github.com/castai/kvisor@v1.7.1-0.20240516114728-b3572a2607b5/api/v1/runtime/runtime_agent_api.proto

syntax = "proto3";

package runtime.v1;

import "api/google/protobuf/timestamp.proto";
import "api/v1/runtime/common.proto";

option go_package = "github.com/castai/kvisord/api/runtime/v1";

// RuntimeSecurityAgentAPI is used in kvisord. Should be mirrored.
service RuntimeSecurityAgentAPI {
  rpc GetConfiguration(GetConfigurationRequest) returns (GetConfigurationResponse) {}
  rpc EventsWriteStream(stream Event) returns (WriteStreamResponse) {}
  rpc LogsWriteStream(stream LogEvent) returns (WriteStreamResponse) {}
  rpc ContainerStatsWriteStream(stream ContainerStatsBatch) returns (WriteStreamResponse) {}

  rpc GetSyncState(GetSyncStateRequest) returns (GetSyncStateResponse) {}
  rpc UpdateSyncState(UpdateSyncStateRequest) returns (UpdateSyncStateResponse) {}

  rpc KubernetesDeltaIngest(stream KubernetesDeltaItem) returns (stream KubernetesDeltaIngestResponse) {}
  rpc ImageMetadataIngest(ImageMetadata) returns (ImageMetadataIngestResponse) {}
  rpc KubeBenchReportIngest(KubeBenchReport) returns (KubeBenchReportIngestResponse) {}
  rpc KubeLinterReportIngest(KubeLinterReport) returns (KubeLinterReportIngestResponse) {}
}

message GetConfigurationRequest {
  oneof current_config {
    ControllerConfig controller = 1;
    AgentConfig agent = 2;
  }
}

message GetConfigurationResponse {
  Configuration config = 1;
}

message Configuration {}

message ControllerConfig {
  string log_level = 1;
  string log_rate_interval = 2;
  int32 log_rate_burst = 3;

  string version = 4;
  string chart_version = 5;

  string pod_namespace = 6;
  string pod_name = 7;

  int32 http_listen_port = 8;
  int32 metrics_http_listen_port = 9;

  string pyroscope_addr = 10;

  CastaiControllerConfig castai_controller = 11;
  CastaiConfig castai_env = 12;
  ImageScanConfig image_scan = 13;
  LinterConfig linter = 14;
  KubeBenchConfig kube_bench = 15;
  DeltaConfig delta = 16;
  JobsCleanupConfig jobs_cleanup = 17;
  ControllerAgentConfig agent_config = 18;
}

message CastaiControllerConfig {
  string remote_config_sync_duration = 1;
}

message ImageScanConfig {
  bool enabled = 1;
  string castai_secret_ref_name = 2;
  string scan_interval = 3;
  string scan_timeout = 4;
  int64 max_concurrent_scans = 5;
  string scan_job_image_pull_policy = 6;
  string mode = 7;
  string cpu_request = 8;
  string cpu_limit = 9;
  string memory_request = 10;
  string memory_limit = 11;
  bool profile_enabled = 12;
  bool phlare_enabled = 13;
  string private_registry_pull_secret = 14;
  string service_account = 15;
  string init_delay = 16;
  string image_scan_blobs_cache_url = 17;
}

message LinterConfig {
  bool enabled = 1;
  string scan_interval = 2;
  string init_delay = 3;
}

message KubeBenchConfig {
  bool enabled = 1;
  bool force = 2;
  string scan_interval = 3;
  string job_image_pull_policy = 4;
  string cloud_provider = 5;
  string job_namespace = 6;
}

message DeltaConfig {
  bool enabled = 1;
  string interval = 2;
  string initial_deltay = 3;
  string send_timeout = 4;
  bool use_compression = 5;
}

message JobsCleanupConfig {
  string cleanup_interval = 1;
  string cleanup_job_age = 2;
  string namespace = 3;
}

