Open mattwelke opened 1 month ago
Plugins should support defining more than one rule of the same rule type per validator. For example, in the AWS plugin:
type AwsValidatorSpec struct { ... AmiRules []AmiRule `json:"amiRules,omitempty" yaml:"amiRules,omitempty"` ... }
The Kubescape plugin should be changed to allow this too. Right now, its spec only allows one rule of each type per validator:
type KubescapeValidatorSpec struct { ... SeverityLimitRule SeverityLimitRule `json:"severityLimitRule,omitempty" yaml:"severityLimitRule,omitempty"` ... IgnoredCVERule []string `json:"ignoredCVERule,omitempty" yaml:"ignoredCVERule,omitempty"` ... FlaggedCVERule []FlaggedCVE `json:"flaggedCVERule,omitempty" yaml:"flaggedCVERule,omitempty"` }
For example, SeverityLimitRule can be changed to []SeverityLimitRule to accomplish this.
SeverityLimitRule
[]SeverityLimitRule
After the spec is changed, the controller logic should be changed to iterate through each rule, processing them one at a time.
@wcrum was working on a refactor to the plugin that I believe would address this. @wcrum can you please chime in?
Summary
Plugins should support defining more than one rule of the same rule type per validator. For example, in the AWS plugin:
The Kubescape plugin should be changed to allow this too. Right now, its spec only allows one rule of each type per validator:
For example,
SeverityLimitRule
can be changed to[]SeverityLimitRule
to accomplish this.After the spec is changed, the controller logic should be changed to iterate through each rule, processing them one at a time.