same -// inputs produces the same output, so idempotency is structural — no per-tick RV -// markers are needed on observed (the previous PR design carried -// kubescape.io/last-merged-ug-*-rv on observed, which had to be reconciled with -// retractions; rebuilding from scratch sidesteps the problem). -func (a *ContainerProfileProcessor) buildMergedProfile(ctx context.Context, observed *softwarecomposition.ContainerProfile, id armotypes.ProfileIdentifier) (*softwarecomposition.ContainerProfile, bool, error) { - instanceIDStr, ok := observed.Annotations[helpers.InstanceIDMetadataKey] - if !ok { - return nil, false, nil - } - instanceID, err := instanceidhandlerv1.GenerateInstanceIDFromString(instanceIDStr) - if err != nil { - logger.L().Debug("ContainerProfileProcessor.buildMergedProfile - failed to parse instance ID", loggerhelpers.Error(err)) - return nil, false, nil - } - workloadSlug, err := instanceID.GetSlug(true) - if err != nil { - logger.L().Debug("ContainerProfileProcessor.buildMergedProfile - failed to derive workload slug", loggerhelpers.Error(err)) - return nil, false, nil - } - containerName := instanceID.GetContainerName() - if containerName == "" { - return nil, false, nil - } - - storageImpl, conn, ok := a.userManagedConn(ctx) - if !ok { - return nil, false, nil - } - - // The ug- overlay is a single ContainerProfile keyed by the shared "ug-" - // prefix. A ContainerProfile spec is already flat/single-container, so there - // is no per-container lookup. - cpID := id - cpID.Name = helpers.UserApplicationProfilePrefix + workloadSlug - cpKey := BuildContainerProfileKey(cpID, "containerprofiles") - - // Start from a fresh copy of observed so the in-place merge cannot bleed - // back into the caller's pointer or onto the canonical CP. - merged := observed.DeepCopy() - hasOverlay := false - - cpCtx, cpCancel := context.WithTimeout(ctx, 5*time.Second) - defer cpCancel() - var userCP softwarecomposition.ContainerProfile - cpPresent := false - if err := storageImpl.GetWithConn(cpCtx, conn, cpKey, storage.GetOptions{}, &userCP); err != nil { - if !storage.IsNotFound(err) { - logger.L().Debug("ContainerProfileProcessor.buildMergedProfile - failed to get user-managed CP", loggerhelpers.Error(err), loggerhelpers.String("key", cpKey)) - } - } else { - cpPresent = true - mergeUserCPIntoCP(merged, &userCP) - hasOverlay = true - } - - if !cpPresent { - // No ug- input at all: caller should delete any stale merged artifact. - return nil, false, nil - } - - // Stamp provenance. - if merged.Labels == nil { - merged.Labels = map[string]string{} - } - merged.Labels[MergedProfileLabelKey] = MergedProfileLabelValue - if merged.Annotations == nil { - merged.Annotations = map[string]string{} - } - merged.Annotations[mergedSourceUserCPKey] = cpKey - merged.Annotations[mergedSourceUserCPRVKey] = userCP.ResourceVersion - merged.Annotations[mergedSourceObservedRVKey] = observed.ResourceVersion - - return merged, hasOverlay, nil -} - -// userManagedConn extracts the StorageImpl and sqlite connection from the -// processor's storage and the supplied context. Returns ok=false when the -// underlying storage is not the SQLite-backed implementation (e.g. tests -// using a stub backend) or when the connection is unavailable. The first such -// miss in a process is logged at warning level so a production -// misconfiguration is visible. -func (a *ContainerProfileProcessor) userManagedConn(ctx context.Context) (*StorageImpl, *sqlite.Conn, bool) { - impl, ok := a.ContainerProfileStorage.(*ContainerProfileStorageImpl) - if !ok { - userManagedConnWarnOnce.Do(func() { - logger.L().Warning("ContainerProfileProcessor.mergeUserManagedProfiles disabled - unexpected storage backend type", - loggerhelpers.Interface("type", a.ContainerProfileStorage)) - }) - return nil, nil, false - } - conn, ok := ctx.Value(connKey).(*sqlite.Conn) - if !ok { - userManagedConnWarnOnce.Do(func() { - logger.L().Warning("ContainerProfileProcessor.mergeUserManagedProfiles disabled - missing sqlite connection on context (WithConnection not applied)") - }) - return nil, nil, false - } - return impl.GetStorageImpl(), conn, true -} - -// mergeUserCPIntoCP unions userCP.Spec into cp.Spec. It is the single-object -// successor to the legacy mergeUserAPIntoCP + mergeUserNNIntoCP overlay: a -// ContainerProfile spec is already flat/single-container, so there is no -// per-container lookup. -// -// Field semantics mirror the legacy helpers: Capabilities / Execs / Opens / -// Syscalls / Endpoints are appended; Ingress / Egress are unioned by Identifier -// via mergeUserNetworkNeighbors (matching entries deep-merged); PolicyByRuleId -// entries are merged via mergePolicies on collision; and the embedded -// LabelSelector is field-merged (MatchLabels via overrideMerge with user keys -// winning, MatchExpressions via appendDedupSortedMatchExpressions). -// -// IdentifiedCallStacks is intentionally NOT merged — node-agent's projection.go -// (the reference implementation) does not project them either, so server- and -// client-side merges stay in sync. -func mergeUserCPIntoCP(cp *softwarecomposition.ContainerProfile, userCP *softwarecomposition.ContainerProfile) { - if userCP == nil { - return - } - // Defensive copy: userCP's slices/maps alias the caller's cached CRD object. - // DeepCopy isolates the merge from concurrent reads of that object. - u := userCP.DeepCopy() - - cp.Spec.Capabilities = append(cp.Spec.Capabilities, u.Spec.Capabilities...) - cp.Spec.Execs = append(cp.Spec.Execs, u.Spec.Execs...) - cp.Spec.Opens = append(cp.Spec.Opens, u.Spec.Opens...) - cp.Spec.Syscalls = append(cp.Spec.Syscalls, u.Spec.Syscalls...) - cp.Spec.Endpoints = append(cp.Spec.Endpoints, u.Spec.Endpoints...) - - if cp.Spec.PolicyByRuleId == nil && len(u.Spec.PolicyByRuleId) > 0 { - cp.Spec.PolicyByRuleId = make(map[string]softwarecomposition.RulePolicy, len(u.Spec.PolicyByRuleId)) - } - for k, v := range u.Spec.PolicyByRuleId { - if existing, ok := cp.Spec.PolicyByRuleId[k]; ok { - cp.Spec.PolicyByRuleId[k] = mergePolicies(existing, v) - } else { - cp.Spec.PolicyByRuleId[k] = v - } - } - - cp.Spec.Ingress = mergeUserNetworkNeighbors(cp.Spec.Ingress, u.Spec.Ingress) - cp.Spec.Egress = mergeUserNetworkNeighbors(cp.Spec.Egress, u.Spec.Egress) - - cp.Spec.LabelSelector.MatchLabels = overrideMerge(cp.Spec.LabelSelector.MatchLabels, u.Spec.LabelSelector.MatchLabels) - cp.Spec.LabelSelector.MatchExpressions = appendDedupSortedMatchExpressions(cp.Spec.LabelSelector.MatchExpressions, u.Spec.LabelSelector.MatchExpressions) -} - -// overrideMerge returns base extended with user's keys; on key collision the -// user value wins. Distinct from utils.MergeMaps which preserves base on -// collision (other callers depend on that semantic, so we don't change it). -func overrideMerge(base, user map[string]string) map[string]string { - if len(user) == 0 { - return base - } - if base == nil { - base = map[string]string{} - } - for k, v := range user { - base[k] = v - } - return base -} - -// appendDedupSortedMatchExpressions appends user expressions to base and -// returns a deduplicated, deterministically-ordered slice. Dedup key is -// (Key, Operator, sorted Values) so semantically-equal expressions collapse -// regardless of input ordering. Determinism keeps the consolidated CP's -// SyncChecksum stable across re-merges of the same content. -func appendDedupSortedMatchExpressions(base, user []metav1.LabelSelectorRequirement) []metav1.LabelSelectorRequirement { - // Allocate a fresh backing array so the in-place dedup below cannot - // mutate base's storage (append(base, user...) would reuse it whenever - // cap(base) is large enough). - combined := make([]metav1.LabelSelectorRequirement, 0, len(base)+len(user)) - combined = append(combined, base...) - combined = append(combined, user...) - if len(combined) == 0 { - return combined - } - type key struct { - k, op, vals string - } - seen := make(map[key]struct{}, len(combined)) - out := combined[:0] - for _, r := range combined { - vs := append([]string(nil), r.Values...) - sort.Strings(vs) - var b strings.Builder - for i, v := range vs { - if i > 0 { - b.WriteByte(',') - } - b.WriteString(v) - } - k := key{string(r.Key), string(r.Operator), b.String()} - if _, ok := seen[k]; ok { - continue - } - seen[k] = struct{}{} - // Store with sorted values to keep serialisation stable. - r.Values = vs - out = append(out, r) - } - sort.Slice(out, func(i, j int) bool { - if out[i].Key != out[j].Key { - return out[i].Key < out[j].Key - } - if out[i].Operator != out[j].Operator { - return out[i].Operator < out[j].Operator - } - return joinSorted(out[i].Values) < joinSorted(out[j].Values) - }) - return out -} - -func joinSorted(vs []string) string { - var b strings.Builder - for i, v := range vs { - if i > 0 { - b.WriteByte(',') - } - b.WriteString(v) - } - return b.String() -} - -func mergeUserNetworkNeighbors(base, user []softwarecomposition.NetworkNeighbor) []softwarecomposition.NetworkNeighbor { - idx := make(map[string]int, len(base)) - for i, n := range base { - idx[n.Identifier] = i - } - for _, u := range user { - if i, exists := idx[u.Identifier]; exists { - base[i] = mergeUserNetworkNeighbor(base[i], u) - } else { - base = append(base, u) - idx[u.Identifier] = len(base) - 1 - } - } - return base -} - -func mergeUserNetworkNeighbor(base, user softwarecomposition.NetworkNeighbor) softwarecomposition.NetworkNeighbor { - merged := *base.DeepCopy() - - dnsSet := mapset.NewSet[string]() - for _, d := range merged.DNSNames { - dnsSet.Add(d) - } - for _, d := range user.DNSNames { - dnsSet.Add(d) - } - merged.DNSNames = merged.DNSNames[:0] - for d := range dnsSet.Iter() { - merged.DNSNames = append(merged.DNSNames, d) - } - // mapset iteration order is randomised; sort for stable serialisation so - // the consolidated CP's SyncChecksum doesn't churn across re-merges of - // the same content. - sort.Strings(merged.DNSNames) - - merged.Ports = mergeUserNetworkPorts(merged.Ports, user.Ports) - - if user.PodSelector != nil { - if merged.PodSelector == nil { - merged.PodSelector = &metav1.LabelSelector{} - } - merged.PodSelector.MatchLabels = overrideMerge(merged.PodSelector.MatchLabels, user.PodSelector.MatchLabels) - merged.PodSelector.MatchExpressions = appendDedupSortedMatchExpressions(merged.PodSelector.MatchExpressions, user.PodSelector.MatchExpressions) - } - - if user.NamespaceSelector != nil { - if merged.NamespaceSelector == nil { - merged.NamespaceSelector = &metav1.LabelSelector{} - } - merged.NamespaceSelector.MatchLabels = overrideMerge(merged.NamespaceSelector.MatchLabels, user.NamespaceSelector.MatchLabels) - merged.NamespaceSelector.MatchExpressions = appendDedupSortedMatchExpressions(merged.NamespaceSelector.MatchExpressions, user.NamespaceSelector.MatchExpressions) - } - - if user.IPAddress != "" { - merged.IPAddress = user.IPAddress - } - if user.Type != "" { - merged.Type = user.Type - } - - return merged -} - -// mergeUserNetworkPorts merges user ports onto base ports, keyed by Name. -// -// On collision the user port wins — intentional even when "base" comes from -// observed time-series traffic. ug- profiles encode the operator's policy -// intent (e.g. an authoritative port spec for an exception), and that intent -// must override observation. This matches node-agent's -// projection.go:mergeNetworkPorts. Revisit only if this discards observations -// the operator actually wanted to keep. -func mergeUserNetworkPorts(base, user []softwarecomposition.NetworkPort) []softwarecomposition.NetworkPort { - idx := make(map[string]int, len(base)) - for i, p := range base { - idx[p.Name] = i - } - for _, u := range user { - if i, exists := idx[u.Name]; exists { - base[i] = u - } else { - base = append(base, u) - idx[u.Name] = len(base) - 1 - } - } - return base -} diff --git a/pkg/registry/file/containerprofile_user_managed_test.go b/pkg/registry/file/containerprofile_user_managed_test.go deleted file mode 100644 index a76f05d93..000000000 --- a/pkg/registry/file/containerprofile_user_managed_test.go +++ /dev/null @@ -1,1218 +0,0 @@ -package file - -import ( - "context" - "encoding/json" - "errors" - "os" - "path" - "testing" - "time" - - "github.com/armosec/armoapi-go/armotypes" - mapset "github.com/deckarep/golang-set/v2" - "github.com/goradd/maps" - helpersv1 "github.com/kubescape/k8s-interface/instanceidhandler/v1/helpers" - "github.com/kubescape/storage/pkg/apis/softwarecomposition" - "github.com/kubescape/storage/pkg/generated/clientset/versioned/scheme" - "github.com/kubescape/storage/pkg/utils" - "github.com/spf13/afero" - "github.com/stretchr/testify/assert" - "github.com/stretchr/testify/require" - metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" - "k8s.io/apimachinery/pkg/runtime" - "k8s.io/apimachinery/pkg/watch" - "k8s.io/apiserver/pkg/storage" - "zombiezen.com/go/sqlite" - "zombiezen.com/go/sqlite/sqlitemigration" -) - - -// End-to-end consolidation test plumbing. - -// p1 / p2 fixtures both report time-series for container "coredns" of -// replicaset-coredns-5d78c9869d in namespace kube-system. -// -// Keys are derived at runtime via BuildContainerProfileKey rather than -// hand-written so a future change to the key format is caught here too. -const ( - e2eNS = "kube-system" - e2eWorkloadSlug = "replicaset-coredns-5d78c9869d" - e2eWorkloadUg = "ug-" + e2eWorkloadSlug - e2eContainerCPName = e2eWorkloadSlug + "-coredns-185f-129c" -) - -// e2eUgCPKey is the key of the single user-managed (ug-) ContainerProfile -// overlay for the e2e workload. buildMergedProfile fetches this object under the -// "containerprofiles" kind, keyed by the shared "ug-" prefix + workload slug. -func e2eUgCPKey() string { - return BuildContainerProfileKey(armotypes.ProfileIdentifier{ - ProfileScope: armotypes.ProfileScope{HostType: armotypes.HostTypeKubernetes, Namespace: e2eNS}, - Name: e2eWorkloadUg, - }, "containerprofiles") -} - -func e2eCPKey() string { - return BuildContainerProfileKey(armotypes.ProfileIdentifier{ - ProfileScope: armotypes.ProfileScope{HostType: armotypes.HostTypeKubernetes, Namespace: e2eNS}, - Name: e2eContainerCPName, - }, "containerprofile") -} - -func e2eMergedCPKey() string { - return MergedKeyFor(e2eCPKey()) -} - -type e2eHarness struct { - t *testing.T - pool *sqlitemigration.Pool - conn *sqlite.Conn - s *StorageImpl - processor *ContainerProfileProcessor - ctx context.Context - cancel context.CancelFunc -} - -func newE2EHarness(t *testing.T) *e2eHarness { - t.Helper() - pool := NewTestPool(t.TempDir()) - require.NotNil(t, pool) - conn, err := pool.Take(context.TODO()) - require.NoError(t, err) - - sch := scheme.Scheme - require.NoError(t, softwarecomposition.AddToScheme(sch)) - processor := &ContainerProfileProcessor{ - DeleteThreshold: 0, - MaxContainerProfileSize: 40000, - HostType: armotypes.HostTypeKubernetes, - } - s := &StorageImpl{ - appFs: afero.NewMemMapFs(), - pool: pool, - locks: utils.NewMapMutex[string](), - processor: processor, - root: DefaultStorageRoot, - scheme: sch, - versioner: storage.APIObjectVersioner{}, - watchDispatcher: NewWatchDispatcher(), - } - processor.SetStorage(NewContainerProfileStorageImpl(s, pool)) - - ctx, cancel := context.WithTimeout(context.TODO(), 15*time.Second) - return &e2eHarness{t: t, pool: pool, conn: conn, s: s, processor: processor, ctx: ctx, cancel: cancel} -} - -func (h *e2eHarness) close() { - h.cancel() - h.pool.Put(h.conn) - _ = h.pool.Close() -} - -func (h *e2eHarness) createCP(fixture string) { - h.t.Helper() - content, err := os.ReadFile(fixture) - require.NoError(h.t, err) - var profile softwarecomposition.ContainerProfile - require.NoError(h.t, json.Unmarshal(content, &profile)) - require.NoError(h.t, h.s.Create(h.ctx, - "/spdx.softwarecomposition.kubescape.io/containerprofile/"+profile.Namespace+"/"+profile.Name, - &profile, nil, 0)) -} - -func (h *e2eHarness) writeTSEntryDirect(kind, namespace, name, seriesID, tsSuffix, reportTimestamp, status, completion, previousReportTimestamp string, hasData bool) { - h.t.Helper() - err := WriteTimeSeriesEntry(h.conn, kind, namespace, name, seriesID, tsSuffix, reportTimestamp, status, completion, previousReportTimestamp, hasData) - require.NoError(h.t, err) -} - -// createFreshReport ingests a TS ContainerProfile for the e2e workload with a -// *current* report