message AgentConfig {
  string log_level = 1;
  string log_rate_interval = 2;
  int32 log_rate_burst = 3;
  string send_logs_level = 4;
  string version = 5;
  string btf_path = 6;
  string pyroscope_addr = 7;
  string containerd_sock_path = 9;
  string host_cgroups_dir = 10;
  int32 metrics_http_listen_port = 12;
  AgentStateControllerConfig state = 13;
  int32 ebpf_events_per_cpu_buffer = 14;
  int32 ebpf_events_output_chan_size = 15;
  repeated string muted_namespaces = 16;
  SignatureEngineConfig signature_engine_config = 17;
  CastaiConfig castai_env = 18;
  EnricherConfig enricher_config = 19;
  NetflowConfig netflow = 20;
}

message ControllerAgentConfig {
  bool enabled = 1;
}

message AgentStateControllerConfig {
  int32 events_sink_queue_size = 1;
  string container_stats_scrape_interval = 2;
}

message SOCKS5DetectedSignatureConfig {
  uint32 cache_size = 1;
}

message SignatureEngineConfig {
  int32 input_chan_size = 1;
  int32 output_chan_size = 2;
  bool tty_detected_signature_enabled = 3;
  bool socks5_detected_signature_enabled = 4;
  SOCKS5DetectedSignatureConfig socks5_detected_signature_config = 5;
}

message CastaiConfig {
  string cluster_id = 1;
  string api_grpc_addr = 2;
  bool insecure = 3;
}

message EnricherConfig {
  bool enable_file_hash_enricher = 1;
}

message NetflowConfig {
  bool enabled = 1;
  uint64 sample_submit_interval_seconds = 2;
}

enum EventType {
  UNKNOWN = 0;
  EVENT_EXEC = 1;
  EVENT_DNS = 2;
  EVENT_TCP_CONNECT = 3;
  EVENT_TCP_CONNECT_ERROR = 4;
  EVENT_TCP_LISTEN = 5;
  EVENT_FILE_CHANGE = 6;
  EVENT_PROCESS_OOM = 7;
  EVENT_MAGIC_WRITE = 8;
  EVENT_SIGNATURE = 9;

  EVENT_ANY = 999;
}

message Event {
  EventType event_type = 1;
  uint64 timestamp = 2; // Stored as unix timestamp in nanoseconds.
  string process_name = 3;
  string namespace = 4;
  string pod_name = 5;
  string container_name = 6;
  string workload_name = 7;
  string workload_kind = 13;
  string pod_uid = 8;
  string container_id = 9;
  uint64 cgroup_id = 10;
  uint32 host_pid = 11;
  string workload_uid = 12;

  oneof data {
    v1.Exec exec = 21;
    v1.DNS dns = 22;
    v1.File file = 23;
    v1.Tuple tuple = 24;
    v1.SignatureEvent signature = 25;
    v1.Any any = 26;
  }
}

message WriteStreamResponse {}

message SendLogsResponse {}

message ContainerStatsBatch {
  repeated ContainerStats items = 1;
}

message ContainerStats {
  string namespace = 1;
  string pod_name = 2;
  string container_name = 3;
  string workload_name = 4;
  string workload_kind = 7;
  string pod_uid = 5;
  string container_id = 6;
  repeated v1.Stats stats = 21;
}

enum KubernetesDeltaItemEvent {
  DELTA_ADD = 0;
  DELTA_UPDATE = 1;
  DELTA_REMOVE = 2;
}

message KubernetesDeltaItem {
  KubernetesDeltaItemEvent event = 1;
  string object_uid = 2;
  string object_name = 3;
  string object_namespace = 4;
  string object_kind = 5;
  string object_api_version = 6;
  google.protobuf.Timestamp object_created_at = 7;
  repeated Container object_containers = 8;
  string object_owner_uid = 9;
  map<string, string> object_labels = 10;
  map<string, string> object_annotations = 11;
  bytes object_status = 12;
  bytes object_spec = 13;
}

