From 7bc2c2be13ffbfd7986dbf23d79caadbafff7306 Mon Sep 17 00:00:00 2001
From: dwertent <dwertent@cyberarmor.io>
Date: Mon, 3 Jan 2022 13:36:29 +0200
Subject: [PATCH] fliter ot reources based on owners

---
 cautils/getter/armoapi.go             |  2 +-
 opaprocessor/processorhandlerutils.go | 27 ++++++++++++++++++++++++++-
 resourcehandler/k8sresources.go       |  2 +-
 3 files changed, 28 insertions(+), 3 deletions(-)

diff --git a/cautils/getter/armoapi.go b/cautils/getter/armoapi.go
index 93ebbf9c..ed920136 100644
--- a/cautils/getter/armoapi.go
+++ b/cautils/getter/armoapi.go
@@ -100,7 +100,7 @@ func (armoAPI *ArmoAPI) GetReportReceiverURL() string {
 func (armoAPI *ArmoAPI) GetFramework(name string) (*reporthandling.Framework, error) {
 	respStr, err := HttpGetter(armoAPI.httpClient, armoAPI.getFrameworkURL(name), nil)
 	if err != nil {
-		return nil, err
+		return nil, nil
 	}
 
 	framework := &reporthandling.Framework{}
diff --git a/opaprocessor/processorhandlerutils.go b/opaprocessor/processorhandlerutils.go
index beb2c208..8c727465 100644
--- a/opaprocessor/processorhandlerutils.go
+++ b/opaprocessor/processorhandlerutils.go
@@ -41,6 +41,7 @@ func getAllSupportedObjects(k8sResources *cautils.K8SResources, allResources map
 
 func getKubernetesObjects(k8sResources *cautils.K8SResources, allResources map[string]workloadinterface.IMetadata, match []reporthandling.RuleMatchObjects) []workloadinterface.IMetadata {
 	k8sObjects := []workloadinterface.IMetadata{}
+
 	for m := range match {
 		for _, groups := range match[m].APIGroups {
 			for _, version := range match[m].APIVersions {
@@ -62,9 +63,33 @@ func getKubernetesObjects(k8sResources *cautils.K8SResources, allResources map[s
 		}
 	}
 
-	return k8sObjects
+	return filterOutChildResources(k8sObjects, match)
 }
 
+// filterOutChildResources filter out child resources if the parent resource is in the list
+func filterOutChildResources(objects []workloadinterface.IMetadata, match []reporthandling.RuleMatchObjects) []workloadinterface.IMetadata {
+	response := []workloadinterface.IMetadata{}
+	owners := []string{}
+	for m := range match {
+		for i := range match[m].Resources {
+			owners = append(owners, match[m].Resources[i])
+		}
+	}
+	for i := range objects {
+		if !k8sinterface.IsTypeWorkload(objects[i].GetObject()) {
+			response = append(response, objects[i])
+			continue
+		}
+		w := workloadinterface.NewWorkloadObj(objects[i].GetObject())
+		ownerReferences, err := w.GetOwnerReferences()
+		if err != nil || len(ownerReferences) == 0 {
+			response = append(response, w)
+		} else if !k8sinterface.IsStringInSlice(owners, ownerReferences[0].Kind) {
+			response = append(response, w)
+		}
+	}
+	return response
+}
 func getRuleDependencies() (map[string]string, error) {
 	modules := resources.LoadRegoModules()
 	if len(modules) == 0 {
diff --git a/resourcehandler/k8sresources.go b/resourcehandler/k8sresources.go
index 75528038..aa308f76 100644
--- a/resourcehandler/k8sresources.go
+++ b/resourcehandler/k8sresources.go
@@ -105,7 +105,7 @@ func (k8sHandler *K8sResourceHandler) pullResources(k8sResources *cautils.K8SRes
 			continue
 		}
 		// store result as []map[string]interface{}
-		metaObjs := ConvertMapListToMeta(k8sinterface.ConvertUnstructuredSliceToMap(k8sinterface.FilterOutOwneredResources(result)))
+		metaObjs := ConvertMapListToMeta(k8sinterface.ConvertUnstructuredSliceToMap(result))
 		for i := range metaObjs {
 			allResources[metaObjs[i].GetID()] = metaObjs[i]
 		}