Skip to content

Commit 4dc35e6

Browse files
georgibaltievgeorgibaltiev
committed
fix: add detail messages to deletion namespace targets
1 parent edda316 commit 4dc35e6

File tree

2 files changed

+26
-23
lines changed

2 files changed

+26
-23
lines changed

‎pkg/provider/managedk8s/ruleset/securityhardenedk8s/rules/2000.go‎

Lines changed: 13 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,11 @@ func (r *Rule2000) Severity() rule.SeverityLevel {
5555
}
5656

5757
func (r *Rule2000) Run(ctx context.Context) (rule.RuleResult, error) {
58+
const (
59+
namespaceDeletionWithoutPodsMessage = "namespace is marked for deletion - no pods are deployed on it"
60+
namespaceDeletionWithPodsMessage = "namespace is marked for deletion - there are still pods deployed on it"
61+
)
62+
5863
networkPolicies, err := kubeutils.GetNetworkPolicies(ctx, r.Client, "", labels.NewSelector(), 300)
5964
if err != nil {
6065
return rule.Result(r, rule.ErroredCheckResult(err.Error(), rule.NewTarget("kind", "ServiceList"))), nil
@@ -154,15 +159,15 @@ func (r *Rule2000) Run(ctx context.Context) (rule.RuleResult, error) {
154159
checkResults = append(checkResults, rule.ErroredCheckResult(err.Error(), rule.NewTarget()))
155160
} else if len(pods) > 0 {
156161
if allowsAllIngress {
157-
checkResults = append(checkResults, rule.FailedCheckResult("All Ingress traffic is allowed by default.", allowsAllIngressTarget))
162+
checkResults = append(checkResults, rule.FailedCheckResult("All Ingress traffic is allowed by default.", allowsAllIngressTarget.With("details", namespaceDeletionWithPodsMessage)))
158163
} else {
159-
checkResults = append(checkResults, rule.FailedCheckResult("Ingress traffic is not denied by default.", target))
164+
checkResults = append(checkResults, rule.FailedCheckResult("Ingress traffic is not denied by default.", target.With("details", namespaceDeletionWithPodsMessage)))
160165
}
161166
} else {
162167
if allowsAllIngress {
163-
checkResults = append(checkResults, rule.WarningCheckResult("All Ingress traffic is allowed by default.", allowsAllIngressTarget))
168+
checkResults = append(checkResults, rule.WarningCheckResult("All Ingress traffic is allowed by default.", allowsAllIngressTarget.With("details", namespaceDeletionWithoutPodsMessage)))
164169
} else {
165-
checkResults = append(checkResults, rule.WarningCheckResult("Ingress traffic is not denied by default.", target))
170+
checkResults = append(checkResults, rule.WarningCheckResult("Ingress traffic is not denied by default.", target.With("details", namespaceDeletionWithoutPodsMessage)))
166171
}
167172
}
168173
}
@@ -200,15 +205,15 @@ func (r *Rule2000) Run(ctx context.Context) (rule.RuleResult, error) {
200205
checkResults = append(checkResults, rule.ErroredCheckResult(err.Error(), rule.NewTarget()))
201206
} else if len(pods) > 0 {
202207
if allowsAllEgress {
203-
checkResults = append(checkResults, rule.FailedCheckResult("All Egress traffic is allowed by default.", allowsAllEgressTarget))
208+
checkResults = append(checkResults, rule.FailedCheckResult("All Egress traffic is allowed by default.", allowsAllEgressTarget.With("details", namespaceDeletionWithPodsMessage)))
204209
} else {
205-
checkResults = append(checkResults, rule.FailedCheckResult("Egress traffic is not denied by default.", target))
210+
checkResults = append(checkResults, rule.FailedCheckResult("Egress traffic is not denied by default.", target.With("details", namespaceDeletionWithPodsMessage)))
206211
}
207212
} else {
208213
if allowsAllEgress {
209-
checkResults = append(checkResults, rule.WarningCheckResult("All Egress traffic is allowed by default.", allowsAllEgressTarget))
214+
checkResults = append(checkResults, rule.WarningCheckResult("All Egress traffic is allowed by default.", allowsAllEgressTarget.With("details", namespaceDeletionWithoutPodsMessage)))
210215
} else {
211-
checkResults = append(checkResults, rule.WarningCheckResult("Egress traffic is not denied by default.", target))
216+
checkResults = append(checkResults, rule.WarningCheckResult("Egress traffic is not denied by default.", target.With("details", namespaceDeletionWithoutPodsMessage)))
212217
}
213218
}
214219
}

