Conversation
📝 WalkthroughWalkthroughRenamed the CEL evaluator interface to Changes
Sequence Diagram(s)sequenceDiagram
participant RM as RuleManager
participant EV as EventConverterRegistry
participant CEL as RuleEvaluator (CEL)
participant PR as CompiledProgram
RM->>RM: receive enriched event
RM->>EV: lookup converter by eventType
alt converter registered
EV-->>RM: converted utils.K8sEvent
else
EV-->>RM: original utils.K8sEvent
end
RM->>CEL: createEvalContext(event)
CEL->>PR: compile/reuse program (evaluateProgramWithContext)
PR-->>CEL: raw result
CEL-->>RM: typed result (bool/string) or error
Estimated code review effort🎯 4 (Complex) | ⏱️ ~40 minutes Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing touches
Comment |
YakirOren
force-pushed
the
feature/remove-to-map
branch
from
d5edce8 to
7fff37e
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
pkg/rulemanager/cel/cel.go (1)
27-36: Synchronize access toeventConvertersmap.The
eventConvertersfield has unsynchronized read and write operations: reads occur increateEvalContext(line 134) and writes inRegisterEventConverter(line 286). Since Go maps are not concurrent-safe and this method is exposed via the publicRuleEvaluatorinterface, add a RWMutex to protect access.🛠️ Suggested locking
type CEL struct { env *cel.Env objectCache objectcache.ObjectCache programCache map[string]cel.Program cacheMutex sync.RWMutex typeMutex sync.RWMutex evalContextPool sync.Pool ta xcel.TypeAdapter tp *xcel.TypeProvider eventConverters map[utils.EventType]func(utils.K8sEvent) utils.K8sEvent + eventConvertersMu sync.RWMutex } @@ - if converter, exists := c.eventConverters[eventType]; exists { + c.eventConvertersMu.RLock() + converter, exists := c.eventConverters[eventType] + c.eventConvertersMu.RUnlock() + if exists { obj, _ = xcel.NewObject(converter(event.Event)) } else { obj, _ = xcel.NewObject(event.Event.(utils.CelEvent)) } @@ func (c *CEL) RegisterEventConverter(eventType utils.EventType, converter func(utils.K8sEvent) utils.K8sEvent) { + c.eventConvertersMu.Lock() c.eventConverters[eventType] = converter + c.eventConvertersMu.Unlock() }Also applies to: 129-148, 285-286
🤖 Fix all issues with AI agents
In `@pkg/rulemanager/cel/cel.go`:
- Around line 254-283: The registerNestedTypes method can panic when obj is nil
or when the resolved objType is not a struct (NumField on non-struct), so add
early guards: return immediately if obj == nil or reflect.TypeOf(obj) == nil,
and after dereferencing pointers return if objType.Kind() != reflect.Struct;
keep existing pointer deref logic, then iterate fields only when
objType.NumField() is safe. Update the CEL.registerNestedTypes function to
perform these nil and non-struct checks before the for-loop so nestedInstance
creation and xcel.RegisterObject calls remain unchanged.
- Around line 126-150: The function createEvalContext currently does an
unchecked type assertion to utils.CelEvent and can panic; change
createEvalContext to return (map[string]any, error), validate the type assertion
when no converter exists (return a descriptive error if event.Event does not
implement utils.CelEvent), propagate errors from xcel.NewObject, and update all
callers of CEL.createEvalContext to handle the returned error (check and
return/handle the error rather than assuming success); keep the existing
behavior of adding "http" when eventType == utils.HTTPEventType.
In `@pkg/rulemanager/rule_manager.go`:
- Around line 382-396: In getUniqueIdAndMessage, stop overwriting the first
evaluation error: after calling
rm.celEvaluator.EvaluateExpression(enrichedEvent, rule.Expressions.Message)
check err and return immediately (message, "", err) if non-nil; then evaluate
rule.Expressions.UniqueID, check that error and return if non-nil, and only then
call hashStringToMD5(uniqueID) before returning; this ensures message-evaluation
errors are propagated and uniqueID hashing happens only on a successful
evaluation.
🧹 Nitpick comments (1)
pkg/rulemanager/rule_manager.go (1)
215-216: Reuse the filteredruleExpressionshere.
You already computedruleExpressionson Line 206; passing it avoids redundant filtering.♻️ Proposed change
- shouldAlert, err := rm.celEvaluator.EvaluateRule(enrichedEvent, rule.Expressions.RuleExpression) + shouldAlert, err := rm.celEvaluator.EvaluateRule(enrichedEvent, ruleExpressions)
Comment on lines
+126
to
+150
| // createEvalContext creates an evaluation context map from an enriched event | ||
| // The context includes the eventType string and the event object wrapped in xcel | ||
| // Uses "event" as the variable name, and for HTTP events also adds "http" variable | ||
| func (c *CEL) createEvalContext(event *events.EnrichedEvent) map[string]any { | ||
| eventType := event.Event.GetEventType() | ||
|
|
||
| // Apply event converter if one is registered, otherwise cast to CelEvent | ||
| var obj interface{} | ||
| if converter, exists := c.eventConverters[eventType]; exists { | ||
| obj, _ = xcel.NewObject(converter(event.Event)) | ||
| } else { | ||
| obj, _ = xcel.NewObject(event.Event.(utils.CelEvent)) | ||
| } | ||
|
|
||
| obj, _ := xcel.NewObject(event.Event.(utils.CelEvent)) // FIXME put safety check here | ||
| out, _, err := program.Eval(map[string]any{"event": obj, "eventType": string(eventType)}) | ||
| if err != nil { | ||
| return false, err | ||
| } | ||
| evalContext := map[string]any{ | ||
| "eventType": string(eventType), | ||
| "event": obj, | ||
| } | ||
|
|
||
| if !out.Value().(bool) { | ||
| return false, nil | ||
| } | ||
| // For HTTP events, also add "http" variable | ||
| if eventType == utils.HTTPEventType { | ||
| evalContext["http"] = obj | ||
| } | ||
|
|
||
| return true, nil | ||
| return evalContext |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
# First, let's examine the specific file and function
cat -n pkg/rulemanager/cel/cel.go | head -200Repository: kubescape/node-agent
Length of output: 7441
🏁 Script executed:
# Find all calls to createEvalContext to see callers
rg "createEvalContext" --type go -B 2 -A 2Repository: kubescape/node-agent
Length of output: 1370
🏁 Script executed:
# Check the utils package to understand CelEvent interface
fd "utils" --type dRepository: kubescape/node-agent
Length of output: 91
🏁 Script executed:
# Look for CelEvent interface definition
rg "interface.*CelEvent|type.*CelEvent" --type go -A 5Repository: kubescape/node-agent
Length of output: 486
🏁 Script executed:
# Check event types and converter registration
rg "eventConverters|EventType" pkg/rulemanager/cel/cel.go --type go -B 2 -A 2Repository: kubescape/node-agent
Length of output: 1491
🏁 Script executed:
# Find where converters are registered
rg "eventConverters\[" --type go -B 3 -A 3Repository: kubescape/node-agent
Length of output: 827
🏁 Script executed:
# Find all event types in the utils package
rg "type.*Event struct" pkg/utils --type go -A 3Repository: kubescape/node-agent
Length of output: 753
🏁 Script executed:
# Find which event types embed or implement CelEvent
rg "CelEvent|K8sEvent" pkg/utils --type go -B 2 -A 2 | head -100Repository: kubescape/node-agent
Length of output: 4225
🏁 Script executed:
# Search for RegisterEventConverter calls to see which types have converters
rg "RegisterEventConverter" --type go -B 3 -A 3Repository: kubescape/node-agent
Length of output: 876
🏁 Script executed:
# Check events package for event implementations
fd "events" pkg/ebpf --type dRepository: kubescape/node-agent
Length of output: 80
🏁 Script executed:
# Look at event types in the ebpf/events package
rg "type.*Event struct" pkg/ebpf/events --type go | head -20Repository: kubescape/node-agent
Length of output: 177
🏁 Script executed:
# Find the CelEvent interface definition to see what it requires
cat -n pkg/utils/cel.go | head -50Repository: kubescape/node-agent
Length of output: 1262
🏁 Script executed:
# Find all event type implementations and check which embed CelEvent interface types
rg "type.*struct" pkg/ebpf/events --type go -A 10 | head -150Repository: kubescape/node-agent
Length of output: 1712
🏁 Script executed:
# Check what event types are used in the system
rg "EventType.*=" pkg/utils --type go | head -30Repository: kubescape/node-agent
Length of output: 1333
🏁 Script executed:
# Look for where RegisterEventConverter is actually called
rg "RegisterEventConverter" --type go -lRepository: kubescape/node-agent
Length of output: 127
🏁 Script executed:
# Find where RegisterEventConverter is called (not just defined)
rg "\.RegisterEventConverter\(" --type go -B 3 -A 3Repository: kubescape/node-agent
Length of output: 46
🏁 Script executed:
# Check all event type implementations in pkg/ebpf/events
fd "\.go$" pkg/ebpf/events --exec basename {} \;Repository: kubescape/node-agent
Length of output: 114
🏁 Script executed:
# Look at one event implementation to see if it implements CelEvent
rg "type.*Event struct" pkg/ebpf/events/dns.go --type go -A 20Repository: kubescape/node-agent
Length of output: 126
🏁 Script executed:
# Check which events are actually created/used in the system
rg "EventType|GetEventType" pkg/ebpf/events --type go | head -40Repository: kubescape/node-agent
Length of output: 2433
🏁 Script executed:
# Find StructEvent definition and check if it implements CelEvent
rg "type StructEvent struct" pkg/utils --type go -A 50 | head -70Repository: kubescape/node-agent
Length of output: 6321
🏁 Script executed:
# Check what K8sEvent interface requires
rg "type K8sEvent interface" pkg/utils --type go -A 20Repository: kubescape/node-agent
Length of output: 914
🏁 Script executed:
# Find where events are actually created to see what types are used
rg "StructEvent\{" --type go | head -20Repository: kubescape/node-agent
Length of output: 1833
🏁 Script executed:
# Look for any event implementations that might satisfy CelEvent
rg "func.*StructEvent.*Get" pkg/utils --type go | head -30Repository: kubescape/node-agent
Length of output: 2220
🏁 Script executed:
# Check if StructEvent implements the required CelEvent sub-interfaces
rg "type CapabilitiesEvent|type DNSEvent|type ExecEvent|type IOUring|type LinkEvent|type NetworkEvent|type OpenEvent|type SshEvent|type SyscallEvent|type KmodEvent|type UnshareEvent|type BpfEvent" pkg/utils --type go -A 5Repository: kubescape/node-agent
Length of output: 2882
🏁 Script executed:
# Check if StructEvent is explicitly implementing any of these interfaces
rg "func.*StructEvent.*Get(Args|Capability|Cmd|Comm|Container|DNSName|DstIP|DstPort|Flags|FullPath|Module)" pkg/utils/struct_event.go --type goRepository: kubescape/node-agent
Length of output: 743
🏁 Script executed:
# Count total methods on StructEvent
rg "func \(\*?StructEvent\)" pkg/utils/struct_event.go --type go | wc -lRepository: kubescape/node-agent
Length of output: 65
🏁 Script executed:
# Get better count of StructEvent methods
rg "^func \(\*StructEvent\)" pkg/utils/struct_event.go --type go | wc -lRepository: kubescape/node-agent
Length of output: 65
🏁 Script executed:
# Check if StructEvent implements all required methods for CelEvent
# First let's see the complete list of all methods needed
rg "type.*Event interface" pkg/utils/events.go --type go -A 10 | grep "Get"Repository: kubescape/node-agent
Length of output: 1751
🏁 Script executed:
# Verify the type assertion scenario - does ALL code using events call RegisterEventConverter?
rg "RegisterEventConverter" --type goRepository: kubescape/node-agent
Length of output: 338
🏁 Script executed:
# Search for tests that might show what happens with unregistered event types
rg "createEvalContext|EvaluateRule|EvaluateExpression" --type go -B 5 -A 5 | head -80Repository: kubescape/node-agent
Length of output: 5743
🏁 Script executed:
# Let's check if StructEvent methods match what CelEvent requires
# Get all CelEvent sub-interface methods and verify StructEvent has them
cat -n pkg/utils/events.go | grep -A 100 "type CelEvent interface"Repository: kubescape/node-agent
Length of output: 46
🏁 Script executed:
# Verify StructEvent has all necessary Get methods - let's count them comprehensively
cat pkg/utils/struct_event.go | grep "^func (e \*StructEvent) Get" | wc -lRepository: kubescape/node-agent
Length of output: 66
🏁 Script executed:
# Look for any tests or comments showing what happens with non-CelEvent types
rg "CelEvent|createEvalContext" pkg/rulemanager/cel --type go -B 3 -A 3Repository: kubescape/node-agent
Length of output: 2661
🏁 Script executed:
# Check if there are any other event implementations besides StructEvent
fd "\.go$" --exec grep -l "implements.*K8sEvent\|GetEventType()" {} \; | grep -E "event|Event" | head -20Repository: kubescape/node-agent
Length of output: 265
🏁 Script executed:
# Check if StructEvent actually implements CelEvent by verifying all required methods
# Get all methods required by CelEvent sub-interfaces
cat pkg/utils/events.go | grep -A 500 "type CelEvent interface" | head -100Repository: kubescape/node-agent
Length of output: 46
🏁 Script executed:
# Verify StructEvent implements all the methods - check for GetUpperLayer which was mentioned
rg "GetUpperLayer|GetPupperLayer|GetSyscall|GetNumAnswers|GetProto|GetQr" pkg/utils/struct_event.go --type goRepository: kubescape/node-agent
Length of output: 1188
🏁 Script executed:
# Check if there are any other K8sEvent implementations besides StructEvent
rg "implements.*K8sEvent|type.*Event.*struct" pkg/utils --type go | grep -v "StructEvent\|CelEvent\|interface"Repository: kubescape/node-agent
Length of output: 240
🏁 Script executed:
# Look for HTTPData and other event types that might not implement CelEvent
rg "type HTTP|type Datasource" pkg/utils --type go -A 5Repository: kubescape/node-agent
Length of output: 705
🏁 Script executed:
# Check if DatasourceEvent implements the necessary methods for CelEvent
rg "func.*DatasourceEvent.*Get" pkg/utils/datasource_event.go --type goRepository: kubescape/node-agent
Length of output: 3116
🏁 Script executed:
# Let's see the full DatasourceEvent definition
cat -n pkg/utils/datasource_event.goRepository: kubescape/node-agent
Length of output: 36207
🏁 Script executed:
# Check where DatasourceEvent is used and if it goes through CEL evaluation
rg "DatasourceEvent" --type go -B 2 -A 2Repository: kubescape/node-agent
Length of output: 30013
Add error handling for type assertion to prevent panics on unsupported event types.
