split failedPath to deletePaths and reviewPaths (#1402)

* support delete paths and review paths Signed-off-by: YiscahLevySilas1 <yiscahls@armosec.io> * update armoapi + opa-utils Signed-off-by: YiscahLevySilas1 <yiscahls@armosec.io> * fix test Signed-off-by: YiscahLevySilas1 <yiscahls@armosec.io> * go mod tidy Signed-off-by: YiscahLevySilas1 <yiscahls@armosec.io> * support failedPaths until all controls replace with review/delete paths Signed-off-by: YiscahLevySilas1 <yiscahls@armosec.io> * fix test Signed-off-by: YiscahLevySilas1 <yiscahls@armosec.io> * fix test Signed-off-by: YiscahLevySilas1 <yiscahls@armosec.io> --------- Signed-off-by: YiscahLevySilas1 <yiscahls@armosec.io>
2026-04-15 06:58:11 +00:00 · 2023-10-02 17:03:02 +03:00
parent 10c7c428e4
commit 269945c08c
9 changed files with 127 additions and 62 deletions
@@ -238,14 +238,14 @@ func (opap *OPAProcessor) processRule(ctx context.Context, rule *reporthandling.
 				}

 				ruleResult.SetStatus(apis.StatusFailed, nil)
-				ruleResult.Paths = appendPaths(ruleResult.Paths, ruleResponse.FailedPaths, ruleResponse.FixPaths, ruleResponse.FixCommand, failedResource.GetID())
+				ruleResult.Paths = appendPaths(ruleResult.Paths, ruleResponse.AssistedRemediation, failedResource.GetID())
 				// if ruleResponse has relatedObjects, add it to ruleResult
 				if len(ruleResponse.RelatedObjects) > 0 {
 					for _, relatedObject := range ruleResponse.RelatedObjects {
 						wl := objectsenvelopes.NewObject(relatedObject.Object)
 						if wl != nil {
 							ruleResult.RelatedResourcesIDs = append(ruleResult.RelatedResourcesIDs, wl.GetID())
-							ruleResult.Paths = appendPaths(ruleResult.Paths, relatedObject.FailedPaths, relatedObject.FixPaths, relatedObject.FixCommand, wl.GetID())
+							ruleResult.Paths = appendPaths(ruleResult.Paths, relatedObject.AssistedRemediation, wl.GetID())
 						}
 					}
 				}
@@ -258,15 +258,22 @@ func (opap *OPAProcessor) processRule(ctx context.Context, rule *reporthandling.
 }

