refactor(rulemanager): reuse armoapi-go profileDataRequired schema#834
refactor(rulemanager): reuse armoapi-go profileDataRequired schema#834matthyx wants to merge 2 commits into
Conversation
📝 WalkthroughWalkthroughThis PR contains a schema type migration where ChangesType Schema Migration to armotypes
Dependency Updates
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@go.mod`:
- Line 188: The go.mod currently pulls github.com/containerd/containerd/v2 at
v2.2.1 which is in the vulnerable range for GHSA-fqw6-gf59-qr4w; update the
dependency graph so containerd is at least v2.2.4 (the first patched release).
Concretely, in go.mod either update the direct dependency that transitively
requires github.com/containerd/containerd/v2 to a version that resolves to
v2.2.4+ or add a module replace/require for github.com/containerd/containerd/v2
=> github.com/containerd/containerd/v2 v2.2.4 (or later) and run go mod tidy to
regenerate go.sum and ensure the new version is used.
- Line 209: The go.mod currently pins the indirect module
github.com/docker/docker v28.5.2+incompatible which contains HIGH-severity
vulnerabilities; update the dependency to at least v29.3.1 by replacing or
bumping github.com/docker/docker to >= v29.3.1 (and ideally a later patched
release) and then run go mod tidy to resolve the graph—if the direct introducer
is github.com/kubescape/node-agent/pkg/containerwatcher/v2 or
github.com/inspektor-gadget/inspektor-gadget/pkg/container-utils/docker, update
those modules (or add a replace directive for github.com/docker/docker) so the
resolved version is >= v29.3.1 and re-run tests/build to ensure compatibility.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: fe36ae3a-968a-4a99-9fab-e6b8c2f19cdd
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (5)
go.modpkg/objectcache/containerprofilecache/projection_compile.gopkg/objectcache/containerprofilecache/projection_compile_test.gopkg/rulemanager/types/v1/profiledata.gopkg/rulemanager/types/v1/profiledata_test.go
💤 Files with no reviewable changes (1)
- pkg/rulemanager/types/v1/profiledata_test.go
| github.com/containerd/containerd v1.7.32 // indirect | ||
| github.com/containerd/containerd/api v1.9.0 // indirect | ||
| github.com/containerd/containerd/api v1.10.0 // indirect | ||
| github.com/containerd/containerd/v2 v2.2.1 // indirect |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Check for containerd security advisories and latest version
gh api graphql -f query='
{
securityVulnerabilities(first: 10, ecosystem: GO, package: "github.com/containerd/containerd/v2") {
nodes {
advisory {
summary
severity
publishedAt
}
vulnerableVersionRange
firstPatchedVersion {
identifier
}
}
}
}'Repository: kubescape/node-agent
Length of output: 2602
Update github.com/containerd/containerd/v2 to fix GHSA-fqw6-gf59-qr4w (runAsNonRoot evasion).
go.mod currently pins github.com/containerd/containerd/v2 v2.2.1 (indirect), which falls in the vulnerable range >= 2.1.0-beta.0, < 2.2.4; the first patched version is 2.2.4. Update your dependency graph (via updating the direct dependency chain or adding a replace) to pull in containerd/v2 >= 2.2.4.
🧰 Tools
🪛 OSV Scanner (2.3.8)
[HIGH] 188-188: github.com/containerd/containerd/v2 2.2.1: containerd user ID handling bypass allows runAsNonRoot evasion
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@go.mod` at line 188, The go.mod currently pulls
github.com/containerd/containerd/v2 at v2.2.1 which is in the vulnerable range
for GHSA-fqw6-gf59-qr4w; update the dependency graph so containerd is at least
v2.2.4 (the first patched release). Concretely, in go.mod either update the
direct dependency that transitively requires github.com/containerd/containerd/v2
to a version that resolves to v2.2.4+ or add a module replace/require for
github.com/containerd/containerd/v2 => github.com/containerd/containerd/v2
v2.2.4 (or later) and run go mod tidy to regenerate go.sum and ensure the new
version is used.
