Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Match/Exclude options are not effective #219

Open
yunus opened this issue Nov 29, 2019 · 0 comments
Open

Match/Exclude options are not effective #219

yunus opened this issue Nov 29, 2019 · 0 comments
Assignees

Comments

@yunus
Copy link
Member

yunus commented Nov 29, 2019

When I try to use match/exclude options with scorecard (make audit), they are not taken into consideration. When I check the config validator code, I see that match and exclude logic is there.
Is it possible that policy library downloads an old version of the scorecard (0.2.0)?

How to reproduce

I've tested the match feature with CMEK rule, see below. I try to scope it to only a project instead of the whole organization. I've added the project with number as a target and ran make audit
I don't see any errors although there supposed to be some.

apiVersion: constraints.gatekeeper.sh/v1alpha1
kind: GCPStorageCMEKEncryptionConstraintV1
metadata:
  name: storage_cmek_encryption
spec:
  severity: high
  match:
    gcp:
      target: ["project/12345"]
  parameters: {}

I have tried other combinations:

  • target: ["project/*"] -> returns all the buckets that do not have cmek, so it works
  • replaced project with projects -> still no change, I don't see any
  • I tried also removing gcp part as below, and the result is still the same, I don't see any buckets without cmek
match:
  target: ["project/12345"]
@morgante morgante self-assigned this Feb 6, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants