[itsvishalyadav]

Overview

Fixes #200.

metadataHasException compared a designator's labels, and its containerName, only for workload objects. For a RegoResponseVector base object, a host-sensor object or a cloud-provider object, it skipped the constraint and returned true. So an exception scoped only by labels matched every RBAC subject, host and cloud finding of the control.

Those objects have no labels, annotations or containers to compare. So a designator that constrains labels or containerName now doesn't match them. Other cases behave as before:

• a vector still matches when one of its related objects has the label (the Fixed exceptions in vector objects #149 path);
• name-, kind- and namespace-only exceptions are unchanged.

How to Test

go test ./exceptions/ -run TestGetResourceExceptions_LabelDesignatorOnNonWorkloads -count=1 -v

TestGetResourceExceptions_LabelDesignatorOnNonWorkloads has four cases:

• a label-only exception doesn't match an RBAC subject vector without the label: fails on main;
• it does match a vector whose ClusterRoleBinding has the label;
• it doesn't match a KubeletInfo host-sensor object: fails on main;
• a name-only exception still matches that host-sensor object.

With the fix all four pass, and go test ./... passes.

🤖 Generated with Claude Code

[coderabbitai]

Important

• Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: e4580371-8156-4e69-beca-17b166ddbdd2

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[matthyx]

Reviewed head 1b0ffd3 against main 2284a07. The fix is needed: label/containerName constraints previously bypassed workload metadata comparisons on non-workload objects, allowing label-scoped exceptions to match unrelated vector/host/cloud findings. The new guard rejects those constrained base objects while preserving matches on related labeled objects and name-only cases; the regression tests cover both vector paths and host-sensor behavior. No blockers found. Related history: #149 introduced vector iteration and was merged; #200 documents the still-reproducible fall-through. Searches surfaced adjacent #169 (containerName), #171 (vector scoring), #176 (objectSelector), and #189 (empty resources), but no superseding fix or explicit rejected approach. GitHub search was rate-limited during broader alternate-term issue queries, so absence of other matches is not conclusive. CI run 43123813746 passed, including race tests, full tests, build, and golangci-lint; DCO and GitGuardian passed; CodeRabbit was skipped. I did not run repository code locally; review was static plus isolated CI. Verdict: approve.