timestamp, so a large DeleteThreshold keeps the workload in -// Learning (the expired path never marks it Completed). Each call uses a fresh -// series ID + TS suffix, modelling an independent node-agent report. The spec is -// taken from p1.json and run through mutate, so callers can feed byte-identical -// reports (mutate=nil) or genuinely-new content across consecutive ticks. This -// is what lets a test drive the newData=true observed-save path more than once — -// re-feeding the old fixtures is rejected once the observed CP is Completed. -func (h *e2eHarness) createFreshReport(seriesID, tsSuffix string, mutate func(*softwarecomposition.ContainerProfile)) { - h.t.Helper() - content, err := os.ReadFile("testdata/p1.json") - require.NoError(h.t, err) - var profile softwarecomposition.ContainerProfile - require.NoError(h.t, json.Unmarshal(content, &profile)) - - profile.Name = e2eContainerCPName + "-" + tsSuffix - profile.Annotations[helpersv1.ReportSeriesIdMetadataKey] = seriesID - profile.Annotations[helpersv1.ReportTimestampMetadataKey] = time.Now().String() - profile.Annotations[helpersv1.PreviousReportTimestampMetadataKey] = "0001-01-01 00:00:00 +0000 UTC" - profile.Annotations[helpersv1.StatusMetadataKey] = "ready" - if mutate != nil { - mutate(&profile) - } - require.NoError(h.t, h.s.Create(h.ctx, - "/spdx.softwarecomposition.kubescape.io/containerprofile/"+profile.Namespace+"/"+profile.Name, - &profile, nil, 0)) -} - -// seedNonCP writes a non-ContainerProfile object via the storage layer, working -// around the test harness's processor wiring (production wires -// ContainerProfileProcessor only for the containerprofile kind via a per-kind -// registry; our test wires it for everything, and AfterCreate rejects non-CP). -func (h *e2eHarness) seedNonCP(key string, obj runtime.Object) { - h.t.Helper() - prev := h.s.processor - h.s.processor = DefaultProcessor{} - defer func() { h.s.processor = prev }() - require.NoError(h.t, h.s.Create(h.ctx, key, obj, nil, 0)) -} - -// replaceUserCP swaps the spec of an existing ug- ContainerProfile via -// GuaranteedUpdate so the versioner bumps the object's ResourceVersion (the CP -// analogue of replaceUserAP). This mirrors how a kube-apiserver-driven update -// lands in storage; a fresh Create after Delete would reset RV to 1, defeating -// the RV-marker assertions. -func (h *e2eHarness) replaceUserCP(spec softwarecomposition.ContainerProfileSpec) { - h.t.Helper() - prev := h.s.processor - h.s.processor = DefaultProcessor{} - defer func() { h.s.processor = prev }() - - tryUpdate := func(input runtime.Object, _ storage.ResponseMeta) (runtime.Object, *uint64, error) { - out := input.DeepCopyObject().(*softwarecomposition.ContainerProfile) - out.Spec = spec - return out, nil, nil - } - require.NoError(h.t, h.s.GuaranteedUpdateWithConn( - h.ctx, h.conn, e2eUgCPKey(), &softwarecomposition.ContainerProfile{}, - false, nil, tryUpdate, nil, "")) -} - -func (h *e2eHarness) consolidate() { - h.t.Helper() - require.NoError(h.t, h.processor.ConsolidateTimeSeries(h.ctx)) -} - -// watchMergedModifications registers a watcher for the merged-CP kind and -// returns a drain function that reports how many Modified events have arrived -// since the previous call. The exact merged key is namespaced (Watch rejects -// namespaced keys), so we register at the namespace-less kind path; the -// dispatcher fans events from the namespaced child up to parent-path watchers. -// A merged write only fires through StorageImpl.saveObject (the sole Modified -// emitter), so a count of zero is a reliable "the merged CP was not written". -func (h *e2eHarness) watchMergedModifications() (drain func() int, stop func()) { - h.t.Helper() - mergedKindPath := path.Dir(path.Dir(e2eMergedCPKey())) - w, err := h.s.Watch(h.ctx, mergedKindPath, storage.ListOptions{}) - require.NoError(h.t, err) - drain = func() int { - n := 0 - for { - select { - case ev, ok := <-w.ResultChan(): - if !ok { - return n - } - if ev.Type == watch.Modified { - n++ - } - case <-time.After(250 * time.Millisecond): - return n - } - } - } - return drain, w.Stop -} - -func (h *e2eHarness) loadConsolidated() softwarecomposition.ContainerProfile { - h.t.Helper() - var cp softwarecomposition.ContainerProfile - require.NoError(h.t, h.s.GetWithConn(h.ctx, h.conn, e2eCPKey(), storage.GetOptions{}, &cp)) - return cp -} - -// loadMerged reads the merged (effective) CP from its parallel key. Returns -// the profile and true on success, or a zero CP and false when no merged -// artifact exists for this workload (the legitimate "no ug- input" case). -func (h *e2eHarness) loadMerged() (softwarecomposition.ContainerProfile, bool) { - h.t.Helper() - var cp softwarecomposition.ContainerProfile - err := h.s.GetWithConn(h.ctx, h.conn, e2eMergedCPKey(), storage.GetOptions{}, &cp) - if err != nil { - if storage.IsNotFound(err) { - return softwarecomposition.ContainerProfile{}, false - } - require.NoError(h.t, err) - } - return cp, true -} - -// requireMerged loads and requires the merged CP to exist; failing the test -// otherwise. Use this in tests asserting the merge fired. -func (h *e2eHarness) requireMerged() softwarecomposition.ContainerProfile { - h.t.Helper() - cp, ok := h.loadMerged() - require.True(h.t, ok, "expected merged CP at %s to exist", e2eMergedCPKey()) - return cp -} - -func count(s []string, v string) int { - n := 0 - for _, x := range s { - if x == v { - n++ - } - } - return n -} - -// TestConsolidateMergesUserManagedCP exercises the full consolidation flow -// with a single ug- ContainerProfile pre-seeded into storage. -func TestConsolidateMergesUserManagedCP(t *testing.T) { - h := newE2EHarness(t) - defer h.close() - - h.createCP("testdata/p1.json") - - userCP := &softwarecomposition.ContainerProfile{ - ObjectMeta: metav1.ObjectMeta{ - Namespace: e2eNS, Name: e2eWorkloadUg, - Annotations: map[string]string{helpersv1.ManagedByMetadataKey: helpersv1.ManagedByUserValue}, - }, - Spec: softwarecomposition.ContainerProfileSpec{ - Capabilities: []string{"USER_MANAGED_CAP"}, - Syscalls: []string{"user_managed_syscall"}, - }, - } - h.seedNonCP(e2eUgCPKey(), userCP) - - h.consolidate() - - // Observed must not carry user-managed entries — the canonical CP stays - // pure time-series data (kubescape/storage#315 review). - observed := h.loadConsolidated() - assert.NotContains(t, observed.Spec.Capabilities, "USER_MANAGED_CAP", - "observed CP must not be mutated by ug- merge") - - // Merged artifact carries the union plus provenance. - merged := h.requireMerged() - assert.Contains(t, merged.Spec.Capabilities, "USER_MANAGED_CAP") - assert.Contains(t, merged.Spec.Syscalls, "user_managed_syscall") - assert.Equal(t, 1, count(merged.Spec.Capabilities, "USER_MANAGED_CAP")) - assert.Equal(t, MergedProfileLabelValue, merged.Labels[MergedProfileLabelKey]) - assert.NotEmpty(t, merged.Annotations[mergedSourceUserCPKey]) -} - -// TestConsolidateMergesUserManagedCPNetwork verifies a ug- -// ContainerProfile's network fields are merged into the consolidated CP, -// including Egress neighbors and the workload-level pod LabelSelector. -func TestConsolidateMergesUserManagedCPNetwork(t *testing.T) { - h := newE2EHarness(t) - defer h.close() - - h.createCP("testdata/p1.json") - - port443 := int32(443) - userCP := &softwarecomposition.ContainerProfile{ - ObjectMeta: metav1.ObjectMeta{ - Namespace: e2eNS, Name: e2eWorkloadUg, - Annotations: map[string]string{helpersv1.ManagedByMetadataKey: helpersv1.ManagedByUserValue}, - }, - Spec: softwarecomposition.ContainerProfileSpec{ - LabelSelector: metav1.LabelSelector{MatchLabels: map[string]string{"user-tier": "edge"}}, - Egress: []softwarecomposition.NetworkNeighbor{ - { - Identifier: "user-egress-1", - DNSNames: []string{"user.example"}, - Ports: []softwarecomposition.NetworkPort{{Name: "tcp-443", Port: &port443}}, - }, - }, - }, - } - h.seedNonCP(e2eUgCPKey(), userCP) - - h.consolidate() - cp := h.requireMerged() - - require.NotEmpty(t, cp.Spec.Egress) - found := false - for _, e := range cp.Spec.Egress { - if e.Identifier == "user-egress-1" { - found = true - assert.Contains(t, e.DNSNames, "user.example") - } - } - assert.True(t, found, "expected user-managed egress neighbor in merged CP") - assert.Equal(t, "edge", cp.Spec.LabelSelector.MatchLabels["user-tier"]) - assert.NotEmpty(t, cp.Annotations[mergedSourceUserCPKey]) -} - -// TestConsolidateUserManagedIdempotent verifies that re-merging unchanged -// inputs does NOT rewrite the merged CP, while a real change does. -// -// The merged CP is rebuilt from (observed, ug-CP) every tick. Because it -// is a DeepCopy of the observed CP it used to carry observed's ResourceVersion + -// SyncChecksum (and a wall-clock "merged-at" annotation), so GuaranteedUpdate's -// "same serialized contents" short-circuit never fired and the merged CP — plus -// a watch event to node-agent — was rewritten on every consolidation tick even -// when nothing changed (kubescape/storage#315 review). SaveMergedContainerProfile -// now carries the persisted merged object's identity forward (and reads the real -// current state rather than an empty cachedExistingObject), and the merge no -// longer stamps a per-tick timestamp, so an unchanged rebuild is recognised and -// the write is skipped — keeping the merged CP's ResourceVersion stable. -// -// A positive DeleteThreshold lets the consolidator revisit the (now idle/expired) -// workload on later ticks without new time-series data — that revisit is what -// re-runs the merge and would expose a spurious rewrite. The p1 fixture carries -// no report timestamp, so its consolidated TS row is always "expired". -func TestConsolidateUserManagedIdempotent(t *testing.T) { - h := newE2EHarness(t) - defer h.close() - h.processor.DeleteThreshold = time.Second - - h.createCP("testdata/p1.json") - userCP := &softwarecomposition.ContainerProfile{ - ObjectMeta: metav1.ObjectMeta{Namespace: e2eNS, Name: e2eWorkloadUg}, - Spec: softwarecomposition.ContainerProfileSpec{ - Capabilities: []string{"USER_MANAGED_CAP"}, - }, - } - h.seedNonCP(e2eUgCPKey(), userCP) - - drainMergedWrites, stopWatch := h.watchMergedModifications() - defer stopWatch() - - h.consolidate() - first := h.requireMerged() - require.Equal(t, 1, count(first.Spec.Capabilities, "USER_MANAGED_CAP")) - require.NotEmpty(t, first.ResourceVersion) - require.Equal(t, 1, drainMergedWrites(), "first tick must create the merged CP") - - // Cross a wall-clock second boundary before the no-data tick. The merge must - // be a pure function of (observed, ug-CP) — independent of when it - // runs — so a re-merge of identical inputs after time has advanced must still - // be a no-op. This deterministically catches any reintroduced per-tick - // timestamp (e.g. a "merged-at" annotation), which would otherwise only flake - // the assertions below when a tick happened to straddle a second. - time.Sleep(1100 * time.Millisecond) - - // Second tick: no new time-series data and the ug- CP unchanged. - // Since the expired time series was cleared on the first tick, we inject a report - // to trigger consolidation and verify that rebuilding with identical inputs is recognized - // as unchanged and NOT rewritten (no watch event, stable ResourceVersion). - h.writeTSEntryDirect("containerprofile", "kube-system", "replicaset-coredns-5d78c9869d-coredns-185f-129c", "4580f9fc-7563-41d8-bb60-e2eeca72f495", "c68b821c86194262b389d919d1355ee6", "2025-06-24 10:29:46.810421941 +0000 UTC m=+66.976503851", "ready", "partial", "0001-01-01 00:00:00 +0000 UTC", true) - h.consolidate() - second := h.requireMerged() - assert.Equal(t, 0, drainMergedWrites(), - "unchanged inputs must not rewrite the merged CP (a write ⇒ spurious watch event to node-agent)") - assert.Equal(t, first.ResourceVersion, second.ResourceVersion, - "unchanged inputs must keep the merged CP ResourceVersion stable") - assert.Equal(t, first, second, "an unchanged tick must leave the merged CP byte-for-byte identical") - assert.Equal(t, 1, count(second.Spec.Capabilities, "USER_MANAGED_CAP"), - "unchanged ug- CP must not duplicate merged entries") - - // Third tick: edit the ug- CP. Now an input changed, so the merged CP must - // be rewritten — its ResourceVersion advances and the new capability lands - // (and the old one is retracted, since the merge is rebuilt from scratch). - h.replaceUserCP(softwarecomposition.ContainerProfileSpec{ - Capabilities: []string{"USER_MANAGED_CAP_V2"}, - }) - h.writeTSEntryDirect("containerprofile", "kube-system", "replicaset-coredns-5d78c9869d-coredns-185f-129c", "4580f9fc-7563-41d8-bb60-e2eeca72f495", "c68b821c86194262b389d919d1355ee6", "2025-06-24 10:29:46.810421941 +0000 UTC m=+66.976503851", "ready", "partial", "0001-01-01 00:00:00 +0000 UTC", true) - h.consolidate() - third := h.requireMerged() - assert.GreaterOrEqual(t, drainMergedWrites(), 1, - "a changed ug- CP must rewrite the merged CP (a watch event must fire)") - assert.NotEqual(t, second.ResourceVersion, third.ResourceVersion, - "a changed ug- CP must rewrite the merged CP (RV must advance)") - assert.Contains(t, third.Spec.Capabilities, "USER_MANAGED_CAP_V2", - "merged CP must pick up the edited ug- CP capability") - assert.NotContains(t, third.Spec.Capabilities, "USER_MANAGED_CAP", - "merge is rebuilt from scratch, so the superseded capability must be retracted") -} - -// TestSaveContainerProfileIdempotent verifies that persisting an observed CP -// whose consolidated content is byte-identical to what is already stored does -// NOT bump its ResourceVersion, while a real content change still does. -// -// updateProfile re-saves the observed CP on every tick that carries new -// time-series data (newData=true), even when consolidation produced the same -// bytes — node-agent re-reports the same observations for an idle/stable -// workload. Before this fix SaveContainerProfile passed a non-nil *empty* -// cachedExistingObject, which told GuaranteedUpdate to treat that empty object -// as the current on-disk state: its "same serialized contents" short-circuit -// then compared the freshly consolidated profile against an empty object (never -// equal) and rewrote the observed CP — bumping its ResourceVersion — on every -// such tick. That bump propagated to the derived merged CP (whose -// merged-source-observed-rv annotation tracks observed.ResourceVersion), -// refreshing the merged artifact and firing a watch event to node-agent once per -// report. Reading the real current state (cachedExistingObject=nil) restores the -// no-op short-circuit (kubescape/storage#315 review). -// -// The test mirrors the consolidation contract: updateProfile loads the persisted -// CP (carrying its ResourceVersion / SyncChecksum) before saving, so an unchanged -// re-save must compare equal and skip. -func TestSaveContainerProfileIdempotent(t *testing.T) { - h := newE2EHarness(t) - defer h.close() - - cpStore := h.processor.ContainerProfileStorage.