Merge pull request #542 from kubescape/fix_c0021

fix control C-0021 - test failure caused by bad access to LinkedIn. Approved
kubescape · Nov 20, 2023 · c228cff · c228cff
2 parents 4b08865 + 295e78f
commit c228cff
Show file tree

Hide file tree

Showing 5 changed files with 7 additions and 7 deletions.
diff --git a/rules/exposed-sensitive-interfaces-v1/raw.rego b/rules/exposed-sensitive-interfaces-v1/raw.rego
@@ -121,10 +121,10 @@ deny[msga] {
 
 wl_connectedto_service(wl, service) = paths{
 	count({x | service.spec.selector[x] == wl.metadata.labels[x]}) == count(service.spec.selector)
-	paths = ["spec.selector.matchLabels", "service.spec.selector"]
+	paths = ["spec.selector.matchLabels", "spec.selector"]
 }
 
 wl_connectedto_service(wl, service) = paths {
 	wl.spec.selector.matchLabels == service.spec.selector
-	paths = ["spec.selector.matchLabels", "service.spec.selector"]
+	paths = ["spec.selector.matchLabels", "spec.selector"]
 }
diff --git a/rules/exposed-sensitive-interfaces-v1/test/pod/expected.json b/rules/exposed-sensitive-interfaces-v1/test/pod/expected.json
@@ -1,6 +1,6 @@
 [{
     "alertMessage": "service: my-service is exposed",
-    "failedPaths": ["spec.selector.matchLabels", "service.spec.selector"],
+    "failedPaths": ["spec.selector.matchLabels", "spec.selector"],
     "fixPaths": [],
     "ruleStatus": "",
     "packagename": "armo_builtins",

diff --git a/rules/exposed-sensitive-interfaces-v1/test/workloads/expected.json b/rules/exposed-sensitive-interfaces-v1/test/workloads/expected.json
@@ -1,6 +1,6 @@
 [{
     "alertMessage": "service: my-service is exposed",
-    "failedPaths": ["spec.selector.matchLabels", "service.spec.selector"],
+    "failedPaths": ["spec.selector.matchLabels", "spec.selector"],
     "fixPaths": [],
     "ruleStatus": "",
     "packagename": "armo_builtins",

diff --git a/rules/exposed-sensitive-interfaces-v1/test/workloads2/expected.json b/rules/exposed-sensitive-interfaces-v1/test/workloads2/expected.json
@@ -3,7 +3,7 @@
         "alertMessage": "service: jenkins-service is exposed",
         "failedPaths": [
             "spec.selector.matchLabels",
-            "service.spec.selector"
+            "spec.selector"
         ],
         "fixPaths": [],
         "ruleStatus": "",

diff --git a/rules/exposed-sensitive-interfaces/raw.rego b/rules/exposed-sensitive-interfaces/raw.rego
@@ -104,10 +104,10 @@ deny[msga] {
 
 wl_connectedto_service(wl, service) = paths{
 	count({x | service.spec.selector[x] == wl.metadata.labels[x]}) == count(service.spec.selector)
-	paths = ["spec.selector.matchLabels", "service.spec.selector"]
+	paths = ["spec.selector.matchLabels","spec.selector"]
 }
 
 wl_connectedto_service(wl, service) = paths {
 	wl.spec.selector.matchLabels == service.spec.selector
-	paths = ["spec.selector.matchLabels", "service.spec.selector"]
+	paths = ["spec.selector.matchLabels", "spec.selector"]
 }