test(rules): sync default-rules.yaml from rulelibrary; add R0040 + Test_32 + lint guard#844
Merged
Merged
Conversation
…t_32, lint guard
Syncs the bundled tests/chart/templates/node-agent/default-rules.yaml from
kubescape/rulelibrary's rules-crd.yaml (the source of truth after rulelibrary#39):
- adds R0040 "Unexpected process arguments" (3-arg get_exec_path overload +
ap.was_executed_with_args, both in node-agent v0.3.147)
- the migrated exec rules (R0001/R0007/R1001/R1004) use the backward-compatible
exepath-first ternary rather than the 3-arg overload
- adds R2000/R2001 and picks up the rule renames already in rulelibrary
- reconciles default-rule-binding.yaml: enables R0040 and updates the renamed
rule names (R1000/R1003/R1015/R2001) so every binding still resolves
Adds Test_32_UnexpectedProcessArguments (+ fixtures) and registers it in the
component-tests matrix. Test_32 uses dynamicpathdetector.WildcardIdentifier
(the zero-or-more exec-args sentinel in the pinned storage v0.0.278), matching
the existing exec_test.go convention. The ExecArgsWildcard ("⋯⋯") form and the
"*"->literal flip arrived in storage v0.0.287 and are a separate coordinated
storage bump.
Adds pkg/rulemanager/cel/libraries/parse/default_rules_yaml_lint_test.go to
guard the bundled rules: no UNGUARDED 2-arg get_exec_path (the exepath-first
ternary or the 3-arg form is required), no string(event.args), and R1000
detects /dev/shm via argv[0]. All three pass against the synced bundle.
Replaces node-agent#805 (its engine landed separately via #843).
Signed-off-by: matthyx <matthias.bertschy@gmail.com>
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Docs-exempt: test-only + rule-bundle sync; node-agent engine/behavior unchanged (R0040 engine shipped in #843, rule bodies are sourced from kubescape/rulelibrary).
matthyx
added
the
ai-assisted
5 tasks
|
Warning Review limit reached
More reviews will be available in 41 minutes and 24 seconds. Learn how PR review limits work. Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file). ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits. 🚦 How do rate limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (10)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Performance Benchmark ResultsNode-Agent Resource Usage
Dedup EffectivenessNo data available. |
… case - Test_02_AllAlertsFromMaliciousApp: update the R1000 expectation key from the old "Process executed from malicious source" to the synced name "Process Executed from /dev/shm" (rule renamed in rulelibrary). - Test_32/echo_literal_star_does_not_broaden_R0040: t.Skip — it asserts the "*"-is-literal semantics introduced in storage v0.0.287, but main pins v0.0.278 where "*" (WildcardIdentifier) is a zero-or-more wildcard, so a literal "*" does broaden. Re-enable with the coordinated storage bump. The other 9 Test_32 subtests pass. Test_27 (R0002 was disabled by the wholesale bundle sync) is still pending a decision on whether to keep R0002 enabled in node-agent's bundle. Docs-exempt: test-only fix, no node-agent behavioral/API change. Signed-off-by: matthyx <matthias.bertschy@gmail.com> Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…n Test_27 #3 (the original #805 intent): bump kubescape/storage v0.0.278 -> v0.0.287, which introduces ExecArgsWildcard ("⋯⋯") as the zero-or-more exec-args wildcard and makes "*" a literal in exec args. Migrate exec_test.go's "*"-as-wildcard profile entries to dynamicpathdetector.ExecArgsWildcard, revert Test_32 from the v0.0.278 WildcardIdentifier stopgap back to ExecArgsWildcard, and un-skip echo_literal_star_does_not_broaden_R0040 (it now passes — "*" is literal). Engine code is unchanged: it routes through dynamicpathdetector.MatchExecArgs (stable signature); only test fixtures supply the sentinel. #2: Test_27_ApplicationProfileOpens enables R0002 ("Files Access Anomalies"), which ships disabled in the synced bundle, for its own cluster only — by applying tests/resources/r0002-files-access-enabled.yaml (an override Rules CRD with R0002 enabled). The rules-watcher filters disabled rules before its per-ID merge, so it uses the enabled override; default-rules.yaml is untouched. Component-test matrix jobs run on isolated clusters. (Test_33 also exercises R0002 but is not in the matrix.) Unit tests (applicationprofile, parse, objectcache) pass under v0.0.287; the component tests compile. Docs-exempt: dependency bump + test updates; the exec-args wildcard sentinel is documented in storage and the rulelibrary R0040 rule, not in node-agent docs. Signed-off-by: matthyx <matthias.bertschy@gmail.com> Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Performance Benchmark ResultsNode-Agent Resource Usage
Dedup EffectivenessNo data available. |
Test_02_AllAlertsFromMaliciousApp expects "Files Access Anomalies in container" (R0002) to fire, but R0002 ships disabled in the synced bundle — so last commit's rename fix alone left Test_02 red on R0002. Extract enableR0002ForTest (apply the override Rules CRD, return a cleanup func) and use it from both Test_02 and Test_27, replacing Test_27's inline copy. Docs-exempt: test-only change. Signed-off-by: matthyx <matthias.bertschy@gmail.com> Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Performance Benchmark ResultsNode-Agent Resource Usage
Dedup EffectivenessNo data available. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Follow-up to rulelibrary#39 (merged): syncs node-agent's bundled
default-rules.yamlfrom rulelibrary'srules-crd.yaml, enables R0040 in the binding, and adds theTest_32_UnexpectedProcessArgumentscomponent test + adefault-rules.yamllint guard. Replaces #805 (whose engine landed separately via #843). The engine (3-argget_exec_pathoverload +ap.was_executed_with_args) is already onmain.What's in it
default-rules.yaml← synced from rulelibrary#39'srules-crd.yaml. Adds R0040, the R1000 /dev/shm rewrite, the R0001/R0007/R1001/R1004 exepath-first ternary, plus R2000/R2001 and the rule renames already in rulelibrary. (Purely additive — no bundled rule is dropped.)default-rule-binding.yaml← enables"Unexpected process arguments"(R0040) and updates the renamed rule names (R1000/R1003/R1015/R2001) so everyruleNamestill resolves. Verified: all 27 bound names exist indefault-rules.yaml.Test_32_UnexpectedProcessArguments+ fixtures, registered in the component-tests matrix.default_rules_yaml_lint_test.goguard — 3 checks, all green against the synced bundle.Two things for reviewers
Migrated rules use the ternary, not the 3-arg overload. R0001/R0007/R1001/R1004 use
event.exepath != "" ? event.exepath : parse.get_exec_path(event.args, event.comm)— backward-compatible (runs on any agent). Only R0040 uses the 3-arg overload (it also needsap.was_executed_with_args). The lint guard was adapted accordingly: it now rejects an unguarded 2-arg call but allows the ternary and the 3-arg forms.Wildcard sentinel / storage version. Test_32 uses
dynamicpathdetector.WildcardIdentifier— the zero-or-more exec-args sentinel in the pinned storage v0.0.278 (where"*"= zero-or-more), matching the existingexec_test.goconvention. Storage v0.0.287 later renamed this toExecArgsWildcard ("⋯⋯")and made"*"literal. R0040's bundled description (inherited verbatim from rulelibrary) already speaks in"⋯⋯"terms, so it fully aligns only after a coordinated storage v0.0.278 → v0.0.287 bump (which also touchesexec_test.go's"*"cases) — out of scope here, flagged as a follow-up.Verification
go test ./pkg/rulemanager/cel/libraries/parse/ -run TestDefaultRulesYAML→ 3/3 passgo vet -tags=component ./tests/→ compiles (Test_32 included)Closes #805.