karmor probe doesn't limit scope of a policy to a namespace

[kareem-DA]

Bug Report

karmor probe cli incorrectly links policies to workload in different namespaces.

I am applying a policy to my cluster. To check that I got the labels correct and that the policy was applied to my workload, I ran the "karmor probe" command. I saw in the report that the policy was applied. After looking a little closer, I saw that I actually applied the policy to the default namespace, not the namespace where my workload was. "karmor probe" still linked them

General Information

• Environment description GKE and Kind
• Kernel version
• Orchestration system version in use (e.g. kubectl version, ...) $ kubectl version Client Version: v1.31.1 Kustomize Version: v5.4.2 Server Version: v1.30.3-gke.196900
• Link to relevant artifacts (policies, deployments scripts, ...)
• Target containers/pods

To Reproduce

1. Create Namespace
2. Start workload in namespace. (kubectl exec -n validator -i -t postgres-0 -- bash)
3. Apply wrong policy

   kind: KubeArmorPolicy                                                                                     |    - path: /etc/passwd
   metadata:                                                                                                 |    - path: /etc/shadow
   name: block-file-access                                                                                 |  message: Warning! access sensitive files detected
   # namespace: validator   # Use the appropriate namespace                                              |  selector:
   spec:                                                                                                     |    matchLabels:
   tags: ["block-file-access"]                                                                             |      app: postgres
   message: "Blocking access to /etc/secretfile for unauthorized processes"                                |  severity: 3
   selector:                                                                                               |  tags:
   matchLabels:                                                                                          |  - MITRE
     app: postgres   # Replace with your application's label                                             |  - FIGHT
   file:                                                                                                   |  - FGT1021
   matchDirectories:                                                                                     |  - 5G
     - dir: /                                                                                            |  - MITRE_T1021_Remote_Services
       fromSource:                                                                                       |---
         - path: /usr/lib/postgresql/14/bin/postgres                                                     |apiVersion: security.kubearmor.com/v1
   matchPaths:                                                                                           |kind: KubeArmorPolicy
   - path: /etc/passwd                                                                                   |metadata:
     fromSource:                                                                                         |  name: postgres-14-system-owner-discovery
       - path: /usr/bin/psql                                                                             |  namespace: validator
       - path: /usr/lib/postgresql/14/bin/psql                                                           |spec:
       - path: /usr/bin/head                                                                             |  action: Block
     action: Allow                                                                                       |  message: System owner discovery command execution denied
   - path: /etc/passwd                                                                                   |  process:
     action: Block                                                                                       |    matchPaths:
   severity: 5                                                                                           |    - execname: who
   action: Block

4. Run karmor probe.

In the included screen shot, you can see that there is only 1 policy on the system and that it is in the default namespace, yet the policy is listed under a workload in the validator namespace.

Expected behavior

In this example, the policy shouldn't be listed at all. There aren't any workloads that should apply.

Screenshots

If applicable, add screenshots to help explain your problem.

[daemon1024]

Ack, need improvements in client side tooling. We are working on exposing all of this information from KubeArmor itself as part of https://github.com/kubearmor/kubearmor-client/issues/304

[jokestax]

@kareem-DA i think this pr Link should solve this issue