(*ContainerProfileStorageImpl) - ctx := context.WithValue(h.ctx, connKey, h.conn) - key := e2eCPKey() - - load := func() softwarecomposition.ContainerProfile { - var cp softwarecomposition.ContainerProfile - require.NoError(t, h.s.GetWithConn(ctx, h.conn, key, storage.GetOptions{}, &cp)) - return cp - } - - // Initial consolidation: build and persist a fresh observed CP. - initial := &softwarecomposition.ContainerProfile{ - TypeMeta: metav1.TypeMeta{APIVersion: StorageV1Beta1ApiVersion, Kind: "ContainerProfile"}, - ObjectMeta: metav1.ObjectMeta{ - Namespace: e2eNS, - Name: e2eContainerCPName, - Annotations: map[string]string{helpersv1.InstanceIDMetadataKey: "x"}, - }, - Spec: softwarecomposition.ContainerProfileSpec{Capabilities: []string{"CAP_A"}}, - } - require.NoError(t, cpStore.SaveContainerProfile(ctx, key, initial)) - first := load() - require.NotEmpty(t, first.ResourceVersion) - - // Re-consolidate with identical content. updateProfile reloads the persisted - // CP before saving, so model that by saving the freshly loaded object: an - // unchanged tick must be recognised as a no-op and leave the ResourceVersion - // untouched. - reloaded := first.DeepCopy() - require.NoError(t, cpStore.SaveContainerProfile(ctx, key, reloaded)) - second := load() - assert.Equal(t, first.ResourceVersion, second.ResourceVersion, - "saving byte-identical consolidated content must not bump the observed CP ResourceVersion") - assert.Equal(t, first, second, "an unchanged re-save must leave the observed CP byte-for-byte identical") - - // A genuine content change must still advance the ResourceVersion. - changed := second.DeepCopy() - changed.Spec.Capabilities = append(changed.Spec.Capabilities, "CAP_B") - require.NoError(t, cpStore.SaveContainerProfile(ctx, key, changed)) - third := load() - assert.NotEqual(t, second.ResourceVersion, third.ResourceVersion, - "a real content change must advance the observed CP ResourceVersion") - assert.Contains(t, third.Spec.Capabilities, "CAP_B", - "the changed capability must be persisted") -} - -// TestConsolidateObservedIdempotentE2E drives the full consolidation pipeline -// and proves the reported symptom is fixed end-to-end: a workload that is -// still actively reporting (newData=true every tick) but whose observations have -// stabilised must NOT bump the observed CP's ResourceVersion, and therefore must -// NOT churn the derived merged CP — no spurious watch event reaches node-agent. -// -// Each tick ingests an independent report (fresh series ID + suffix) with a -// current timestamp, so the large DeleteThreshold keeps the workload Learning and -// the report is accepted. Tick 2 carries byte-identical content; tick 3 carries -// new content. This complements the storage-level TestSaveContainerProfileIdempotent -// (which pins the exact GuaranteedUpdate mechanism) by exercising the real -// consolidate → observed-save → merged-refresh chain. -func TestConsolidateObservedIdempotentE2E(t *testing.T) { - h := newE2EHarness(t) - defer h.close() - h.processor.DeleteThreshold = time.Hour - - userCP := &softwarecomposition.ContainerProfile{ - ObjectMeta: metav1.ObjectMeta{Namespace: e2eNS, Name: e2eWorkloadUg}, - Spec: softwarecomposition.ContainerProfileSpec{ - Capabilities: []string{"USER_MANAGED_CAP"}, - }, - } - h.seedNonCP(e2eUgCPKey(), userCP) - - drainMergedWrites, stopWatch := h.watchMergedModifications() - defer stopWatch() - - // Feed reports with only order-stable spec fields. The Opens / Endpoints - // deflate paths (dynamicpathdetector) back their flag / header lists with - // unordered sets, so their serialisation is non-deterministic across - // consolidations and would churn the observed CP independently of the save - // path under test. Capabilities/Syscalls go through DeflateSortString (sorted, - // deterministic), giving a byte-stable consolidated CP so this test isolates - // the observed-save idempotency fix. - deterministic := func(p *softwarecomposition.ContainerProfile) { - p.Spec.Opens = nil - p.Spec.Endpoints = nil - p.Spec.Ingress = nil - p.Spec.Egress = nil - p.Spec.PolicyByRuleId = nil - p.Spec.IdentifiedCallStacks = nil - p.Spec.Capabilities = []string{"NET_BIND_SERVICE", "SETUID"} - p.Spec.Syscalls = []string{"accept", "read"} - } - - // Tick 1: first report. Observed and merged are created. - h.createFreshReport("series-1", "aaaa1111", deterministic) - h.consolidate() - observed1 := h.loadConsolidated() - merged1 := h.requireMerged() - require.NotEmpty(t, observed1.ResourceVersion) - require.Equal(t, 1, drainMergedWrites(), "first report must create the merged CP") - - // Tick 2: an independent report with byte-identical observations. The - // consolidator runs the newData=true save path, but the consolidated content - // is unchanged — so the observed CP must NOT be rewritten, its ResourceVersion - // must hold, and the merged CP must not churn (no watch event to node-agent). - h.createFreshReport("series-2", "bbbb2222", deterministic) - h.consolidate() - observed2 := h.loadConsolidated() - merged2 := h.requireMerged() - assert.Equal(t, observed1.ResourceVersion, observed2.ResourceVersion, - "a report with no new observations must not bump the observed CP ResourceVersion") - assert.Equal(t, 0, drainMergedWrites(), - "a stable observed CP must not churn the merged CP (a write ⇒ spurious watch event to node-agent)") - assert.Equal(t, merged1.ResourceVersion, merged2.ResourceVersion, - "merged CP ResourceVersion must stay stable while the observed CP is unchanged") - assert.Equal(t, merged1.Annotations[mergedSourceObservedRVKey], merged2.Annotations[mergedSourceObservedRVKey], - "merged source-observed-rv provenance must not advance when observed is unchanged") - - // Tick 3: a report carrying a genuinely new capability. Now the observed - // CP changes, so its ResourceVersion advances and the merged CP is rewritten. - h.createFreshReport("series-3", "cccc3333", func(p *softwarecomposition.ContainerProfile) { - deterministic(p) - p.Spec.Capabilities = append(p.Spec.Capabilities, "OBSERVED_NEW_CAP") - }) - h.consolidate() - changed := h.loadConsolidated() - assert.NotEqual(t, observed2.ResourceVersion, changed.ResourceVersion, - "a report with new observations must advance the observed CP ResourceVersion") - assert.Contains(t, changed.Spec.Capabilities, "OBSERVED_NEW_CAP", - "the new observation must land in the observed CP") - assert.GreaterOrEqual(t, drainMergedWrites(), 1, - "a changed observed CP must refresh the merged CP") - mergedChanged := h.requireMerged() - assert.Contains(t, mergedChanged.Spec.Capabilities, "OBSERVED_NEW_CAP", - "merged CP must reflect the new observation") - assert.Contains(t, mergedChanged.Spec.Capabilities, "USER_MANAGED_CAP", - "merged CP must still carry the ug- overlay after an observed change") -} - -// TestConsolidateUserManagedRVBump verifies that updating the ug- CP (bumping -// its ResourceVersion) causes the next consolidation to apply the new content. -// New entries appear, and the RV marker advances. -func TestConsolidateUserManagedRVBump(t *testing.T) { - h := newE2EHarness(t) - defer h.close() - - h.createCP("testdata/p1.json") - userCP := &softwarecomposition.ContainerProfile{ - ObjectMeta: metav1.ObjectMeta{Namespace: e2eNS, Name: e2eWorkloadUg}, - Spec: softwarecomposition.ContainerProfileSpec{ - Capabilities: []string{"V1_CAP"}, - }, - } - h.seedNonCP(e2eUgCPKey(), userCP) - h.consolidate() - first := h.requireMerged() - require.Contains(t, first.Spec.Capabilities, "V1_CAP") - rvAfterFirst := first.Annotations[mergedSourceUserCPRVKey] - - // Bump ug- CP: replace with a new spec carrying a different capability. - // Because the merged is rebuilt fresh from observed + ug- inputs, the new - // V2_CAP appears and V1_CAP is retracted (the primary motivation for moving - // to a derived artifact). - h.replaceUserCP(softwarecomposition.ContainerProfileSpec{ - Capabilities: []string{"V2_CAP"}, - }) - - h.createCP("testdata/p2.json") - h.consolidate() - second := h.requireMerged() - - assert.Contains(t, second.Spec.Capabilities, "V2_CAP", - "new ug- entries must appear after RV bump") - assert.NotContains(t, second.Spec.Capabilities, "V1_CAP", - "retraction: V1_CAP must not survive a ug- CP replacement") - assert.NotEqual(t, rvAfterFirst, second.Annotations[mergedSourceUserCPRVKey], - "merged source-CP-RV annotation must advance after ug- update") -} - -// TestConsolidateNoUserManaged verifies the merge path is a no-op (no error, -// no marker annotations) when no ug- ContainerProfile exists for the workload. -func TestConsolidateNoUserManaged(t *testing.T) { - h := newE2EHarness(t) - defer h.close() - - h.createCP("testdata/p1.json") - h.consolidate() - - // Observed must exist and carry no merge metadata. - observed := h.loadConsolidated() - assert.NotContains(t, observed.Labels, MergedProfileLabelKey) - assert.NotContains(t, observed.Annotations, mergedSourceUserCPKey) - - // No merged artifact should have been written when no ug- input exists. - _, ok := h.loadMerged() - assert.False(t, ok, "merged artifact must not exist when no ug- input is present") -} - -// TestConsolidateUserManagedPreservesStatus verifies the additive contract: -// status / completion annotations are derived from the time-series flow and -// must NOT be touched by the user-managed merge. -func TestConsolidateUserManagedPreservesStatus(t *testing.T) { - h := newE2EHarness(t) - defer h.close() - - h.createCP("testdata/p1.json") - userCP := &softwarecomposition.ContainerProfile{ - ObjectMeta: metav1.ObjectMeta{Namespace: e2eNS, Name: e2eWorkloadUg}, - Spec: softwarecomposition.ContainerProfileSpec{ - // Set values that, if naively copied, would clobber base CP - // status/completion. The merge must ignore these and only - // touch Spec slices. - Capabilities: []string{"X"}, - }, - } - // Adding annotations that look like base-CP status/completion to the ug- - // CP itself — these live on userCP.Annotations, never on its Spec, and - // must not bleed into the consolidated CP's annotations. - userCP.Annotations = map[string]string{ - helpersv1.StatusMetadataKey: "should-not-overwrite", - helpersv1.CompletionMetadataKey: "should-not-overwrite", - } - h.seedNonCP(e2eUgCPKey(), userCP) - - h.consolidate() - cp := h.requireMerged() - - // Status/completion came from time-series flow — not from userAP. - assert.NotEqual(t, "should-not-overwrite", cp.Annotations[helpersv1.StatusMetadataKey]) - assert.NotEqual(t, "should-not-overwrite", cp.Annotations[helpersv1.CompletionMetadataKey]) -} - -// TestConsolidateUserManagedCPNetworkRVBump mirrors TestConsolidateUserManagedRVBump -// for the ug- ContainerProfile's network fields: bumping the ug- CP's -// ResourceVersion must cause the next consolidation to re-merge the egress set. -func TestConsolidateUserManagedCPNetworkRVBump(t *testing.T) { - h := newE2EHarness(t) - defer h.close() - - h.createCP("testdata/p1.json") - userCP := &softwarecomposition.ContainerProfile{ - ObjectMeta: metav1.ObjectMeta{Namespace: e2eNS, Name: e2eWorkloadUg}, - Spec: softwarecomposition.ContainerProfileSpec{ - Egress: []softwarecomposition.NetworkNeighbor{ - {Identifier: "v1-egress", DNSNames: []string{"v1.example"}}, - }, - }, - } - h.seedNonCP(e2eUgCPKey(), userCP) - - h.consolidate() - first := h.requireMerged() - require.True(t, hasNeighbor(first.Spec.Egress, "v1-egress"), "first tick: v1-egress should be merged") - rvAfterFirst := first.Annotations[mergedSourceUserCPRVKey] - require.NotEmpty(t, rvAfterFirst) - - // Bump the ug- CP: replace egress with a new identifier. - h.replaceUserCP(softwarecomposition.ContainerProfileSpec{ - Egress: []softwarecomposition.NetworkNeighbor{ - {Identifier: "v2-egress", DNSNames: []string{"v2.example"}}, - }, - }) - - h.createCP("testdata/p2.json") - h.consolidate() - second := h.requireMerged() - - assert.True(t, hasNeighbor(second.Spec.Egress, "v2-egress"), - "second tick: v2-egress must appear after RV bump") - assert.False(t, hasNeighbor(second.Spec.Egress, "v1-egress"), - "retraction: v1-egress must not survive a ug- CP replacement") - assert.NotEqual(t, rvAfterFirst, second.Annotations[mergedSourceUserCPRVKey], - "merged source-CP-RV annotation must advance after ug- CP update") -} - -func hasNeighbor(neighbors []softwarecomposition.NetworkNeighbor, identifier string) bool { - for _, n := range neighbors { - if n.Identifier == identifier { - return true - } - } - return false -} - -// TestConsolidateUserManagedFanOut exercises slug fan-out: a single -// ug- ContainerProfile must be merged into BOTH per-container CPs -// the consolidation flow produces for that workload. Uses the fixture workload -// "multiple-containers-deployment-d4b8dd5fd" which has separate per-container TS -// profiles for "server" and "nginx". The ug- overlay is now flat (single -// container), so the same overlay applies to every per-container CP of the -// workload rather than being split per container name. -func TestConsolidateUserManagedFanOut(t *testing.T) { - pool := NewTestPool(t.TempDir()) - require.NotNil(t, pool) - defer func(p *sqlitemigration.Pool) { _ = p.Close() }(pool) - conn, err := pool.Take(context.TODO()) - require.NoError(t, err) - defer pool.Put(conn) - - sch := scheme.Scheme - require.NoError(t, softwarecomposition.AddToScheme(sch)) - processor := &ContainerProfileProcessor{ - DeleteThreshold: 0, - MaxContainerProfileSize: 40000, - HostType: armotypes.HostTypeKubernetes, - } - s := &StorageImpl{ - appFs: afero.NewMemMapFs(), - pool: pool, - locks: utils.NewMapMutex[string](), - processor: processor, - root: DefaultStorageRoot, - scheme: sch, - versioner: storage.APIObjectVersioner{}, - watchDispatcher: NewWatchDispatcher(), - } - processor.SetStorage(NewContainerProfileStorageImpl(s, pool)) - - ctx, cancel := context.WithTimeout(context.TODO(), 15*time.Second) - defer cancel() - - createCP := func(f string) { - content, err := os.ReadFile(f) - require.NoError(t, err) - var profile softwarecomposition.ContainerProfile - require.NoError(t, json.Unmarshal(content, &profile)) - require.NoError(t, s.Create(ctx, - "/spdx.softwarecomposition.kubescape.io/containerprofile/"+profile.Namespace+"/"+profile.Name, - &profile, nil, 0)) - } - // p10 (server) and p12 (nginx) belong to the same workload - // (replicaset-multiple-containers-deployment-d4b8dd5fd) in namespace - // node-agent-test-hjjz. Their consolidated CPs share the workload slug. - createCP("testdata/p10.json") - createCP("testdata/p12.json") - - const ns = "node-agent-test-hjjz" - const ugName = "ug-replicaset-multiple-containers-deployment-d4b8dd5fd" - ugKey := BuildContainerProfileKey(armotypes.ProfileIdentifier{ - ProfileScope: armotypes.ProfileScope{HostType: armotypes.HostTypeKubernetes, Namespace: ns}, - Name: ugName, - }, "containerprofiles") - - userCP := &softwarecomposition.ContainerProfile{ - ObjectMeta: metav1.ObjectMeta{Namespace: ns, Name: ugName}, - Spec: softwarecomposition.ContainerProfileSpec{ - Capabilities: []string{"FANOUT_SHARED"}, - }, - } - prev := s.processor - s.processor = DefaultProcessor{} - require.NoError(t, s.Create(ctx, ugKey, userCP, nil, 0)) - s.processor = prev - - require.NoError(t, processor.ConsolidateTimeSeries(ctx)) - - // Both per-container CPs of the workload must carry the shared ug- overlay in - // the merged artifact (not on the observed CP — that one stays pure - // time-series). The overlay is flat, so it fans out to every per-container CP. - loadCP := func(name string) softwarecomposition.ContainerProfile { - var cp softwarecomposition.ContainerProfile - observedKey := BuildContainerProfileKey(armotypes.ProfileIdentifier{ - ProfileScope: armotypes.ProfileScope{HostType: armotypes.HostTypeKubernetes, Namespace: ns}, - Name: name, - }, "containerprofile") - require.NoError(t, s.GetWithConn(ctx, conn, MergedKeyFor(observedKey), storage.GetOptions{}, &cp)) - return cp - } - - serverCP := loadCP("replicaset-multiple-containers-deployment-d4b8dd5fd-server-5cad-76b6") - nginxCP := loadCP("replicaset-multiple-containers-deployment-d4b8dd5fd-nginx-42c9-63c3") - - assert.Contains(t, serverCP.Spec.Capabilities, "FANOUT_SHARED", "server CP missed user-managed merge") - assert.Equal(t, 1, count(serverCP.Spec.Capabilities, "FANOUT_SHARED"), "server CP must not duplicate the overlay entry") - assert.Contains(t, nginxCP.Spec.Capabilities, "FANOUT_SHARED", "nginx CP missed user-managed merge") - assert.Equal(t, 1, count(nginxCP.Spec.Capabilities, "FANOUT_SHARED"), "nginx CP must not duplicate the overlay entry") -} - -// TestConsolidateRetractsMergedOnUgCPDelete is the central correctness test -// for the stale-on-delete concern. After a successful merge, removing the ug- -// ContainerProfile must cause the merged artifact to disappear so node-agent -// falls back to the observed CP — i.e., the user's permission grant is -// retracted. -func TestConsolidateRetractsMergedOnUgCPDelete(t *testing.T) { - h := newE2EHarness(t) - defer h.close() - - h.createCP("testdata/p1.json") - userCP := &softwarecomposition.ContainerProfile{ - ObjectMeta: metav1.ObjectMeta{Namespace: e2eNS, Name: e2eWorkloadUg}, - Spec: softwarecomposition.ContainerProfileSpec{ - Capabilities: []string{"DOOMED_CAP"}, - }, - } - h.seedNonCP(e2eUgCPKey(), userCP) - - h.consolidate() - require.Contains(t, h.requireMerged().Spec.Capabilities, "DOOMED_CAP", - "first tick: merged should reflect ug- CP") - - // Delete the ug- CP outside the consolidation path. - prev := h.s.processor - h.s.processor = DefaultProcessor{} - require.NoError(t, h.s.Delete(h.ctx, e2eUgCPKey(), &softwarecomposition.ContainerProfile{}, - nil, storage.ValidateAllObjectFunc, nil, storage.DeleteOptions{})) - h.s.processor = prev - - // Re-consolidate with