Line 137 contains an unchecked type assertion that will panic if an event type doesn't implement utils.CelEvent and no converter is registered. While current implementations (StructEvent and DatasourceEvent) do implement CelEvent, the code has no safeguard against future event types that may not. Change the function signature to return an error and validate the assertion before wrapping:
🛠️ Suggested change (createEvalContext + callers)
-func (c *CEL) createEvalContext(event *events.EnrichedEvent) map[string]any {
+func (c *CEL) createEvalContext(event *events.EnrichedEvent) (map[string]any, error) {
eventType := event.Event.GetEventType()
// Apply event converter if one is registered, otherwise cast to CelEvent
var obj interface{}
if converter, exists := c.eventConverters[eventType]; exists {
obj, _ = xcel.NewObject(converter(event.Event))
} else {
- obj, _ = xcel.NewObject(event.Event.(utils.CelEvent))
+ celEvt, ok := event.Event.(utils.CelEvent)
+ if !ok {
+ return nil, fmt.Errorf("event type %s does not implement utils.CelEvent and no converter is registered", eventType)
+ }
+ obj, _ = xcel.NewObject(celEvt)
}
evalContext := map[string]any{
"eventType": string(eventType),
"event": obj,
}
@@
- return evalContext
+ return evalContext, nil
}
@@
- evalContext := c.createEvalContext(event)
+ evalContext, ctxErr := c.createEvalContext(event)
+ if ctxErr != nil {
+ return false, ctxErr
+ }
@@
- evalContext := c.createEvalContext(event)
+ evalContext, ctxErr := c.createEvalContext(event)
+ if ctxErr != nil {
+ return "", ctxErr
+ }📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| // createEvalContext creates an evaluation context map from an enriched event | |
| // The context includes the eventType string and the event object wrapped in xcel | |
| // Uses "event" as the variable name, and for HTTP events also adds "http" variable | |
| func (c *CEL) createEvalContext(event *events.EnrichedEvent) map[string]any { | |
| eventType := event.Event.GetEventType() | |
| // Apply event converter if one is registered, otherwise cast to CelEvent | |
| var obj interface{} | |
| if converter, exists := c.eventConverters[eventType]; exists { | |
| obj, _ = xcel.NewObject(converter(event.Event)) | |
| } else { | |
| obj, _ = xcel.NewObject(event.Event.(utils.CelEvent)) | |
| } | |
| obj, _ := xcel.NewObject(event.Event.(utils.CelEvent)) // FIXME put safety check here | |
| out, _, err := program.Eval(map[string]any{"event": obj, "eventType": string(eventType)}) | |
| if err != nil { | |
| return false, err | |
| } | |
| evalContext := map[string]any{ | |
| "eventType": string(eventType), | |
| "event": obj, | |
| } | |
| if !out.Value().(bool) { | |
| return false, nil | |
| } | |
| // For HTTP events, also add "http" variable | |
| if eventType == utils.HTTPEventType { | |
| evalContext["http"] = obj | |
| } | |
| return true, nil | |
| return evalContext | |
| // createEvalContext creates an evaluation context map from an enriched event | |
| // The context includes the eventType string and the event object wrapped in xcel | |
| // Uses "event" as the variable name, and for HTTP events also adds "http" variable | |
| func (c *CEL) createEvalContext(event *events.EnrichedEvent) (map[string]any, error) { | |
| eventType := event.Event.GetEventType() | |
| // Apply event converter if one is registered, otherwise cast to CelEvent | |
| var obj interface{} | |
| if converter, exists := c.eventConverters[eventType]; exists { | |
| obj, _ = xcel.NewObject(converter(event.Event)) | |
| } else { | |
| celEvt, ok := event.Event.(utils.CelEvent) | |
| if !ok { | |
| return nil, fmt.Errorf("event type %s does not implement utils.CelEvent and no converter is registered", eventType) | |
| } | |
| obj, _ = xcel.NewObject(celEvt) | |
| } | |
| evalContext := map[string]any{ | |
| "eventType": string(eventType), | |
| "event": obj, | |
| } | |
| // For HTTP events, also add "http" variable | |
| if eventType == utils.HTTPEventType { | |
| evalContext["http"] = obj | |
| } | |
| return evalContext, nil | |
| } |
🤖 Prompt for AI Agents
In `@pkg/rulemanager/cel/cel.go` around lines 126 - 150, The function
createEvalContext currently does an unchecked type assertion to utils.CelEvent
and can panic; change createEvalContext to return (map[string]any, error),
validate the type assertion when no converter exists (return a descriptive error
if event.Event does not implement utils.CelEvent), propagate errors from
xcel.NewObject, and update all callers of CEL.createEvalContext to handle the
returned error (check and return/handle the error rather than assuming success);
keep the existing behavior of adding "http" when eventType ==
utils.HTTPEventType.
