Repository: zegl/kube-score
Pull request #263 (2020-06-17 12:11:21)

Forward CronJob Namespace properly
```
RELNOTE: Fix for CronJob parsing - This fixes issues with namespace matching of CronJob resources, for CronJobs this mostly mean that the "Pod has NetworkPolicy" test was not working.
```


Patch:
diff --git a/go.sum b/go.sum
index d97d517..f2afe84 100644
--- a/go.sum
+++ b/go.sum
@@ -198,6 +198,7 @@ k8s.io/apimachinery v0.18.0/go.mod h1:9SnR/e11v5IbyPCGbvJViimtJ0SwHG4nfZFjU77ftc
 k8s.io/apimachinery v0.18.1/go.mod h1:9SnR/e11v5IbyPCGbvJViimtJ0SwHG4nfZFjU77ftcA=
 k8s.io/apimachinery v0.18.2 h1:44CmtbmkzVDAhCpRVSiP2R5PPrC2RtlIv/MoB8xpdRA=
 k8s.io/apimachinery v0.18.2/go.mod h1:9SnR/e11v5IbyPCGbvJViimtJ0SwHG4nfZFjU77ftcA=
+k8s.io/apimachinery v0.18.3 h1:pOGcbVAhxADgUYnjS08EFXs9QMl8qaH5U4fr5LGUrSk=
 k8s.io/apimachinery v0.18.3/go.mod h1:OaXp26zu/5J7p0f92ASynJa1pZo06YlV9fG7BoWbCko=
 k8s.io/gengo v0.0.0-20190128074634-0689ccc1d7d6/go.mod h1:ezvh/TsK7cY6rbqRK0oQQ8IAqLxYwwyPxAX1Pzy0ii0=
 k8s.io/klog v0.0.0-20181102134211-b9b56d5dfc92/go.mod h1:Gq+BEi5rUBO/HRz0bTSXDUcqjScdoY3a9IHpCEIOOfk=
diff --git a/parser/internal/jobs.go b/parser/internal/jobs.go
index 6ac8069..7211487 100644
--- a/parser/internal/jobs.go
+++ b/parser/internal/jobs.go
@@ -37,6 +37,7 @@ func (d Batchv1beta1CronJob) GetObjectMeta() metav1.ObjectMeta {
 }
 
 func (d Batchv1beta1CronJob) GetPodTemplateSpec() corev1.PodTemplateSpec {
-	d.Spec.JobTemplate.ObjectMeta.Namespace = d.ObjectMeta.Namespace
-	return d.Spec.JobTemplate.Spec.Template
+	t := d.Spec.JobTemplate.Spec.Template
+	t.ObjectMeta.Namespace = d.ObjectMeta.Namespace
+	return t
 }


Test patch:
diff --git a/score/networkpolicy_test.go b/score/networkpolicy_test.go
index 9afb4f5..2003ce2 100644
--- a/score/networkpolicy_test.go
+++ b/score/networkpolicy_test.go
@@ -2,6 +2,8 @@ package score
 
 import (
 	"testing"
+
+	"github.com/zegl/kube-score/scorecard"
 )
 
 func TestPodHasNoMatchingNetworkPolicy(t *testing.T) {
@@ -39,8 +41,38 @@ func TestNetworkPolicyTargetsPodNotMatching(t *testing.T) {
 	testExpectedScore(t, "networkpolicy-targets-pod-not-matching.yaml", "NetworkPolicy targets Pod", 1)
 }
 
