Struct ConfinementConfig 

pub struct ConfinementConfig {
    pub dangerously_allow_unconfined_template_resolution: bool,
}

Serializable config fragment for template confinement.

Embed this in a component config with #[serde(flatten)] to get the dangerously_allow_unconfined_template_resolution field. Pass it to Template::confine on each template the component owns.

Fields

dangerously_allow_unconfined_template_resolution: bool

Disable all template confinement checks for this sink.

DANGEROUS — disables a security control.

Bypasses both startup validation and runtime confinement for every templated field on this sink. When enabled, a log producer that controls any field used in a template can write to arbitrary keys, paths, or routing destinations. This flag is a full opt-out: it disables confinement even for templates that have a usable static prefix.

Implementations

impl ConfinementConfig

pub fn warn_unconfined_template( component_kind: &'static str, component_type: &'static str, field: &'static str, )

Logs a per-template SECURITY warning on the opt-out path. Does NOT touch the gauge — the gauge is emitted once per sink build by Self::set_confinement_gauge.

pub fn set_confinement_gauge( &self, component_kind: &'static str, component_type: &'static str, )

Emit vector_security_confinement_disabled{component_kind,component_type} reflecting whether this sink has the confinement policy disabled.

Must be called at the END of SinkConfig::build, on the success path only. Value = 1 when the flag is set (operator explicitly disabled confinement policy for this sink), 0 otherwise.

Emitting earlier means a build that later errors would still leave its gauge write behind. On a reload where the new config fails to build, the topology manager keeps the old sink active but the failed replacement’s write would silently misreport the live sink’s confinement state.

Trait Implementations

impl Clone for ConfinementConfig

fn clone(&self) -> ConfinementConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Configurable for ConfinementConfig

fn referenceable_name() -> Option<&'static str>

Gets the referenceable name of this value, if any.

fn metadata() -> Metadata

Gets the metadata for this value.

fn generate_schema( schema_gen: &RefCell<SchemaGenerator>, ) -> Result<SchemaObject, GenerateError>

Generates the schema for this value.

fn is_optional() -> bool

where Self: Sized,

Whether or not this value is optional.

fn validate_metadata(_metadata: &Metadata) -> Result<(), GenerateError>

where Self: Sized,

Validates the given metadata against this type.

fn as_configurable_ref() -> ConfigurableRef

where Self: Sized + 'static,

Create a new configurable reference table.

impl Debug for ConfinementConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for ConfinementConfig

fn default() -> ConfinementConfig

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for ConfinementConfig

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for ConfinementConfig

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl ToValue for ConfinementConfig

fn to_value(&self) -> Value

Convert this value into a serde_json::Value. Must not fail.