initial commit

Author: felix.phipps

pkg/agent/run.go

@@ -196,8 +196,8 @@ func Run(cmd *cobra.Command, args []string) (returnErr error) {
 
 		dynDg, isDynamicGatherer := newDg.(*k8sdynamic.DataGathererDynamic)
 		if isDynamicGatherer {
-			dynDg.ExcludeAnnotKeys = config.ExcludeAnnotationKeysRegex
-			dynDg.ExcludeLabelKeys = config.ExcludeLabelKeysRegex
+			dynDg.ExcludeAnnotKeys = append(dynDg.ExcludeAnnotKeys, config.ExcludeAnnotationKeysRegex...)
+			dynDg.ExcludeLabelKeys = append(dynDg.ExcludeLabelKeys, config.ExcludeLabelKeysRegex...)
 
 			gvr := dynDg.GVR()
 

pkg/datagatherer/k8sdynamic/dynamic_test.go

@@ -1100,6 +1100,104 @@ func TestExcludeAnnotKeys_ExcludesResourcesFromUpload(t *testing.T) {
 	}
 }
 
+// Verifies the Certificate is excluded and an unannotated Certificate is kept.
+func TestExcludeAnnotKeys_CertificateWithOpenshiftAnnotation(t *testing.T) {
+	ctx := t.Context()
+
+	certGVR := schema.GroupVersionResource{Group: "cert-manager.io", Version: "v1", Resource: "certificates"}
+	gvrToListKind := map[schema.GroupVersionResource]string{
+		certGVR: "UnstructuredList",
+	}
+
+	excluded := getObjectAnnot("cert-manager.io/v1", "Certificate", "example-com", "cyberark",
+		map[string]any{"openshift.io/discovery": "ignore"},
+		map[string]any{},
+	)
+	included := getObjectAnnot("cert-manager.io/v1", "Certificate", "other-cert", "cyberark",
+		map[string]any{"some-other-annotation": "value"},
+		map[string]any{},
+	)
+
+	cl := fake.NewSimpleDynamicClientWithCustomListKinds(
+		runtime.NewScheme(), gvrToListKind, excluded, included,
+	)
+
+	cfg := ConfigDynamic{GroupVersionResource: certGVR}
+	dg, err := cfg.newDataGathererWithClient(ctx, cl, nil)
+	require.NoError(t, err)
+
+	dgd := dg.(*DataGathererDynamic)
+	// simulate run.go appending the global exclude-annotation-keys-regex
+	dgd.ExcludeAnnotKeys = append(dgd.ExcludeAnnotKeys, regexp.MustCompile(`^openshift\.io.*$`))
+
+	go func() { _ = dg.Run(ctx) }()
+	require.NoError(t, dgd.WaitForCacheSync(ctx))
+
+	res, count, err := dg.Fetch(ctx)
+	require.NoError(t, err)
+
+	data, ok := res.(*api.DynamicData)
+	require.True(t, ok)
+
+	assert.Equal(t, 1, count)
+	if assert.Len(t, data.Items, 1) {
+		got := data.Items[0].Resource.(*unstructured.Unstructured)
+		assert.Equal(t, "other-cert", got.GetName(), "certificate with openshift.io/discovery annotation should be excluded")
+	}
+}
+
+// Verifies that per-gatherer ExcludeAnnotKeys and globally-appended keys both take effect.
+func TestExcludeAnnotKeys_PerGathererAndGlobalMerge(t *testing.T) {
+	ctx := t.Context()
+
+	gvrToListKind := map[schema.GroupVersionResource]string{
+		{Group: "", Version: "v1", Resource: "secrets"}: "UnstructuredList",
+	}
+
+	excludedByPerGatherer := getObjectAnnot("v1", "Secret", "excluded-per-gatherer", "ns",
+		map[string]any{"per-gatherer.io/exclude": "true"},
+		map[string]any{},
+	)
+	excludedByGlobal := getObjectAnnot("v1", "Secret", "excluded-global", "ns",
+		map[string]any{"global.io/exclude": "true"},
+		map[string]any{},
+	)
+	included := getObjectAnnot("v1", "Secret", "included", "ns",
+		map[string]any{"other": "kept"},
+		map[string]any{},
+	)
+
+	cl := fake.NewSimpleDynamicClientWithCustomListKinds(
+		runtime.NewScheme(), gvrToListKind, excludedByPerGatherer, excludedByGlobal, included,
+	)
+
+	cfg := ConfigDynamic{
+		GroupVersionResource:       schema.GroupVersionResource{Group: "", Version: "v1", Resource: "secrets"},
+		ExcludeAnnotationKeysRegex: []string{`^per-gatherer\.io/.*$`},
+	}
+	dg, err := cfg.newDataGathererWithClient(ctx, cl, nil)
+	require.NoError(t, err)
+
+	dgd := dg.(*DataGathererDynamic)
+	// simulate the append done in run.go after newDataGathererWithClient
+	dgd.ExcludeAnnotKeys = append(dgd.ExcludeAnnotKeys, regexp.MustCompile(`^global\.io/.*$`))
+
+	go func() { _ = dg.Run(ctx) }()
+	require.NoError(t, dgd.WaitForCacheSync(ctx))
+
+	res, count, err := dg.Fetch(ctx)
+	require.NoError(t, err)
+
+	data, ok := res.(*api.DynamicData)
+	require.True(t, ok)
+
+	assert.Equal(t, 1, count, "only the non-matching resource should be returned")
+	if assert.Len(t, data.Items, 1) {
+		got := data.Items[0].Resource.(*unstructured.Unstructured)
+		assert.Equal(t, "included", got.GetName())
+	}
+}
+
 func TestDynamicGathererNativeResources_Fetch(t *testing.T) {
 	// start a k8s client
 	// init the datagatherer's informer with the client