new TS data so the workload is visited again. - h.createCP("testdata/p2.json") - h.consolidate() - - _, ok := h.loadMerged() - assert.False(t, ok, "merged artifact must be deleted after ug- CP is removed") - - // Observed must still exist and never have contained DOOMED_CAP. - observed := h.loadConsolidated() - assert.NotContains(t, observed.Spec.Capabilities, "DOOMED_CAP", - "observed CP must never have been mutated by the ug- merge") -} - -// TestConsolidateRefreshesMergedOnNoNewData verifies that updateProfile's -// merged refresh runs even when the time-series merge produced no new data -// this tick. The earlier !newData early-return short-circuited this path and -// stranded the merged artifact (kubescape/storage#315 review step 5). -// -// Scope note: a truly idle workload with zero hasData=1 TS rows isn't visited -// by ConsolidateTimeSeries at all — that case requires a separate trigger -// (option a, watch-driven enqueue) and is out of scope here per the review's -// "option (c)" decision. This test covers the in-tick !newData case where -// the consolidator still visits the workload. -func TestConsolidateRefreshesMergedOnNoNewData(t *testing.T) { - h := newE2EHarness(t) - defer h.close() - - h.createCP("testdata/p1.json") - // No ug- input on the first tick: consolidate to drain TS data into - // observed; merged should not exist. - h.consolidate() - _, ok := h.loadMerged() - require.False(t, ok, "preconditions: no merged before ug- is added") - - // Add ug- CP, then re-run consolidation. The same workload may still be - // visited because there's a (possibly stale) TS row queued by createCP; - // even if processTimeSeries returns no new data, the merged refresh must - // still execute. - userCP := &softwarecomposition.ContainerProfile{ - ObjectMeta: metav1.ObjectMeta{Namespace: e2eNS, Name: e2eWorkloadUg}, - Spec: softwarecomposition.ContainerProfileSpec{ - Capabilities: []string{"LATE_ADDITION"}, - }, - } - h.seedNonCP(e2eUgCPKey(), userCP) - - // Inject a fresh TS row so the consolidator visits the workload. We're - // proving that the merged refresh fires even when the merge itself - // doesn't generate new spec entries (the data is unchanged from the prior - // tick) — what matters is that ug- propagation isn't gated on TS newness. - h.createCP("testdata/p1.json") - h.consolidate() - - merged := h.requireMerged() - assert.Contains(t, merged.Spec.Capabilities, "LATE_ADDITION", - "merged refresh must propagate a late-added ug- CP") -} - -// TestRESTWrapper_MergedFirstFallback exercises the consumer-side read path: -// the REST wrapper prefers the merged artifact, falls back to observed when -// no merged exists, and surfaces NotFound when both are absent. -func TestRESTWrapper_MergedFirstFallback(t *testing.T) { - h := newE2EHarness(t) - defer h.close() - - rest := NewContainerProfileRESTStorage(h.s) - observedKey := e2eCPKey() - mergedKey := e2eMergedCPKey() - - // Stage 1: neither observed nor merged exists. - var got softwarecomposition.ContainerProfile - err := rest.Get(h.ctx, observedKey, storage.GetOptions{}, &got) - require.Error(t, err, "expected NotFound when neither observed nor merged exists") - assert.True(t, storage.IsNotFound(err)) - - // Stage 2: only observed exists. Wrapper falls back. - observed := &softwarecomposition.ContainerProfile{ - ObjectMeta: metav1.ObjectMeta{ - Namespace: e2eNS, Name: e2eContainerCPName, - Labels: map[string]string{"source": "observed"}, - }, - } - prev := h.s.processor - h.s.processor = DefaultProcessor{} - require.NoError(t, h.s.Create(h.ctx, observedKey, observed, nil, 0)) - - got = softwarecomposition.ContainerProfile{} - require.NoError(t, rest.Get(h.ctx, observedKey, storage.GetOptions{}, &got)) - assert.Equal(t, "observed", got.Labels["source"], "fallback must return observed when no merged exists") - - // Stage 3: merged exists; wrapper prefers it. - merged := &softwarecomposition.ContainerProfile{ - ObjectMeta: metav1.ObjectMeta{ - Namespace: e2eNS, Name: e2eContainerCPName, - Labels: map[string]string{"source": "merged", MergedProfileLabelKey: MergedProfileLabelValue}, - }, - } - require.NoError(t, h.s.Create(h.ctx, mergedKey, merged, nil, 0)) - h.s.processor = prev - - got = softwarecomposition.ContainerProfile{} - require.NoError(t, rest.Get(h.ctx, observedKey, storage.GetOptions{}, &got)) - assert.Equal(t, "merged", got.Labels["source"], "wrapper must prefer merged when present") -} - -// failingDeleteStore wraps a StorageQuerier and injects an error for Delete on -// one specific key, passing every other call straight through. It exists to -// prove the REST wrapper surfaces merged-sibling delete failures rather than -// swallowing them. -type failingDeleteStore struct { - StorageQuerier - failKey string - err error -} - -func (f failingDeleteStore) Delete(ctx context.Context, key string, out runtime.Object, preconditions *storage.Preconditions, validateDeletion storage.ValidateObjectFunc, cachedExistingObject runtime.Object, opts storage.DeleteOptions) error { - if key == f.failKey { - return f.err - } - return f.StorageQuerier.Delete(ctx, key, out, preconditions, validateDeletion, cachedExistingObject, opts) -} - -// TestRESTWrapper_MergedDeleteFailurePropagates asserts that a non-NotFound -// failure deleting the merged sibling is returned as a hard error (so the -// apiserver retries) instead of being swallowed, which would orphan the merged -// artifact and let the merged-first read path keep serving a profile whose -// observed sibling is gone. -func TestRESTWrapper_MergedDeleteFailurePropagates(t *testing.T) { - h := newE2EHarness(t) - defer h.close() - - errBoom := errors.New("storage unavailable") - rest := NewContainerProfileRESTStorage(failingDeleteStore{ - StorageQuerier: h.s, - failKey: e2eMergedCPKey(), - err: errBoom, - }) - - var out softwarecomposition.ContainerProfile - err := rest.Delete(h.ctx, e2eCPKey(), &out, nil, storage.ValidateAllObjectFunc, nil, storage.DeleteOptions{}) - require.Error(t, err, "merged-sibling delete failure must propagate") - assert.ErrorIs(t, err, errBoom) - assert.ErrorContains(t, err, "merged container profile sibling") -} - -// fakeRunningFetcher reports a fixed namespace list and running-workload set, -// standing in for the live Kubernetes discovery the production cleanup uses. -type fakeRunningFetcher struct { - namespaces []string - running *maps.SafeMap[string, mapset.Set[string]] -} - -func (f fakeRunningFetcher) ListNamespaces(_ *sqlite.Conn) ([]string, error) { - return f.namespaces, nil -} - -func (f fakeRunningFetcher) FetchResources(_ string) (ResourceMaps, error) { - return ResourceMaps{ - RunningContainerImageIds: mapset.NewSet[string](), - RunningInstanceIds: mapset.NewSet[string](), - RunningTemplateHash: mapset.NewSet[string](), - RunningWlidsToContainerNames: f.running, - }, nil -} - -// TestCleanupRetiresMergedOrphan proves the merged-CP kind is wired into the -// cleanup map: a merged CP whose workload is no longer running is age-cleaned, -// while a merged CP for a running workload survives. -// This covers the path where a workload is retired without going through the -// REST Delete cascade that maintains the merged sibling. -func TestCleanupRetiresMergedOrphan(t *testing.T) { - h := newE2EHarness(t) - defer h.close() - - const ns = "cleanup-ns" - mergedKey := func(name string) string { - return MergedKeyFor(BuildContainerProfileKey(armotypes.ProfileIdentifier{ - ProfileScope: armotypes.ProfileScope{HostType: armotypes.HostTypeKubernetes, Namespace: ns}, - Name: name, - }, "containerprofile")) - } - goneWlid := "wlid://cluster-test/namespace-" + ns + "/deployment-gone" - runningWlid := "wlid://cluster-test/namespace-" + ns + "/deployment-running" - - // Seed two merged CPs directly through the storage layer (processor swapped - // out so AfterCreate doesn't intercept) so both the payload file and the - // SQLite metadata land where the cleanup walk + readMetadata expect them. - prev := h.s.processor - h.s.processor = DefaultProcessor{} - writeMerged := func(name, wlid string) { - cp := &softwarecomposition.ContainerProfile{ - ObjectMeta: metav1.ObjectMeta{ - Namespace: ns, - Name: name, - Annotations: map[string]string{helpersv1.WlidMetadataKey: wlid}, - Labels: map[string]string{MergedProfileLabelKey: MergedProfileLabelValue}, - }, - } - require.NoError(t, h.s.Create(h.ctx, mergedKey(name), cp, nil, 0)) - } - writeMerged("gone", goneWlid) - writeMerged("running", runningWlid) - h.s.processor = prev - - // Discovery reports only the running workload as alive. - running := new(maps.SafeMap[string, mapset.Set[string]]) - running.Set(wlidWithoutClusterName(runningWlid), mapset.NewSet[string]()) - - var deleted []string - handler := &ResourcesCleanupHandler{ - appFs: h.s.appFs, - pool: h.pool, - root: DefaultStorageRoot, - // Distinct from ns so the final defaultNamespace pass (which carries an - // empty running-wlid set) walks an unrelated, empty directory rather than - // recursing back over our test namespace and sweeping the survivor. - defaultNamespace: "kubescape", - fetcher: fakeRunningFetcher{ - namespaces: []string{ns}, - running: running, - }, - deleteFunc: func(appFs afero.Fs, path string) { - require.NoError(t, appFs.Remove(path)) - deleted = append(deleted, path) - }, - } - - require.NoError(t, handler.CleanupTask(h.ctx, map[string][]TypeCleanupHandlerFunc{ - ContainerProfileMergedKind: {deleteByTemplateHashOrWlid}, - })) - - require.Len(t, deleted, 1, "exactly the orphan merged CP should be deleted") - assert.Contains(t, deleted[0], ContainerProfileMergedKind, "deleted file must be a merged CP") - assert.Contains(t, deleted[0], "/gone", "the orphan, not the running workload, must be deleted") -} - -// TestE2EScenario_Walkthrough is a verbose end-to-end scenario that prints -// observed-vs-merged state at every step. Run with `go test -run -// TestE2EScenario_Walkthrough -v` to watch the new design behave: ug- adds, -// retractions on edit and delete, and the REST wrapper's merged-first read. -// Not an assertion-heavy test — its job is to make the behavior legible. -func TestE2EScenario_Walkthrough(t *testing.T) { - h := newE2EHarness(t) - defer h.close() - - rest := NewContainerProfileRESTStorage(h.s) - getViaREST := func() (softwarecomposition.ContainerProfile, error) { - var cp softwarecomposition.ContainerProfile - err := rest.Get(h.ctx, e2eCPKey(), storage.GetOptions{}, &cp) - return cp, err - } - - dumpState := func(label string) { - t.Logf("=== %s ===", label) - - var observed softwarecomposition.ContainerProfile - obsErr := h.s.GetWithConn(h.ctx, h.conn, e2eCPKey(), storage.GetOptions{}, &observed) - if obsErr != nil { - t.Logf(" observed: <%s>", obsErr.Error()) - } else { - t.Logf(" observed capabilities: %v", observed.Spec.Capabilities) - t.Logf(" observed has merge-label: %v", observed.Labels[MergedProfileLabelKey]) - } - - merged, mergedOK := h.loadMerged() - if !mergedOK { - t.Logf(" merged: ") - } else { - t.Logf(" merged capabilities: %v", merged.Spec.Capabilities) - t.Logf(" merged label: %s=%s", MergedProfileLabelKey, merged.Labels[MergedProfileLabelKey]) - t.Logf(" merged source ug-cp: %s (rv=%s)", merged.Annotations[mergedSourceUserCPKey], merged.Annotations[mergedSourceUserCPRVKey]) - } - - viaREST, restErr := getViaREST() - if restErr != nil { - t.Logf(" REST GET: <%s>", restErr.Error()) - } else { - t.Logf(" REST GET capabilities: %v (label-kind=%q → %s)", - viaREST.Spec.Capabilities, viaREST.Labels[MergedProfileLabelKey], - map[bool]string{true: "served merged", false: "served observed"}[viaREST.Labels[MergedProfileLabelKey] == MergedProfileLabelValue]) - } - t.Logf("") - } - - t.Log("Scenario: simulate node-agent reads across the ug- CP lifecycle") - t.Log("Workload slug:", e2eWorkloadSlug, " container CP name:", e2eContainerCPName) - t.Log("") - - // Step 1: time-series data arrives from node-agent, no ug- yet. - h.createCP("testdata/p1.json") - h.consolidate() - dumpState("Step 1: TS data only — no ug-") - - // Step 2: operator creates a ug- CP granting an extra capability. - userCP := &softwarecomposition.ContainerProfile{ - ObjectMeta: metav1.ObjectMeta{Namespace: e2eNS, Name: e2eWorkloadUg}, - Spec: softwarecomposition.ContainerProfileSpec{ - Capabilities: []string{"NET_ADMIN_FROM_UG"}, - }, - } - h.seedNonCP(e2eUgCPKey(), userCP) - h.createCP("testdata/p2.json") // fresh TS row so consolidator visits - h.consolidate() - dumpState("Step 2: operator adds ug- CP granting NET_ADMIN_FROM_UG") - - // Step 3: operator edits the ug- CP — replaces the capability list. The - // previous in-place merge couldn't retract; the new design must. - h.replaceUserCP(softwarecomposition.ContainerProfileSpec{ - Capabilities: []string{"SYS_PTRACE_FROM_UG"}, - }) - h.createCP("testdata/p1.json") - h.consolidate() - dumpState("Step 3: operator edits ug- CP (NET_ADMIN_FROM_UG → SYS_PTRACE_FROM_UG)") - - // Step 4: operator deletes the ug- CP. The merged artifact must disappear - // and the REST wrapper must transparently fall back to observed. - prev := h.s.processor - h.s.processor = DefaultProcessor{} - require.NoError(t, h.s.Delete(h.ctx, e2eUgCPKey(), &softwarecomposition.ContainerProfile{}, - nil, storage.ValidateAllObjectFunc, nil, storage.DeleteOptions{})) - h.s.processor = prev - h.createCP("testdata/p2.json") - h.consolidate() - dumpState("Step 4: operator deletes ug- CP — retraction") -} - -// TestConsolidatorReadsObservedOnly proves the consolidator's read path never -// pulls from the merged key. We seed a poisoned merged artifact with content -// that, if mistakenly used as the consolidation base, would surface in the -// next observed CP. After a tick, the observed CP must be free of the poison. -func TestConsolidatorReadsObservedOnly(t *testing.T) { - h := newE2EHarness(t) - defer h.close() - - h.createCP("testdata/p1.json") - h.consolidate() // populate observed - - // Poison the merged key with a capability that doesn't exist anywhere else. - prev := h.s.processor - h.s.processor = DefaultProcessor{} - poison := &softwarecomposition.ContainerProfile{ - ObjectMeta: metav1.ObjectMeta{Namespace: e2eNS, Name: e2eContainerCPName}, - Spec: softwarecomposition.ContainerProfileSpec{Capabilities: []string{"POISON_FROM_MERGED"}}, - } - require.NoError(t, h.s.Create(h.ctx, e2eMergedCPKey(), poison, nil, 0)) - h.s.processor = prev - - // Run another consolidation tick with fresh TS data; the consolidator's - // loadOrInitializeProfile must read observed, not merged. - h.createCP("testdata/p2.json") - h.consolidate() - - observed := h.loadConsolidated() - assert.NotContains(t, observed.Spec.Capabilities, "POISON_FROM_MERGED", - "consolidator must read observed, never merged — poisoned merged content leaked into observed") -} From a67f8096384175fc9130267e545f8958b6f67b0c Mon Sep 17 00:00:00 2001 From: entlein Date: Wed, 29 Jul 2026 12:58:19 +0200 Subject: [PATCH 06/17] moving fixutres Signed-off-by: entlein --- pkg/apis/softwarecomposition/network_types.go | 23 - .../networkpolicy/v2/networkpolicy.go | 81 +- .../networkpolicy/v2/networkpolicy_test.go | 791 ++++++++---------- .../v2/testdata/cp-operator.json | 299 +++++++ .../v2/testdata/known-servers.json | 24 + .../v2/testdata/np-operator.json | 281 +++++++ .../networkpolicy/v2/testdata/np.new.json | 281 +++++++ .../v1beta1/generated.proto | 2 +- .../zz_generated.deepcopy.go | 87 -- .../v1beta1/containerprofilespec.go | 2 +- pkg/registry/file/generatednetworkpolicy.go | 50 +- 11 files changed, 1279 insertions(+), 642 deletions(-) create mode 100644 pkg/apis/softwarecomposition/networkpolicy/v2/testdata/cp-operator.json create mode 100644 pkg/apis/softwarecomposition/networkpolicy/v2/testdata/known-servers.json create mode 100644 pkg/apis/softwarecomposition/networkpolicy/v2/testdata/np-operator.json create mode 100644 pkg/apis/softwarecomposition/networkpolicy/v2/testdata/np.new.json diff --git a/pkg/apis/softwarecomposition/network_types.go b/pkg/apis/softwarecomposition/network_types.go index fd698dc0d..76a1be969 100644 --- a/pkg/apis/softwarecomposition/network_types.go +++ b/pkg/apis/softwarecomposition/network_types.go @@ -18,29 +18,6 @@ const ( CommunicationTypeEgress CommunicationType = "external" ) -// NetworkNeighborhood is an in-process, non-CRD intermediate used only to feed -// the GeneratedNetworkPolicy