Source: Linters/SAST tools
| github.com/docker/cli v29.2.0+incompatible // indirect | ||
| github.com/docker/cli v29.3.0+incompatible // indirect | ||
| github.com/docker/distribution v2.8.3+incompatible // indirect | ||
| github.com/docker/docker v28.5.2+incompatible // indirect |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Check for Docker security advisories and patched versions
gh api graphql -f query='
{
securityVulnerabilities(first: 15, ecosystem: GO, package: "github.com/docker/docker") {
nodes {
advisory {
summary
severity
publishedAt
}
vulnerableVersionRange
firstPatchedVersion {
identifier
}
}
}
}'
echo "---"
echo "Checking which direct dependencies pull in docker/docker:"
rg -n "github.com/docker/docker" go.modRepository: kubescape/node-agent
Length of output: 3625
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== go.mod entries =="
rg -n "github.com/docker/docker" go.mod
echo
echo "== go mod why (dependency chain) =="
go mod why -m github.com/docker/docker
echo
echo "== modules that import/require docker/docker (small graph slice) =="
# Print only relevant edges around docker/docker
go mod graph | rg "github.com/docker/docker@" | head -n 50 || trueRepository: kubescape/node-agent
Length of output: 8415
major: Update vulnerable github.com/docker/docker v28.5.2+incompatible (indirect) pulled via inspektor-gadget
go.mod includes github.com/docker/docker v28.5.2+incompatible // indirect and go mod why -m github.com/docker/docker traces it to github.com/kubescape/node-agent/pkg/containerwatcher/v2 → github.com/inspektor-gadget/inspektor-gadget/pkg/container-utils/docker → github.com/docker/docker/api/types/container.
GitHub advisory data shows HIGH issues affecting this version:
- AuthZ plugin bypass with oversized request bodies: fixed in 29.3.1 (
< 29.3.1) docker cprace condition (bind mount redirection to host path): affects <= 28.5.2; no patched version listed in advisory dataPUT /containers/{id}/archiveexecutes container binary on the host: affects <= 28.5.2; no patched version listed in advisory data
Update github.com/docker/docker to >= 29.3.1 at minimum, and bump further once the upstream patched versions for the docker cp and PUT .../archive HIGH issues are identified.
🧰 Tools
🪛 OSV Scanner (2.3.8)
[HIGH] 209-209: github.com/docker/docker 28.5.2+incompatible: Moby has an Off-by-one error in its plugin privilege validation in github.com/docker/docker
(GO-2026-4883)
[HIGH] 209-209: github.com/docker/docker 28.5.2+incompatible: Moby has AuthZ plugin bypass when provided oversized request bodies in github.com/docker/docker
(GO-2026-4887)
[HIGH] 209-209: github.com/docker/docker 28.5.2+incompatible: Moby has an Off-by-one error in its plugin privilege validation
[HIGH] 209-209: github.com/docker/docker 28.5.2+incompatible: Docker: Race condition in docker cp allows bind mount redirection to host path
[HIGH] 209-209: github.com/docker/docker 28.5.2+incompatible: Docker: Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swap
[HIGH] 209-209: github.com/docker/docker 28.5.2+incompatible: Moby has AuthZ plugin bypass when provided oversized request bodies
[HIGH] 209-209: github.com/docker/docker 28.5.2+incompatible: Docker: PUT /containers/{id}/archive executes container binary on the host
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@go.mod` at line 209, The go.mod currently pins the indirect module
github.com/docker/docker v28.5.2+incompatible which contains HIGH-severity
vulnerabilities; update the dependency to at least v29.3.1 by replacing or
bumping github.com/docker/docker to >= v29.3.1 (and ideally a later patched
release) and then run go mod tidy to resolve the graph—if the direct introducer
is github.com/kubescape/node-agent/pkg/containerwatcher/v2 or
github.com/inspektor-gadget/inspektor-gadget/pkg/container-utils/docker, update
those modules (or add a replace directive for github.com/docker/docker) so the
resolved version is >= v29.3.1 and re-run tests/build to ensure compatibility.
