docs: add doc comments to functions touched for API resource audit po…

…licies
zwennesm · Sep 30, 2026 · Sep 30, 2026 · Sep 30, 2026 · Sep 30, 2026 · Sep 30, 2026
commit 6e4512f9e3fa8282d308ed2cf19cf016266c39f9
diff --git a/central/alert/views/views.go b/central/alert/views/views.go
@@ -262,6 +262,8 @@ func (k *AlertMatchKey) GetResourceName() string {
 	}
 	return *k.ResourceName
 }
+
+// GetResourceAPIResource returns the "<plural>[.<group>]" API resource name, or empty if unset.
 func (k *AlertMatchKey) GetResourceAPIResource() string {
 	if k.ResourceAPIResource == nil {
 		return ""

diff --git a/central/detection/alertmanager/alert_manager_impl.go b/central/detection/alertmanager/alert_manager_impl.go
@@ -642,6 +642,8 @@ func (w alertAdapter) GetResourceType() storage.Alert_Resource_ResourceType {
 	return w.a.GetResource().GetResourceType()
 }
 func (w alertAdapter) GetResourceName() string { return w.a.GetResource().GetName() }
+
+// GetResourceAPIResource returns the API resource name of resource alerts for non built-in resource types.
 func (w alertAdapter) GetResourceAPIResource() string {
 	return w.a.GetResource().GetApiResource()
 }
@@ -691,6 +693,8 @@ func findMatchingKey(toFind *storage.Alert, keys []*alertviews.AlertMatchKey) *a
 	return nil
 }
 
+// alertsAreForSamePolicyAndEntity reports whether both alerts share policy, state and the violating
+// entity (deployment, resource or node).
 func alertsAreForSamePolicyAndEntity(a1, a2 alertviews.AlertMatcher) bool {
 	if a1.GetPolicyId() != a2.GetPolicyId() || a1.GetState() != a2.GetState() {
 		return false

@@ -156,6 +156,8 @@ func (s *policyValidator) removeEnforcementsForMissingLifecycles(policy *storage
 	}
 }
 
+// validateEventSource checks that the event source fits the lifecycle stages and that audit log
+// policies only use supported criteria, scopes and exclusions.
 func (s *policyValidator) validateEventSource(policy *storage.Policy) error {
 	if policies.AppliesAtRunTime(policy) && policy.GetEventSource() == storage.EventSource_NOT_APPLICABLE {
 		return s.eventSourceError()

diff --git a/compliance/collection/auditlog/auditevent.go b/compliance/collection/auditlog/auditevent.go
@@ -82,6 +82,8 @@ func (u *userRef) ToKubernetesEventUser() *storage.KubernetesEvent_User {
 	}
 }
 
+// ToKubernetesEvent converts the audit event into a KubernetesEvent. Resources not covered by the
+// resource type enum are identified by their API resource name.
 func (e *auditEvent) ToKubernetesEvent(clusterID string) *storage.KubernetesEvent {
 	protoTime, err := protocompat.ParseRFC3339NanoTimestamp(e.StageTimestamp)
 	if err != nil {

diff --git a/compliance/collection/auditlog/auditlog_impl.go b/compliance/collection/auditlog/auditlog_impl.go
@@ -141,6 +141,8 @@ func (s *auditLogReaderImpl) readAndForwardAuditLogs(ctx context.Context, tailer
 	}
 }
 
+// shouldSendEvent reports whether the event is past the start state and matches either the built-in
+// resource allow-list or one of the requested API resources.
 func (s *auditLogReaderImpl) shouldSendEvent(event *auditEvent) bool {
 	if s.startState != nil {
 		protoTime, err := protocompat.ParseRFC3339NanoTimestamp(event.StageTimestamp)

diff --git a/compliance/compliance.go b/compliance/compliance.go
@@ -379,6 +379,7 @@ func dispatchACK(umh handler.UnconfirmedMessageHandler, label string, action sen
 	}
 }
 
+// startAuditLogCollection starts an audit log reader for this node based on the start request.
 func (c *Compliance) startAuditLogCollection(ctx context.Context, client sensor.ComplianceService_CommunicateClient, request *sensor.MsgToCompliance_AuditLogCollectionRequest_StartRequest) auditlog.Reader {
 	if request.GetCollectStartState() == nil {
 		log.Infof("Starting audit log reader on node %s in cluster %s with no saved state", c.nodeNameProvider.GetNodeName(), request.GetClusterId())

diff --git a/pkg/alert/convert/convert.go b/pkg/alert/convert/convert.go
@@ -38,6 +38,7 @@ func AlertToListAlert(alert *storage.Alert) *storage.ListAlert {
 	return listAlert
 }
 
+// populateListAlertEntityInfoForResource sets the resource entity and common entity info on the list alert.
 func populateListAlertEntityInfoForResource(listAlert *storage.ListAlert, resource *storage.Alert_Resource) {
 	listAlert.Entity = &storage.ListAlert_Resource{
 		Resource: &storage.ListAlert_ResourceEntity{

@@ -240,6 +240,7 @@ func (f *FieldMetadata) registerFieldMetadata(fieldName string, qb querybuilders
 	f.fieldsToQB[fieldName] = newFieldMetadata(qb, contextFields, validator, source, fieldTypes, options...)
 }
 
+// initializeFieldMetadata registers the query builder, validator and event source of every policy field.
 func initializeFieldMetadata() FieldMetadata {
 	f := FieldMetadata{
 		fieldsToQB: make(map[string]*metadataAndQB),

@@ -84,6 +84,7 @@ func podAttachViolationMsg(event *storage.KubernetesEvent) (string, []*storage.A
 	return getAttachMsgHeader(event), getAttachMsgViolationAttr(event)
 }
 
+// getDefaultViolationMsgHeader builds a human readable header describing the accessed resource.
 func getDefaultViolationMsgHeader(event *storage.KubernetesEvent) string {
 	object := event.GetObject()
 	readableResourceName := strings.ToLower(object.GetResource().String())

@@ -14,6 +14,9 @@ export type MostRecentViolationsProps = {
     alerts: Alert[];
 };
 
+/**
+ * Lists the most recent critical severity violations with links to their details.
+ */
 function MostRecentViolations({ alerts }: MostRecentViolationsProps) {
     return (
         <Flex direction={{ default: 'column' }} spaceItems={{ default: 'spaceItemsMd' }}>

@@ -91,6 +91,9 @@ function EnforcementColumn({ original }: EnforcementColumnProps): ReactElement {
     return <span>{message}</span>;
 }
 
+/**
+ * Returns the violations table columns for the given workflow view.
+ */
 export function getViolationsTableColumnDescriptors(filteredWorkflowView: FilteredWorkflowView) {
     return [
         {