# Infra Inspector

The Infra Inspector is a tool used to inspect resources for infra. It supports the following subcommands:

* `inspector inspect`: inspects resources once in a Kubernetes cluster or dataplanes.
* `inspector daemon`: runs a daemon to continuously inspect resources in the infra apiserver, gardener apiserver and dataplanes and reports results.

## CLI

To inspect resources with rego engine in a Kubernetes cluster. For example, inspect Clusters and Networks in the infra apiserver:

```bash
KUBECONFIG=${kubeconfig} infra-inspector inspect --rego=manifests/regorules/infra cloud.pingcap.com/v1:Cluster cloud.pingcap.com/v1:Network
```

To inspect resources with Rego engine in each dataplanes, use the following command:

```bash
KUBECONFIG=${infra_kubeconfig} infra-inspector inspect --gardener-env=dev --gardener-config=${gardener_kubeconfig} --dataplane --rego=manifests/regorules/dataplane v1:Pod v1:PersistentVolumeClaim
```

If the resource is in-tree resource, you also can inspect resources with the field selector using the following command:

```bash
KUBECONFIG=${infra_kubeconfig} infra-inspector inspect --gardener-env=dev --gardener-config=${gardener_kubeconfig} --dataplane --always-deny --field-selector status.phase==Pending v1:Pod
```


The output is similar to this:

```
Target: dataplane/nightly-ms-73813/eks-us-west-2, Total: 23, Critical: 0, Warning: 0, Info: 23
KIND      NAMESPACE      NAME                                                  LEVEL     RULE         MESSAGE
Pod       cert-manager   aws-pca-issuer-aws-privateca-issuer-65fd955bd-d86vv   info      AlwaysDeny
Pod       cert-manager   cert-manager-86695f5d9-l5dmf                          info      AlwaysDeny
Pod       cert-manager   cert-manager-cainjector-6fd6967df8-5zshb              info      AlwaysDeny
Pod       cert-manager   cert-manager-webhook-75f9bc6d74-6tzzl                 info      AlwaysDeny
Pod       kube-system    coredns-85d5b4454c-5znpr                              info      AlwaysDeny
Pod       kube-system    coredns-85d5b4454c-xhjft                              info      AlwaysDeny
Pod       kube-system    ebs-csi-controller-5b7588f9b8-7hv6w                   info      AlwaysDeny
Pod       kube-system    ebs-csi-controller-5b7588f9b8-mmzst                   info      AlwaysDeny
```

## Daemon

Daemon continuously inspects in the infra apiserver, gardener apiserver and dataplanes and reports results.

```bash
infra-inspector daemon --config ./manifests/config.yaml
```

For more information about configuration, see [config.yaml](../../infra-inspector/manifests/config.yaml).

## Architecture

![Infra Inspector Architecture](./inspector.png)

* Lister: List resources from the infra apiserver, gardener apiserver or dataplanes, then provide they to the Engine.

* Engine: Validate a resource with predefined rules.

* Notifier: receives the results of the inspection and reports to remotes.