[itsvishalyadav]

Overview

This PR fixes #488

Signed Commits

• Yes, I signed my commits.

getNamespaces put the namespace of the request's ID in the list, and for a cluster-wide WildWlid that is "". A list holding "" isn't empty, so the "list every namespace" branch never ran and HandleImageScanningScopedRequest worked on "":

• SkipNamespace("") is true whenever includeNamespaces is set, so a cluster-wide image scan scanned nothing at all;
• ContainerProfiles were looked up in namespace "", which client-go refuses for a named Get, so these scans never used relevancy.

An empty namespace is now left out, so every namespace is listed and each one is filtered and looked up on its own. A request with a namespace, or with designators, is handled as before.

How to Test

go test ./mainhandler/ -run 'TestHandleImageScanningScopedRequest' -count=1 -v

• TestHandleImageScanningScopedRequest_ClusterWideLooksUpProfilesInPodNamespace: a cluster-wide request for a pod in default with a ContainerProfile. On main the profile is looked up in "" (expected: []string{"default"} actual: []string{""}); with the fix it's looked up in default and the profile scan is dispatched.
• TestHandleImageScanningScopedRequest_ClusterWideHonoursIncludedNamespaces: with includeNamespaces: ["payments"], a cluster-wide request scans the pod in payments and not the one in other. On main nothing is scanned (expected: 1 actual: 0).

go test ./mainhandler/ -count=1 passes, and gofmt, goimports, go vet and golangci-lint report nothing new. I haven't run it on a live cluster.

Checklist before requesting a review

• My code follows the style guidelines of this project
• I have commented on my code, particularly in hard-to-understand areas
• I have performed a self-review of my code
• If it is a core feature, I have added thorough tests.
• New and existing unit tests pass locally with my changes

🤖 Generated with Claude Code

Summary by CodeRabbit

• Bug Fixes
  • Cluster-wide image scans now correctly search across namespaces. Namespace filters continue to limit scans to matching pods.
• Tests
  • Added coverage for cluster-wide scans and namespace-filtered scans.

[coderabbitai]

No actionable comments were generated in the recent review.

Walkthrough

Cluster-wide requests no longer add an empty namespace to the namespace list. Tests check ContainerProfile lookups for pod namespaces, scan dispatch, and filtering by an included namespace.

Changes: Cluster-wide image scans

Layer / File(s)	Summary
Namespace fallback and scan tests mainhandler/handlerequests.go, mainhandler/scoped_cluster_wide_test.go	getNamespaces omits an empty namespace, allowing the existing all-namespaces fallback to run. Tests check ContainerProfile lookups by pod namespace, scan dispatch, and filtering to the included namespace.

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix · Severity of issue fixed: Medium

Suggested labels: ai-assisted

Suggested reviewers: matthyx

Merge Risk: Minimal · up to 88614

Cluster-wide scans can use the namespace fallback with the recommended deployment’s permissions. No actionable merge-blocking risk remains after normal checks.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly summarizes the main change: listing namespaces for cluster-wide image scan requests.
Linked Issues check		Issue #488 requires cluster-wide image scans to cover each namespace, apply namespace filters per namespace, and look up each pod’s ContainerProfile in its namespace. The PR summary says `getNamespace…
Out of Scope Changes check		The reported change in mainhandler/handlerequests.go and the tests in mainhandler/scoped_cluster_wide_test.go directly implement and verify issue #488. The available PR evidence shows no unrelated…
Docstring Coverage		Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…

Full details: Linked Issues check

Explanation

Issue #488 requires cluster-wide image scans to cover each namespace, apply namespace filters per namespace, and look up each pod’s ContainerProfile in its namespace. The PR summary says getNamespaces now omits an empty request namespace so the existing all-namespaces path runs. mainhandler/scoped_cluster_wide_test.go checks a ContainerProfile lookup in default, scan dispatch, and filtering to payments rather than other. These changes address the reported failures.

Full details: Out of Scope Changes check

Explanation

The reported change in mainhandler/handlerequests.go and the tests in mainhandler/scoped_cluster_wide_test.go directly implement and verify issue #488. The available PR evidence shows no unrelated changes.

Full details: Docstring Coverage

Explanation

Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 1 functions across 2 files.

Finishing Touches

Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: e443e1b4-c8f8-4022-bdbb-fe1cec16b00f

Commits

Reviewing files that changed from the base of the PR and between 47e9ae6 and 88614e2.

Files selected for processing: 2

• mainhandler/handlerequests.go
• mainhandler/scoped_cluster_wide_test.go

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

[matthyx]

Approving 88614e2 (base main). No blockers found.

• Need: Confirmed on main. For a cluster-wide WildWlid, getNamespaces returns [""], which is non-empty, so the "list all namespaces" fallback never runs. With includeNamespaces set, nothing is scanned. Without it, ContainerProfiles are fetched in namespace "", so relevancy scans never start. Matches #488.
• Fix: Skipping an empty namespace lets the existing fallback run. Requests with a namespace or with designators behave as before. This is the cause, not a symptom patch. Designator-based requests already used the fallback, so they are unaffected.
• Validation (run locally):
  • Both new tests fail on the unfixed code (expected ["default"] actual [""], and expected 1 actual 0).
  • They pass with the fix, and go test ./mainhandler/ and go vet are clean.
  • Not tested on a live cluster.
• CI: build, CodeQL, DCO and GitGuardian are green. The Basic-Test result was not reported when I checked.
• History: I found no duplicate, superseded or previously rejected PRs. The search was by keyword, so it is not exhaustive. There are no prior reviews or inline threads.