Containers_running_as_root query faild to evaluate

[mukeshpilaniya]

The query Containers_runs_as_root failed to produce an output

for this Yaml file

 
---
apiVersion: v1
kind: Pod
metadata:
  name: security-context-demo-2
spec:
  securityContext:
    runAsUser: 10
    runAsNonRoot: false
  containers:
  - name: sec-ctx-demo-100
    image: gcr.io/google-samples/node-hello:1.0
    securityContext:
      runAsUser: 0
      runAsNonRoot: false
  - name: sec-ctx-demo-200
    image: gcr.io/google-samples/node-hedwfwllo:1.0
    securityContext:
      runAsUser: 0
      runAsNonRoot: false

Specifications

• Version: 1.2.3
• Platform: window

[cxlucas]

Hi, @mukeshpilaniya.
Thank you for identifying this problem.
The bug was reproduced and it affects all versions, including the most recent one (1.3.1)
We will check it as soon as possible.

Below a small technical report on the data collected from the problem:

Query: Container Running As Root
ID: cf34805e-3872-4c08-bf92-6ff7bb0cfadb
Error: failed to evaluate query: containers_running_as_root:100 :
eval_conflict_error: functions must not produce
multiple outputs for same inputs

Query: Container Running With Low UID
ID: 02323c00-cdc3-4fdc-a310-4f2b3e7a1660
Error: failed to evaluate query: containers_run_with_low_uid:104:
eval_conflict_error: functions must not produce
multiple outputs for same inputs

A possible solution to the problem can be seen at: https://www.openpolicyagent.org/docs/latest/policy-language/#functions
in the section: eval_conflict_error: functions must not produce multiple outputs for the same inputs

Note: The error does not happen if there is only one container in the test sample.

apiVersion: v1
kind: Pod
metadata:
  name: security-context-demo-2
spec:
  securityContext:
    runAsUser: 10
    runAsNonRoot: false
  containers:
  - name: sec-ctx-demo-100
    image: gcr.io/google-samples/node-hello:1.0
    securityContext:
      runAsUser: 0
      runAsNonRoot: false