Comment on lines
+254
to
+283
| // registerNestedTypes registers nested pointer types found in the given object | ||
| // This ensures that CEL can properly resolve nested types in expressions | ||
| func (c *CEL) registerNestedTypes(obj interface{}) { | ||
| objType := reflect.TypeOf(obj) | ||
| if objType.Kind() == reflect.Ptr { | ||
| objType = objType.Elem() | ||
| } | ||
|
|
||
| // Iterate through all fields of the struct | ||
| for i := 0; i < objType.NumField(); i++ { | ||
| field := objType.Field(i) | ||
| fieldType := field.Type | ||
|
|
||
| // Check if field is a pointer to a custom type | ||
| if fieldType.Kind() == reflect.Ptr { | ||
| elemType := fieldType.Elem() | ||
|
|
||
| // Skip built-in types (net.Header, etc.) - only register custom structs | ||
| if elemType.Kind() == reflect.Struct && elemType.PkgPath() != "" { | ||
| // Create a zero instance of the nested type | ||
| nestedInstance := reflect.New(elemType).Interface() | ||
|
|
||
| // Register the nested type | ||
| xcelObj, xcelTyp := xcel.NewObject(nestedInstance) | ||
| fields := xcel.NewFields(xcelObj) | ||
| xcel.RegisterObject(c.ta, c.tp, xcelObj, xcelTyp, fields) | ||
| } | ||
| } | ||
| } | ||
| } |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
# First, let's locate and examine the actual file
find . -name "cel.go" -path "*/rulemanager/cel/*" | head -20Repository: kubescape/node-agent
Length of output: 92
🏁 Script executed:
# Get the content of the file around lines 254-283
if [ -f "pkg/rulemanager/cel/cel.go" ]; then
wc -l pkg/rulemanager/cel/cel.go
fiRepository: kubescape/node-agent
Length of output: 94
🏁 Script executed:
# Read the function to see the actual implementation
cat -n pkg/rulemanager/cel/cel.go | sed -n '250,290p'Repository: kubescape/node-agent
Length of output: 1527
🏁 Script executed:
# Test Go reflect behavior with nil and non-struct types
python3 << 'EOF'
# We need to create a small Go test to verify the reflect behavior
test_code = '''package main
import (
"fmt"
"reflect"
)
func main() {
// Test 1: reflect.TypeOf(nil)
var nilVal interface{} = nil
nilType := reflect.TypeOf(nilVal)
fmt.Printf("Test 1 - reflect.TypeOf(nil): %v\\n", nilType)
// Test 2: What happens when we try NumField on nil type
if nilType != nil {
fmt.Printf("Test 2 - NumField on nil type: not testing (type is not nil)\\n")
} else {
fmt.Printf("Test 2 - nilType is nil, so calling NumField would panic\\n")
}
// Test 3: Non-struct type
var intVal interface{} = 42
intType := reflect.TypeOf(intVal)
fmt.Printf("Test 3 - Type of int value: %v, Kind: %v\\n", intType, intType.Kind())
// Test 4: Try NumField on non-struct
if intType.Kind() != reflect.Struct {
fmt.Printf("Test 4 - Attempting NumField on non-struct will panic\\n")
// Uncomment to test: intType.NumField()
}
}
'''
with open('/tmp/test_reflect.go', 'w') as f:
f.write(test_code)
print("Created test code")
EOFRepository: kubescape/node-agent
Length of output: 150
🏁 Script executed:
# Check the call sites to see how registerNestedTypes is called
rg "registerNestedTypes" --type go -B 3 -A 3Repository: kubescape/node-agent
Length of output: 1032
🏁 Script executed:
# Let's check what Go version is available and create a simpler test
cat > /tmp/reflect_test.go << 'GOEOF'
package main
import (
"fmt"
"reflect"
)
func main() {
// Test 1: nil type
var nilVal interface{}
nilType := reflect.TypeOf(nilVal)
fmt.Printf("Test 1 - nil type is nil: %v\n", nilType == nil)
// Test 2: non-struct type
nonStructVal := 42
nonStructType := reflect.TypeOf(nonStructVal)
fmt.Printf("Test 2 - int type kind: %v (is not Struct)\n", nonStructType.Kind())
// Test 3: Will NumField panic on non-struct?
fmt.Println("Test 3 - Would call panic on NumField for non-struct")
// Test 4: struct type
type MyStruct struct {
Field1 string
}
structType := reflect.TypeOf(MyStruct{})
fmt.Printf("Test 4 - struct type kind: %v\n", structType.Kind())
fmt.Printf("Test 4 - struct NumField: %v\n", structType.NumField())
}
GOEOF
# Try to run it if Go is available
if command -v go &> /dev/null; then
go run /tmp/reflect_test.go 2>&1 || echo "Go execution had issue"
else
echo "Go not available in sandbox"
fiRepository: kubescape/node-agent
Length of output: 241
🏁 Script executed:
# Let's check the actual function implementation in context
if [ -f "pkg/rulemanager/cel/cel.go" ]; then
echo "=== Function at lines 254-283 ==="
sed -n '254,283p' pkg/rulemanager/cel/cel.go
echo ""
echo "=== Context before (lines 240-253) ==="
sed -n '240,253p' pkg/rulemanager/cel/cel.go
echo ""
echo "=== Context after (lines 284-300) ==="
sed -n '284,300p' pkg/rulemanager/cel/cel.go
fiRepository: kubescape/node-agent
Length of output: 1640
🏁 Script executed:
# Check all call sites to see what's passed to registerNestedTypes
rg "registerNestedTypes" -B 5 -A 1 pkg/rulemanager/cel/Repository: kubescape/node-agent
Length of output: 1015
Add nil and non-struct guards in registerNestedTypes.
Passing nil or a non-struct value will panic at NumField(). Add early returns to handle these cases.