message Container {
  string name = 1;
  string image_name = 2;
}

message KubernetesDeltaIngestResponse {}

message ImageMetadata {
  string image_name = 1;
  string image_id = 2;
  string image_digest = 3;
  string architecture = 5;
  string os_name = 6;
  google.protobuf.Timestamp created_at = 7;
  repeated string resource_ids = 8;

  bytes packages = 9; // JSON containing []github.com/aquasecurity/trivy/pkg/fanal/types.BlobInfo type.
  bytes manifest = 10; // JSON containing github.com/google/go-containerregistry/pkg/v1.Manifest type.
  bytes index = 11; // JSON containing github.com/google/go-containerregistry/pkg/v1.IndexManifest type.
  bytes config_file = 12; // JSON containing github.com/google/go-containerregistry/pkg/v1.ConfigFile type.
}

message ImageMetadataIngestResponse {}

message GetSyncStateRequest {
  repeated string image_ids = 1;
}
message GetSyncStateResponse {
  ImagesSyncState images = 1;
}

message ImagesSyncState {
  bool full_resync_required = 1;
  repeated Image images = 2;
}

enum ImageScanStatus {
  IMAGE_SCAN_STATUS_UNKNOWN = 0;
  IMAGE_SCAN_STATUS_SCANNED = 1;
  IMAGE_SCAN_STATUS_PENDING = 2;
  IMAGE_SCAN_STATUS_SCAN_ERROR = 3;
}

message Image {
  string id = 1;
  string name = 2;
  string architecture = 3;
  repeated string resource_ids = 4;
  ImageScanStatus scan_status = 5;
  string scan_error = 6;
}

message UpdateSyncStateRequest {
  bool full_snapshot = 1;
  repeated Image images = 2;
}

message UpdateSyncStateResponse {}

message KubeBenchReport {
  repeated KubeBenchControls controls = 1;
  KubeBenchNode node = 2;
}
message KubeBenchReportIngestResponse {}

message KubeBenchNode {
  string node_name = 1;
  string resource_uid = 2;
}

message KubeBenchControls {
  string version = 1;
  repeated KubeBenchGroup groups = 2;
}

message KubeBenchGroup {
  repeated KubeBenchCheck checks = 1;
}

message KubeBenchCheck {
  string id = 1;
  string text = 2;
  repeated string test_info = 3;
  string state = 4;
}

message KubeLinterReport {
  repeated KubeLinterCheck checks = 1;
}
message KubeLinterReportIngestResponse {}

message KubeLinterCheck {
  string resource_uid = 1;
  uint64 passed = 2; // Represented as bitmasks of passed checks.
  uint64 failed = 3; // Represented as bitmasks of failed checks.
}

enum NetflowProtocol {
  NETFLOW_PROTOCOL_UNKNOWN = 0;
  NETFLOW_PROTOCOL_TCP = 1;
  NETFLOW_PROTOCOL_UDP = 2;
}

message Netflow {
  uint64 start_ts = 1; // Stored as unix timestamp in nanoseconds.
  uint64 end_ts = 2; // Stored as unix timestamp in nanoseconds.
  string process_name = 3;
  string namespace = 4;
  string pod_name = 5;
  string container_name = 6;
  string workload_name = 7;
  string workload_kind = 8;
  string zone = 9;
  bytes addr = 10;
  uint32 port = 11;
  NetflowProtocol protocol = 12;
  repeated NetflowDestination destinations = 14;
}

message NetflowDestination {
  string namespace = 1;
  string pod_name = 2;
  string workload_name = 3;
  string workload_kind = 4;
  string zone = 5;
  string dns_question = 6;
  bytes addr = 8;
  uint32 port = 9;
  uint64 tx_bytes = 10;
  uint64 rx_bytes = 11;
  uint64 tx_packets = 12;
  uint64 rx_packets = 13;
}