How derailed/popeye works
Popeye is a read-only Kubernetes live-cluster linter. The main workflow is CLI invocation, configuration and cluster initialization, loading resources into an in-memory database, running resource linters, collecting findings, and emitting a scored report. The README documents resource checks, namespace and section selection, configuration, multiple report formats, and optional Prometheus metrics; the tree also shows Cilium-specific linting. Source excerpts do not expose every runtime registration or integration, so uncertain connections are omitted.
Main entry points: popeye.go Scan coordinator · db.go In-memory resource DB · root.go CLI commands · pod.go Resource linters
Components 17
CLI and configuration
- Program entry
main.go - CLI commands
cmd/root.go - Scan configuration
pkg/config
Cluster scan
- Scan coordinator
pkg/popeye.go - Kubernetes client
internal/client/client.go - Resource factory
internal/client/factory.go - Resource loader
internal/db/loader.go - In-memory resource DB
internal/db/db.go
Lint and findings
- Resource scrubbers
internal/scrub - Resource linters
internal/lint/pod.go - Cilium policy lint
internal/cilium/lint/ccnp.go - Finding collection
internal/issues/collector.go
Reports and metrics
- Report builder
internal/report/builder.go - Report output
internal/report/writer.go - Prometheus metrics
internal/report/prometheus.go
Other components
- Operator
- Kubernetes cluster
Connections 19
- Operator → Program entry: invokes
main.go - Program entry → CLI commands: dispatches
main.go - CLI commands → Scan coordinator: starts scan
cmd/root.go - CLI commands → Scan configuration: sets flags
cmd/root.go - Scan coordinator → Scan configuration: loads config
pkg/popeye.go - Scan coordinator → Kubernetes client: initializes client
pkg/popeye.go - Kubernetes client → Kubernetes cluster: queries API
internal/client/client.go - Scan coordinator → Resource factory: creates factory
pkg/popeye.go - Resource factory → Kubernetes cluster: reads resources
- Scan coordinator → In-memory resource DB: initializes DB
pkg/popeye.go - Resource loader → In-memory resource DB: loads resources
internal/db/loader.go - Scan coordinator → Resource linters: runs lint
pkg/popeye.go - Resource linters → In-memory resource DB: reads resources
internal/lint/pod.go - Resource linters → Finding collection: records findings
internal/lint/pod.go - Scan coordinator → Report builder: adds outcomes
pkg/popeye.go - Report builder → Report output: formats report
internal/report/writer.go - Report builder → Prometheus metrics: publishes metrics
- Scan coordinator → Cilium policy lint: runs lint
- Resource scrubbers → In-memory resource DB: uses resource DB