‎pkg/provider/managedk8s/ruleset/securityhardenedk8s/rules/2000_test.go‎

Lines changed: 13 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -553,7 +553,7 @@ var _ = Describe("#2000", func() {
553553
{
554554
Status: rule.Failed,
555555
Message: "All Ingress traffic is allowed by default.",
556-
Target: rule.NewTarget("namespace", "plain-namespace", "kind", "NetworkPolicy", "name", "allow-ingress"),
556+
Target: rule.NewTarget("namespace", "plain-namespace", "kind", "NetworkPolicy", "name", "allow-ingress", "details", "namespace is marked for deletion - there are still pods deployed on it"),
557557
},
558558
{
559559
Status: rule.Passed,
@@ -586,7 +586,7 @@ var _ = Describe("#2000", func() {
586586
{
587587
Status: rule.Failed,
588588
Message: "All Egress traffic is allowed by default.",
589-
Target: rule.NewTarget("namespace", "plain-namespace", "kind", "NetworkPolicy", "name", "allow-egress"),
589+
Target: rule.NewTarget("namespace", "plain-namespace", "kind", "NetworkPolicy", "name", "allow-egress", "details", "namespace is marked for deletion - there are still pods deployed on it"),
590590
},
591591
},
592592
),
@@ -608,7 +608,7 @@ var _ = Describe("#2000", func() {
608608
{
609609
Status: rule.Failed,
610610
Message: "Ingress traffic is not denied by default.",
611-
Target: rule.NewTarget("namespace", "plain-namespace"),
611+
Target: rule.NewTarget("namespace", "plain-namespace", "details", "namespace is marked for deletion - there are still pods deployed on it"),
612612
},
613613
{
614614
Status: rule.Passed,
@@ -640,7 +640,7 @@ var _ = Describe("#2000", func() {
640640
{
641641
Status: rule.Failed,
642642
Message: "Egress traffic is not denied by default.",
643-
Target: rule.NewTarget("namespace", "plain-namespace"),
643+
Target: rule.NewTarget("namespace", "plain-namespace", "details", "namespace is marked for deletion - there are still pods deployed on it"),
644644
},
645645
},
646646
),
@@ -663,7 +663,7 @@ var _ = Describe("#2000", func() {
663663
{
664664
Status: rule.Warning,
665665
Message: "All Ingress traffic is allowed by default.",
666-
Target: rule.NewTarget("namespace", "plain-namespace", "kind", "NetworkPolicy", "name", "allow-ingress"),
666+
Target: rule.NewTarget("namespace", "plain-namespace", "kind", "NetworkPolicy", "name", "allow-ingress", "details", "namespace is marked for deletion - no pods are deployed on it"),
667667
},
668668
{
669669
Status: rule.Passed,
@@ -696,7 +696,7 @@ var _ = Describe("#2000", func() {
696696
{
697697
Status: rule.Warning,
698698
Message: "All Egress traffic is allowed by default.",
699-
Target: rule.NewTarget("namespace", "plain-namespace", "kind", "NetworkPolicy", "name", "allow-egress"),
699+
Target: rule.NewTarget("namespace", "plain-namespace", "kind", "NetworkPolicy", "name", "allow-egress", "details", "namespace is marked for deletion - no pods are deployed on it"),
700700
},
701701
},
702702
),
@@ -718,7 +718,7 @@ var _ = Describe("#2000", func() {
718718
{
719719
Status: rule.Warning,
720720
Message: "Ingress traffic is not denied by default.",
721-
Target: rule.NewTarget("namespace", "plain-namespace"),
721+
Target: rule.NewTarget("namespace", "plain-namespace", "details", "namespace is marked for deletion - no pods are deployed on it"),
722722
},
723723
{
724724
Status: rule.Passed,
@@ -750,7 +750,7 @@ var _ = Describe("#2000", func() {
750750
{
751751
Status: rule.Warning,
752752
Message: "Egress traffic is not denied by default.",
753-
Target: rule.NewTarget("namespace", "plain-namespace"),
753+
Target: rule.NewTarget("namespace", "plain-namespace", "details", "namespace is marked for deletion - no pods are deployed on it"),
754754
},
755755
},
756756
),
@@ -762,26 +762,24 @@ var _ = Describe("#2000", func() {
762762
acceptedNamespace.Labels = map[string]string{
763763
"environment": "production",
764764
}
765-
Expect(client.Create(ctx, acceptedNamespace)).To(Succeed())
765+
// Expect(client.Create(ctx, acceptedNamespace)).To(Succeed())
766766

