How luciana-okorie/kubeshield works
KubeShield is a prototype with two distinct products: a multi-tenant platform API for identity, organizations, cluster registration, and agent scan jobs; and an earlier single-operator scanner API that scans Kubernetes and stores findings. The documented agent connects the platform API to a cluster scanner, but the README explicitly says this workflow is not yet integrated with the platform’s organization-scoped registration. The graph preserves both paths and their separate persistence. Some subsystem links are based on README documentation because their implementations were not sampled; unsampled internals are not inferred.
Main entry points: storage.go Platform Store · routes.go Platform Routes · server.go Scanner API Server · scanner.go Cluster Scanner
Components 17
Platform API
- Platform Server
cmd/api/main.go - Platform Routes
internal/api/routes/routes.go - Identity & Sessions
internal/api/handlers/auth.go - Organizations & Clusters
internal/api/handlers/resources.go - Agent & Scan Jobs
internal/api/handlers/agents.go - Request Authentication
internal/api/middleware/auth.go
Cluster Agent
- Agent Poll & Submit
cmd/kubeshield-agent/main.go
Scanner API
- Scanner API Server
internal/httpapi/server.go - Scanner API Runtime
cmd/kubeshield-api/main.go
Kubernetes Scanning
- Cluster Scanner
internal/kube/scanner.go
Persistence
- Platform Store
internal/storage/storage.go - Memory Backend
internal/storage/memory/memory.go - Platform PostgreSQL
internal/storage/postgres/store.go - Finding Repository
internal/store/interface.go - Scanner PostgreSQL
internal/store/postgres.go
Other components
- Platform Engineer
- Kubernetes Cluster
Connections 23
- Platform Engineer → Platform Server: uses platform
README.md - Platform Server → Platform Routes: builds routes
cmd/api/main.go - Platform Routes → Identity & Sessions: routes auth
internal/api/routes/routes.go - Platform Routes → Organizations & Clusters: routes org operations
internal/api/routes/routes.go - Platform Routes → Agent & Scan Jobs: routes agent operations
internal/api/routes/routes.go - Platform Routes → Request Authentication: applies authentication
internal/api/routes/routes.go - Identity & Sessions → Platform Store: reads and writes
internal/api/handlers/auth.go - Organizations & Clusters → Platform Store: reads and writes
internal/api/handlers/resources.go - Agent & Scan Jobs → Platform Store: reads and writes
internal/api/handlers/agents.go - Request Authentication → Platform Store: validates tokens
internal/api/middleware/auth.go - Platform Server → Platform Store: opens backend
- Platform Store → Memory Backend: selects fallback
- Platform Store → Platform PostgreSQL: selects PostgreSQL
- Platform Engineer → Scanner API Server: uses scanner API
README.md - Scanner API Runtime → Scanner API Server: serves routes
cmd/kubeshield-api/main.go - Scanner API Runtime → Cluster Scanner: initializes scanner
cmd/kubeshield-api/main.go - Scanner API Runtime → Finding Repository: opens repository
cmd/kubeshield-api/main.go - Scanner API Server → Cluster Scanner: runs scans
internal/httpapi/server.go - Scanner API Server → Finding Repository: reads and updates findings
internal/httpapi/server.go - Finding Repository → Scanner PostgreSQL: implemented by
internal/store/postgres.go - Cluster Scanner → Kubernetes Cluster: inspects resources
README.md - Agent Poll & Submit → Cluster Scanner: runs scan
cmd/kubeshield-agent/main.go - Agent Poll & Submit → Platform Routes: polls and submits results
README.md