ROX-33548: Avoid unnecessary image scan requests in k8s event webhook#19377
Merged
ROX-33548: Avoid unnecessary image scan requests in k8s event webhook#19377
Conversation
|
Skipping CI for Draft Pull Request. |
300e983 to
5be7e45
Compare
Contributor
There was a problem hiding this comment.
Hey - I've left some high level feedback:
- The repeated
len(s.slowPathDetector.PolicySet().GetCompiledPolicies()) == 0checks inevaluatePodEventandwaitForDeploymentAndDetectare on a hot path; consider computing a simplehasDeployFieldPoliciesflag instateduringProcessNewSettingsand using that instead to avoid repeated policy set traversal and potential nil access issues. - In
ProcessNewSettings,allK8sEventPolicySetusesdetection.NewPolicySet()while the per-deploy-field sets usedetection.NewPolicySet(nil, nil)—it would be clearer and less error-prone to make the constructor usage consistent across all three policy sets.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- The repeated `len(s.slowPathDetector.PolicySet().GetCompiledPolicies()) == 0` checks in `evaluatePodEvent` and `waitForDeploymentAndDetect` are on a hot path; consider computing a simple `hasDeployFieldPolicies` flag in `state` during `ProcessNewSettings` and using that instead to avoid repeated policy set traversal and potential nil access issues.
- In `ProcessNewSettings`, `allK8sEventPolicySet` uses `detection.NewPolicySet()` while the per-deploy-field sets use `detection.NewPolicySet(nil, nil)`—it would be clearer and less error-prone to make the constructor usage consistent across all three policy sets.Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
3694ffb to
191b5ca
Compare
Contributor
|
Images are ready for the commit at c764d9a. To use with deploy scripts, first |
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## master #19377 +/- ##
==========================================
- Coverage 49.64% 49.64% -0.01%
==========================================
Files 2698 2698
Lines 203132 203147 +15
==========================================
Hits 100855 100855
- Misses 94751 94768 +17
+ Partials 7526 7524 -2
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
191b5ca to
7992c8a
Compare
7992c8a to
b7db63b
Compare
b7db63b to
c764d9a
Compare
Contributor
Author
|
/test all |
Contributor
There was a problem hiding this comment.
Hey - I've left some high level feedback:
- Consider capturing a simple boolean flag in
state(e.g.hasDeployFieldPolicies) when building the policy sets instead of repeatedly checkinglen(s.slowPathDetector.PolicySet().GetCompiledPolicies()) == 0, which would simplify the fast/slow path branching and avoid multiple PolicySet traversals. - After renaming
allRuntimePoliciesDetectortoallK8sEventPoliciesDetector, the log message inshouldBypassRuntimeDetectionstill refers to a "Runtime policy matcher"; updating this wording to match the new naming would make logs clearer.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- Consider capturing a simple boolean flag in `state` (e.g. `hasDeployFieldPolicies`) when building the policy sets instead of repeatedly checking `len(s.slowPathDetector.PolicySet().GetCompiledPolicies()) == 0`, which would simplify the fast/slow path branching and avoid multiple PolicySet traversals.
- After renaming `allRuntimePoliciesDetector` to `allK8sEventPoliciesDetector`, the log message in `shouldBypassRuntimeDetection` still refers to a "Runtime policy matcher"; updating this wording to match the new naming would make logs clearer.Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
Stringy
approved these changes
Mar 12, 2026
Contributor
|
The backport to To backport manually, run these commands in your terminal: # Fetch latest updates from GitHub
git fetch
# Create a new working tree
git worktree add .worktrees/backport-release-4.10 release-4.10
# Navigate to the new working tree
cd .worktrees/backport-release-4.10
# Create a new branch
git switch --create backport-19377-to-release-4.10
# Cherry-pick the merged commit of this pull request and resolve the conflicts
git cherry-pick -x --mainline 1 d37b6110faee1714b2fcf2f0dd881b000be025e1
# Push it to GitHub
git push --set-upstream origin backport-19377-to-release-4.10
# Go back to the original working tree
cd ../..
# Delete the working tree
git worktree remove .worktrees/backport-release-4.10Then, create a pull request where the |
clickboo
added a commit
that referenced
this pull request
Mar 18, 2026
9 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This PR introduces a simple optimization to avoid unnecessary image fetch requests when evaluating k8s events policies.
It is noteworthy that the k8s events webhook is invoked only by user initiated commands, and hence is shielded from the burst resilience required in policy eval webhook. A simple optimization should hence do.
While here, renamed detectors and policies for both conciseness and specificity. Also, fixed an incorrect message header in the output.
User-facing documentation
Testing and quality
Automated testing
How I validated my change
Tested on openshift infra cluster with oc exec policy + latest image tag (slow path), and a simple oc debug policy (fast path). Operations were blocked as expected.