ROX-37315: Keep deploy checks with image exclusions - #23107

Description

Fixes ROX-37315.

TL;DR: if a policy runs at both Build and Deploy and has an image exclusion, it stops checking every deployment, not just the excluded image. This PR makes image exclusions ignore deployments, so deploy-time detection and admission control work again.

Background: two kinds of exclusion

A policy exclusion has two optional parts:

• a deployment part (name and/or scope: cluster, namespace, label), which skips deployments at Deploy and Runtime;
• an image part (an image name), which skips that image at Build (roxctl image check).

When you add an image exclusion in the UI, it saves { image: { name: "..." }, deployment: null }.

The bug

This came from a customer: "Block Critical CVE older than 180 days" runs at Build and Deploy, with one image excluded. After they added the exclusion, the policy stopped raising deploy-time violations and stopped blocking deployments in admission control, for every deployment and not only the excluded image. roxctl image check still worked, so the problem was easy to miss. This is a regression from stackrox/rox#8454 (3.63), which removed a nil check on the exclusion's deployment part as redundant. Without it, a nil scope matches every deployment.

To reproduce on master:

1. Create a policy with Build and Deploy stages (for example "Image Tag is latest") and enforcement on.
2. Add an image exclusion for docker.io/library/nginx:latest.
3. Deploy busybox:latest. It isn't blocked and gets no violation, even though it matches the policy and isn't excluded.

Why it happens

At deploy time, pkg/detection checks every exclusion against the deployment with compiledExclusion.MatchesDeployment. That runs two checks:

1. a deployment name check, which is skipped when the exclusion has no name;
2. a scope check, CompiledScope.MatchesDeployment, which returns true when the scope is nil (pkg/scopecomp/scope.go:139).

An image-only exclusion has no deployment name and no scope, so both checks pass and every deployment counts as excluded. The policy is skipped everywhere. Admission control compiles policies with the same code, so it's affected too.

The policy matchers in central/policy/matcher follow the same pattern. That's why these policies also disappear from the policy lists on the cluster, namespace, and deployment pages.

The fix

An exclusion only counts against a deployment if it has a deployment part (exclusion.GetDeployment() != nil).

• pkg/detection/compiled_policy.go: MatchesDeployment and MatchesAuditEvent return false for image-only exclusions. This is the main fix. The audit event guard is defensive: audit log policies are Runtime-only, so they can't have image exclusions today.
• central/policy/matcher/{deployment,namespace,cluster}.go: the same guard, so these policies show up in the entity policy lists again.

Image exclusions still work at Build. That path (imagePredicate) never read the deployment part, so it's unchanged.

No UI change is needed.

Heads up: behavior change on upgrade

Policies that have this problem will start raising deploy-time violations again after upgrading. If they have enforcement on, they'll start blocking deployments again. This is the intended behavior, but customers who relied on the bug to exempt an app at deploy time will notice. The CHANGELOG entry points them to deployment exclusions.

Workaround until this ships (also the right setup after it): skip apps at deploy time with deployment exclusions (by name, namespace, or label). If you still need to skip an image in CI, make a Build-only copy of the policy with the image exclusion, and turn off Build on the original.

Alternatives considered

• Make image exclusions apply at deploy time too (skip deployments whose images all match). Image exclusions are meant to apply only at Build, and deploy time ignored them until the guard was removed in stackrox/rox#8454. Changing that now would change what every existing image exclusion does at deploy time, and it raises open questions like how multi-container deployments should behave. Not something to pursue.
• Reject image exclusions on policies that run at Deploy. This would break policies customers have already saved and the UI flow they use today.

This restores the guard that stackrox/rox#8454 removed from pkg/detection, and adds the same guard to the entity policy matchers.

Not in this PR: the config-controller CR converter (config-controller/api/v1alpha1/policy_types.go) never sets Image on exclusions, so policies managed as CRs can't have image exclusions at all. That's a separate gap and needs its own ticket.

User-facing documentation

• CHANGELOG.md is updated OR update is not needed
• documentation PR is created and is linked above OR is not needed

Testing and quality

• the change is production ready: the change is GA, or otherwise the functionality is gated by a feature flag
• CI results are inspected

Automated testing

• added unit tests
• added e2e tests
• added regression tests
• added compatibility tests
• modified existing tests

How I validated my change

Unit and regression tests. The main regression test is pkg/detection/deploytime/detector_impl_test.go. It runs a policy shaped like the customer's through the real policy set and deploy-time detector:

• With no exclusion, the vulnerable deployment alerts. This confirms the test data triggers the policy.
• With an image exclusion, a deployment that doesn't run the excluded image still alerts. This is the bug.
• A deployment exclusion still skips the named deployment.
• At Build, the excluded image is still skipped and other images are still checked.

I also added:

• smaller cases in exclusion_test.go and compiled_policy_test.go;
• an audit event check;
• central/policy/matcher/matcher_test.go, which checks that an image-only exclusion doesn't hide the policy from a deployment, namespace, or cluster, while a cluster-scoped deployment exclusion still does.

To prove the tests catch the bug, I reverted only the production code and kept the tests. Five tests failed, and the deploy-time one failed exactly as the customer described (no alerts):

--- FAIL: TestImageExclusionDoesNotDisableDeployTimeDetection
    Error: "[]" should have 1 item(s), but has 0
--- FAIL: TestCompiledPolicyScopesAndExclusions
--- FAIL: TestMatchesDeploymentExclusion
--- FAIL: TestImageOnlyExclusionDoesNotMatchAuditEvent
--- FAIL: TestImageOnlyExclusionDoesNotExcludeEntities

With the fix, they all pass: go test ./pkg/detection/... ./pkg/booleanpolicy/... ./central/detection/... ./sensor/admission-control/... ./central/policy/matcher/...

Live smoke test. I deployed this PR's CI image (5.1.x-90-gee0811461c) to a GKE cluster with roxie, then used the repro steps above. The policy runs at Build and Deploy with enforcement on, and excludes docker.io/library/nginx:latest. I deployed nginx:latest (excluded) and busybox:latest (not excluded).

I didn't see scale-to-zero, because break-glass also bypasses Sensor's enforcer. The admission block already shows enforcement works.