ROX-34157: Allow label scopes on audit event policies#20061
ROX-34157: Allow label scopes on audit event policies#20061
Conversation
AlexVulaj
changed the title
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## master #20061 +/- ##
=======================================
Coverage 49.67% 49.67%
=======================================
Files 2765 2765
Lines 209039 209045 +6
=======================================
+ Hits 103834 103844 +10
+ Misses 97527 97520 -7
- Partials 7678 7681 +3
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
🚀 Build Images ReadyImages are ready for commit dd12183. To use with deploy scripts: export MAIN_IMAGE_TAG=4.11.x-674-gdd12183441 |
|
@AlexVulaj: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
1 participant
Description
Fixes a bug where cluster and namespace label scopes were incorrectly rejected on audit log event policies. In https://redhat.atlassian.net/browse/ROX-32149, the
validateNoLabelsInScopeForAuditEventguard was extended to rejectcluster_labelandnamespace_labelscopes, modeled after the existing rejection of deployment labels. However, unlike deployment labels, audit events carry cluster ID and namespace information that is sufficient to resolve cluster and namespace labels via providers.This change removes
cluster_label/namespace_labelfrom the validation rejection (keeping the deploymentlabelrejection, since audit events have no deployment context) and wires up MatchesClusterLabels andMatchesNamespaceLabelsinMatchesAuditEventso that label-based cluster/namespace scoping actually works for audit event policies.Additionally,
MatchesClusterLabelsandMatchesNamespaceLabelssignatures are refactored to accept primitive parameters (clusterID string,namespace string) instead of a full*storage.Deployment, making them usable from non-deployment contexts like audit events.User-facing documentation
Testing and quality
Automated testing
How I validated my change
Added new test(s). Will rely on CI for full integration validation.