diff --git a/src/audit.rs b/src/audit.rs index 4e03d9c..50eeffa 100644 --- a/src/audit.rs +++ b/src/audit.rs @@ -4,7 +4,6 @@ use crate::manager::Manager; use crate::policy::{load_policies_from_file, PolicyInfo, PolicyStore, PolicyStoreRef}; use crate::util::error::{kube_err, load_err, BridgekeeperError, Result}; use crate::util::k8s::{list_with_retry, patch_status_with_retry, namespaces, find_k8s_resource_matches, gen_target_identifier}; -use crate::util::defaults::api_group_or_default; use argh::FromArgs; use k8s_openapi::chrono::{DateTime, Utc}; use kube::{ @@ -143,10 +142,7 @@ impl Auditor { let namespaces = namespaces(self.k8s_client.clone()).await?; let mut matched_resources: Vec<(KubeApiResource, bool)> = Vec::new(); for target_match in policy.policy.target.matches.iter() { - // Default to "core" if apiGroup is set to "" - let api_group = api_group_or_default(target_match.api_group.as_str()); - - let mut result = find_k8s_resource_matches(api_group, &target_match.kind, &self.k8s_client).await?; + let mut result = find_k8s_resource_matches(&target_match.api_group, &target_match.kind, &self.k8s_client).await?; matched_resources.append(&mut result); } diff --git a/src/policy.rs b/src/policy.rs index 03764d4..8285d27 100644 --- a/src/policy.rs +++ b/src/policy.rs @@ -1,6 +1,5 @@ use crate::crd::{Policy, PolicySpec}; use crate::util::error::{load_err, Result}; -use crate::util::defaults::api_group_or_default; use k8s_openapi::api::core::v1::ObjectReference as KubeObjectReference; use kube::api::GroupVersionKind; use kube::core::Resource; @@ -78,8 +77,7 @@ impl PolicyInfo { pub fn is_match(&self, gvk: &GroupVersionKind, namespace: &Option) -> bool { for kind in self.policy.target.matches.iter() { - // Default to "core" if apiGroup is set to "" - let api_group = api_group_or_default(kind.api_group.as_str()); + let api_group = kind.api_group.as_str(); if (api_group == "*" || api_group.to_lowercase() == gvk.group.to_lowercase()) && (kind.kind == "*" || kind.kind.to_lowercase() == gvk.kind.to_lowercase()) diff --git a/src/util/defaults.rs b/src/util/defaults.rs deleted file mode 100644 index 6621b4a..0000000 --- a/src/util/defaults.rs +++ /dev/null @@ -1,8 +0,0 @@ -/// Returns the original api_group if it was not empty, otherwise returns "core" -pub fn api_group_or_default(api_group: &str) -> &str { - if api_group.is_empty() { - "core" - } else { - api_group - } -} \ No newline at end of file diff --git a/src/util/k8s.rs b/src/util/k8s.rs index 81277a3..7b993f1 100644 --- a/src/util/k8s.rs +++ b/src/util/k8s.rs @@ -89,7 +89,7 @@ pub async fn find_k8s_resource_matches( && !resource.name.contains('/') { matched_resources.push(( - gen_resource_description(None, resource), + gen_resource_description(None, resource, Some(version.clone())), resource.namespaced, )); } @@ -119,7 +119,7 @@ pub async fn find_k8s_resource_matches( && !resource.name.contains('/') { matched_resources.push(( - gen_resource_description(Some(group), resource), + gen_resource_description(Some(group), resource, None), resource.namespaced, )); } @@ -133,6 +133,7 @@ pub async fn find_k8s_resource_matches( pub fn gen_resource_description( api_group: Option<&APIGroup>, api_resource: &APIResource, + version: Option, ) -> KubeApiResource { let gvk = GroupVersionKind { group: match api_group { @@ -147,7 +148,7 @@ pub fn gen_resource_description( .expect("API Server always has a preferred_version") .version } - None => String::from(""), + None => version.unwrap_or_default(), }, kind: api_resource.kind.clone(), }; diff --git a/src/util/mod.rs b/src/util/mod.rs index 0c052c3..beac6fe 100644 --- a/src/util/mod.rs +++ b/src/util/mod.rs @@ -1,5 +1,4 @@ pub mod cert; pub mod error; pub mod k8s; -pub mod webhook; -pub mod defaults; \ No newline at end of file +pub mod webhook; \ No newline at end of file