Repository: zegl/kube-score (go)

Issue:
Ignoring rule container-resources makes every rule exceptional
**Which version of kube-score are you using?**

> kube-score version: v1.16.1

**What did you do?**

Added 
```
annotations:
    kube-score/ignore: container-resources
```
And it made kube-score skip all the current issues

**What did you expect to see?**

> See only issues related to container-resources to skip

**What did you see instead?**

> kube-score passing all checks


Pull request:
Ignoring rule container resources makes every rule exceptional #542
Fixes #542

```
RELNOTE: Fix bug related to processing implied kube-score/ignore annotations.
```


Patch:
diff --git a/scorecard/enabled.go b/scorecard/enabled.go
index 5f2f5c8..1476698 100644
--- a/scorecard/enabled.go
+++ b/scorecard/enabled.go
@@ -13,8 +13,12 @@ func (so *ScoredObject) isEnabled(check ks.Check, annotations, childAnnotations
 			if v == key {
 				return true
 			}
-			if _, ok := impliedIgnoreAnnotations[v]; ok {
-				return true
+			if vals, ok := impliedIgnoreAnnotations[v]; ok {
+				for i := range vals {
+					if vals[i] == key {
+						return true
+					}
+				}
 			}
 		}
 		return false


Test patch:
diff --git a/score/score_test.go b/score/score_test.go
index 296c37d..4bcfdd6 100644
--- a/score/score_test.go
+++ b/score/score_test.go
@@ -515,3 +515,36 @@ func TestPodEnvDuplicated(t *testing.T) {
 	diff := cmp.Diff(expected, actual)
 	assert.Empty(t, diff)
 }
+
+func TestMultipleIgnoreAnnotations(t *testing.T) {
+	t.Parallel()
+	s, err := testScore(config.Configuration{
+		VerboseOutput:             0,
+		AllFiles:                  []ks.NamedReader{testFile("kube-score-ignore-annotations.yaml")},
+		UseIgnoreChecksAnnotation: true,
+	})
+	assert.Nil(t, err)
+	assert.Len(t, s, 1)
+
+	tested := false
+	skipped := false
+
+	for _, o := range s {
+		for _, c := range o.Checks {
+			// implied by the ignore container-resources annotation
+			if c.Check.ID == "container-ephemeral-storage-request-and-limit" {
+				assert.True(t, c.Skipped)
+				skipped = true
+			}
+			// a default check
+			if c.Check.ID == "container-image-pull-policy" {
+				assert.False(t, c.Skipped)
+				assert.Equal(t, scorecard.GradeCritical, c.Grade)
+				tested = true
+			}
+			assert.Equal(t, "kube-score-ignore-annotations", o.ObjectMeta.Name)
+		}
+	}
+	assert.True(t, tested)
+	assert.True(t, skipped)
+}
diff --git a/score/testdata/kube-score-ignore-annotations.yaml b/score/testdata/kube-score-ignore-annotations.yaml
new file mode 100644
index 0000000..e930062
--- /dev/null
+++ b/score/testdata/kube-score-ignore-annotations.yaml
@@ -0,0 +1,17 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: kube-score-ignore-annotations
+  annotations:
+    "kube-score/ignore": container-security-context-readonlyrootfilesystem,pod-networkpolicy,container-security-context-user-group-id,pod-probes,container-resources
+spec:
+  containers:
+  - name: foobar
+    image: foo/bar:123
+    resources:
+      limits:
+        cpu: 200m
+        memory: 1Gi
+        ephemeral-storage: 2Gi
+      requests:
+        cpu: 200m