Source: Linters/SAST tools
Replace node-agent's duplicate profileDataRequired schema (ProfileDataRequired/FieldRequirement/PatternObject + custom marshalling) with type aliases to the canonical armoapi-go/armotypes types (ProfileDataRequired/ProfileDataField/ProfileDataPattern). Defining the matcher once in armoapi-go — imported by node-agent (query side), storage (generation side / rule-aware collapse), and the backend (rules in MongoDB) — guarantees it can never drift between the side that records a profile and the side that queries it. Shape change: a profile-data surface is now a *pointer* (Opens *ProfileDataField); a nil pointer means "this rule does not declare this surface", the role the old FieldRequirement.Declared bool played. mergeField is updated accordingly (pointer + nil check); the schema's own test moves to armoapi-go. Deps: - armoapi-go -> v0.0.719 (profileDataRequired schema + UnionOpenProtection). - kubescape/storage -> v0.0.282. Note: the storage v0.0.282 bump pulls a newer SBOM/containerd stack (stereoscope v0.1.22, containerd/api v1.10.0) that does not yet compile against node-agent's pinned containerd v1.7.32 and kubescape/syft fork — a separate coordinated dependency update, tracked independently of this schema refactor. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com>
matthyx
force-pushed
the
feat/dedup-profiledata-to-armoapi
branch
from
7bb0c7a to
d972a07
Compare
…places only) Bumping kubescape/storage to v0.0.282 pulled a newer transitive stack that broke the build against the frozen forks/replaces: - opencontainers/runtime-spec was forced to v1.3.0, which changed LinuxPids.Limit from int64 to *int64; containerd v1.7.32's oci/spec_opts.go assigns an int64 and no longer compiles. - anchore/stereoscope was forced to v0.1.22, whose docker/podman clients need a docker client API (client.New, client.PingOptions) newer than the pinned docker v28.5.2; the frozen kubescape/syft fork expects stereoscope v0.1.9. Resolve with two additive replace directives pinning these transitives back to the versions the frozen set already uses (runtime-spec v1.2.1 — the version origin/main used — and the stereoscope v0.1.9 pseudo-version the kubescape/syft fork requires). No change to the three frozen replaces (syft, inspektor-gadget, cilium/ebpf) or to the storage v0.0.282 pin. go build ./... is clean, all test binaries compile, and the affected unit tests (containerprofilecache projection, applicationprofile CEL) pass. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com>
|
Review — no merge blockers. CI is fully green (build-and-push + all 24 component tests) and the refactor is sound. One non-blocking gap and a deps note below. ✅ Verified
|
Performance Benchmark ResultsNode-Agent Resource Usage
Dedup EffectivenessNo data available. |
1 participant
What
Two commits:
Schema dedup — replaces node-agent's duplicate
profileDataRequiredschema with type aliases to the canonical armoapi-go types (ProfileDataRequired/ProfileDataField/ProfileDataPattern). Defining the matcher once in armoapi-go — imported by node-agent (query side), storage (generation side / rule-aware collapse), and the backend (rules in MongoDB) — guarantees it can't drift between the side that records a profile and the side that queries it. Shape change: a profile-data surface is now a pointer (Opens *ProfileDataField); a nil pointer means "not declared" (the role the oldFieldRequirement.Declaredbool played).mergeFieldupdated to pointer + nil-check; the schema's own test moves to armoapi-go.Dependency fix — resolves the transitive conflicts from the
kubescape/storage v0.0.282bump using additive replace directives only, leaving the three frozen replaces (syft, inspektor-gadget, cilium/ebpf) and the storage pin untouched.Deps
armoapi-go→v0.0.719(profileDataRequired schema +UnionOpenProtection).kubescape/storage→v0.0.282.Dependency resolution (was the blocker — now fixed)
The
storage v0.0.282bump pulled a newer transitive stack that broke the build against the frozen forks:opencontainers/runtime-specwas forced tov1.3.0, which changedLinuxPids.Limitfromint64to*int64;containerd v1.7.32'soci/spec_opts.goassigns anint64and stopped compiling.anchore/stereoscopewas forced tov0.1.22, whose docker/podman clients need a docker API (client.New,client.PingOptions) newer than the pinneddocker v28.5.2; the frozenkubescape/syftfork expectsstereoscope v0.1.9.Resolved with two additive replaces pinning these transitives back to the versions the frozen set already uses:
(
runtime-spec v1.2.1is whatorigin/mainused; the stereoscope pseudo-version is the one thekubescape/syft v1.32.0-ks.2fork requires.) The three frozen replaces andstorage v0.0.282are unchanged.Verified
go build ./...— clean.go test ./... -run='^$'— all test binaries compile.pkg/objectcache/containerprofilecache(projection /mergeField) andpkg/rulemanager/cel/libraries/applicationprofile(was_path_opened).Related
UnionOpenProtection, released in v0.0.719)🤖 Generated with Claude Code