fix(query): service should match container using targetPort instead o…

…f port (#4762)
Checkmarx · Feb 1, 2022 · 12db5eb · 12db5eb
1 parent b38bc28
commit 12db5eb
Show file tree

Hide file tree

Showing 3 changed files with 40 additions and 1 deletion.
diff --git a/assets/queries/k8s/service_does_not_target_pod/query.rego b/assets/queries/k8s/service_does_not_target_pod/query.rego
@@ -48,7 +48,7 @@ confirmPorts(label, servicePorts) {
 	resource.metadata.labels[_] == label[_]
 	[path, value] := walk(resource.spec)
 	cont := value[types[j]]
-	cont[_].ports[_].containerPort == servicePorts.port
+	cont[_].ports[_].containerPort == servicePorts.targetPort
 }
 
 match_label(string) = ret {

diff --git a/...ce_does_not_target_pod/test/negative.yaml → ...e_does_not_target_pod/test/negative1.yaml b/...ce_does_not_target_pod/test/negative.yaml → ...e_does_not_target_pod/test/negative1.yaml
diff --git a/assets/queries/k8s/service_does_not_target_pod/test/negative2.yaml b/assets/queries/k8s/service_does_not_target_pod/test/negative2.yaml
@@ -0,0 +1,39 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: helloworld
+spec:
+  type: ClusterIP
+  ports:
+    - name: http
+      port: 80
+      protocol: TCP
+      targetPort: 8080
+    - name: health
+      port: 8081
+      protocol: TCP
+      targetPort: 8082
+  selector:
+    app: helloworld
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: helloworld
+  labels:
+    app: helloworld
+spec:
+  selector:
+    matchLabels:
+      app: helloworld
+  template:
+    metadata:
+      labels:
+        app: helloworld
+    spec:
+      containers:
+        - name: webserver
+          image: nginx:latest
+          ports:
+            - containerPort: 8080
+            - containerPort: 8082