🛠️ Proposed guard
func (c *CEL) registerNestedTypes(obj interface{}) {
objType := reflect.TypeOf(obj)
+ if objType == nil {
+ return
+ }
if objType.Kind() == reflect.Ptr {
objType = objType.Elem()
}
+ if objType.Kind() != reflect.Struct {
+ return
+ }📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| // registerNestedTypes registers nested pointer types found in the given object | |
| // This ensures that CEL can properly resolve nested types in expressions | |
| func (c *CEL) registerNestedTypes(obj interface{}) { | |
| objType := reflect.TypeOf(obj) | |
| if objType.Kind() == reflect.Ptr { | |
| objType = objType.Elem() | |
| } | |
| // Iterate through all fields of the struct | |
| for i := 0; i < objType.NumField(); i++ { | |
| field := objType.Field(i) | |
| fieldType := field.Type | |
| // Check if field is a pointer to a custom type | |
| if fieldType.Kind() == reflect.Ptr { | |
| elemType := fieldType.Elem() | |
| // Skip built-in types (net.Header, etc.) - only register custom structs | |
| if elemType.Kind() == reflect.Struct && elemType.PkgPath() != "" { | |
| // Create a zero instance of the nested type | |
| nestedInstance := reflect.New(elemType).Interface() | |
| // Register the nested type | |
| xcelObj, xcelTyp := xcel.NewObject(nestedInstance) | |
| fields := xcel.NewFields(xcelObj) | |
| xcel.RegisterObject(c.ta, c.tp, xcelObj, xcelTyp, fields) | |
| } | |
| } | |
| } | |
| } | |
| // registerNestedTypes registers nested pointer types found in the given object | |
| // This ensures that CEL can properly resolve nested types in expressions | |
| func (c *CEL) registerNestedTypes(obj interface{}) { | |
| objType := reflect.TypeOf(obj) | |
| if objType == nil { | |
| return | |
| } | |
| if objType.Kind() == reflect.Ptr { | |
| objType = objType.Elem() | |
| } | |
| if objType.Kind() != reflect.Struct { | |
| return | |
| } | |
| // Iterate through all fields of the struct | |
| for i := 0; i < objType.NumField(); i++ { | |
| field := objType.Field(i) | |
| fieldType := field.Type | |
| // Check if field is a pointer to a custom type | |
| if fieldType.Kind() == reflect.Ptr { | |
| elemType := fieldType.Elem() | |
| // Skip built-in types (net.Header, etc.) - only register custom structs | |
| if elemType.Kind() == reflect.Struct && elemType.PkgPath() != "" { | |
| // Create a zero instance of the nested type | |
| nestedInstance := reflect.New(elemType).Interface() | |
| // Register the nested type | |
| xcelObj, xcelTyp := xcel.NewObject(nestedInstance) | |
| fields := xcel.NewFields(xcelObj) | |
| xcel.RegisterObject(c.ta, c.tp, xcelObj, xcelTyp, fields) | |
| } | |
| } | |
| } | |
| } |
🤖 Prompt for AI Agents
In `@pkg/rulemanager/cel/cel.go` around lines 254 - 283, The registerNestedTypes
method can panic when obj is nil or when the resolved objType is not a struct
(NumField on non-struct), so add early guards: return immediately if obj == nil
or reflect.TypeOf(obj) == nil, and after dereferencing pointers return if
objType.Kind() != reflect.Struct; keep existing pointer deref logic, then
iterate fields only when objType.NumField() is safe. Update the
CEL.registerNestedTypes function to perform these nil and non-struct checks
before the for-loop so nestedInstance creation and xcel.RegisterObject calls
remain unchanged.
Comment on lines
382
to
+396
| func (rm *RuleManager) getUniqueIdAndMessage(enrichedEvent *events.EnrichedEvent, rule typesv1.Rule) (string, string, error) { | ||
| // Special event types are evaluated by map because we're doing parsing optimizations | ||
| // TODO: Manage special event types in a better way | ||
| eventType := enrichedEvent.Event.GetEventType() | ||
| if eventType == utils.HTTPEventType { | ||
| eventAdapter, ok := rm.adapterFactory.GetAdapter(eventType) | ||
| if !ok { | ||
| logger.L().Error("RuleManager - no adapter registered for event type", helpers.String("eventType", string(eventType))) | ||
| return "", "", nil | ||
| } | ||
| eventMap := eventAdapter.ToMap(enrichedEvent) | ||
| defer adapters.ReleaseEventMap(eventMap) | ||
|
|
||
| message, err := rm.celEvaluator.EvaluateExpressionByMap(eventMap, rule.Expressions.Message, eventType) | ||
| if err != nil { | ||
| logger.L().Error("RuleManager - failed to evaluate message", helpers.Error(err)) | ||
| } | ||
| uniqueID, err := rm.celEvaluator.EvaluateExpressionByMap(eventMap, rule.Expressions.UniqueID, eventType) | ||
| if err != nil { | ||
| logger.L().Error("RuleManager - failed to evaluate unique ID", helpers.Error(err)) | ||
| } | ||
| uniqueID = hashStringToMD5(uniqueID) | ||
| return message, uniqueID, err | ||
| } else { | ||
| message, err := rm.celEvaluator.EvaluateExpression(enrichedEvent, rule.Expressions.Message) | ||
| if err != nil { | ||
| logger.L().Error("RuleManager - failed to evaluate message", helpers.Error(err)) | ||
| } | ||
| uniqueID, err := rm.celEvaluator.EvaluateExpression(enrichedEvent, rule.Expressions.UniqueID) | ||
| if err != nil { | ||
| logger.L().Error("RuleManager - failed to evaluate unique ID", helpers.Error(err)) | ||
| } | ||
| // All event types now use the unified EvaluateExpression path | ||
| // HTTP events are handled in the CEL evaluator with type-safe access | ||
| message, err := rm.celEvaluator.EvaluateExpression(enrichedEvent, rule.Expressions.Message) | ||
| if err != nil { | ||
| logger.L().Error("RuleManager - failed to evaluate message", helpers.Error(err)) | ||
| } | ||
| uniqueID, err := rm.celEvaluator.EvaluateExpression(enrichedEvent, rule.Expressions.UniqueID) | ||
| if err != nil { | ||
| logger.L().Error("RuleManager - failed to evaluate unique ID", helpers.Error(err)) | ||
| } | ||
|
|
||
| uniqueID = hashStringToMD5(uniqueID) | ||
| uniqueID = hashStringToMD5(uniqueID) | ||
|
|
||
| return message, uniqueID, err | ||
| } | ||
| return message, uniqueID, err |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
# First, let's look at the actual implementation of the function
cat -n pkg/rulemanager/rule_manager.go | sed -n '382,396p'Repository: kubescape/node-agent
Length of output: 897
🏁 Script executed:
# Let's get more context around this function to understand its full scope
cat -n pkg/rulemanager/rule_manager.go | sed -n '375,410p'Repository: kubescape/node-agent
Length of output: 1532
🏁 Script executed:
# Search for callers of getUniqueIdAndMessage to understand how errors are handled
rg "getUniqueIdAndMessage" --type go -A 3 -B 3Repository: kubescape/node-agent
Length of output: 1210
🏁 Script executed:
# Look for tests related to this function
rg "getUniqueIdAndMessage\|TestGetUniqueIdAndMessage" --type goRepository: kubescape/node-agent
Length of output: 46
Don't overwrite message-evaluation errors.
err is overwritten by the uniqueID evaluation, so a failed message expression can yield an empty message with a nil error. The function should return on the first error instead.
