fix(core): ensure only cluster policy is updated on new ns #1837
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
The `if` condition in `GetSecurityPolicies(..)` returns true if `matchClusterSecurityPolicyRule(..)` evaluates to `true`. That function doesn't check whether the passed policy is a cluster policy, and since the `matchExpressions` is empty for container policies, it ends up adding one namespace (whatever comes back in the k8s client response first that hasn't been added yet) to NamespaceList of all existing container policies, it then returns `true` and the policy is added to the `GetSecurityPolicies(..)` response. Over time, as `matchClusterSecurityPolicyRule(..)` is called, the list of `NamespaceList` in each regular policy keeps increasing, causing the container policy to be applied in namespaces where was not intended. The `matchClusterSecurityPolicyRule(..)` is corrected to apply only on cluster policies. Fixes: kubearmor#1840 Signed-off-by: Carlos Rodriguez-Fernandez <[email protected]>
carlosrodfern
changed the title
Prateeknandle
approved these changes
Aug 14, 2024
DelusionalOptimist
approved these changes
Aug 16, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Regular policies are mistakenly modified and applied at cluster level over time
Purpose of PR?:
Fixes: #1840
Does this PR introduce a breaking change? No
If the changes in this PR are manually verified, list down the scenarios covered::
Built and deployed, and verified that the policy is not applied on different namespaces or even the same namespace with no matching labels.
Additional information for reviewer? :
Checklist:
<type>(<scope>): <subject>