 // appendPaths appends the failedPaths, fixPaths and fixCommand to the paths slice with the resourceID
-func appendPaths(paths []armotypes.PosturePaths, failedPaths []string, fixPaths []armotypes.FixPath, fixCommand string, resourceID string) []armotypes.PosturePaths {
-	for _, failedPath := range failedPaths {
+func appendPaths(paths []armotypes.PosturePaths, assistedRemediation reporthandling.AssistedRemediation, resourceID string) []armotypes.PosturePaths {
+	// TODO - deprecate failedPaths after all controls support reviewPaths and deletePaths
+	for _, failedPath := range assistedRemediation.FailedPaths {
 		paths = append(paths, armotypes.PosturePaths{ResourceID: resourceID, FailedPath: failedPath})
 	}
-	for _, fixPath := range fixPaths {
+	for _, deletePath := range assistedRemediation.DeletePaths {
+		paths = append(paths, armotypes.PosturePaths{ResourceID: resourceID, DeletePath: deletePath})
+	}
+	for _, reviewPath := range assistedRemediation.ReviewPaths {
+		paths = append(paths, armotypes.PosturePaths{ResourceID: resourceID, ReviewPath: reviewPath})
+	}
+	for _, fixPath := range assistedRemediation.FixPaths {
 		paths = append(paths, armotypes.PosturePaths{ResourceID: resourceID, FixPath: fixPath})
 	}
-	if fixCommand != "" {
-		paths = append(paths, armotypes.PosturePaths{ResourceID: resourceID, FixCommand: fixCommand})
+	if assistedRemediation.FixCommand != "" {
+		paths = append(paths, armotypes.PosturePaths{ResourceID: resourceID, FixCommand: assistedRemediation.FixCommand})
 	}
 	return paths
 }
@@ -271,7 +271,7 @@ func TestProcessRule(t *testing.T) {
 						"armoBuiltin": true,
 					},
 				},
-				Rule: "package armo_builtins\n\n# Checks if NodePort or LoadBalancer is connected to a workload to expose something\ndeny[msga] {\n    service := input[_]\n    service.kind == \"Service\"\n    is_exposed_service(service)\n    \n    wl := input[_]\n    spec_template_spec_patterns := {\"Deployment\", \"ReplicaSet\", \"DaemonSet\", \"StatefulSet\", \"Pod\", \"Job\", \"CronJob\"}\n    spec_template_spec_patterns[wl.kind]\n    wl_connected_to_service(wl, service)\n    failPath := [\"spec.type\"]\n    msga := {\n        \"alertMessage\": sprintf(\"workload '%v' is exposed through service '%v'\", [wl.metadata.name, service.metadata.name]),\n        \"packagename\": \"armo_builtins\",\n        \"alertScore\": 7,\n        \"fixPaths\": [],\n        \"failedPaths\": [],\n        \"alertObject\": {\n            \"k8sApiObjects\": [wl]\n        },\n        \"relatedObjects\": [{\n            \"object\": service,\n            \"failedPaths\": failPath,\n        }]\n    }\n}\n\n# Checks if Ingress is connected to a service and a workload to expose something\ndeny[msga] {\n    ingress := input[_]\n    ingress.kind == \"Ingress\"\n    \n    svc := input[_]\n    svc.kind == \"Service\"\n    # avoid duplicate alerts\n    # if service is already exposed through NodePort or LoadBalancer workload will fail on that\n    not is_exposed_service(svc)\n\n    wl := input[_]\n    spec_template_spec_patterns := {\"Deployment\", \"ReplicaSet\", \"DaemonSet\", \"StatefulSet\", \"Pod\", \"Job\", \"CronJob\"}\n    spec_template_spec_patterns[wl.kind]\n    wl_connected_to_service(wl, svc)\n\n    result := svc_connected_to_ingress(svc, ingress)\n    \n    msga := {\n        \"alertMessage\": sprintf(\"workload '%v' is exposed through ingress '%v'\", [wl.metadata.name, ingress.metadata.name]),\n        \"packagename\": \"armo_builtins\",\n        \"failedPaths\": [],\n        \"fixPaths\": [],\n        \"alertScore\": 7,\n        \"alertObject\": {\n            \"k8sApiObjects\": [wl]\n        },\n        \"relatedObjects\": [{\n            \"object\": ingress,\n            \"failedPaths\": result,\n        }]\n    }\n} \n\n# ====================================================================================\n\nis_exposed_service(svc) {\n    svc.spec.type == \"NodePort\"\n}\n\nis_exposed_service(svc) {\n    svc.spec.type == \"LoadBalancer\"\n}\n\nwl_connected_to_service(wl, svc) {\n    count({x | svc.spec.selector[x] == wl.metadata.labels[x]}) == count(svc.spec.selector)\n}\n\nwl_connected_to_service(wl, svc) {\n    wl.spec.selector.matchLabels == svc.spec.selector\n}\n\n# check if service is connected to ingress\nsvc_connected_to_ingress(svc, ingress) = result {\n    rule := ingress.spec.rules[i]\n    paths := rule.http.paths[j]\n    svc.metadata.name == paths.backend.service.name\n    result := [sprintf(\"ingress.spec.rules[%d].http.paths[%d].backend.service.name\", [i,j])]\n}\n\n",