🛠️ Proposed fix
- message, err := rm.celEvaluator.EvaluateExpression(enrichedEvent, rule.Expressions.Message)
- if err != nil {
- logger.L().Error("RuleManager - failed to evaluate message", helpers.Error(err))
- }
- uniqueID, err := rm.celEvaluator.EvaluateExpression(enrichedEvent, rule.Expressions.UniqueID)
- if err != nil {
- logger.L().Error("RuleManager - failed to evaluate unique ID", helpers.Error(err))
- }
-
- uniqueID = hashStringToMD5(uniqueID)
-
- return message, uniqueID, err
+ message, msgErr := rm.celEvaluator.EvaluateExpression(enrichedEvent, rule.Expressions.Message)
+ if msgErr != nil {
+ logger.L().Error("RuleManager - failed to evaluate message", helpers.Error(msgErr))
+ return "", "", msgErr
+ }
+ uniqueID, idErr := rm.celEvaluator.EvaluateExpression(enrichedEvent, rule.Expressions.UniqueID)
+ if idErr != nil {
+ logger.L().Error("RuleManager - failed to evaluate unique ID", helpers.Error(idErr))
+ return "", "", idErr
+ }
+
+ uniqueID = hashStringToMD5(uniqueID)
+
+ return message, uniqueID, nil📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| func (rm *RuleManager) getUniqueIdAndMessage(enrichedEvent *events.EnrichedEvent, rule typesv1.Rule) (string, string, error) { | |
| // Special event types are evaluated by map because we're doing parsing optimizations | |
| // TODO: Manage special event types in a better way | |
| eventType := enrichedEvent.Event.GetEventType() | |
| if eventType == utils.HTTPEventType { | |
| eventAdapter, ok := rm.adapterFactory.GetAdapter(eventType) | |
| if !ok { | |
| logger.L().Error("RuleManager - no adapter registered for event type", helpers.String("eventType", string(eventType))) | |
| return "", "", nil | |
| } | |
| eventMap := eventAdapter.ToMap(enrichedEvent) | |
| defer adapters.ReleaseEventMap(eventMap) | |
| message, err := rm.celEvaluator.EvaluateExpressionByMap(eventMap, rule.Expressions.Message, eventType) | |
| if err != nil { | |
| logger.L().Error("RuleManager - failed to evaluate message", helpers.Error(err)) | |
| } | |
| uniqueID, err := rm.celEvaluator.EvaluateExpressionByMap(eventMap, rule.Expressions.UniqueID, eventType) | |
| if err != nil { | |
| logger.L().Error("RuleManager - failed to evaluate unique ID", helpers.Error(err)) | |
| } | |
| uniqueID = hashStringToMD5(uniqueID) | |
| return message, uniqueID, err | |
| } else { | |
| message, err := rm.celEvaluator.EvaluateExpression(enrichedEvent, rule.Expressions.Message) | |
| if err != nil { | |
| logger.L().Error("RuleManager - failed to evaluate message", helpers.Error(err)) | |
| } | |
| uniqueID, err := rm.celEvaluator.EvaluateExpression(enrichedEvent, rule.Expressions.UniqueID) | |
| if err != nil { | |
| logger.L().Error("RuleManager - failed to evaluate unique ID", helpers.Error(err)) | |
| } | |
| // All event types now use the unified EvaluateExpression path | |
| // HTTP events are handled in the CEL evaluator with type-safe access | |
| message, err := rm.celEvaluator.EvaluateExpression(enrichedEvent, rule.Expressions.Message) | |
| if err != nil { | |
| logger.L().Error("RuleManager - failed to evaluate message", helpers.Error(err)) | |
| } | |
| uniqueID, err := rm.celEvaluator.EvaluateExpression(enrichedEvent, rule.Expressions.UniqueID) | |
| if err != nil { | |
| logger.L().Error("RuleManager - failed to evaluate unique ID", helpers.Error(err)) | |
| } | |
| uniqueID = hashStringToMD5(uniqueID) | |
| uniqueID = hashStringToMD5(uniqueID) | |
| return message, uniqueID, err | |
| } | |
| return message, uniqueID, err | |
| func (rm *RuleManager) getUniqueIdAndMessage(enrichedEvent *events.EnrichedEvent, rule typesv1.Rule) (string, string, error) { | |
| // All event types now use the unified EvaluateExpression path | |
| // HTTP events are handled in the CEL evaluator with type-safe access | |
| message, msgErr := rm.celEvaluator.EvaluateExpression(enrichedEvent, rule.Expressions.Message) | |
| if msgErr != nil { | |
| logger.L().Error("RuleManager - failed to evaluate message", helpers.Error(msgErr)) | |
| return "", "", msgErr | |
| } | |
| uniqueID, idErr := rm.celEvaluator.EvaluateExpression(enrichedEvent, rule.Expressions.UniqueID) | |
| if idErr != nil { | |
| logger.L().Error("RuleManager - failed to evaluate unique ID", helpers.Error(idErr)) | |
| return "", "", idErr | |
| } | |
| uniqueID = hashStringToMD5(uniqueID) | |
| return message, uniqueID, nil | |
| } |
🤖 Prompt for AI Agents
In `@pkg/rulemanager/rule_manager.go` around lines 382 - 396, In
getUniqueIdAndMessage, stop overwriting the first evaluation error: after
calling rm.celEvaluator.EvaluateExpression(enrichedEvent,
rule.Expressions.Message) check err and return immediately (message, "", err) if
non-nil; then evaluate rule.Expressions.UniqueID, check that error and return if
non-nil, and only then call hashStringToMD5(uniqueID) before returning; this
ensures message-evaluation errors are propagated and uniqueID hashing happens
only on a successful evaluation.
7fff37e to
23b8d53
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Fix all issues with AI agents
In `@pkg/rulemanager/cel/cel.go`:
- Around line 239-241: The RegisterEventConverter method writes to the
CEL.eventConverters map without synchronization while createEvalContext reads it
concurrently, causing a data race; add a sync.RWMutex field (e.g.,
eventConvertersMu) to the CEL struct and use eventConvertersMu.Lock()/Unlock()
in RegisterEventConverter and eventConvertersMu.RLock()/RUnlock() around reads
in createEvalContext to protect access, or alternatively enforce that
RegisterEventConverter is only called during initialization before NewCEL
returns.
3180547 to
c2743f0
Compare
matthyx
reviewed
Jan 29, 2026
Contributor
matthyx
left a comment
matthyx
left a comment
There was a problem hiding this comment.
2 questions and remove the evalContextPool (maybe I missed other fields you can remove, it would be cool to check)
| @@ -31,19 +32,18 @@ type CEL struct { | |||
| evalContextPool sync.Pool | |||
Contributor
There was a problem hiding this comment.
