ROX-37161: Strip exclude-by-kind rules for sensors without capability by clickboo · Pull Request #22963 · stackrox/stackrox

clickboo · 2026-09-22T05:25:17Z

Description

When broadcasting policies, Central strips exclude_by_kind items if the Sensor lacks WorkloadKindExclusionCap. Policies are cloned first so a mixed-sensor fanout does not mutate a shared slice. Admission controller gets the same policy copies as Sensor.

This is PR 4 of 6 (flag → proto → validate → sync → UI → e2e). Stacked on #22962.

Without stripping, a 4.11 Sensor drops the unknown exclude_by_kind field, so GetDeployment() is nil. A nil scope matches every deployment, and the exclusion turns the policy off for every workload. Put differently, the policy then excludes every workload, including ones the kind rule was never meant to cover.

Stripping removes that exclusion before sync. A 4.11 Sensor never evaluates it, and the remaining scope exclusions still apply.

User-facing documentation

CHANGELOG.md is updated OR update is not needed
documentation PR is created and is linked above OR is not needed

Testing and quality

the change is production ready: the change is GA, or otherwise the functionality is gated by a feature flag
CI results are inspected

Automated testing

How I validated my change

Unit tests on the Sensor connection path: type exclusions stripped without the capability, preserved with it, and cloned so one Sensor cannot mutate another Sensors list.

Old sensor manual test

Central 5.1.x with ROX_POLICY_WORKLOAD_KIND_EXCLUSION enabled, Sensor 4.11.4. Sensor 4.11.4 does not advertise WorkloadKindExclusion, so Central strips kind exclusions before policy sync and leaves scope exclusions in place.

Policy: image tag latest, plus a namespace scope exclusion and a Job/CronJob kind exclusion.

{
  "name": "Latest tag old-sensor strip",
  "description": "Latest tag policy with a namespace scope exclusion and a Job and CronJob kind exclusion.",
  "categories": ["DevOps Best Practices"],
  "lifecycleStages": ["DEPLOY"],
  "severity": "LOW_SEVERITY",
  "policyVersion": "1.1",
  "exclusions": [
    {
      "name": "skip namespace policy-exclusion-skip",
      "deployment": {
        "scope": {
          "namespace": "policy-exclusion-skip"
        }
      }
    },
    {
      "name": "skip jobs and cronjobs",
      "excludeByKind": {
        "kinds": ["JOB", "CRON_JOB"]
      }
    }
  ],
  "policySections": [
    {
      "policyGroups": [
        {
          "fieldName": "Image Tag",
          "values": [{ "value": "latest" }]
        }
      ]
    }
  ]
}

Workloads are a Job, a CronJob, and a Deployment, each using nginx:latest, in default and again in policy-exclusion-skip. Alerts below are for this policy only. The built-in Latest tag policy also alerts on all six.

Workload	Namespace	4.11.4 Sensor	Why
Job `latest-tag-job`, CronJob `latest-tag-cronjob`, Deployment `latest-tag-deploy`	`default`	Violation	• 4.11.4 does not advertise `WorkloadKindExclusion`, so the Job and CronJob exclusion is removed before sync • The image tag is `latest`, so the policy matches • The namespace is not `policy-exclusion-skip`, so the scope exclusion does not match • The Deployment violation shows the policy was not turned off for every workload
Job `latest-tag-job`, CronJob `latest-tag-cronjob`, Deployment `latest-tag-deploy`	`policy-exclusion-skip`	No violation	• The namespace scope exclusion is kept • That exclusion matches `policy-exclusion-skip` • Exclusions are OR'd, so the scope rule alone excludes these workloads

openshift-ci · 2026-09-22T05:25:21Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

clickboo · 2026-09-22T05:25:27Z

This change is part of the following stack:

ROX-37161: Strip exclude-by-kind rules for sensors without capability #22963 ◀
- ROX-37157: add workload kind policy exclusion in wizard #22964
  - ROX-37162: add Groovy e2e for Job workload type exclusion #22965

_{Change managed by git-spice.}

github-actions · 2026-09-22T05:34:57Z

🚀 Build Images Ready

Images are ready for commit e831e09. To use with deploy scripts:

export MAIN_IMAGE_TAG=5.1.x-294-ge831e09165

codecov · 2026-09-22T05:56:15Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 51.98%. Comparing base (5a0ada2) to head (0fa3b64).
⚠️ Report is 2 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master   #22963      +/-   ##
==========================================
- Coverage   52.00%   51.98%   -0.03%     
==========================================
  Files        2913     2913              
  Lines      183624   183638      +14     
==========================================
- Hits        95500    95456      -44     
- Misses      79776    79815      +39     
- Partials     8348     8367      +19

Flag	Coverage Δ
go-unit-tests	`51.98% <100.00%> (-0.03%)`	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

coderabbitai · 2026-10-15T16:55:48Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)
Review profile: CHILL
Plan: Advanced
Run ID: 6764af0a-106e-4526-bdf1-dd0672d2f406

📥 Commits

Reviewing files that changed from the base of the PR and between 4e0382b and 8623e87.

📒 Files selected for processing: 13

central/policy/matcher/cluster.go
central/policy/matcher/deployment.go
central/policy/matcher/matcher.go
central/policy/matcher/matcher_test.go
central/policy/matcher/namespace.go
central/policy/service/validator.go
central/policy/service/validator_test.go
central/sensor/service/connection/connection_impl.go
central/sensor/service/connection/connection_test.go
config-controller/api/v1alpha1/policy_types.go
pkg/detection/compiled_policy.go
pkg/detection/compiled_policy_test.go
pkg/detection/exclusion_test.go

Included review availability: This review used your included allowance. Your plan provides up to 4 included reviews per hour; 3 remain after this review.

📝 Summary

Summary by CodeRabbit

New Features
- Policies can now exclude CronJob and Job workloads by kind, alongside existing exclusion criteria.
- Kind-based exclusions are available for deploy-time and runtime policies when the feature is enabled.
Bug Fixes
- Exclusions now match the intended workload types without unintentionally applying to unrelated deployments, namespaces, or clusters.
- Policies synced to Sensors without workload-kind exclusion support omit unsupported kind-based exclusions while preserving the original policy for later synchronization.

Adds feature-flagged workload-kind exclusions for CronJob and Job policies. Validation and detection compile and match these exclusions, central policy matching handles them, and policy sync removes them for Sensors without the capability.

Changes: Workload-kind exclusions

Layer / File(s)	Summary
Validate workload-kind exclusions `central/policy/service/validator.go`, `central/policy/service/validator_test.go`, `config-controller/api/v1alpha1/policy_types.go`	Validation accepts kind-only exclusions for deploy-time and runtime policies when the feature is enabled. It rejects empty or unsupported kind lists.
Compile and match workload kinds `pkg/detection/compiled_policy.go`, `pkg/detection/_test.go`, `central/policy/matcher/`	Detection and central policy matching recognize CronJob and Job exclusions. Tests cover feature-flag behavior, kind matching, and interactions with other exclusion criteria.
Filter exclusions for unsupported Sensors `central/sensor/service/connection/connection_impl.go`, `central/sensor/service/connection/connection_test.go`	Policy sync removes kind-based exclusions when a Sensor lacks the capability. Tests check retained exclusions and verify that filtering does not mutate the source policy.

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~25 minutes

Change: Feature

Suggested reviewers: alexvulaj, janisz

Merge Risk: ⚪ Minimal · up to 8623e

The compatibility filtering appears consistent across Sensor policy delivery and admission-controller forwarding. No issue identified here prevents merging after normal checks.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 33.33% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 18 functions across 13 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Title check		The title clearly identifies the main change: stripping `exclude_by_kind` rules for Sensors that lack the required capability.
Description check		The description follows the required template and explains the change, compatibility behavior, tests, and manual validation. CI inspection and several optional test categories are not marked, but the …

✨ Finishing Touches: 💡 2

📝 Generate docstrings: 💡

Commit to this branch
Create a new PR

⚔️ Resolve merge conflicts: 💡

Resolve merge conflict in branch boo-policy-excl-type-sync

🧪 Generate unit tests (beta)

Commit to this branch
Create a new PR

_{Comment @coderabbitai help to get the list of available commands.}

clickboo · 2026-10-15T17:31:45Z

/test all

c-du

Looks good.

Co-authored-by: Cursor <cursoragent@cursor.com>

clickboo · 2026-10-17T01:17:31Z

/test gke-ui-e2e-tests

clickboo added the ai-assisted label Sep 22, 2026

openshift-ci Bot added the do-not-merge/work-in-progress label Sep 22, 2026

github-actions Bot added the area/central label Sep 22, 2026

clickboo force-pushed the boo-policy-excl-type-validate branch from f034de2 to d06e574 Compare September 23, 2026 00:27

clickboo force-pushed the boo-policy-excl-type-sync branch from 834cc7f to a61fbb5 Compare September 23, 2026 00:27

clickboo changed the title ~~feat(be): strip type exclusions for incapable sensors~~ ROX-37161: strip exclude-by-type rules for sensors without capability Sep 23, 2026

clickboo force-pushed the boo-policy-excl-type-validate branch from d06e574 to 848c2be Compare September 23, 2026 00:50

clickboo force-pushed the boo-policy-excl-type-sync branch from a61fbb5 to 1299bba Compare September 23, 2026 00:50

clickboo force-pushed the boo-policy-excl-type-validate branch from 848c2be to 2ae48bf Compare September 23, 2026 02:56

clickboo force-pushed the boo-policy-excl-type-sync branch from 1299bba to c100bea Compare September 23, 2026 02:56

clickboo force-pushed the boo-policy-excl-type-validate branch from 2ae48bf to 4c9e9a0 Compare September 24, 2026 16:07

clickboo force-pushed the boo-policy-excl-type-sync branch from c100bea to ce9c1bb Compare September 24, 2026 16:07

clickboo force-pushed the boo-policy-excl-type-validate branch from 4c9e9a0 to 9d641f1 Compare September 24, 2026 16:10

clickboo force-pushed the boo-policy-excl-type-sync branch from ce9c1bb to 849578a Compare September 24, 2026 16:10

clickboo force-pushed the boo-policy-excl-type-validate branch from 9d641f1 to 124313b Compare September 25, 2026 01:25

clickboo force-pushed the boo-policy-excl-type-sync branch from 849578a to c3b6821 Compare September 25, 2026 01:26

clickboo force-pushed the boo-policy-excl-type-validate branch from 124313b to 9c3f628 Compare September 25, 2026 02:53

clickboo force-pushed the boo-policy-excl-type-sync branch from c3b6821 to c058d8e Compare September 25, 2026 02:53

clickboo force-pushed the boo-policy-excl-type-validate branch from 9c3f628 to 05ae9c3 Compare September 25, 2026 03:01

clickboo force-pushed the boo-policy-excl-type-sync branch from c058d8e to f6954f4 Compare September 25, 2026 03:02

clickboo force-pushed the boo-policy-excl-type-validate branch from 05ae9c3 to d538db1 Compare September 25, 2026 05:27

clickboo force-pushed the boo-policy-excl-type-sync branch from ee53ccb to 468df04 Compare October 10, 2026 04:09

clickboo force-pushed the boo-policy-excl-type-validate branch from cccf4ce to 59f2472 Compare October 10, 2026 04:56

clickboo force-pushed the boo-policy-excl-type-sync branch from 468df04 to ddb6193 Compare October 10, 2026 04:56

clickboo force-pushed the boo-policy-excl-type-validate branch from 59f2472 to 3a7c7da Compare October 10, 2026 05:46

clickboo force-pushed the boo-policy-excl-type-sync branch from ddb6193 to ac58ab3 Compare October 10, 2026 05:46

clickboo changed the title ~~ROX-37161: strip exclude-by-type rules for sensors without capability~~ ROX-37161: Strip exclude-by-type rules for sensors without capability Oct 11, 2026

clickboo force-pushed the boo-policy-excl-type-sync branch 2 times, most recently from dba66f8 to 52a4fd0 Compare October 11, 2026 05:09

clickboo force-pushed the boo-policy-excl-type-validate branch from 3a7c7da to 3893396 Compare October 13, 2026 20:29

clickboo force-pushed the boo-policy-excl-type-sync branch from 52a4fd0 to 8623e87 Compare October 13, 2026 20:29

Base automatically changed from boo-policy-excl-type-validate to master October 15, 2026 16:51

clickboo force-pushed the boo-policy-excl-type-sync branch from 8623e87 to 65f9e84 Compare October 15, 2026 17:27

clickboo marked this pull request as ready for review October 15, 2026 18:26

openshift-ci Bot removed the do-not-merge/work-in-progress label Oct 15, 2026

clickboo requested review from Stringy, abushkin-redhat, c-du and lvalerom October 15, 2026 18:26

clickboo changed the title ~~ROX-37161: Strip exclude-by-type rules for sensors without capability~~ ROX-37161: Strip exclude-by-kind rules for sensors without capability Oct 15, 2026

c-du approved these changes Oct 16, 2026

View reviewed changes

clickboo enabled auto-merge (squash) October 16, 2026 20:46

clickboo disabled auto-merge October 16, 2026 20:47

ROX-37161: strip exclude-by-kind rules for sensors without capability

0fa3b64

Co-authored-by: Cursor <cursoragent@cursor.com>

clickboo force-pushed the boo-policy-excl-type-sync branch from 65f9e84 to 0fa3b64 Compare October 16, 2026 20:48

clickboo enabled auto-merge (squash) October 16, 2026 20:48

clickboo merged commit e831e09 into master Oct 17, 2026
109 checks passed

clickboo deleted the boo-policy-excl-type-sync branch October 17, 2026 02:36

Navigation Menu

Repository navigation

ROX-37161: Strip exclude-by-kind rules for sensors without capability - #22963

ROX-37161: Strip exclude-by-kind rules for sensors without capability#22963
clickboo merged 1 commit into
masterfrom
boo-policy-excl-type-sync

clickboo commented Sep 22, 2026 •

edited

Loading

Uh oh!

openshift-ci Bot commented Sep 22, 2026

Uh oh!

clickboo commented Sep 22, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Sep 22, 2026 •

edited

Loading

Uh oh!

codecov Bot commented Sep 22, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Oct 15, 2026 •

edited

Loading

Summary by CodeRabbit

Uh oh!

clickboo commented Oct 15, 2026

Uh oh!

c-du left a comment

Uh oh!

clickboo commented Oct 17, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

clickboo commented Sep 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

User-facing documentation

Testing and quality

Automated testing

How I validated my change

Old sensor manual test

Uh oh!

openshift-ci Bot commented Sep 22, 2026

Uh oh!

clickboo commented Sep 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🚀 Build Images Ready

Uh oh!

codecov Bot commented Sep 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

coderabbitai Bot commented Oct 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

clickboo commented Oct 15, 2026

Uh oh!

c-du left a comment

Choose a reason for hiding this comment

Uh oh!

clickboo commented Oct 17, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

clickboo commented Sep 22, 2026 •

edited

Loading

clickboo commented Sep 22, 2026 •

edited

Loading

github-actions Bot commented Sep 22, 2026 •

edited

Loading

codecov Bot commented Sep 22, 2026 •

edited

Loading

coderabbitai Bot commented Oct 15, 2026 •

edited

Loading