+				Rule: "package armo_builtins\n\n# Checks if NodePort or LoadBalancer is connected to a workload to expose something\ndeny[msga] {\n    service := input[_]\n    service.kind == \"Service\"\n    is_exposed_service(service)\n    \n    wl := input[_]\n    spec_template_spec_patterns := {\"Deployment\", \"ReplicaSet\", \"DaemonSet\", \"StatefulSet\", \"Pod\", \"Job\", \"CronJob\"}\n    spec_template_spec_patterns[wl.kind]\n    wl_connected_to_service(wl, service)\n    failPath := [\"spec.type\"]\n    msga := {\n        \"alertMessage\": sprintf(\"workload '%v' is exposed through service '%v'\", [wl.metadata.name, service.metadata.name]),\n        \"packagename\": \"armo_builtins\",\n        \"alertScore\": 7,\n        \"fixPaths\": [],\n        \"failedPaths\": [],\n        \"alertObject\": {\n            \"k8sApiObjects\": [wl]\n        },\n        \"relatedObjects\": [{\n            \"object\": service,\n            \"failedPaths\": failPath,\n   \"reviewPaths\": failPath,\n      }]\n    }\n}\n\n# Checks if Ingress is connected to a service and a workload to expose something\ndeny[msga] {\n    ingress := input[_]\n    ingress.kind == \"Ingress\"\n    \n    svc := input[_]\n    svc.kind == \"Service\"\n    # avoid duplicate alerts\n    # if service is already exposed through NodePort or LoadBalancer workload will fail on that\n    not is_exposed_service(svc)\n\n    wl := input[_]\n    spec_template_spec_patterns := {\"Deployment\", \"ReplicaSet\", \"DaemonSet\", \"StatefulSet\", \"Pod\", \"Job\", \"CronJob\"}\n    spec_template_spec_patterns[wl.kind]\n    wl_connected_to_service(wl, svc)\n\n    result := svc_connected_to_ingress(svc, ingress)\n    \n    msga := {\n        \"alertMessage\": sprintf(\"workload '%v' is exposed through ingress '%v'\", [wl.metadata.name, ingress.metadata.name]),\n        \"packagename\": \"armo_builtins\",\n        \"failedPaths\": [],\n        \"fixPaths\": [],\n        \"alertScore\": 7,\n        \"alertObject\": {\n            \"k8sApiObjects\": [wl]\n        },\n        \"relatedObjects\": [{\n            \"object\": ingress,\n            \"failedPaths\": result,\n     \"reviewPaths\": result,\n    }]\n    }\n} \n\n# ====================================================================================\n\nis_exposed_service(svc) {\n    svc.spec.type == \"NodePort\"\n}\n\nis_exposed_service(svc) {\n    svc.spec.type == \"LoadBalancer\"\n}\n\nwl_connected_to_service(wl, svc) {\n    count({x | svc.spec.selector[x] == wl.metadata.labels[x]}) == count(svc.spec.selector)\n}\n\nwl_connected_to_service(wl, svc) {\n    wl.spec.selector.matchLabels == svc.spec.selector\n}\n\n# check if service is connected to ingress\nsvc_connected_to_ingress(svc, ingress) = result {\n    rule := ingress.spec.rules[i]\n    paths := rule.http.paths[j]\n    svc.metadata.name == paths.backend.service.name\n    result := [sprintf(\"ingress.spec.rules[%d].http.paths[%d].backend.service.name\", [i,j])]\n}\n\n",
 				Match: []reporthandling.RuleMatchObjects{
 					{
 						APIGroups:   []string{""},
@@ -309,6 +309,7 @@ func TestProcessRule(t *testing.T) {
 					SubStatus:             "",
 					Paths: []armotypes.PosturePaths{
 						{ResourceID: "/v1/default/Service/fake-service-1", FailedPath: "spec.type"},
+						{ResourceID: "/v1/default/Service/fake-service-1", ReviewPath: "spec.type"},
 					},
 					Exception: nil,
 					RelatedResourcesIDs: []string{
@@ -333,37 +334,25 @@ func TestProcessRule(t *testing.T) {
 		opap := NewOPAProcessorMock(tc.opaSessionObjMock, tc.resourcesMock)
 		resources, err := opap.processRule(context.Background(), &tc.rule, nil)
 		assert.NoError(t, err)
-		assert.Equal(t, tc.expectedResult, resources)
+		assert.Equal(t, tc.expectedResult, resources, t.Name)
 	}
 }

 func TestAppendPaths(t *testing.T) {
 	tests := []struct {
-		name        string
-		paths       []armotypes.PosturePaths
-		failedPaths []string
-		fixPaths    []armotypes.FixPath
-		fixCommand  string
-		resourceID  string
-		expected    []armotypes.PosturePaths
+		name                string
+		paths               []armotypes.PosturePaths
+		assistedRemediation reporthandling.AssistedRemediation
+		resourceID          string
+		expected            []armotypes.PosturePaths
 	}{
 		{
-			name:        "Only FailedPaths",
-			paths:       []armotypes.PosturePaths{{ResourceID: "1", FailedPath: "path1"}},
-			failedPaths: []string{"path2", "path3"},
-			resourceID:  "2",
-			expected: []armotypes.PosturePaths{
-				{ResourceID: "1", FailedPath: "path1"},
-				{ResourceID: "2", FailedPath: "path2"},
-				{ResourceID: "2", FailedPath: "path3"},
-			},
-		},
-		{
-			name:  "Only FixPaths",
-			paths: []armotypes.PosturePaths{},
-			fixPaths: []armotypes.FixPath{
-				{Path: "path2", Value: "command2"},
-				{Path: "path3", Value: "command3"},
+			name: "Only FixPaths",
+			assistedRemediation: reporthandling.AssistedRemediation{
+				FixPaths: []armotypes.FixPath{
+					{Path: "path2", Value: "command2"},
+					{Path: "path3", Value: "command3"},
+				},
 			},
 			resourceID: "2",
 			expected: []armotypes.PosturePaths{
@@ -372,26 +361,55 @@ func TestAppendPaths(t *testing.T) {
 			},
 		},
 		{
-			name:       "Only FixCommand",
-			paths:      []armotypes.PosturePaths{},
-			fixCommand: "fix command",
+			name: "Only FixCommand",
+			assistedRemediation: reporthandling.AssistedRemediation{
+				FixCommand: "fix command",
+			},
 			resourceID: "2",
 			expected: []armotypes.PosturePaths{
 				{ResourceID: "2", FixCommand: "fix command"},
 			},
 		},
 		{
-			name:        "All types of paths",
-			paths:       []armotypes.PosturePaths{{ResourceID: "1", FailedPath: "path1"}},
-			failedPaths: []string{"path2"},
-			fixPaths: []armotypes.FixPath{
-				{Path: "path3", Value: "command3"},
+			name: "Only DeletePaths",
+			assistedRemediation: reporthandling.AssistedRemediation{
+				DeletePaths: []string{"path2", "path3"},
+			},
+			resourceID: "2",
+			expected: []armotypes.PosturePaths{
+				{ResourceID: "2", DeletePath: "path2"},
+				{ResourceID: "2", DeletePath: "path3"},
+			},
+		},
+		{
+			name: "Only ReviewPaths",
+			assistedRemediation: reporthandling.AssistedRemediation{
+				ReviewPaths: []string{"path2", "path3"},
+			},
+			resourceID: "2",
+			expected: []armotypes.PosturePaths{
+				{ResourceID: "2", ReviewPath: "path2"},
+				{ResourceID: "2", ReviewPath: "path3"},
+			},
+		},
+		{
+			name: "All types of paths",
+			assistedRemediation: reporthandling.AssistedRemediation{
+				FailedPaths: []string{"path2"},
+				DeletePaths: []string{"path4", "path5"},
+				ReviewPaths: []string{"path6", "path7"},
+				FixPaths: []armotypes.FixPath{
+					{Path: "path3", Value: "command3"},
+				},
+				FixCommand: "fix command",
 			},
-			fixCommand: "fix command",
 			resourceID: "2",
 			expected: []armotypes.PosturePaths{
-				{ResourceID: "1", FailedPath: "path1"},
 				{ResourceID: "2", FailedPath: "path2"},
+				{ResourceID: "2", DeletePath: "path4"},
+				{ResourceID: "2", DeletePath: "path5"},
+				{ResourceID: "2", ReviewPath: "path6"},
+				{ResourceID: "2", ReviewPath: "path7"},
 				{ResourceID: "2", FixPath: armotypes.FixPath{Path: "path3", Value: "command3"}},
 				{ResourceID: "2", FixCommand: "fix command"},
 			},
@@ -400,7 +418,7 @@ func TestAppendPaths(t *testing.T) {

 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			result := appendPaths(tt.paths, tt.failedPaths, tt.fixPaths, tt.fixCommand, tt.resourceID)
+			result := appendPaths(tt.paths, tt.assistedRemediation, tt.resourceID)
 			if !reflect.DeepEqual(result, tt.expected) {
 				t.Errorf("Expected %v, but got %v", tt.expected, result)
 			}
@@ -146,7 +146,7 @@ func buildResourceControlResult(resourceControl resourcesresults.ResourceAssocia
 	ctlName := resourceControl.GetName()
 	ctlID := resourceControl.GetID()
 	ctlURL := cautils.GetControlLink(resourceControl.GetID())
-	failedPaths := append(failedPathsToString(&resourceControl), fixPathsToString(&resourceControl)...)
+	failedPaths := AssistedRemediationPathsToString(&resourceControl)

 	return ResourceControlResult{ctlSeverity, ctlName, ctlID, ctlURL, failedPaths}
 }
@@ -12,6 +12,7 @@ import (
 	"github.com/kubescape/opa-utils/reporthandling/results/v1/reportsummary"
 	"github.com/kubescape/opa-utils/reporthandling/results/v1/resourcesresults"
 	"github.com/olekukonko/tablewriter"
+	"k8s.io/utils/strings/slices"
 )

 const (
@@ -97,7 +98,7 @@ func generateResourceRows(controls []resourcesresults.ResourceAssociatedControl,
 		}

 		row[resourceColumnURL] = cautils.GetControlLink(controls[i].GetID())
-		row[resourceColumnPath] = strings.Join(append(failedPathsToString(&controls[i]), fixPathsToString(&controls[i])...), "\n")
+		row[resourceColumnPath] = strings.Join(AssistedRemediationPathsToString(&controls[i]), "\n")
 		row[resourceColumnName] = controls[i].GetName()

 		if c := summaryDetails.Controls.GetControl(reportsummary.EControlCriteriaID, controls[i].GetID()); c != nil {
@@ -149,6 +150,7 @@ func (a Matrix) Less(i, j int) bool {
 	return true
 }

+// TODO - deprecate once all controls support review/delete paths
 func failedPathsToString(control *resourcesresults.ResourceAssociatedControl) []string {
 	var paths []string

@@ -175,3 +177,45 @@ func fixPathsToString(control *resourcesresults.ResourceAssociatedControl) []str
 	}
 	return paths
 }
+
+func deletePathsToString(control *resourcesresults.ResourceAssociatedControl) []string {
+	var paths []string
+
+	for j := range control.ResourceAssociatedRules {
+		for k := range control.ResourceAssociatedRules[j].Paths {
+			if p := control.ResourceAssociatedRules[j].Paths[k].DeletePath; p != "" {
+				paths = append(paths, p)
+			}
+		}
+	}
+	return paths
+}
+
+func reviewPathsToString(control *resourcesresults.ResourceAssociatedControl) []string {
+	var paths []string
+
+	for j := range control.ResourceAssociatedRules {
+		for k := range control.ResourceAssociatedRules[j].Paths {
+			if p := control.ResourceAssociatedRules[j].Paths[k].ReviewPath; p != "" {
+				paths = append(paths, p)
+			}
+		}
+	}
+	return paths
+}
+
+func AssistedRemediationPathsToString(control *resourcesresults.ResourceAssociatedControl) []string {
+	paths := append(fixPathsToString(control), append(deletePathsToString(control), reviewPathsToString(control)...)...)
+	// TODO - deprecate failedPaths once all controls support review/delete paths
+	paths = appendFailedPathsIfNotInPaths(paths, failedPathsToString(control))
+	return paths
+}
+
+func appendFailedPathsIfNotInPaths(paths []string, failedPaths []string) []string {
+	for _, failedPath := range failedPaths {
+		if !slices.Contains(paths, failedPath) {
+			paths = append(paths, failedPath)
+		}
+	}
+	return paths
+}
@@ -207,10 +207,7 @@ func (sp *SARIFPrinter) resolveFixLocation(opaSessionObj *cautils.OPASessionObj,
 		return defaultLocation
 	}

-	fixPaths := failedPathsToString(ac)
-	if len(fixPaths) == 0 {
-		fixPaths = fixPathsToString(ac)
-	}
+	fixPaths := AssistedRemediationPathsToString(ac)
 	var fixPath string
 	if len(fixPaths) > 0 {
 		fixPath = fixPaths[0]
@@ -7,7 +7,7 @@ require (
 	github.com/anchore/grype v0.63.1
 	github.com/anchore/stereoscope v0.0.0-20230627195312-cd49355d934e
 	github.com/anchore/syft v0.84.1
-	github.com/armosec/armoapi-go v0.0.220
+	github.com/armosec/armoapi-go v0.0.256
 	github.com/armosec/utils-go v0.0.20
 	github.com/armosec/utils-k8s-go v0.0.17
 	github.com/briandowns/spinner v1.23.0
@@ -24,7 +24,7 @@ require (
 	github.com/kubescape/go-git-url v0.0.25
 	github.com/kubescape/go-logger v0.0.20
 	github.com/kubescape/k8s-interface v0.0.142
-	github.com/kubescape/opa-utils v0.0.267
+	github.com/kubescape/opa-utils v0.0.269
 	github.com/kubescape/rbac-utils v0.0.21-0.20230806101615-07e36f555520
 	github.com/kubescape/regolibrary v1.0.291-rc.0
 	github.com/libgit2/git2go/v33 v33.0.9
@@ -415,7 +415,6 @@ require (
 replace github.com/libgit2/git2go/v33 => ./git2go

 replace (
-
 	// Using the forked version of tablewriter
 	github.com/olekukonko/tablewriter => github.com/kubescape/tablewriter v0.0.6-0.20230907094812-c8c737a432a6
 	// TODO(vladklokun): Since later versions (e.g. v0.40.0) that get used without the pin introduce weird packaging issues probably due to package renames, pin to last known good.
@@ -587,8 +587,8 @@ github.com/armon/go-metrics v0.3.10/go.mod h1:4O98XIr/9W0sxpJ8UaYkvjk10Iff7SnFrb
 github.com/armon/go-radix v0.0.0-20180808171621-7fddfc383310/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
 github.com/armon/go-radix v1.0.0/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
 github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio=
-github.com/armosec/armoapi-go v0.0.220 h1:gfg2UmcFgcyStjp5ZXfwE8yb0H43eaRX9H/KkqFIv6w=
-github.com/armosec/armoapi-go v0.0.220/go.mod h1:Y1ZcqPUTQ+F8JiQzErrToK5ULrPvClxZoshHmV9PIlU=
+github.com/armosec/armoapi-go v0.0.256 h1:eV8WWQ1r+2D0KHhLA6ux6lx67+uqkYe/uVHrOUFqz5c=
+github.com/armosec/armoapi-go v0.0.256/go.mod h1:CJT5iH5VF30zjdQYXaQhsAm8IEHtM1T87HcFVXeLX54=
 github.com/armosec/gojay v1.2.15 h1:sSB2vnAvacUNkw9nzUYZKcPzhJOyk6/5LK2JCNdmoZY=
 github.com/armosec/gojay v1.2.15/go.mod h1:vzVAaay2TWJAngOpxu8aqLbye9jMgoKleuAOK+xsOts=
 github.com/armosec/utils-go v0.0.20 h1:bvr+TMumEYdMsGFGSsaQysST7K02nNROFvuajNuKPlw=
@@ -1294,8 +1294,8 @@ github.com/kubescape/go-logger v0.0.20 h1:ZU3T6Za7maCiChdoTrqpD6TI11DGJwd9xU/TFt
 github.com/kubescape/go-logger v0.0.20/go.mod h1:BAWhQMYc/gnC5wMtPvc9Z4VXFqykFFMaXaPkq0+txBY=
 github.com/kubescape/k8s-interface v0.0.142 h1:kL8D/2s+GNEZlp50rTNDLe6dhSzHAXMOQweyJdSWkVk=
 github.com/kubescape/k8s-interface v0.0.142/go.mod h1:5sz+5Cjvo98lTbTVDiDA4MmlXxeHSVMW/wR0V3hV4K8=
-github.com/kubescape/opa-utils v0.0.267 h1:qzINBGsVOTKeLAIj1YfaYdV93FsSRriWdiN0JXJwD/o=
-github.com/kubescape/opa-utils v0.0.267/go.mod h1:95JkuIOfClgLc+DyGb2mDvefRW0STkZe4L2z6AaZJlQ=
+github.com/kubescape/opa-utils v0.0.269 h1:KBzwTZ6xjyJ2XEXr3yAQBg9ZZeJRpoWoYpuWc0Yze84=
+github.com/kubescape/opa-utils v0.0.269/go.mod h1:VmplJnkhei6mDna+6z183k/HX6GOPgsXiwIlDW8mhKw=
 github.com/kubescape/rbac-utils v0.0.21-0.20230806101615-07e36f555520 h1:SqlwF8G+oFazeYmZQKoPczLEflBQpwpHCU8DoLLyfj8=
 github.com/kubescape/rbac-utils v0.0.21-0.20230806101615-07e36f555520/go.mod h1:wuxMUSDzGUyWd25IJfBzEJ/Udmw2Vy7npj+MV3u3GrU=
 github.com/kubescape/regolibrary v1.0.291-rc.0 h1:DztPS3NSKfiltO1wZvxRjuu5c99c6+dEgfTs6DcsVa8=
@@ -5,7 +5,7 @@ go 1.20
 replace github.com/kubescape/kubescape/v2 => ../

