Repository navigation
Kubescape default binding names a rule ("Port forward") that its Rules object does not define #4978
Description
🤖 Generated by the Agentic Engineer (interactive Claude Code session)
Evidence
The pinned kubescape-operator chart (1.40.5) ships a default Rules object and a cluster-wide RuntimeRuleAlertBinding (all-rules-all-pods). Rendering both offline shows that the binding lists a rule named "Port forward", while the Rules object names that rule "Port forward to pod". Every other bound name matches a rule. The new switch regression (#4976) reports the mismatch as a note on every run.
Two rules in the Rules object are not bound at all: "Process tries to escape container" and "ld_preload hooks technique detected".
Problem and who it affects
Once the default rules are switched on (#4968), port-forwarding into a pod may raise no alert. The binding entry would match nothing, and nothing in the cluster reports a binding that names an unknown rule. The platform operator would then believe port-forward detection is active when it is not.
Hypothesis
If the node agent matches bindings by exact rule name, "Port forward" binds nothing, and port-forward detection stays off even with the switch on.
Success signal
After the switch is turned on, the node agent's rule sync and a deliberate kubectl port-forward against a test pod show whether the rule fires. Measure it in the same window as the #4968 read-back.
Smallest useful change
- Verify the node agent's matching (by name, rule ID or tag) against the shipped node-agent release.
- If the entry is unbound, bind the rule correctly in the platform (for example, a binding that also names "Port forward to pod"), and report the mismatch to the chart's maintainers.
Acceptance criteria
- The node agent's binding-match behaviour for rule names is established from its released source or a live read.
- Port-forward detection is shown to fire, or is bound so that it does, once the default rules are on.
- Whether the two unbound rules should be bound is decided and recorded.
Size: small. Part of #4968.
Activity