I think you can remove this now
| // Apply event converter if one is registered, otherwise cast to CelEvent | ||
| var obj interface{} | ||
| if converter, exists := c.eventConverters[eventType]; exists { | ||
| obj, _ = xcel.NewObject(converter(event.Event)) |
Signed-off-by: Yakir Oren <yakiroren@gmail.com>
YakirOren
force-pushed
the
feature/remove-to-map
branch
from
c2743f0 to
a940649
Compare
matthyx
approved these changes
Jan 29, 2026
Darkflame72
pushed a commit
to Darkflame72/home-ops
that referenced
this pull request
Feb 10, 2026
This PR contains the following updates: | Package | Update | Change | |---|---|---| | [kubescape-operator](https://kubescape.io/) ([source](https://github.com/kubescape/helm-charts)) | patch | `1.30.2` → `1.30.3` | --- ### Release Notes <details> <summary>kubescape/helm-charts (kubescape-operator)</summary> ### [`v1.30.3`](https://github.com/kubescape/helm-charts/releases/tag/kubescape-operator-1.30.3) [Compare Source](https://github.com/kubescape/helm-charts/compare/kubescape-operator-1.30.2...kubescape-operator-1.30.3) Kubescape is an E2E Kubernetes cluster security platform #### What's Changed - chore: adding the ability to adjust the source of busybox by [@​drew-viles](https://github.com/drew-viles) in [#​784](https://github.com/kubescape/helm-charts/pull/784) - add k8s context tag by [@​YakirOren](https://github.com/YakirOren) in [#​785](https://github.com/kubescape/helm-charts/pull/785) - run system tests from private repo by [@​bvolovat](https://github.com/bvolovat) in [#​786](https://github.com/kubescape/helm-charts/pull/786) - add stream logs and wait for tests finish by [@​bvolovat](https://github.com/bvolovat) in [#​787](https://github.com/kubescape/helm-charts/pull/787) - fix attempt by [@​bvolovat](https://github.com/bvolovat) in [#​788](https://github.com/kubescape/helm-charts/pull/788) - Update 02-e2e-test.yaml by [@​armobot](https://github.com/armobot) in [#​789](https://github.com/kubescape/helm-charts/pull/789) - Run test from private repo by [@​bvolovat](https://github.com/bvolovat) in [#​791](https://github.com/kubescape/helm-charts/pull/791) - add workflow\_call by [@​bvolovat](https://github.com/bvolovat) in [#​792](https://github.com/kubescape/helm-charts/pull/792) - add startup probe by [@​YakirOren](https://github.com/YakirOren) in [#​793](https://github.com/kubescape/helm-charts/pull/793) - <kubescape/kubescape@v3.0.47...v3.0.48> - Fix typos in documentation by [@​oglok](https://github.com/oglok) in [kubescape/kubescape#1913](https://github.com/kubescape/kubescape/pull/1913) - fix: Kustomize directory analysis not working by [@​majiayu000](https://github.com/majiayu000) in [kubescape/kubescape#1914](https://github.com/kubescape/kubescape/pull/1914) - feat: Define labels to copy from workloads to reports by [@​majiayu000](https://github.com/majiayu000) in [kubescape/kubescape#1915](https://github.com/kubescape/kubescape/pull/1915) - Add SkipPersistence flag to MetricsQueryParams in metrics endpoint by [@​BroderPeters](https://github.com/BroderPeters) in [kubescape/kubescape#1917](https://github.com/kubescape/kubescape/pull/1917) - ci: update scorecard action version by [@​AndrewCharlesHay](https://github.com/AndrewCharlesHay) in [kubescape/kubescape#1918](https://github.com/kubescape/kubescape/pull/1918) - update test lists by [@​amirmalka](https://github.com/amirmalka) in [kubescape/kubescape#1919](https://github.com/kubescape/kubescape/pull/1919) - build(deps): Bump github.com/sigstore/cosign/v3 from 3.0.3-0.20251208232815-901b44d65952 to 3.0.4 by [@​dependabot](https://github.com/dependabot)\[bot] in [kubescape/kubescape#1920](https://github.com/kubescape/kubescape/pull/1920) - Update build number retrieval and permissions in workflow by [@​matthyx](https://github.com/matthyx) in [kubescape/kubescape#1921](https://github.com/kubescape/kubescape/pull/1921) - Fix workload scan to include allcontrols framework by [@​Copilot](https://github.com/Copilot) in [kubescape/kubescape#1922](https://github.com/kubescape/kubescape/pull/1922) - build(deps): Bump github.com/sigstore/fulcio from 1.8.4 to 1.8.5 by [@​dependabot](https://github.com/dependabot)\[bot] in [kubescape/kubescape#1923](https://github.com/kubescape/kubescape/pull/1923) - Fix panic on unsafe interface{} to string type assertions by [@​Copilot](https://github.com/Copilot) in [kubescape/kubescape#1926](https://github.com/kubescape/kubescape/pull/1926) - build(deps): Bump github.com/theupdateframework/go-tuf/v2 from 2.3.0 to 2.3.1 by [@​dependabot](https://github.com/dependabot)\[bot] in [kubescape/kubescape#1927](https://github.com/kubescape/kubescape/pull/1927) - build(deps): Bump github.com/sigstore/rekor from 1.4.3 to 1.5.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [kubescape/kubescape#1928](https://github.com/kubescape/kubescape/pull/1928) - <kubescape/operator@v0.2.121...v0.2.126> - bump version by [@​jnathangreeg](https://github.com/jnathangreeg) in [kubescape/operator#349](https://github.com/kubescape/operator/pull/349) - Fix comment typo in checkECRRegistry function to clarify \_catalog end… by [@​jnathangreeg](https://github.com/jnathangreeg) in [kubescape/operator#351](https://github.com/kubescape/operator/pull/351) - add permissions by [@​bvolovat](https://github.com/bvolovat) in [kubescape/operator#352](https://github.com/kubescape/operator/pull/352) - bump github.com/armosec/armoapi-go v0.0.673 by [@​matthyx](https://github.com/matthyx) in [kubescape/operator#353](https://github.com/kubescape/operator/pull/353) - bump github.com/kubescape/go-logger v0.0.26 by [@​matthyx](https://github.com/matthyx) in [kubescape/operator#354](https://github.com/kubescape/operator/pull/354) - bump github.com/goradd/maps v1.3.0 by [@​matthyx](https://github.com/matthyx) in [kubescape/operator#355](https://github.com/kubescape/operator/pull/355) - <kubescape/kubevuln@v0.3.98...v0.3.104> - replace debian 12 with debian 13 when building container images by [@​pfarikrispy](https://github.com/pfarikrispy) in [kubescape/kubevuln#317](https://github.com/kubescape/kubevuln/pull/317) - Add comprehensive documentation and governance by [@​matthyx](https://github.com/matthyx) in [kubescape/kubevuln#318](https://github.com/kubescape/kubevuln/pull/318) - Bump github.com/cilium/cilium from 1.16.9 to 1.16.17 by [@​dependabot](https://github.com/dependabot)\[bot] in [kubescape/kubevuln#319](https://github.com/kubescape/kubevuln/pull/319) - Add timeout to Grype DB update with graceful fallback to prevent indefinite readiness probe failures by [@​Copilot](https://github.com/Copilot) in [kubescape/kubevuln#320](https://github.com/kubescape/kubevuln/pull/320) - Prevent DB update cancellation on readiness probe by [@​matthyx](https://github.com/matthyx) in [kubescape/kubevuln#321](https://github.com/kubescape/kubevuln/pull/321) - <kubescape/storage@v0.0.237...v0.0.239> - feat: handle large object storage by clearing spec and