767767
partiallyAcceptedNamespaceWithPod := namespaceWithDeletionTimestamp.DeepCopy()
768768
partiallyAcceptedNamespaceWithPod.Name = "partially-accepted-with-pod"
769769
partiallyAcceptedNamespaceWithPod.Labels = map[string]string{
770770
"team": "security",
771771
}
772-
Expect(client.Create(ctx, partiallyAcceptedNamespaceWithPod)).To(Succeed())
773772

774773
partiallyAcceptedNamespace := namespaceWithDeletionTimestamp.DeepCopy()
775774
partiallyAcceptedNamespace.Name = "partially-accepted"
776775
partiallyAcceptedNamespace.Labels = map[string]string{
777776
"team": "security",
778777
}
779778

780-
client = fakeclient.NewClientBuilder().WithObjects(acceptedNamespace, partiallyAcceptedNamespace, partiallyAcceptedNamespaceWithPod).Build()
781-
782779
pod1 := plainPod.DeepCopy()
783780
pod1.Namespace = "partially-accepted-with-pod"
784-
Expect(client.Create(ctx, pod1)).To(Succeed())
781+
782+
client = fakeclient.NewClientBuilder().WithObjects(acceptedNamespace, partiallyAcceptedNamespace, partiallyAcceptedNamespaceWithPod, pod1).Build()
785783

786784
allowAllPolicy1 := &networkingv1.NetworkPolicy{
787785
ObjectMeta: metav1.ObjectMeta{
@@ -870,7 +868,7 @@ var _ = Describe("#2000", func() {
870868
{
871869
Status: rule.Failed,
872870
Message: "Ingress traffic is not denied by default.",
873-
Target: rule.NewTarget("namespace", "partially-accepted-with-pod"),
871+
Target: rule.NewTarget("namespace", "partially-accepted-with-pod", "details", "namespace is marked for deletion - there are still pods deployed on it"),
874872
},
875873
{
876874
Status: rule.Accepted,
@@ -880,7 +878,7 @@ var _ = Describe("#2000", func() {
880878
{
881879
Status: rule.Warning,
882880
Message: "All Ingress traffic is allowed by default.",
883-
Target: rule.NewTarget("namespace", "partially-accepted", "kind", "NetworkPolicy", "name", "allow-all"),
881+
Target: rule.NewTarget("namespace", "partially-accepted", "kind", "NetworkPolicy", "name", "allow-all", "details", "namespace is marked for deletion - no pods are deployed on it"),
884882
},
885883
{
886884
Status: rule.Accepted,

0 commit comments

Comments
 (0)