-func TestNetworkPolicyNamespaceMatching(t *testing.T) {
+func TestNetworkPolicyDeploymentNamespaceMatching(t *testing.T) {
+	t.Parallel()
+	testExpectedScore(t, "networkpolicy-deployment-matching.yaml", "NetworkPolicy targets Pod", scorecard.GradeAllOK)
+	testExpectedScore(t, "networkpolicy-deployment-matching.yaml", "Pod NetworkPolicy", scorecard.GradeAllOK)
+}
+
+func TestNetworkPolicyStatefulSetNamespaceMatching(t *testing.T) {
+	t.Parallel()
+	testExpectedScore(t, "networkpolicy-statefulset-matching.yaml", "NetworkPolicy targets Pod", scorecard.GradeAllOK)
+	testExpectedScore(t, "networkpolicy-statefulset-matching.yaml", "Pod NetworkPolicy", scorecard.GradeAllOK)
+}
+
+func TestNetworkPolicyCronJobNamespaceMatching(t *testing.T) {
+	t.Parallel()
+	testExpectedScore(t, "networkpolicy-cronjob-matching.yaml", "NetworkPolicy targets Pod", scorecard.GradeAllOK)
+	testExpectedScore(t, "networkpolicy-cronjob-matching.yaml", "Pod NetworkPolicy", scorecard.GradeAllOK)
+}
+
+func TestNetworkPolicyDeploymentNamespaceNotMatchingSelector(t *testing.T) {
+	t.Parallel()
+	testExpectedScore(t, "networkpolicy-deployment-not-matching-selector.yaml", "NetworkPolicy targets Pod", scorecard.GradeCritical)
+	testExpectedScore(t, "networkpolicy-deployment-not-matching-selector.yaml", "Pod NetworkPolicy", scorecard.GradeCritical)
+}
+
+func TestNetworkPolicyStatefulSetNamespaceNotMatchingSelector(t *testing.T) {
+	t.Parallel()
+	testExpectedScore(t, "networkpolicy-statefulset-not-matching-selector.yaml", "NetworkPolicy targets Pod", scorecard.GradeCritical)
+	testExpectedScore(t, "networkpolicy-statefulset-not-matching-selector.yaml", "Pod NetworkPolicy", scorecard.GradeCritical)
+}
+
+func TestNetworkPolicyCronJobNamespaceNotMatchingSelector(t *testing.T) {
 	t.Parallel()
-	testExpectedScore(t, "networkpolicy-deployment-matching.yaml", "NetworkPolicy targets Pod", 10)
-	testExpectedScore(t, "networkpolicy-deployment-matching.yaml", "Pod NetworkPolicy", 10)
+	testExpectedScore(t, "networkpolicy-cronjob-not-matching-selector.yaml", "NetworkPolicy targets Pod", scorecard.GradeCritical)
+	testExpectedScore(t, "networkpolicy-cronjob-not-matching-selector.yaml", "Pod NetworkPolicy", scorecard.GradeCritical)
 }
diff --git a/score/testdata/networkpolicy-cronjob-matching.yaml b/score/testdata/networkpolicy-cronjob-matching.yaml
new file mode 100644
index 0000000..d946fb6
--- /dev/null
+++ b/score/testdata/networkpolicy-cronjob-matching.yaml
@@ -0,0 +1,29 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: testapp-netpol
+  namespace: testspace
+spec:
+  podSelector:
+    matchLabels:
+      app: foo
+  policyTypes:
+    - Egress
+    - Ingress
+---
+apiVersion: batch/v1beta1
+kind: CronJob
+metadata:
+  name: cronjob-test-1
+  namespace: testspace
+spec:
+  jobTemplate:
+    spec:
+      template:
+        metadata:
+          labels:
+            app: foo
+        spec:
+          containers:
+          - name: foobar
+            image: foo:bar
diff --git a/score/testdata/networkpolicy-cronjob-not-matching-selector.yaml b/score/testdata/networkpolicy-cronjob-not-matching-selector.yaml
new file mode 100644
index 0000000..9302bfc
--- /dev/null
+++ b/score/testdata/networkpolicy-cronjob-not-matching-selector.yaml
@@ -0,0 +1,29 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: testapp-netpol
+  namespace: testspace
+spec:
+  podSelector:
+    matchLabels:
+      app: foo
+  policyTypes:
+    - Egress
+    - Ingress
+---
+apiVersion: batch/v1beta1
+kind: CronJob
+metadata:
+  name: cronjob-test-1
+  namespace: testspace
+spec:
+  jobTemplate:
+    spec:
+      template:
+        metadata:
+          labels:
+            app: not-foo
+        spec:
+          containers:
+          - name: foobar
+            image: foo:bar
diff --git a/score/testdata/networkpolicy-deployment-matching.yaml b/score/testdata/networkpolicy-deployment-matching.yaml
index c041b1a..f9de2d7 100644
--- a/score/testdata/networkpolicy-deployment-matching.yaml
+++ b/score/testdata/networkpolicy-deployment-matching.yaml
@@ -14,7 +14,7 @@ spec:
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: statefulset-test-1
+  name: deployment-test-1
   namespace: testspace
 spec:
   template:
diff --git a/score/testdata/networkpolicy-deployment-not-matching-selector.yaml b/score/testdata/networkpolicy-deployment-not-matching-selector.yaml
new file mode 100644
index 0000000..195d36d
--- /dev/null
+++ b/score/testdata/networkpolicy-deployment-not-matching-selector.yaml
@@ -0,0 +1,27 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: testapp-netpol
+  namespace: testspace
+spec:
+  podSelector:
+    matchLabels:
+      app: foo
+  policyTypes:
+    - Egress
+    - Ingress
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: deployment-test-1
+  namespace: testspace
+spec:
+  template:
+    metadata:
+      labels:
+        app: not-foo
+    spec:
+      containers:
+        - name: foobar
+          image: foo:bar
diff --git a/score/testdata/networkpolicy-statefulset-matching.yaml b/score/testdata/networkpolicy-statefulset-matching.yaml
new file mode 100644
index 0000000..fbc0fa2
--- /dev/null
+++ b/score/testdata/networkpolicy-statefulset-matching.yaml
@@ -0,0 +1,27 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: testapp-netpol
+  namespace: testspace
+spec:
+  podSelector:
+    matchLabels:
+      app: foo
+  policyTypes:
+    - Egress
+    - Ingress
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: statefulset-test-1
+  namespace: testspace
+spec:
+  template:
+    metadata:
+      labels:
+        app: foo
+    spec:
+      containers:
+        - name: foobar
+          image: foo:bar
diff --git a/score/testdata/networkpolicy-statefulset-not-matching-selector.yaml b/score/testdata/networkpolicy-statefulset-not-matching-selector.yaml
new file mode 100644
index 0000000..673dfa6
--- /dev/null
+++ b/score/testdata/networkpolicy-statefulset-not-matching-selector.yaml
@@ -0,0 +1,27 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: testapp-netpol
+  namespace: testspace
+spec:
+  podSelector:
+    matchLabels:
+      app: foo
+  policyTypes:
+    - Egress
+    - Ingress
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: statefulset-test-1
+  namespace: testspace
+spec:
+  template:
+    metadata:
+      labels:
+        app: not-foo
+    spec:
+      containers:
+        - name: foobar
+          image: foo:bar