generation. It is projected from ContainerProfile -// data at request time and is never stored or served as an API object. -type NetworkNeighborhood struct { - metav1.TypeMeta - metav1.ObjectMeta - - Spec NetworkNeighborhoodSpec -} - -type NetworkNeighborhoodSpec struct { - metav1.LabelSelector // The labels which are inside spec.selector in the parent workload. - Containers []NetworkNeighborhoodContainer - InitContainers []NetworkNeighborhoodContainer - EphemeralContainers []NetworkNeighborhoodContainer -} - -type NetworkNeighborhoodContainer struct { - Name string - Ingress []NetworkNeighbor - Egress []NetworkNeighbor -} - // NetworkNeighbor represents a single network communication made by this resource. type NetworkNeighbor struct { Identifier string diff --git a/pkg/apis/softwarecomposition/networkpolicy/v2/networkpolicy.go b/pkg/apis/softwarecomposition/networkpolicy/v2/networkpolicy.go index 9febd5121..8d5b8cead 100644 --- a/pkg/apis/softwarecomposition/networkpolicy/v2/networkpolicy.go +++ b/pkg/apis/softwarecomposition/networkpolicy/v2/networkpolicy.go @@ -21,33 +21,33 @@ import ( metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" ) -func GenerateNetworkPolicy(nn *softwarecomposition.NetworkNeighborhood, knownServers softwarecomposition.IKnownServersFinder, timeProvider metav1.Time) (softwarecomposition.GeneratedNetworkPolicy, error) { - if !IsAvailable(nn) { - return softwarecomposition.GeneratedNetworkPolicy{}, fmt.Errorf("nn %s/%s status annotation is not ready nor completed", nn.Namespace, nn.Name) +func GenerateNetworkPolicy(cp *softwarecomposition.ContainerProfile, knownServers softwarecomposition.IKnownServersFinder, timeProvider metav1.Time) (softwarecomposition.GeneratedNetworkPolicy, error) { + if !IsAvailable(cp) { + return softwarecomposition.GeneratedNetworkPolicy{}, fmt.Errorf("container profile %s/%s status annotation is not ready nor completed", cp.Namespace, cp.Name) } // get name from labels and clean labels - kind, ok := nn.Labels[helpersv1.RelatedKindMetadataKey] + kind, ok := cp.Labels[helpersv1.RelatedKindMetadataKey] if !ok { - return softwarecomposition.GeneratedNetworkPolicy{}, fmt.Errorf("nn %s/%s does not have a kind label", nn.Namespace, nn.Name) + return softwarecomposition.GeneratedNetworkPolicy{}, fmt.Errorf("container profile %s/%s does not have a kind label", cp.Namespace, cp.Name) } - name, ok := nn.Labels[helpersv1.RelatedNameMetadataKey] + name, ok := cp.Labels[helpersv1.RelatedNameMetadataKey] if !ok { - logger.L().Debug("nn does not have a workload-name label, falling back to nn.Name", helpers.String("name", nn.Name), helpers.String("namespace", nn.Namespace)) - name = nn.Name + logger.L().Debug("container profile does not have a workload-name label, falling back to cp.Name", helpers.String("name", cp.Name), helpers.String("namespace", cp.Namespace)) + name = cp.Name } - delete(nn.Labels, helpersv1.TemplateHashKey) + delete(cp.Labels, helpersv1.TemplateHashKey) networkPolicy := softwarecomposition.NetworkPolicy{ Kind: "NetworkPolicy", APIVersion: "networking.k8s.io/v1", ObjectMeta: metav1.ObjectMeta{ Name: fmt.Sprintf("%s-%s", strings.ToLower(kind), name), - Namespace: nn.Namespace, + Namespace: cp.Namespace, Annotations: map[string]string{ "generated-by": "kubescape", }, - Labels: nn.Labels, + Labels: cp.Labels, }, Spec: softwarecomposition.NetworkPolicySpec{ PodSelector: metav1.LabelSelector{}, @@ -58,12 +58,12 @@ func GenerateNetworkPolicy(nn *softwarecomposition.NetworkNeighborhood, knownSer }, } - if nn.Spec.MatchLabels != nil { - networkPolicy.Spec.PodSelector.MatchLabels = nn.Spec.MatchLabels + if cp.Spec.MatchLabels != nil { + networkPolicy.Spec.PodSelector.MatchLabels = cp.Spec.MatchLabels } - if nn.Spec.MatchExpressions != nil { - networkPolicy.Spec.PodSelector.MatchExpressions = nn.Spec.MatchExpressions + if cp.Spec.MatchExpressions != nil { + networkPolicy.Spec.PodSelector.MatchExpressions = cp.Spec.MatchExpressions } generatedNetworkPolicy := softwarecomposition.GeneratedNetworkPolicy{ @@ -72,9 +72,9 @@ func GenerateNetworkPolicy(nn *softwarecomposition.NetworkNeighborhood, knownSer APIVersion: "spdx.softwarecomposition.kubescape.io/v1beta1", }, ObjectMeta: metav1.ObjectMeta{ - Name: nn.Name, - Namespace: nn.Namespace, - Labels: nn.Labels, + Name: cp.Name, + Namespace: cp.Namespace, + Labels: cp.Labels, CreationTimestamp: timeProvider, }, PoliciesRef: []softwarecomposition.PolicyRef{}, @@ -82,7 +82,7 @@ func GenerateNetworkPolicy(nn *softwarecomposition.NetworkNeighborhood, knownSer ingressHash := make(map[string]bool) ingressPolicyRefsHash := make(map[string]bool) - for _, neighbor := range listIngressNetworkNeighbors(nn) { + for _, neighbor := range listIngressNetworkNeighbors(cp) { rule, policyRefs := generateIngressRule(neighbor, knownServers) @@ -104,7 +104,7 @@ func GenerateNetworkPolicy(nn *softwarecomposition.NetworkNeighborhood, knownSer egressHash := make(map[string]bool) egressPolicyRefsHash := make(map[string]bool) - for _, neighbor := range listEgressNetworkNeighbors(nn) { + for _, neighbor := range listEgressNetworkNeighbors(cp) { rule, policyRefs := generateEgressRule(neighbor, knownServers) @@ -132,34 +132,17 @@ func GenerateNetworkPolicy(nn *softwarecomposition.NetworkNeighborhood, knownSer return generatedNetworkPolicy, nil } -func listIngressNetworkNeighbors(nn *softwarecomposition.NetworkNeighborhood) []softwarecomposition.NetworkNeighbor { - var neighbors []softwarecomposition.NetworkNeighbor - for i := range nn.Spec.Containers { - neighbors = append(neighbors, nn.Spec.Containers[i].Ingress...) - } - for i := range nn.Spec.InitContainers { - neighbors = append(neighbors, nn.Spec.InitContainers[i].Ingress...) - } - for i := range nn.Spec.EphemeralContainers { - neighbors = append(neighbors, nn.Spec.EphemeralContainers[i].Ingress...) - } - return neighbors - +// listIngressNetworkNeighbors returns the ingress neighbors for the container +// profile. A ContainerProfile describes a single container, so its Spec.Ingress +// is the exact equivalent of the previously-flattened per-container ingress list. +func listIngressNetworkNeighbors(cp *softwarecomposition.ContainerProfile) []softwarecomposition.NetworkNeighbor { + return cp.Spec.Ingress } -func listEgressNetworkNeighbors(nn *softwarecomposition.NetworkNeighborhood) []softwarecomposition.NetworkNeighbor { - var neighbors []softwarecomposition.NetworkNeighbor - for i := range nn.Spec.Containers { - neighbors = append(neighbors, nn.Spec.Containers[i].Egress...) - } - for i := range nn.Spec.InitContainers { - neighbors = append(neighbors, nn.Spec.InitContainers[i].Egress...) - } - for i := range nn.Spec.EphemeralContainers { - neighbors = append(neighbors, nn.Spec.EphemeralContainers[i].Egress...) - } - return neighbors - +// listEgressNetworkNeighbors returns the egress neighbors for the container +// profile. See listIngressNetworkNeighbors for the single-container rationale. +func listEgressNetworkNeighbors(cp *softwarecomposition.ContainerProfile) []softwarecomposition.NetworkNeighbor { + return cp.Spec.Egress } // containsIPBlockPeer reports whether peers already contains an entry with the given CIDR. @@ -609,11 +592,11 @@ func removeLabels(labels map[string]string) { } } -func IsAvailable(nn *softwarecomposition.NetworkNeighborhood) bool { - if nn.GetAnnotations()[helpersv1.ManagedByMetadataKey] == helpersv1.ManagedByUserValue { +func IsAvailable(cp *softwarecomposition.ContainerProfile) bool { + if cp.GetAnnotations()[helpersv1.ManagedByMetadataKey] == helpersv1.ManagedByUserValue { return true } - switch nn.GetAnnotations()[helpersv1.StatusMetadataKey] { + switch cp.GetAnnotations()[helpersv1.StatusMetadataKey] { case helpersv1.Learning, helpersv1.Completed: return true default: diff --git a/pkg/apis/softwarecomposition/networkpolicy/v2/networkpolicy_test.go b/pkg/apis/softwarecomposition/networkpolicy/v2/networkpolicy_test.go index c489d9be7..2f58dd989 100644 --- a/pkg/apis/softwarecomposition/networkpolicy/v2/networkpolicy_test.go +++ b/pkg/apis/softwarecomposition/networkpolicy/v2/networkpolicy_test.go @@ -22,14 +22,14 @@ func TestGenerateNetworkPolicy(t *testing.T) { tests := []struct { name string - networkNeighborhood softwarecomposition.NetworkNeighborhood + containerProfile softwarecomposition.ContainerProfile knownServers []softwarecomposition.KnownServer expectedNetworkPolicy softwarecomposition.GeneratedNetworkPolicy expectError bool }{ { name: "basic ingress rule", - networkNeighborhood: softwarecomposition.NetworkNeighborhood{ + containerProfile: softwarecomposition.ContainerProfile{ ObjectMeta: metav1.ObjectMeta{ Name: "deployment-nginx", Namespace: "kubescape", @@ -41,28 +41,25 @@ func TestGenerateNetworkPolicy(t *testing.T) { helpersv1.RelatedNameMetadataKey: "nginx", }, }, - Spec: softwarecomposition.NetworkNeighborhoodSpec{ + Spec: softwarecomposition.ContainerProfileSpec{ LabelSelector: metav1.LabelSelector{ MatchLabels: map[string]string{ "app": "nginx", }, }, - Containers: []softwarecomposition.NetworkNeighborhoodContainer{ + + Ingress: []softwarecomposition.NetworkNeighbor{ { - Ingress: []softwarecomposition.NetworkNeighbor{ + PodSelector: &metav1.LabelSelector{ + MatchLabels: map[string]string{ + "app": "nginx", + }, + }, + Ports: []softwarecomposition.NetworkPort{ { - PodSelector: &metav1.LabelSelector{ - MatchLabels: map[string]string{ - "app": "nginx", - }, - }, - Ports: []softwarecomposition.NetworkPort{ - { - Port: ptrToInt32(80), - Protocol: softwarecomposition.ProtocolTCP, - Name: "TCP-80", - }, - }, + Port: ptrToInt32(80), + Protocol: softwarecomposition.ProtocolTCP, + Name: "TCP-80", }, }, }, @@ -128,7 +125,7 @@ func TestGenerateNetworkPolicy(t *testing.T) { }, { name: "network neighborhood not ready", - networkNeighborhood: softwarecomposition.NetworkNeighborhood{ + containerProfile: softwarecomposition.ContainerProfile{ ObjectMeta: metav1.ObjectMeta{ Name: "deployment-nginx", Namespace: "kubescape", @@ -140,14 +137,14 @@ func TestGenerateNetworkPolicy(t *testing.T) { helpersv1.RelatedNameMetadataKey: "nginx", }, }, - Spec: softwarecomposition.NetworkNeighborhoodSpec{}, + Spec: softwarecomposition.ContainerProfileSpec{}, }, expectedNetworkPolicy: softwarecomposition.GeneratedNetworkPolicy{}, expectError: true, }, { name: "network_policy_with_multiple_ports_and_labels", - networkNeighborhood: softwarecomposition.NetworkNeighborhood{ + containerProfile: softwarecomposition.ContainerProfile{ ObjectMeta: metav1.ObjectMeta{ Name: "deployment-multi", Namespace: "kubescape", @@ -159,7 +156,7 @@ func TestGenerateNetworkPolicy(t *testing.T) { helpersv1.RelatedNameMetadataKey: "multi", }, }, - Spec: softwarecomposition.NetworkNeighborhoodSpec{ + Spec: softwarecomposition.ContainerProfileSpec{ LabelSelector: metav1.LabelSelector{ MatchLabels: map[string]string{ "app": "multi-app", @@ -173,35 +170,32 @@ func TestGenerateNetworkPolicy(t *testing.T) { }, }, }, - Containers: []softwarecomposition.NetworkNeighborhoodContainer{ + + Ingress: []softwarecomposition.NetworkNeighbor{ { - Ingress: []softwarecomposition.NetworkNeighbor{ + IPAddress: "10.0.0.1", + Ports: []softwarecomposition.NetworkPort{ { - IPAddress: "10.0.0.1", - Ports: []softwarecomposition.NetworkPort{ - { - Port: ptr.To(int32(80)), - Protocol: softwarecomposition.ProtocolTCP, - Name: "TCP-80", - }, - { - Port: ptr.To(int32(443)), - Protocol: softwarecomposition.ProtocolTCP, - Name: "TCP-443", - }, - }, + Port: ptr.To(int32(80)), + Protocol: softwarecomposition.ProtocolTCP, + Name: "TCP-80", + }, + { + Port: ptr.To(int32(443)), + Protocol: softwarecomposition.ProtocolTCP, + Name: "TCP-443", }, }, - Egress: []softwarecomposition.NetworkNeighbor{ + }, + }, + Egress: []softwarecomposition.NetworkNeighbor{ + { + IPAddress: "192.168.1.1", + Ports: []softwarecomposition.NetworkPort{ { - IPAddress: "192.168.1.1", - Ports: []softwarecomposition.NetworkPort{ - { - Port: ptr.To(int32(8080)), - Protocol: softwarecomposition.ProtocolTCP, - Name: "TCP-8080", - }, - }, + Port: ptr.To(int32(8080)), + Protocol: softwarecomposition.ProtocolTCP, + Name: "TCP-8080", }, }, }, @@ -302,7 +296,7 @@ func TestGenerateNetworkPolicy(t *testing.T) { }, { name: "policy_with_known_servers", - networkNeighborhood: softwarecomposition.NetworkNeighborhood{ + containerProfile: softwarecomposition.ContainerProfile{ ObjectMeta: metav1.ObjectMeta{ Name: "deployment-known-servers", Namespace: "kubescape", @@ -314,38 +308,33 @@ func TestGenerateNetworkPolicy(t *testing.T) { helpersv1.RelatedNameMetadataKey: "known-servers", }, }, - Spec: softwarecomposition.NetworkNeighborhoodSpec{ + Spec: softwarecomposition.ContainerProfileSpec{ LabelSelector: metav1.LabelSelector{ MatchLabels: map[string]string{ "app": "known-app", }, }, - Containers: []softwarecomposition.NetworkNeighborhoodContainer{ + + Ingress: []softwarecomposition.NetworkNeighbor{ { - Ingress: []softwarecomposition.NetworkNeighbor{ + IPAddress: "10.0.0.1", + Ports: []softwarecomposition.NetworkPort{ { - IPAddress: "10.0.0.1", - Ports: []softwarecomposition.NetworkPort{ - { - Port: ptrToInt32(80), - Protocol: softwarecomposition.ProtocolTCP, - Name: "TCP-80", - }, - }, + Port: ptrToInt32(80), + Protocol: softwarecomposition.ProtocolTCP, + Name: "TCP-80", }, }, }, + }, + Egress: []softwarecomposition.NetworkNeighbor{ { - Egress: []softwarecomposition.NetworkNeighbor{ + IPAddress: "192.168.1.1", + Ports: []softwarecomposition.NetworkPort{ { - IPAddress: "192.168.1.1", - Ports: []softwarecomposition.NetworkPort{ - { - Port: ptrToInt32(8080), - Protocol: softwarecomposition.ProtocolTCP, - Name: "TCP-8080", - }, - }, + Port: ptrToInt32(8080), + Protocol: softwarecomposition.ProtocolTCP, + Name: "TCP-8080", }, }, }, @@ -453,7 +442,7 @@ func TestGenerateNetworkPolicy(t *testing.T) { }, { name: "policy_with_known_servers", - networkNeighborhood: softwarecomposition.NetworkNeighborhood{ + containerProfile: softwarecomposition.ContainerProfile{ ObjectMeta: metav1.ObjectMeta{ Name: "deployment-known-servers", Namespace: "kubescape", @@ -465,38 +454,33 @@ func TestGenerateNetworkPolicy(t *testing.T) { helpersv1.RelatedNameMetadataKey: "known-servers", }, }, - Spec: softwarecomposition.NetworkNeighborhoodSpec{ + Spec: softwarecomposition.ContainerProfileSpec{ LabelSelector: metav1.LabelSelector{ MatchLabels: map[string]string{ "app": "known-app", }, }, - Containers: []softwarecomposition.NetworkNeighborhoodContainer{ + + Ingress: []softwarecomposition.NetworkNeighbor{ { - Ingress: []softwarecomposition.NetworkNeighbor{ + IPAddress: "10.0.0.1", + Ports: []softwarecomposition.NetworkPort{ { - IPAddress: "10.0.0.1", - Ports: []softwarecomposition.NetworkPort{ - { - Port: ptrToInt32(80), - Protocol: softwarecomposition.ProtocolTCP, - Name: "TCP-80", - }, - }, + Port: ptrToInt32(80), + Protocol: softwarecomposition.ProtocolTCP, + Name: "TCP-80", }, }, }, + }, + Egress: []softwarecomposition.NetworkNeighbor{ { - Egress: []softwarecomposition.NetworkNeighbor{ + IPAddress: "192.168.1.1", + Ports: []softwarecomposition.NetworkPort{ { - IPAddress: "192.168.1.1", - Ports: []softwarecomposition.NetworkPort{ - { - Port: ptrToInt32(8080), - Protocol: softwarecomposition.ProtocolTCP, - Name: "TCP-8080", - }, - }, + Port: ptrToInt32(8080), + Protocol: softwarecomposition.ProtocolTCP, + Name: "TCP-8080", }, }, }, @@ -604,7 +588,7 @@ func TestGenerateNetworkPolicy(t *testing.T) { }, { name: "policy_with_dns_neighbors", - networkNeighborhood: softwarecomposition.NetworkNeighborhood{ + containerProfile: softwarecomposition.ContainerProfile{ ObjectMeta: metav1.ObjectMeta{ Name: "deployment-dns", Namespace: "kubescape", @@ -616,25 +600,21 @@ func TestGenerateNetworkPolicy(t *testing.T) { helpersv1.RelatedNameMetadataKey: "dns", }, }, - Spec: softwarecomposition.NetworkNeighborhoodSpec{ + Spec: softwarecomposition.ContainerProfileSpec{ LabelSelector: metav1.LabelSelector{ MatchLabels: map[string]string{ "app": "dns-app", }, }, - Containers: []softwarecomposition.NetworkNeighborhoodContainer{ + Egress: []softwarecomposition.NetworkNeighbor{ { - Egress: []softwarecomposition.NetworkNeighbor{ + IPAddress: "192.168.1.1", + DNS: "example.com", + Ports: []softwarecomposition.NetworkPort{ { - IPAddress: "192.168.1.1", - DNS: "example.com", - Ports: []softwarecomposition.NetworkPort{ - { - Port: ptr.To(int32(80)), - Protocol: softwarecomposition.ProtocolTCP, - Name: "TCP-80", - }, - }, + Port: ptr.To(int32(80)), + Protocol: softwarecomposition.ProtocolTCP, + Name: "TCP-80", }, }, }, @@ -704,7 +684,7 @@ func TestGenerateNetworkPolicy(t *testing.T) { }, { name: "network_policy_with_multiple_containers", - networkNeighborhood: softwarecomposition.NetworkNeighborhood{ + containerProfile: softwarecomposition.ContainerProfile{ ObjectMeta: metav1.ObjectMeta{ Name: "deployment-multi-container", Namespace: "kubescape", @@ -716,46 +696,40 @@ func TestGenerateNetworkPolicy(t *testing.T) { helpersv1.RelatedNameMetadataKey: "multi-container", }, }, - Spec: softwarecomposition.NetworkNeighborhoodSpec{ + Spec: softwarecomposition.ContainerProfileSpec{ LabelSelector: metav1.LabelSelector{ MatchLabels: map[string]string{ "app": "multi-container", }, }, - Containers: []softwarecomposition.NetworkNeighborhoodContainer{ + + Ingress: []softwarecomposition.NetworkNeighbor{ { - Ingress: []softwarecomposition.NetworkNeighbor{ + PodSelector: &metav1.LabelSelector{ + MatchLabels: map[string]string{ + "app": "nginx", + }, + }, + Ports: []softwarecomposition.NetworkPort{ { - PodSelector: &metav1.LabelSelector{ - MatchLabels: map[string]string{ - "app": "nginx", - }, - }, - Ports: []softwarecomposition.NetworkPort{ - { - Port: ptrToInt32(80), - Protocol: softwarecomposition.ProtocolTCP, - Name: "TCP-80", - }, - }, + Port: ptrToInt32(80), + Protocol: softwarecomposition.ProtocolTCP, + Name: "TCP-80", }, }, }, + { - Ingress: []softwarecomposition.NetworkNeighbor{ + PodSelector: &metav1.LabelSelector{ + MatchLabels: map[string]string{ + "app": "nginx", + }, + }, + Ports: []softwarecomposition.NetworkPort{ { - PodSelector: &metav1.LabelSelector{ - MatchLabels: map[string]string{ - "app": "nginx", - }, - }, - Ports: []softwarecomposition.NetworkPort{ - { - Port: ptrToInt32(443), - Protocol: softwarecomposition.ProtocolTCP, - Name: "TCP-443", - }, - }, + Port: ptrToInt32(443), + Protocol: softwarecomposition.ProtocolTCP, + Name: "TCP-443", }, }, }, @@ -838,7 +812,7 @@ func TestGenerateNetworkPolicy(t *testing.T) { }, { name: "network_policy_with_multiple_containers_with_same_ip", - networkNeighborhood: softwarecomposition.NetworkNeighborhood{ + containerProfile: softwarecomposition.ContainerProfile{ ObjectMeta: metav1.ObjectMeta{ Name: "deployment-multi-containers", Namespace: "kubescape", @@ -850,69 +824,60 @@ func TestGenerateNetworkPolicy(t *testing.T) { helpersv1.RelatedNameMetadataKey: "multi-containers", }, }, - Spec: softwarecomposition.NetworkNeighborhoodSpec{ + Spec: softwarecomposition.ContainerProfileSpec{ LabelSelector: metav1.LabelSelector{ MatchLabels: map[string]string{ "app": "multi-container-app", }, }, - Containers: []softwarecomposition.NetworkNeighborhoodContainer{ + + Ingress: []softwarecomposition.NetworkNeighbor{ { - Name: "container-1", - Ingress: []softwarecomposition.NetworkNeighbor{ + IPAddress: "10.0.0.1", + Ports: []softwarecomposition.NetworkPort{ { - IPAddress: "10.0.0.1", - Ports: []softwarecomposition.NetworkPort{ - { - Port: ptr.To(int32(80)), - Protocol: softwarecomposition.ProtocolTCP, - Name: "TCP-80", - }, - { - Port: ptr.To(int32(443)), - Protocol: softwarecomposition.ProtocolTCP, - Name: "TCP-443", - }, - }, + Port: ptr.To(int32(80)), + Protocol: softwarecomposition.ProtocolTCP, + Name: "TCP-80", + }, + { + Port: ptr.To(int32(443)), + Protocol: softwarecomposition.ProtocolTCP, + Name: "TCP-443", }, }, - Egress: []softwarecomposition.NetworkNeighbor{ + }, + + { + IPAddress: "10.0.0.1", + Ports: []softwarecomposition.NetworkPort{ { - IPAddress: "192.168.1.1", - Ports: []softwarecomposition.NetworkPort{ - { - Port: ptr.To(int32(8080)), - Protocol: softwarecomposition.ProtocolTCP, - Name: "TCP-8080", - }, - }, + Port: ptr.To(int32(80)), + Protocol: softwarecomposition.ProtocolTCP, + Name: "TCP-80", }, }, }, + }, + Egress: []softwarecomposition.NetworkNeighbor{ { - Name: "container-2", - Ingress: []softwarecomposition.NetworkNeighbor{ + IPAddress: "192.168.1.1", + Ports: []softwarecomposition.NetworkPort{ { - IPAddress: "10.0.0.1", - Ports: []softwarecomposition.NetworkPort{ - { - Port: ptr.To(int32(80)), - Protocol: softwarecomposition.ProtocolTCP, - Name: "TCP-80", - }, - }, + Port: ptr.To(int32(8080)), + Protocol: softwarecomposition.ProtocolTCP, + Name: "TCP-8080", }, }, - Egress: []softwarecomposition.NetworkNeighbor{ + }, + + { + IPAddress: "192.168.1.1", + Ports: []softwarecomposition.NetworkPort{ { - IPAddress: "192.168.1.1", - Ports: []softwarecomposition.NetworkPort{ - { - Port: ptr.To(int32(8080)), - Protocol: softwarecomposition.ProtocolTCP, - Name: "TCP-8080", - }, - }, + Port: ptr.To(int32(8080)), + Protocol: softwarecomposition.ProtocolTCP, + Name: "TCP-8080", }, }, }, @@ -1006,7 +971,7 @@ func TestGenerateNetworkPolicy(t *testing.T) { }, { name: "network_policy_with_multiple_different_containers", - networkNeighborhood: softwarecomposition.NetworkNeighborhood{ + containerProfile: softwarecomposition.ContainerProfile{ ObjectMeta: metav1.ObjectMeta{ Name: "deployment-multi-containers", Namespace: "kubescape", @@ -1018,203 +983,177 @@ func TestGenerateNetworkPolicy(t *testing.T) { helpersv1.RelatedNameMetadataKey: "multi-containers", }, }, - Spec: softwarecomposition.NetworkNeighborhoodSpec{ + Spec: softwarecomposition.ContainerProfileSpec{ LabelSelector: metav1.LabelSelector{ MatchLabels: map[string]string{ "app": "multi-container-app", }, }, - Containers: []softwarecomposition.NetworkNeighborhoodContainer{ + + Ingress: []softwarecomposition.NetworkNeighbor{ { - Ingress: []softwarecomposition.NetworkNeighbor{ + IPAddress: "10.0.0.1", + Ports: []softwarecomposition.NetworkPort{ { - IPAddress: "10.0.0.1", - Ports: []softwarecomposition.NetworkPort{ - { - Port: ptr.To(int32(80)), - Protocol: softwarecomposition.ProtocolTCP, - Name: "TCP-80", - }, - { - Port: ptr.To(int32(443)), - Protocol: softwarecomposition.ProtocolTCP, - Name: "TCP-443", - }, - }, + Port: ptr.To(int32(80)), + Protocol: softwarecomposition.ProtocolTCP, + Name: "TCP-80", }, - }, - Egress: []softwarecomposition.NetworkNeighbor{ { - IPAddress: "192.168.1.1", - Ports: []softwarecomposition.NetworkPort{ - { - Port: ptr.To(int32(8080)), - Protocol: softwarecomposition.ProtocolTCP, - Name: "TCP-8080", - }, - }, + Port: ptr.To(int32(443)), + Protocol: softwarecomposition.ProtocolTCP, + Name: "TCP-443", }, }, }, + { - Ingress: []softwarecomposition.NetworkNeighbor{ + IPAddress: "10.0.0.2", + Ports: []softwarecomposition.NetworkPort{ { - IPAddress: "10.0.0.2", - Ports: []softwarecomposition.NetworkPort{ - { - Port: ptr.To(int32(8081)), - Protocol: softwarecomposition.ProtocolTCP, - Name: "TCP-8081", - }, - }, + Port: ptr.To(int32(8081)), + Protocol: softwarecomposition.ProtocolTCP, + Name: "TCP-8081", }, }, - Egress: []softwarecomposition.NetworkNeighbor{ + }, + + { + IPAddress: "10.0.0.3", + Ports: []softwarecomposition.NetworkPort{ { - IPAddress: "192.168.1.2", - Ports: []softwarecomposition.NetworkPort{ - { - Port: ptr.To(int32(8082)), - Protocol: softwarecomposition.ProtocolTCP, - Name: "TCP-8082", - }, - }, + Port: ptr.To(int32(80)), + Protocol: softwarecomposition.ProtocolTCP, + Name: "TCP-80", + }, + { + Port: ptr.To(int32(443)), + Protocol: softwarecomposition.ProtocolTCP, + Name: "TCP-443", }, }, }, - }, - InitContainers: []softwarecomposition.NetworkNeighborhoodContainer{ { - Ingress: []softwarecomposition.NetworkNeighbor{ + IPAddress: "10.0.0.1", + Ports: []softwarecomposition.NetworkPort{ { - IPAddress: "10.0.0.3", - Ports: []softwarecomposition.NetworkPort{ - { - Port: ptr.To(int32(80)), - Protocol: softwarecomposition.ProtocolTCP, - Name: "TCP-80", - }, - { - Port: ptr.To(int32(443)), - Protocol: softwarecomposition.ProtocolTCP, - Name: "TCP-443", - }, - }, + Port: ptr.To(int32(90)), + Protocol: softwarecomposition.ProtocolTCP, + Name: "TCP-90", }, { - IPAddress: "10.0.0.1", - Ports: []softwarecomposition.NetworkPort{ - { - Port: ptr.To(int32(90)), - Protocol: softwarecomposition.ProtocolTCP, - Name: "TCP-90", - }, - { - Port: ptr.To(int32(443)), - Protocol: softwarecomposition.ProtocolTCP, - Name: "TCP-443", - }, - }, + Port: ptr.To(int32(443)), + Protocol: softwarecomposition.ProtocolTCP, + Name: "TCP-443", }, }, - Egress: []softwarecomposition.NetworkNeighbor{ + }, + + { + IPAddress: "10.0.0.2", + Ports: []softwarecomposition.NetworkPort{ { - IPAddress: "192.168.1.1", - Ports: []softwarecomposition.NetworkPort{ - { - Port: ptr.To(int32(8080)), - Protocol: softwarecomposition.ProtocolTCP, - Name: "TCP-8080", - }, - }, + Port: ptr.To(int32(8081)), + Protocol: softwarecomposition.ProtocolTCP, + Name: "TCP-8081", }, }, }, + { - Ingress: []softwarecomposition.NetworkNeighbor{ + IPAddress: "10.0.0.4", + Ports: []softwarecomposition.NetworkPort{ { - IPAddress: "10.0.0.2", - Ports: []softwarecomposition.NetworkPort{ - { - Port: ptr.To(int32(8081)), - Protocol: softwarecomposition.ProtocolTCP, - Name: "TCP-8081", - }, - }, + Port: ptr.To(int32(80)), + Protocol: softwarecomposition.ProtocolTCP, + Name: "TCP-80", + }, + { + Port: ptr.To(int32(443)), + Protocol: softwarecomposition.ProtocolTCP, + Name: "TCP-443", }, }, - Egress: []softwarecomposition.NetworkNeighbor{ + }, + { + IPAddress: "10.0.0.1", + Ports: []softwarecomposition.NetworkPort{ { - IPAddress: "192.168.1.2", - Ports: []softwarecomposition.NetworkPort{ - { - Port: ptr.To(int32(8082)), - Protocol: softwarecomposition.ProtocolTCP, - Name: "TCP-8082", - }, - }, + Port: ptr.To(int32(100)), + Protocol: softwarecomposition.ProtocolTCP, + Name: "TCP-100", + }, + { + Port: ptr.To(int32(443)), + Protocol: softwarecomposition.ProtocolTCP, + Name: "TCP-443", + }, + }, + }, + + { + IPAddress: "10.0.0.2", + Ports: []softwarecomposition.NetworkPort{ + { + Port: ptr.To(int32(8081)), + Protocol: softwarecomposition.ProtocolTCP, + Name: "TCP-8081", }, }, }, }, - EphemeralContainers: []softwarecomposition.NetworkNeighborhoodContainer{ + Egress: []softwarecomposition.NetworkNeighbor{ { - Ingress: []softwarecomposition.NetworkNeighbor{ + IPAddress: "192.168.1.1", + Ports: []softwarecomposition.NetworkPort{ { - IPAddress: "10.0.0.4", - Ports: []softwarecomposition.NetworkPort{ - { - Port: ptr.To(int32(80)), - Protocol: softwarecomposition.ProtocolTCP, - Name: "TCP-80", - }, - { - Port: ptr.To(int32(443)), - Protocol: softwarecomposition.ProtocolTCP, - Name: "TCP-443", - }, - }, + Port: ptr.To(int32(8080)), + Protocol: softwarecomposition.ProtocolTCP, + Name: "TCP-8080", }, + }, + }, + + { + IPAddress: "192.168.1.2", + Ports: []softwarecomposition.NetworkPort{ { - IPAddress: "10.0.0.1", - Ports: []softwarecomposition.NetworkPort{ - { - Port: ptr.To(int32(100)), - Protocol: softwarecomposition.ProtocolTCP, - Name: "TCP-100", - }, - { - Port: ptr.To(int32(443)), - Protocol: softwarecomposition.ProtocolTCP, - Name: "TCP-443", - }, - }, + Port: ptr.To(int32(8082)), + Protocol: softwarecomposition.ProtocolTCP, + Name: "TCP-8082", }, }, - Egress: []softwarecomposition.NetworkNeighbor{ + }, + + { + IPAddress: "192.168.1.1", + Ports: []softwarecomposition.NetworkPort{ { - IPAddress: "192.168.1.1", - Ports: []softwarecomposition.NetworkPort{ - { - Port: ptr.To(int32(8080)), - Protocol: softwarecomposition.ProtocolTCP, - Name: "TCP-8080", - }, - }, + Port: ptr.To(int32(8080)), + Protocol: softwarecomposition.ProtocolTCP, + Name: "TCP-8080", }, }, }, + { - Ingress: []softwarecomposition.NetworkNeighbor{ + IPAddress: "192.168.1.2", + Ports: []softwarecomposition.NetworkPort{ { - IPAddress: "10.0.0.2", - Ports: []softwarecomposition.NetworkPort{ - { - Port: ptr.To(int32(8081)), - Protocol: softwarecomposition.ProtocolTCP, - Name: "TCP-8081", - }, - }, + Port: ptr.To(int32(8082)), + Protocol: softwarecomposition.ProtocolTCP, + Name: "TCP-8082", + }, + }, + }, + + { + IPAddress: "192.168.1.1", + Ports: []softwarecomposition.NetworkPort{ + { + Port: ptr.To(int32(8080)), + Protocol: softwarecomposition.ProtocolTCP, + Name: "TCP-8080", }, }, }, @@ -1388,7 +1327,7 @@ func TestGenerateNetworkPolicy(t *testing.T) { }, { name: "real_duplicate_bug_test", - networkNeighborhood: func() softwarecomposition.NetworkNeighborhood { + containerProfile: func() softwarecomposition.ContainerProfile { sharedPodSelector := &metav1.LabelSelector{ MatchLabels: map[string]string{ "app.kubernetes.io/component": "master", @@ -1401,7 +1340,7 @@ func TestGenerateNetworkPolicy(t *testing.T) { Name: "TCP-6379", } - return softwarecomposition.NetworkNeighborhood{ + return softwarecomposition.ContainerProfile{ ObjectMeta: metav1.ObjectMeta{ Name: "deployment-real-bug", Namespace: "kubescape", @@ -1413,24 +1352,20 @@ func TestGenerateNetworkPolicy(t *testing.T) { helpersv1.RelatedNameMetadataKey: "real-bug", }, }, - Spec: softwarecomposition.NetworkNeighborhoodSpec{ + Spec: softwarecomposition.ContainerProfileSpec{ LabelSelector: metav1.LabelSelector{ MatchLabels: map[string]string{ "app": "real-bug-app", }, }, - Containers: []softwarecomposition.NetworkNeighborhoodContainer{ + Egress: []softwarecomposition.NetworkNeighbor{ { - Egress: []softwarecomposition.NetworkNeighbor{ - { - PodSelector: sharedPodSelector, - Ports: []softwarecomposition.NetworkPort{sharedPort}, - }, - { - PodSelector: sharedPodSelector, - Ports: []softwarecomposition.NetworkPort{sharedPort}, - }, - }, + PodSelector: sharedPodSelector, + Ports: []softwarecomposition.NetworkPort{sharedPort}, + }, + { + PodSelector: sharedPodSelector, + Ports: []softwarecomposition.NetworkPort{sharedPort}, }, }, }, @@ -1495,7 +1430,7 @@ func TestGenerateNetworkPolicy(t *testing.T) { }, { name: "duplicate_ports_within_single_neighbor", - networkNeighborhood: softwarecomposition.NetworkNeighborhood{ + containerProfile: softwarecomposition.ContainerProfile{ ObjectMeta: metav1.ObjectMeta{ Name: "deployment-duplicate-ports", Namespace: "kubescape", @@ -1507,29 +1442,25 @@ func TestGenerateNetworkPolicy(t *testing.T) { helpersv1.RelatedNameMetadataKey: "duplicate-ports", }, }, - Spec: softwarecomposition.NetworkNeighborhoodSpec{ + Spec: softwarecomposition.ContainerProfileSpec{ LabelSelector: metav1.LabelSelector{ MatchLabels: map[string]string{ "app": "duplicate-ports-app", }, }, - Containers: []softwarecomposition.NetworkNeighborhoodContainer{ + Egress: []softwarecomposition.NetworkNeighbor{ { - Egress: []softwarecomposition.NetworkNeighbor{ + IPAddress: "192.168.1.1", + Ports: []softwarecomposition.NetworkPort{ { - IPAddress: "192.168.1.1", - Ports: []softwarecomposition.NetworkPort{ - { - Port: ptrToInt32(8080), - Protocol: softwarecomposition.ProtocolTCP, - Name: "TCP-8080", - }, - { - Port: ptrToInt32(8080), - Protocol: softwarecomposition.ProtocolTCP, - Name: "TCP-8080", - }, - }, + Port: ptrToInt32(8080), + Protocol: softwarecomposition.ProtocolTCP, + Name: "TCP-8080", + }, + { + Port: ptrToInt32(8080), + Protocol: softwarecomposition.ProtocolTCP, + Name: "TCP-8080", }, }, }, @@ -1592,7 +1523,7 @@ func TestGenerateNetworkPolicy(t *testing.T) { }, { name: "duplicate_ports_with_pod_selector", - networkNeighborhood: softwarecomposition.NetworkNeighborhood{ + containerProfile: softwarecomposition.ContainerProfile{ ObjectMeta: metav1.ObjectMeta{ Name: "deployment-duplicate-ports-pod", Namespace: "kubescape", @@ -1604,33 +1535,29 @@ func TestGenerateNetworkPolicy(t *testing.T) { helpersv1.RelatedNameMetadataKey: "duplicate-ports-pod", }, }, - Spec: softwarecomposition.NetworkNeighborhoodSpec{ + Spec: softwarecomposition.ContainerProfileSpec{ LabelSelector: metav1.LabelSelector{ MatchLabels: map[string]string{ "app": "duplicate-ports-pod-app", }, }, - Containers: []softwarecomposition.NetworkNeighborhoodContainer{ + Egress: []softwarecomposition.NetworkNeighbor{ { - Egress: []softwarecomposition.NetworkNeighbor{ + PodSelector: &metav1.LabelSelector{ + MatchLabels: map[string]string{ + "app": "redis", + }, + }, + Ports: []softwarecomposition.NetworkPort{ { - PodSelector: &metav1.LabelSelector{ - MatchLabels: map[string]string{ - "app": "redis", - }, - }, - Ports: []softwarecomposition.NetworkPort{ - { - Port: ptrToInt32(6379), - Protocol: softwarecomposition.ProtocolTCP, - Name: "TCP-6379", - }, - { - Port: ptrToInt32(6379), - Protocol: softwarecomposition.ProtocolTCP, - Name: "TCP-6379", - }, - }, + Port: ptrToInt32(6379), + Protocol: softwarecomposition.ProtocolTCP, + Name: "TCP-6379", + }, + { + Port: ptrToInt32(6379), + Protocol: softwarecomposition.ProtocolTCP, + Name: "TCP-6379", }, }, }, @@ -1695,7 +1622,7 @@ func TestGenerateNetworkPolicy(t *testing.T) { }, { name: "selector_based_rules_not_merged", - networkNeighborhood: softwarecomposition.NetworkNeighborhood{ + containerProfile: softwarecomposition.ContainerProfile{ ObjectMeta: metav1.ObjectMeta{ Name: "deployment-selector-rules", Namespace: "kubescape", @@ -1707,42 +1634,38 @@ func TestGenerateNetworkPolicy(t *testing.T) { helpersv1.RelatedNameMetadataKey: "selector-rules", }, }, - Spec: softwarecomposition.NetworkNeighborhoodSpec{ + Spec: softwarecomposition.ContainerProfileSpec{ LabelSelector: metav1.LabelSelector{ MatchLabels: map[string]string{ "app": "selector-rules-app", }, }, - Containers: []softwarecomposition.NetworkNeighborhoodContainer{ + Egress: []softwarecomposition.NetworkNeighbor{ { - Egress: []softwarecomposition.NetworkNeighbor{ + PodSelector: &metav1.LabelSelector{ + MatchLabels: map[string]string{ + "app": "redis", + }, + }, + Ports: []softwarecomposition.NetworkPort{ { - PodSelector: &metav1.LabelSelector{ - MatchLabels: map[string]string{ - "app": "redis", - }, - }, - Ports: []softwarecomposition.NetworkPort{ - { - Port: ptrToInt32(6379), - Protocol: softwarecomposition.ProtocolTCP, - Name: "TCP-6379", - }, - }, + Port: ptrToInt32(6379), + Protocol: softwarecomposition.ProtocolTCP, + Name: "TCP-6379", + }, + }, + }, + { + PodSelector: &metav1.LabelSelector{ + MatchLabels: map[string]string{ + "app": "postgres", }, + }, + Ports: []softwarecomposition.NetworkPort{ { - PodSelector: &metav1.LabelSelector{ - MatchLabels: map[string]string{ - "app": "postgres", - }, - }, - Ports: []softwarecomposition.NetworkPort{ - { - Port: ptrToInt32(6379), - Protocol: softwarecomposition.ProtocolTCP, - Name: "TCP-6379", - }, - }, + Port: ptrToInt32(6379), + Protocol: softwarecomposition.ProtocolTCP, + Name: "TCP-6379", }, }, }, @@ -1824,7 +1747,7 @@ func TestGenerateNetworkPolicy(t *testing.T) { }, { name: "network neighborhood with managed by user annotation should generate policy", - networkNeighborhood: softwarecomposition.NetworkNeighborhood{ + containerProfile: softwarecomposition.ContainerProfile{ ObjectMeta: metav1.ObjectMeta{ Name: "deployment-managed-by-user", Namespace: "kubescape", @@ -1836,24 +1759,21 @@ func TestGenerateNetworkPolicy(t *testing.T) { helpersv1.RelatedNameMetadataKey: "managed-by-user", }, }, - Spec: softwarecomposition.NetworkNeighborhoodSpec{ + Spec: softwarecomposition.ContainerProfileSpec{ LabelSelector: metav1.LabelSelector{ MatchLabels: map[string]string{ "app": "managed-app", }, }, - Containers: []softwarecomposition.NetworkNeighborhoodContainer{ + + Ingress: []softwarecomposition.NetworkNeighbor{ { - Ingress: []softwarecomposition.NetworkNeighbor{ + IPAddress: "10.0.0.1", + Ports: []softwarecomposition.NetworkPort{ { - IPAddress: "10.0.0.1", - Ports: []softwarecomposition.NetworkPort{ - { - Port: ptrToInt32(80), - Protocol: softwarecomposition.ProtocolTCP, - Name: "TCP-80", - }, - }, + Port: ptrToInt32(80), + Protocol: softwarecomposition.ProtocolTCP, + Name: "TCP-80", }, }, }, @@ -1916,7 +1836,7 @@ func TestGenerateNetworkPolicy(t *testing.T) { }, { name: "network neighborhood with completed status should generate policy", - networkNeighborhood: softwarecomposition.NetworkNeighborhood{ + containerProfile: softwarecomposition.ContainerProfile{ ObjectMeta: metav1.ObjectMeta{ Name: "deployment-completed", Namespace: "kubescape", @@ -1928,24 +1848,20 @@ func TestGenerateNetworkPolicy(t *testing.T) { helpersv1.RelatedNameMetadataKey: "completed", }, }, - Spec: softwarecomposition.NetworkNeighborhoodSpec{ + Spec: softwarecomposition.ContainerProfileSpec{ LabelSelector: metav1.LabelSelector{ MatchLabels: map[string]string{ "app": "completed-app", }, }, - Containers: []softwarecomposition.NetworkNeighborhoodContainer{ + Egress: []softwarecomposition.NetworkNeighbor{ { - Egress: []softwarecomposition.NetworkNeighbor{ + IPAddress: "192.168.1.1", + Ports: []softwarecomposition.NetworkPort{ { - IPAddress: "192.168.1.1", - Ports: []softwarecomposition.NetworkPort{ - { - Port: ptrToInt32(8080), - Protocol: softwarecomposition.ProtocolTCP, - Name: "TCP-8080", - }, - }, + Port: ptrToInt32(8080), + Protocol: softwarecomposition.ProtocolTCP, + Name: "TCP-8080", }, }, }, @@ -2008,7 +1924,7 @@ func TestGenerateNetworkPolicy(t *testing.T) { }, { name: "network neighborhood with not ready status should return error", - networkNeighborhood: softwarecomposition.NetworkNeighborhood{ + containerProfile: softwarecomposition.ContainerProfile{ ObjectMeta: metav1.ObjectMeta{ Name: "deployment-not-ready", Namespace: "kubescape", @@ -2020,24 +1936,21 @@ func TestGenerateNetworkPolicy(t *testing.T) { helpersv1.RelatedNameMetadataKey: "not-ready", }, }, - Spec: softwarecomposition.NetworkNeighborhoodSpec{ + Spec: softwarecomposition.ContainerProfileSpec{ LabelSelector: metav1.LabelSelector{ MatchLabels: map[string]string{ "app": "not-ready-app", }, }, - Containers: []softwarecomposition.NetworkNeighborhoodContainer{ + + Ingress: []softwarecomposition.NetworkNeighbor{ { - Ingress: []softwarecomposition.NetworkNeighbor{ + IPAddress: "10.0.0.1", + Ports: []softwarecomposition.NetworkPort{ { - IPAddress: "10.0.0.1", - Ports: []softwarecomposition.NetworkPort{ - { - Port: ptrToInt32(80), - Protocol: softwarecomposition.ProtocolTCP, - Name: "TCP-80", - }, - }, + Port: ptrToInt32(80), + Protocol: softwarecomposition.ProtocolTCP, + Name: "TCP-80", }, }, }, @@ -2051,7 +1964,7 @@ func TestGenerateNetworkPolicy(t *testing.T) { for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { - got, err := GenerateNetworkPolicy(&tt.networkNeighborhood, softwarecomposition.NewKnownServersFinderImpl(tt.knownServers), timeProvider) + got, err := GenerateNetworkPolicy(&tt.containerProfile, softwarecomposition.NewKnownServersFinderImpl(tt.knownServers), timeProvider) if tt.expectError { assert.Error(t, err) diff --git a/pkg/apis/softwarecomposition/networkpolicy/v2/testdata/cp-operator.json b/pkg/apis/softwarecomposition/networkpolicy/v2/testdata/cp-operator.json new file mode 100644 index 000000000..d1b602258 --- /dev/null +++ b/pkg/apis/softwarecomposition/networkpolicy/v2/testdata/cp-operator.json @@ -0,0 +1,299 @@ +{ + "apiVersion": "spdx.softwarecomposition.kubescape.io/v1beta1", + "kind": "ContainerProfile", + "metadata": { + "annotations": { + "kubescape.io/completion": "complete", + "kubescape.io/resource-size": "13", + "kubescape.io/status": "completed", + "kubescape.io/wlid": "wlid://cluster-do-fra1-dwertent/namespace-kubescape/deployment-operator", + "kubescape.io/workload-container-type": "containers" + }, + "creationTimestamp": "2024-05-30T08:20:01Z", + "labels": { + "kubescape.io/instance-template-hash": "55df98fc6d", + "kubescape.io/workload-api-group": "apps", + "kubescape.io/workload-api-version": "v1", + "kubescape.io/workload-kind": "Deployment", + "kubescape.io/workload-name": "operator", + "kubescape.io/workload-namespace": "kubescape", + "kubescape.io/workload-resource-version": "5358810", + "kubescape.io/workload-container-name": "operator" + }, + "name": "replicaset-operator-55df98fc6d", + "namespace": "kubescape", + "resourceVersion": "1", + "uid": "98333be8-c05a-49ff-b0ff-fe029060b241" + }, + "spec": { + "matchLabels": { + "app.kubernetes.io/instance": "kubescape", + "app.kubernetes.io/name": "operator", + "tier": "ks-control-plane" + }, + "ingress": [ + { + "dns": "", + "dnsNames": null, + "identifier": "e09f0b1719b5a3a09e401846cb4a171b6e1b9d5fb00df7d9f886e344aa42b861", + "ipAddress": "10.244.0.73", + "namespaceSelector": null, + "podSelector": null, + "ports": [ + { + "name": "TCP-8000", + "port": 8000, + "protocol": "TCP" + } + ], + "type": "external" + }, + { + "dns": "", + "dnsNames": null, + "identifier": "8d888c23b764ff6cf9fb900bf51c53287f10e889eac145c090890d546751d81e", + "ipAddress": "10.244.0.67", + "namespaceSelector": null, + "podSelector": null, + "ports": [ + { + "name": "TCP-4002", + "port": 4002, + "protocol": "TCP" + } + ], + "type": "external" + }, + { + "dns": "", + "dnsNames": null, + "identifier": "a7831eb3c44184545e41f512277c3e246e60b3fe83272223f114a4db1f9759c0", + "ipAddress": "", + "namespaceSelector": null, + "podSelector": { + "matchLabels": { + "app": "kubescape-scheduler", + "app.kubernetes.io/name": "kubescape-scheduler", + "armo.tier": "kubescape-scan", + "batch.kubernetes.io/controller-uid": "c3f4e988-0cca-40e6-bd25-69872d41281a", + "batch.kubernetes.io/job-name": "kubescape-scheduler-28618366", + "controller-uid": "c3f4e988-0cca-40e6-bd25-69872d41281a", + "job-name": "kubescape-scheduler-28618366", + "kubescape.io/tier": "core" + } + }, + "ports": [ + { + "name": "TCP-4002", + "port": 4002, + "protocol": "TCP" + } + ], + "type": "internal" + } + ], + "egress": [ + { + "dns": "version-check.ks-services.co.", + "dnsNames": [ + "version-check.ks-services.co." + ], + "identifier": "2393462a016456c7d3b0a027c2106de039bb34d36bf58ffff7fc8635304170aa", + "ipAddress": "35.186.253.219", + "namespaceSelector": null, + "podSelector": null, + "ports": [ + { + "name": "TCP-443", + "port": 443, + "protocol": "TCP" + } + ], + "type": "external" + }, + { + "dns": "", + "dnsNames": null, + "identifier": "ad98a9e00a1e4a5efbbd827f432595a31085d0e8dcec365dbdfd8141bf3cbe3e", + "ipAddress": "", + "namespaceSelector": null, + "podSelector": { + "matchLabels": { + "app": "otel-collector" + } + }, + "ports": [ + { + "name": "TCP-4317", + "port": 4317, + "protocol": "TCP" + } + ], + "type": "internal" + }, + { + "dns": "", + "dnsNames": null, + "identifier": "ed8a3fa8750dd7045e9abb755f5dbd1a2025f5ed49c1ed67b7d8e1c534899bbb", + "ipAddress": "", + "namespaceSelector": null, + "podSelector": { + "matchLabels": { + "app": "kubescape" + } + }, + "ports": [ + { + "name": "TCP-8080", + "port": 8080, + "protocol": "TCP" + } + ], + "type": "internal" + }, + { + "dns": "", + "dnsNames": null, + "identifier": "e6d07dcea08c02c35494f7aed68e7cff6d51843c5fbb36032a905f11ba833c13", + "ipAddress": "", + "namespaceSelector": null, + "podSelector": { + "matchLabels": { + "app": "gateway" + } + }, + "ports": [ + { + "name": "TCP-8001", + "port": 8001, + "protocol": "TCP" + } + ], + "type": "internal" + }, + { + "dns": "", + "dnsNames": null, + "identifier": "ba56b560f0008cb2227752015bf87c5fc365fb8dfd5599162cbe71f105dfce00", + "ipAddress": "", + "namespaceSelector": null, + "podSelector": { + "matchLabels": { + "app": "kubevuln" + } + }, + "ports": [ + { + "name": "TCP-8080", + "port": 8080, + "protocol": "TCP" + } + ], + "type": "internal" + }, + { + "dns": "report.armo.cloud.", + "dnsNames": [ + "report.armo.cloud." + ], + "identifier": "c6bf8190e40278af21d4d561ed3256e05a6c240a1865f19baf353cdb45d8c363", + "ipAddress": "16.170.46.131", + "namespaceSelector": null, + "podSelector": null, + "ports": [ + { + "name": "TCP-443", + "port": 443, + "protocol": "TCP" + } + ], + "type": "external" + }, + { + "dns": "report.armo.cloud.", + "dnsNames": [ + "report.armo.cloud." + ], + "identifier": "83260a3ba8236e69f12ebb706196a2d9541b6c2771cb481dde4f3f5816a1cd94", + "ipAddress": "16.171.184.118", + "namespaceSelector": null, + "podSelector": null, + "ports": [ + { + "name": "TCP-443", + "port": 443, + "protocol": "TCP" + } + ], + "type": "external" + }, + { + "dns": "", + "dnsNames": null, + "identifier": "e5e8ca3d76f701a19b7478fdc1c8c24ccc6cef9902b52c8c7e015439e2a1ddf3", + "ipAddress": "", + "namespaceSelector": { + "matchLabels": { + "kubernetes.io/metadata.name": "kube-system" + } + }, + "podSelector": { + "matchLabels": { + "k8s-app": "kube-dns" + } + }, + "ports": [ + { + "name": "UDP-53", + "port": 53, + "protocol": "UDP" + } + ], + "type": "internal" + }, + { + "dns": "", + "dnsNames": null, + "identifier": "275a177484719f71d0e1dc151f5bca143095b34c1bf4b3525131cce48970bedb", + "ipAddress": "10.245.0.1", + "namespaceSelector": { + "matchLabels": { + "kubernetes.io/metadata.name": "default" + } + }, + "podSelector": { + "matchLabels": { + "component": "apiserver", + "provider": "kubernetes" + } + }, + "ports": [ + { + "name": "TCP-443", + "port": 443, + "protocol": "TCP" + } + ], + "type": "internal" + }, + { + "dns": "report.armo.cloud.", + "dnsNames": [ + "report.armo.cloud." + ], + "identifier": "ba5459ff4343e49a03322aab030b548e688dcac5fd6814e3ab8415e949c71bb2", + "ipAddress": "13.50.180.111", + "namespaceSelector": null, + "podSelector": null, + "ports": [ + { + "name": "TCP-443", + "port": 443, + "protocol": "TCP" + } + ], + "type": "external" + } + ] + } +} diff --git a/pkg/apis/softwarecomposition/networkpolicy/v2/testdata/known-servers.json b/pkg/apis/softwarecomposition/networkpolicy/v2/testdata/known-servers.json new file mode 100644 index 000000000..256f27201 --- /dev/null +++ b/pkg/apis/softwarecomposition/networkpolicy/v2/testdata/known-servers.json @@ -0,0 +1,24 @@ +[ + { + "apiVersion": "spdx.softwarecomposition.kubescape.io/v1beta1", + "kind": "KnownServer", + "metadata": { + "creationTimestamp": "2024-06-02T08:04:02Z", + "name": "my-org", + "resourceVersion": "1", + "uid": "caf185d6-a59a-4fd1-81cd-0ce44be34b44" + }, + "spec": [ + { + "ipBlock": "16.170.0.0/15", + "name": "my-cloud", + "server": "cloud.io" + }, + { + "ipBlock": "13.50.180.111/24", + "name": "my-cloud", + "server": "cloud.io" + } + ] + } +] \ No newline at end of file diff --git a/pkg/apis/softwarecomposition/networkpolicy/v2/testdata/np-operator.json b/pkg/apis/softwarecomposition/networkpolicy/v2/testdata/np-operator.json new file mode 100644 index 000000000..94d54d604 --- /dev/null +++ b/pkg/apis/softwarecomposition/networkpolicy/v2/testdata/np-operator.json @@ -0,0 +1,281 @@ +{ + "apiVersion": "spdx.softwarecomposition.kubescape.io/v1beta1", + "kind": "GeneratedNetworkPolicy", + "metadata": { + "creationTimestamp": null, + "labels": { + "kubescape.io/workload-api-group": "apps", + "kubescape.io/workload-api-version": "v1", + "kubescape.io/workload-kind": "Deployment", + "kubescape.io/workload-name": "operator", + "kubescape.io/workload-namespace": "kubescape", + "kubescape.io/workload-resource-version": "5358810" + }, + "name": "replicaset-operator-55df98fc6d", + "namespace": "kubescape" + }, + "policyRef": [ + { + "dns": "report.armo.cloud.", + "ipBlock": "13.50.180.111/24", + "name": "my-cloud", + "originalIP": "13.50.180.111", + "server": "cloud.io" + }, + { + "dns": "report.armo.cloud.", + "ipBlock": "16.170.0.0/15", + "name": "my-cloud", + "originalIP": "16.171.184.118", + "server": "cloud.io" + }, + { + "dns": "report.armo.cloud.", + "ipBlock": "16.170.0.0/15", + "name": "my-cloud", + "originalIP": "16.170.46.131", + "server": "cloud.io" + }, + { + "dns": "version-check.ks-services.co.", + "ipBlock": "35.186.253.219/32", + "name": "", + "originalIP": "35.186.253.219", + "server": "" + } + ], + "spec": { + "apiVersion": "networking.k8s.io/v1", + "kind": "NetworkPolicy", + "metadata": { + "annotations": { + "generated-by": "kubescape" + }, + "creationTimestamp": null, + "labels": { + "kubescape.io/workload-api-group": "apps", + "kubescape.io/workload-api-version": "v1", + "kubescape.io/workload-kind": "Deployment", + "kubescape.io/workload-name": "operator", + "kubescape.io/workload-namespace": "kubescape", + "kubescape.io/workload-resource-version": "5358810" + }, + "name": "deployment-operator", + "namespace": "kubescape" + }, + "spec": { + "ingress": [ + { + "from": [ + { + "ipBlock": { + "cidr": "10.244.0.67/32" + } + } + ], + "ports": [ + { + "port": 4002, + "protocol": "TCP" + } + ] + }, + { + "from": [ + { + "ipBlock": { + "cidr": "10.244.0.73/32" + } + } + ], + "ports": [ + { + "port": 8000, + "protocol": "TCP" + } + ] + }, + { + "from": [ + { + "podSelector": { + "matchLabels": { + "app": "kubescape-scheduler", + "app.kubernetes.io/name": "kubescape-scheduler", + "armo.tier": "kubescape-scan", + "batch.kubernetes.io/controller-uid": "c3f4e988-0cca-40e6-bd25-69872d41281a", + "batch.kubernetes.io/job-name": "kubescape-scheduler-28618366", + "controller-uid": "c3f4e988-0cca-40e6-bd25-69872d41281a", + "job-name": "kubescape-scheduler-28618366", + "kubescape.io/tier": "core" + } + } + } + ], + "ports": [ + { + "port": 4002, + "protocol": "TCP" + } + ] + } + ], + "egress": [ + { + "ports": [ + { + "port": 443, + "protocol": "TCP" + } + ], + "to": [ + { + "ipBlock": { + "cidr": "13.50.180.111/24" + } + }, + { + "ipBlock": { + "cidr": "16.170.0.0/15" + } + }, + { + "ipBlock": { + "cidr": "35.186.253.219/32" + } + } + ] + }, + { + "ports": [ + { + "port": 4317, + "protocol": "TCP" + } + ], + "to": [ + { + "podSelector": { + "matchLabels": { + "app": "otel-collector" + } + } + } + ] + }, + { + "ports": [ + { + "port": 53, + "protocol": "UDP" + } + ], + "to": [ + { + "namespaceSelector": { + "matchLabels": { + "kubernetes.io/metadata.name": "kube-system" + } + }, + "podSelector": { + "matchLabels": { + "k8s-app": "kube-dns" + } + } + } + ] + }, + { + "ports": [ + { + "port": 8001, + "protocol": "TCP" + } + ], + "to": [ + { + "podSelector": { + "matchLabels": { + "app": "gateway" + } + } + } + ] + }, + { + "ports": [ + { + "port": 8080, + "protocol": "TCP" + } + ], + "to": [ + { + "podSelector": { + "matchLabels": { + "app": "kubevuln" + } + } + } + ] + }, + { + "ports": [ + { + "port": 8080, + "protocol": "TCP" + } + ], + "to": [ + { + "podSelector": { + "matchLabels": { + "app": "kubescape" + } + } + } + ] + }, + { + "ports": [ + { + "port": 443, + "protocol": "TCP" + } + ], + "to": [ + { + "namespaceSelector": { + "matchLabels": { + "kubernetes.io/metadata.name": "default" + } + }, + "podSelector": { + "matchLabels": { + "component": "apiserver", + "provider": "kubernetes" + } + } + }, + { + "ipBlock": { + "cidr": "10.245.0.1/32" + } + } + ] + } + ], + "podSelector": { + "matchLabels": { + "app.kubernetes.io/instance": "kubescape", + "app.kubernetes.io/name": "operator", + "tier": "ks-control-plane" + } + }, + "policyTypes": [ + "Ingress", + "Egress" + ] + } + } +} diff --git a/pkg/apis/softwarecomposition/networkpolicy/v2/testdata/np.new.json b/pkg/apis/softwarecomposition/networkpolicy/v2/testdata/np.new.json new file mode 100644 index 000000000..6d097c5f1 --- /dev/null +++ b/pkg/apis/softwarecomposition/networkpolicy/v2/testdata/np.new.json @@ -0,0 +1,281 @@ +{ + "kind": "GeneratedNetworkPolicy", + "apiVersion": "spdx.softwarecomposition.kubescape.io/v1beta1", + "metadata": { + "name": "replicaset-operator-55df98fc6d", + "namespace": "kubescape", + "creationTimestamp": null, + "labels": { + "kubescape.io/workload-api-group": "apps", + "kubescape.io/workload-api-version": "v1", + "kubescape.io/workload-kind": "Deployment", + "kubescape.io/workload-name": "operator", + "kubescape.io/workload-namespace": "kubescape", + "kubescape.io/workload-resource-version": "5358810" + } + }, + "policyRef": [ + { + "ipBlock": "35.186.253.219/32", + "originalIP": "35.186.253.219", + "dns": "version-check.ks-services.co.", + "name": "", + "server": "" + }, + { + "ipBlock": "16.170.0.0/15", + "originalIP": "16.170.46.131", + "dns": "report.armo.cloud.", + "name": "my-cloud", + "server": "cloud.io" + }, + { + "ipBlock": "16.170.0.0/15", + "originalIP": "16.171.184.118", + "dns": "report.armo.cloud.", + "name": "my-cloud", + "server": "cloud.io" + }, + { + "ipBlock": "13.50.180.111/24", + "originalIP": "13.50.180.111", + "dns": "report.armo.cloud.", + "name": "my-cloud", + "server": "cloud.io" + } + ], + "spec": { + "kind": "NetworkPolicy", + "apiVersion": "networking.k8s.io/v1", + "metadata": { + "name": "replicaset-operator-55df98fc6d", + "namespace": "kubescape", + "creationTimestamp": null, + "labels": { + "kubescape.io/workload-api-group": "apps", + "kubescape.io/workload-api-version": "v1", + "kubescape.io/workload-kind": "Deployment", + "kubescape.io/workload-name": "operator", + "kubescape.io/workload-namespace": "kubescape", + "kubescape.io/workload-resource-version": "5358810" + }, + "annotations": { + "generated-by": "kubescape" + } + }, + "spec": { + "podSelector": { + "matchLabels": { + "app.kubernetes.io/instance": "kubescape", + "app.kubernetes.io/name": "operator", + "tier": "ks-control-plane" + } + }, + "ingress": [ + { + "ports": [ + { + "protocol": "TCP", + "port": 4002 + } + ], + "from": [ + { + "ipBlock": { + "cidr": "10.244.0.67/32" + } + } + ] + }, + { + "ports": [ + { + "protocol": "TCP", + "port": 8000 + } + ], + "from": [ + { + "ipBlock": { + "cidr": "10.244.0.73/32" + } + } + ] + }, + { + "ports": [ + { + "protocol": "TCP", + "port": 4002 + } + ], + "from": [ + { + "podSelector": { + "matchLabels": { + "app": "kubescape-scheduler", + "app.kubernetes.io/name": "kubescape-scheduler", + "armo.tier": "kubescape-scan", + "batch.kubernetes.io/controller-uid": "c3f4e988-0cca-40e6-bd25-69872d41281a", + "batch.kubernetes.io/job-name": "kubescape-scheduler-28618366", + "controller-uid": "c3f4e988-0cca-40e6-bd25-69872d41281a", + "job-name": "kubescape-scheduler-28618366", + "kubescape.io/tier": "core" + } + } + } + ] + } + ], + "egress": [ + { + "ports": [ + { + "protocol": "TCP", + "port": 443 + } + ], + "to": [ + { + "ipBlock": { + "cidr": "13.50.180.111/24" + } + }, + { + "ipBlock": { + "cidr": "16.170.0.0/15" + } + }, + { + "ipBlock": { + "cidr": "35.186.253.219/32" + } + } + ] + }, + { + "ports": [ + { + "protocol": "TCP", + "port": 4317 + } + ], + "to": [ + { + "podSelector": { + "matchLabels": { + "app": "otel-collector" + } + } + } + ] + }, + { + "ports": [ + { + "protocol": "TCP", + "port": 8080 + } + ], + "to": [ + { + "podSelector": { + "matchLabels": { + "app": "kubescape" + } + } + } + ] + }, + { + "ports": [ + { + "protocol": "TCP", + "port": 8001 + } + ], + "to": [ + { + "podSelector": { + "matchLabels": { + "app": "gateway" + } + } + } + ] + }, + { + "ports": [ + { + "protocol": "TCP", + "port": 8080 + } + ], + "to": [ + { + "podSelector": { + "matchLabels": { + "app": "kubevuln" + } + } + } + ] + }, + { + "ports": [ + { + "protocol": "UDP", + "port": 53 + } + ], + "to": [ + { + "podSelector": { + "matchLabels": { + "k8s-app": "kube-dns" + } + }, + "namespaceSelector": { + "matchLabels": { + "kubernetes.io/metadata.name": "kube-system" + } + } + } + ] + }, + { + "ports": [ + { + "protocol": "TCP", + "port": 443 + } + ], + "to": [ + { + "podSelector": { + "matchLabels": { + "component": "apiserver", + "provider": "kubernetes" + } + }, + "namespaceSelector": { + "matchLabels": { + "kubernetes.io/metadata.name": "default" + } + } + }, + { + "ipBlock": { + "cidr": "10.245.0.1/32" + } + } + ] + } + ], + "policyTypes": [ + "Ingress", + "Egress" + ] + } + } +} \ No newline at end of file diff --git a/pkg/apis/softwarecomposition/v1beta1/generated.proto b/pkg/apis/softwarecomposition/v1beta1/generated.proto index 55c527b79..9446ef949 100644 --- a/pkg/apis/softwarecomposition/v1beta1/generated.proto +++ b/pkg/apis/softwarecomposition/v1beta1/generated.proto @@ -255,7 +255,7 @@ message ContainerProfileSpec { repeated IdentifiedCallStack identifiedCallStacks = 11; - // WARNING report fields from NetworkNeighborhoodContainer here, increment proto IDs by 100 + // WARNING report the network fields here, increment proto IDs by 100 optional .k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelector labelSelector = 101; repeated NetworkNeighbor ingress = 102; diff --git a/pkg/apis/softwarecomposition/zz_generated.deepcopy.go b/pkg/apis/softwarecomposition/zz_generated.deepcopy.go index 7ce140bea..4eae94315 100644 --- a/pkg/apis/softwarecomposition/zz_generated.deepcopy.go +++ b/pkg/apis/softwarecomposition/zz_generated.deepcopy.go @@ -1897,93 +1897,6 @@ func (in *NetworkNeighbor) DeepCopy() *NetworkNeighbor { return out } -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *NetworkNeighborhood) DeepCopyInto(out *NetworkNeighborhood) { - *out = *in - out.TypeMeta = in.TypeMeta - in.ObjectMeta.DeepCopyInto(&out.ObjectMeta) - in.Spec.DeepCopyInto(&out.Spec) - return -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new NetworkNeighborhood. -func (in *NetworkNeighborhood) DeepCopy() *NetworkNeighborhood { - if in == nil { - return nil - } - out := new(NetworkNeighborhood) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *NetworkNeighborhoodContainer) DeepCopyInto(out *NetworkNeighborhoodContainer) { - *out = *in - if in.Ingress != nil { - in, out := &in.Ingress, &out.Ingress - *out = make([]NetworkNeighbor, len(*in)) - for i := range *in { - (*in)[i].DeepCopyInto(&(*out)[i]) - } - } - if in.Egress != nil { - in, out := &in.Egress, &out.Egress - *out = make([]NetworkNeighbor, len(*in)) - for i := range *in { - (*in)[i].DeepCopyInto(&(*out)[i]) - } - } - return -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new NetworkNeighborhoodContainer. -func (in *NetworkNeighborhoodContainer) DeepCopy() *NetworkNeighborhoodContainer { - if in == nil { - return nil - } - out := new(NetworkNeighborhoodContainer) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *NetworkNeighborhoodSpec) DeepCopyInto(out *NetworkNeighborhoodSpec) { - *out = *in - in.LabelSelector.DeepCopyInto(&out.LabelSelector) - if in.Containers != nil { - in, out := &in.Containers, &out.Containers - *out = make([]NetworkNeighborhoodContainer, len(*in)) - for i := range *in { - (*in)[i].DeepCopyInto(&(*out)[i]) - } - } - if in.InitContainers != nil { - in, out := &in.InitContainers, &out.InitContainers - *out = make([]NetworkNeighborhoodContainer, len(*in)) - for i := range *in { - (*in)[i].DeepCopyInto(&(*out)[i]) - } - } - if in.EphemeralContainers != nil { - in, out := &in.EphemeralContainers, &out.EphemeralContainers - *out = make([]NetworkNeighborhoodContainer, len(*in)) - for i := range *in { - (*in)[i].DeepCopyInto(&(*out)[i]) - } - } - return -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new NetworkNeighborhoodSpec. -func (in *NetworkNeighborhoodSpec) DeepCopy() *NetworkNeighborhoodSpec { - if in == nil { - return nil - } - out := new(NetworkNeighborhoodSpec) - in.DeepCopyInto(out) - return out -} - // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *NetworkPolicy) DeepCopyInto(out *NetworkPolicy) { *out = *in diff --git a/pkg/generated/applyconfiguration/softwarecomposition/v1beta1/containerprofilespec.go b/pkg/generated/applyconfiguration/softwarecomposition/v1beta1/containerprofilespec.go index f043d24e2..9b21bf6e8 100644 --- a/pkg/generated/applyconfiguration/softwarecomposition/v1beta1/containerprofilespec.go +++ b/pkg/generated/applyconfiguration/softwarecomposition/v1beta1/containerprofilespec.go @@ -37,7 +37,7 @@ type ContainerProfileSpecApplyConfiguration struct { ImageTag *string `json:"imageTag,omitempty"` PolicyByRuleId map[string]RulePolicyApplyConfiguration `json:"rulePolicies,omitempty"` IdentifiedCallStacks []IdentifiedCallStackApplyConfiguration `json:"identifiedCallStacks,omitempty"` - // WARNING report fields from NetworkNeighborhoodContainer here, increment proto IDs by 100 + // WARNING report the network fields here, increment proto IDs by 100 v1.LabelSelectorApplyConfiguration `json:",inline"` Ingress []NetworkNeighborApplyConfiguration `json:"ingress,omitempty"` Egress []NetworkNeighborApplyConfiguration `json:"egress,omitempty"` diff --git a/pkg/registry/file/generatednetworkpolicy.go b/pkg/registry/file/generatednetworkpolicy.go index 01baa9a47..b0a4e027f 100644 --- a/pkg/registry/file/generatednetworkpolicy.go +++ b/pkg/registry/file/generatednetworkpolicy.go @@ -7,7 +7,6 @@ import ( "github.com/kubescape/go-logger" "github.com/kubescape/go-logger/helpers" - helpersv1 "github.com/kubescape/k8s-interface/instanceidhandler/v1/helpers" "github.com/kubescape/storage/pkg/apis/softwarecomposition" "github.com/kubescape/storage/pkg/apis/softwarecomposition/networkpolicy/v2" "go.opentelemetry.io/otel" @@ -54,37 +53,6 @@ func (s *GeneratedNetworkPolicyStorage) GetCurrentResourceVersion(_ context.Cont return 0, nil } -// containerProfileToNetworkNeighborhood projects a ContainerProfile into the -// in-process NetworkNeighborhood-shaped intermediate consumed by the network -// policy generator. This is the projection that previously lived in the (now -// removed) NetworkNeighborhoodStorage: the container's ingress/egress and the -// workload label selector are copied into a single-container neighborhood, -// bucketed by the container type annotation. -func containerProfileToNetworkNeighborhood(cp *softwarecomposition.ContainerProfile) *softwarecomposition.NetworkNeighborhood { - nn := &softwarecomposition.NetworkNeighborhood{ - TypeMeta: cp.TypeMeta, - ObjectMeta: *cp.ObjectMeta.DeepCopy(), - } - nn.Spec.MatchLabels = cp.Spec.MatchLabels - nn.Spec.MatchExpressions = cp.Spec.MatchExpressions - - container := softwarecomposition.NetworkNeighborhoodContainer{ - Name: cp.Labels[helpersv1.ContainerNameMetadataKey], - Ingress: cp.Spec.Ingress, - Egress: cp.Spec.Egress, - } - switch cp.Annotations[helpersv1.ContainerTypeMetadataKey] { - case "initContainers": - nn.Spec.InitContainers = append(nn.Spec.InitContainers, container) - case "ephemeralContainers": - nn.Spec.EphemeralContainers = append(nn.Spec.EphemeralContainers, container) - default: - // "containers" and the empty/back-compat case both land here. - nn.Spec.Containers = append(nn.Spec.Containers, container) - } - return nn -} - // Get generates and returns a single GeneratedNetworkPolicy object func (s *GeneratedNetworkPolicyStorage) Get(ctx context.Context, key string, opts storage.GetOptions, objPtr runtime.Object) error { ctx, span := otel.Tracer("").Start(ctx, "GeneratedNetworkPolicyStorage.Get") @@ -93,8 +61,8 @@ func (s *GeneratedNetworkPolicyStorage) Get(ctx context.Context, key string, opt logger.L().Debug("GeneratedNetworkPolicyStorage.Get", helpers.String("key", key)) - // retrieve the container profile with the same name and project it into a - // NetworkNeighborhood-shaped intermediate in-process. + // retrieve the container profile with the same name and generate the policy + // directly from it. containerProfileObjPtr := &softwarecomposition.ContainerProfile{} key = replaceKeyForKind(key, containerProfilesResource) @@ -103,15 +71,13 @@ func (s *GeneratedNetworkPolicyStorage) Get(ctx context.Context, key string, opt return err } - networkNeighborhoodObjPtr := containerProfileToNetworkNeighborhood(containerProfileObjPtr) - knownServersListObjPtr := &softwarecomposition.KnownServerList{} if err := s.realStore.GetByCluster(ctx, softwarecomposition.GroupName, knownServersResource, knownServersListObjPtr); err != nil { return err } - generatedNetworkPolicy, err := networkpolicy.GenerateNetworkPolicy(networkNeighborhoodObjPtr, softwarecomposition.NewKnownServersFinderImpl(knownServersListObjPtr.Items), metav1.Now()) + generatedNetworkPolicy, err := networkpolicy.GenerateNetworkPolicy(containerProfileObjPtr, softwarecomposition.NewKnownServersFinderImpl(knownServersListObjPtr.Items), metav1.Now()) if err != nil { return fmt.Errorf("error generating network policy: %w", err) } @@ -145,8 +111,8 @@ func (s *GeneratedNetworkPolicyStorage) GetList(ctx context.Context, key string, } for i := range containerProfileObjListPtr.Items { - nn := containerProfileToNetworkNeighborhood(&containerProfileObjListPtr.Items[i]) - if !networkpolicy.IsAvailable(nn) { + cp := &containerProfileObjListPtr.Items[i] + if !networkpolicy.IsAvailable(cp) { continue } generatedNetworkPolicyList.Items = append(generatedNetworkPolicyList.Items, softwarecomposition.GeneratedNetworkPolicy{ @@ -155,9 +121,9 @@ func (s *GeneratedNetworkPolicyStorage) GetList(ctx context.Context, key string, APIVersion: "spdx.softwarecomposition.kubescape.io/v1beta1", }, ObjectMeta: metav1.ObjectMeta{ - Name: nn.Name, - Namespace: nn.Namespace, - Labels: nn.Labels, + Name: cp.Name, + Namespace: cp.Namespace, + Labels: cp.Labels, CreationTimestamp: metav1.Now(), }, PoliciesRef: []softwarecomposition.PolicyRef{}, From 54e23b4a44def49a6b8d89d81f355d2508d437aa Mon Sep 17 00:00:00 2001 From: Entlein Date: Wed, 29 Jul 2026 13:13:24 +0200 Subject: [PATCH 07/17] test: add GeneratedNetworkPolicy diff-oracle + per-container test The migrated network-policy fixtures (cp-operator.json + the np-operator/np.new goldens) were moved but not yet consumed by a test. Add TestGenerateNetworkPolicyFromFile: it loads the v1beta1 ContainerProfile fixture, converts it to the internal type as the read path does, generates a policy, and asserts the result reproduces the pre-migration golden output under the generator's deterministic sort -- a diff-oracle that generating directly from a ContainerProfile matches the removed NetworkNeighborhood intermediate path. Add TestGenerateNetworkPolicy_PerContainerProfiles: two per-container profiles for one workload each generate their own policy reflecting only that container's network, with no cross-container bleed -- pinning the