updating annotations by [@​matthyx](https://github.com/matthyx) in [kubescape/storage#279](https://github.com/kubescape/storage/pull/279) - bump k8s version to v0.35.0 by [@​matthyx](https://github.com/matthyx) in [kubescape/storage#280](https://github.com/kubescape/storage/pull/280) - <kubescape/node-agent@v0.3.11...v0.3.36> - feat: propagate IsTriggerAlert field from rules to runtime alerts by [@​slashben](https://github.com/slashben) in [kubescape/node-agent#686](https://github.com/kubescape/node-agent/pull/686) - Generating release by [@​slashben](https://github.com/slashben) in [kubescape/node-agent#688](https://github.com/kubescape/node-agent/pull/688) - Feature/rule engine redesign by [@​YakirOren](https://github.com/YakirOren) in [kubescape/node-agent#685](https://github.com/kubescape/node-agent/pull/685) - refactor: update cloud metadata types to use armotypes package by [@​matthyx](https://github.com/matthyx) in [kubescape/node-agent#689](https://github.com/kubescape/node-agent/pull/689) - Replace host sensor with node agent sensing by [@​Bezbran](https://github.com/Bezbran) in [kubescape/node-agent#681](https://github.com/kubescape/node-agent/pull/681) - use k8s-interface by [@​Bezbran](https://github.com/Bezbran) in [kubescape/node-agent#691](https://github.com/kubescape/node-agent/pull/691) - optimize header parsing and add early return in ruleAppliesToContext by [@​YakirOren](https://github.com/YakirOren) in [kubescape/node-agent#692](https://github.com/kubescape/node-agent/pull/692) - improve field accessor retrieval with nil checks and type assertions by [@​matthyx](https://github.com/matthyx) in [kubescape/node-agent#694](https://github.com/kubescape/node-agent/pull/694) - Bump github.com/sigstore/sigstore from 1.9.5 to 1.10.4 by [@​dependabot](https://github.com/dependabot)\[bot] in [kubescape/node-agent#696](https://github.com/kubescape/node-agent/pull/696) - Add Azure ResourceGroup enrichment to CloudMetadata by [@​slashben](https://github.com/slashben) in [kubescape/node-agent#697](https://github.com/kubescape/node-agent/pull/697) - Add unit tests for Azure ResourceGroup parsing by [@​slashben](https://github.com/slashben) in [kubescape/node-agent#698](https://github.com/kubescape/node-agent/pull/698) - remove toMap function by [@​YakirOren](https://github.com/YakirOren) in [kubescape/node-agent#693](https://github.com/kubescape/node-agent/pull/693) - run system test from private repo by [@​bvolovat](https://github.com/bvolovat) in [kubescape/node-agent#700](https://github.com/kubescape/node-agent/pull/700) - bump: update golang-set dependency to v2.8.0 by [@​matthyx](https://github.com/matthyx) in [kubescape/node-agent#701](https://github.com/kubescape/node-agent/pull/701) - bump: update armoapi-go dependency to v0.0.671 by [@​matthyx](https://github.com/matthyx) in [kubescape/node-agent#702](https://github.com/kubescape/node-agent/pull/702) - update the tests\_groups by [@​bvolovat](https://github.com/bvolovat) in [kubescape/node-agent#703](https://github.com/kubescape/node-agent/pull/703) - bump: update dependencies for backend, storage, and OpenAPI packages by [@​matthyx](https://github.com/matthyx) in [kubescape/node-agent#704](https://github.com/kubescape/node-agent/pull/704) - update chart repo by [@​bvolovat](https://github.com/bvolovat) in [kubescape/node-agent#705](https://github.com/kubescape/node-agent/pull/705) - bump: update cel-go dependency to v0.26.1 by [@​matthyx](https://github.com/matthyx) in [kubescape/node-agent#706](https://github.com/kubescape/node-agent/pull/706) - Implement ClusterUID enrichment for runtime alerts by [@​slashben](https://github.com/slashben) in [kubescape/node-agent#708](https://github.com/kubescape/node-agent/pull/708) - fix a bug where failed expressions would recompile on every event by [@​YakirOren](https://github.com/YakirOren) in [kubescape/node-agent#690](https://github.com/kubescape/node-agent/pull/690) - fix container watcher error propagation by [@​YakirOren](https://github.com/YakirOren) in [kubescape/node-agent#709](https://github.com/kubescape/node-agent/pull/709) - add permissions by [@​bvolovat](https://github.com/bvolovat) in [kubescape/node-agent#710](https://github.com/kubescape/node-agent/pull/710) - upgrade to IG v0.48.1 by [@​matthyx](https://github.com/matthyx) in [kubescape/node-agent#695](https://github.com/kubescape/node-agent/pull/695) - <kubescape/synchronizer@v0.0.127...v0.0.128> - perf: optimize memory usage by avoiding string-to-byte conversions by [@​amirmalka](https://github.com/amirmalka) in [kubescape/synchronizer#135](https://github.com/kubescape/synchronizer/pull/135) #### New Contributors - [@​drew-viles](https://github.com/drew-viles) made their first contribution in [#​784](https://github.com/kubescape/helm-charts/pull/784) - [@​YakirOren](https://github.com/YakirOren) made their first contribution in [#​785](https://github.com/kubescape/helm-charts/pull/785) - [@​armobot](https://github.com/armobot) made their first contribution in [#​789](https://github.com/kubescape/helm-charts/pull/789) - [@​pfarikrispy](https://github.com/pfarikrispy) made their first contribution in [kubescape/kubevuln#317](https://github.com/kubescape/kubevuln/pull/317) - [@​bvolovat](https://github.com/bvolovat) made their first contribution in [kubescape/operator#352](https://github.com/kubescape/operator/pull/352) - [@​oglok](https://github.com/oglok) made their first contribution in [kubescape/kubescape#1913](https://github.com/kubescape/kubescape/pull/1913) - [@​majiayu000](https://github.com/majiayu000) made their first contribution in [kubescape/kubescape#1914](https://github.com/kubescape/kubescape/pull/1914) - [@​BroderPeters](https://github.com/BroderPeters) made their first contribution in [kubescape/kubescape#1917](https://github.com/kubescape/kubescape/pull/1917) - [@​AndrewCharlesHay](https://github.com/AndrewCharlesHay) made their first contribution in [kubescape/kubescape#1918](https://github.com/kubescape/kubescape/pull/1918) - [@​Bezbran](https://github.com/Bezbran) made their first contribution in [kubescape/node-agent#681](https://github.com/kubescape/node-agent/pull/681) - [@​bvolovat](https://github.com/bvolovat) made their first contribution in [kubescape/node-agent#700](https://github.com/kubescape/node-agent/pull/700) **Full Changelog**: <kubescape/helm-charts@kubescape-operator-1.30.2...kubescape-operator-1.30.3> </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/Darkflame72/home-ops). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0Mi45NS4yIiwidXBkYXRlZEluVmVyIjoiNDIuOTUuMiIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsicmVub3ZhdGUvaGVsbSIsInR5cGUvcGF0Y2giXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
This was referenced Mar 29, 2026
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary by CodeRabbit
Refactor
New Features
✏️ Tip: You can customize this high-level summary in your review settings.