query giving a failure where some field(s) might not exist

[joelddiaz]

I have a query that isn't behaving in a way I would expect.

Given a Pod that looks like:

apiVersion: v1
kind: Pod
metadata:
  name: joel-test
  namespace: default
spec:
  containers:
    - command:
        - sleep
        - "3600000"
      image: quay.io/fedora/fedora:latest
      name: fedora
      securityContext:
        capabilities:
          drop: ["ALL"]
    - command:
        - sleep
        - "3600000"
      image: quay.io/fedora/fedora:latest
      name: fedora2

I would expect that the following query would pass since neither container in the Pod specification have anything specified under .securityContext.capabilities.add:

k8s.pod {
      podSpec['containers'] {
          _['securityContext']['capabilities'] {
            _['add'] == null || _['add'].none(_.upcase == "ALL")
          }
      }
    }

This passes the first container (named 'fedora'), but fails the second one (named 'fedora2').

I ended up writing an alternative query that does pass:

k8s.pod {
      podSpec['containers'] {
        if( _['securityContext']['capabilities'] != null ) {
          _['securityContext']['capabilities'] {
            _['add'] == null || _['add'].none(_.upcase == "ALL")
          }
        } else {
            true
        }
      }
    }

This felt a bit verbose (especially that else true piece bolted on to the end), and I was wondering if there was a better way to write this kind of query.

[arlimus]

Great question! I'd like to reduce the amount of if statements as much as possible, because conditionals are a bit harder to process (and aggregate data for). This also implies we don't really need the else statements.

Here is an updated version of the query:

k8s.pod
   .podSpec['containers']
   .none( 
     _['securityContext']['capabilities']['add']
       .contains(_.upcase == 'ALL' || _.upcase == 'SYS_ADMIN')
    )

It depends on the newly merged handling for contains and roughly reads as:

1. For the k8s pod ...
2. ... in the podSpec for containers ...
3. ... make sure you have no container ...
4. ... whose securityContext capabilities ...
5. ... contain all or sys_admin

[joelddiaz]

Yeah, that looks great.

cnquery> k8s.pod.podSpec['containers'].none(_['securityContext']['capabilities']['add'].contains(_.upcase == 'ALL' || _.upcase == 'SYS_ADMIN'))
[ok] value: true