 require (
-	github.com/armosec/armoapi-go v0.0.220
+	github.com/armosec/armoapi-go v0.0.256
 	github.com/armosec/utils-go v0.0.20
 	github.com/go-openapi/runtime v0.26.0
 	github.com/google/uuid v1.3.0
@@ -15,7 +15,7 @@ require (
 	github.com/kubescape/go-logger v0.0.20
 	github.com/kubescape/k8s-interface v0.0.144
 	github.com/kubescape/kubescape/v2 v2.0.0-00010101000000-000000000000
-	github.com/kubescape/opa-utils v0.0.268
+	github.com/kubescape/opa-utils v0.0.269
 	github.com/kubescape/storage v0.0.20
 	github.com/stretchr/testify v1.8.4
 	go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux v0.38.0
@@ -587,8 +587,8 @@ github.com/armon/go-metrics v0.3.10/go.mod h1:4O98XIr/9W0sxpJ8UaYkvjk10Iff7SnFrb
 github.com/armon/go-radix v0.0.0-20180808171621-7fddfc383310/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
 github.com/armon/go-radix v1.0.0/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
 github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio=
-github.com/armosec/armoapi-go v0.0.220 h1:gfg2UmcFgcyStjp5ZXfwE8yb0H43eaRX9H/KkqFIv6w=
-github.com/armosec/armoapi-go v0.0.220/go.mod h1:Y1ZcqPUTQ+F8JiQzErrToK5ULrPvClxZoshHmV9PIlU=
+github.com/armosec/armoapi-go v0.0.256 h1:eV8WWQ1r+2D0KHhLA6ux6lx67+uqkYe/uVHrOUFqz5c=
+github.com/armosec/armoapi-go v0.0.256/go.mod h1:CJT5iH5VF30zjdQYXaQhsAm8IEHtM1T87HcFVXeLX54=
 github.com/armosec/gojay v1.2.15 h1:sSB2vnAvacUNkw9nzUYZKcPzhJOyk6/5LK2JCNdmoZY=
 github.com/armosec/gojay v1.2.15/go.mod h1:vzVAaay2TWJAngOpxu8aqLbye9jMgoKleuAOK+xsOts=
 github.com/armosec/utils-go v0.0.20 h1:bvr+TMumEYdMsGFGSsaQysST7K02nNROFvuajNuKPlw=
@@ -1298,8 +1298,8 @@ github.com/kubescape/go-logger v0.0.20 h1:ZU3T6Za7maCiChdoTrqpD6TI11DGJwd9xU/TFt
 github.com/kubescape/go-logger v0.0.20/go.mod h1:BAWhQMYc/gnC5wMtPvc9Z4VXFqykFFMaXaPkq0+txBY=
 github.com/kubescape/k8s-interface v0.0.144 h1:fNjYbu2u376dZhWvRDzTyBVbH3vUmSfOjzuL1/HTtIU=
 github.com/kubescape/k8s-interface v0.0.144/go.mod h1:5sz+5Cjvo98lTbTVDiDA4MmlXxeHSVMW/wR0V3hV4K8=
-github.com/kubescape/opa-utils v0.0.268 h1:mIsAbpIW0aIk8xr0ECuf8q9gUntGQqJQIJACtn1hklk=
-github.com/kubescape/opa-utils v0.0.268/go.mod h1:95JkuIOfClgLc+DyGb2mDvefRW0STkZe4L2z6AaZJlQ=
+github.com/kubescape/opa-utils v0.0.269 h1:KBzwTZ6xjyJ2XEXr3yAQBg9ZZeJRpoWoYpuWc0Yze84=
+github.com/kubescape/opa-utils v0.0.269/go.mod h1:VmplJnkhei6mDna+6z183k/HX6GOPgsXiwIlDW8mhKw=
 github.com/kubescape/rbac-utils v0.0.21-0.20230806101615-07e36f555520 h1:SqlwF8G+oFazeYmZQKoPczLEflBQpwpHCU8DoLLyfj8=
 github.com/kubescape/rbac-utils v0.0.21-0.20230806101615-07e36f555520/go.mod h1:wuxMUSDzGUyWd25IJfBzEJ/Udmw2Vy7npj+MV3u3GrU=
 github.com/kubescape/regolibrary v1.0.291-rc.0 h1:DztPS3NSKfiltO1wZvxRjuu5c99c6+dEgfTs6DcsVa8=