[VISHNU0906]

Overview

The regolibrary container rules now report Pod findings on spec.ephemeralContainers[N] (e.g. container-hostPort, set-seLinuxOptions). extractFailingContainerNames only recognised containers[N] and initContainers[N], so for those findings it returned nothing and compareContainerName fell back to scanning the regular and init containers. Two things go wrong:

• an exception with containerName: app also silences a finding on the ephemeral debugger container in the same Pod, which is the case a0483ba set out to prevent;
• an exception that names the ephemeral container never matches, because the fallback scan doesn't look at ephemeral containers.

This change parses ephemeralContainers[N] paths and adds ephemeral containers to the fallback scan. The pinned k8s-interface version has no ephemeral container getter, so the names are read from spec.ephemeralContainers in a small helper.

How to Test

• New TestSetRuleResponsExceptions_EphemeralContainerPrecision goes through SetRuleResponsExceptions with a Pod that has app and an ephemeral debugger: exception on the failing ephemeral container applies, exception on app does not, and the no-paths fallback finds debugger.
• TestComparator_compareContainerName gets an ephemeral case, plus a unit test for the helper.
• Reverting the path regex or the fallback loop makes the matching cases fail. go test -race ./..., go test ./... -covermode=count and go build ./... pass; golangci-lint shows the same two existing staticcheck findings as on main.

cc @matthyx

[coderabbitai]

Important

• Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 1d559fb1-8a14-4dfd-b0a8-41498bc357ee

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[matthyx]

Reviewed head a32044a against main. No blockers: the change is needed and correct. Approving.

Non-blocking: in the new ephemeralContainerNames helper, a malformed entry without a string name is appended as "". Skipping it would be tidier, but this is harmless in practice.