fix: list active ReplicaSets in the given namespace (#804)

Signed-off-by: Daniel Pacak <pacak.daniel@gmail.com>
aquasecurity · Nov 10, 2021 · 6093bc4 · 6093bc4
1 parent 6a4a574
commit 6093bc4
Show file tree

Hide file tree

Showing 2 changed files with 11 additions and 9 deletions.
diff --git a/pkg/kube/object.go b/pkg/kube/object.go
@@ -452,9 +452,11 @@ func (o *ObjectResolver) getActiveReplicaSetByDeployment(ctx context.Context, ob
 		return "", fmt.Errorf("getting deployment %q: %w", object.Namespace+"/"+object.Name, err)
 	}
 	var rsList appsv1.ReplicaSetList
-	err = o.Client.List(ctx, &rsList, client.MatchingLabelsSelector{
-		Selector: labels.SelectorFromSet(deploy.Spec.Selector.MatchLabels),
-	})
+	err = o.Client.List(ctx, &rsList,
+		client.InNamespace(deploy.Namespace),
+		client.MatchingLabelsSelector{
+			Selector: labels.SelectorFromSet(deploy.Spec.Selector.MatchLabels),
+		})
 	if err != nil {
 		return "", fmt.Errorf("listing replicasets for deployment %q: %w", object.Name, err)
 	}

diff --git a/pkg/plugin/conftest/plugin_test.go b/pkg/plugin/conftest/plugin_test.go
@@ -76,14 +76,14 @@ func TestConfig_GetPoliciesByKind(t *testing.T) {
 					"conftest.library.utils.rego":                            "<REGO_B>",
 					"conftest.policy.access_to_host_pid.rego":                "<REGO_C>",
 					"conftest.policy.cpu_not_limited.rego":                   "<REGO_D>",
-					"configmap_with_sensitive_data.rego":                     "<REGO_E>",
-					"configmap_with_secret_data.rego":                        "<REGO_F>",
+					"conftest.policy.configmap_with_sensitive_data.rego":     "<REGO_E>",
+					"conftest.policy.configmap_with_secret_data.rego":        "<REGO_F>",
 					"conftest.policy.object_without_recommended_labels.rego": "<REGO_G>",
 
 					"conftest.policy.access_to_host_pid.kinds":                "Pod,ReplicaSet",
 					"conftest.policy.cpu_not_limited.kinds":                   "Workload",
-					"configmap_with_sensitive_data.kinds":                     "ConfigMap",
-					"configmap_with_secret_data.kinds":                        "ConfigMap",
+					"conftest.policy.configmap_with_sensitive_data.kinds":     "ConfigMap",
+					"conftest.policy.configmap_with_secret_data.kinds":        "ConfigMap",
 					"conftest.policy.object_without_recommended_labels.kinds": "*",
 
 					// This one should be skipped (no .rego suffix)
@@ -99,8 +99,8 @@ func TestConfig_GetPoliciesByKind(t *testing.T) {
 			"conftest.policy.object_without_recommended_labels.rego": "<REGO_G>",
 		}))
 		g.Expect(config.GetPoliciesByKind("ConfigMap")).To(Equal(map[string]string{
-			"configmap_with_sensitive_data.rego":                     "<REGO_E>",
-			"configmap_with_secret_data.rego":                        "<REGO_F>",
+			"conftest.policy.configmap_with_sensitive_data.rego":     "<REGO_E>",
+			"conftest.policy.configmap_with_secret_data.rego":        "<REGO_F>",
 			"conftest.policy.object_without_recommended_labels.rego": "<REGO_G>",
 		}))
 	})