diff --git a/core/pkg/opaprocessor/processorhandlerutils.go b/core/pkg/opaprocessor/processorhandlerutils.go index 500c64f3..8526bded 100644 --- a/core/pkg/opaprocessor/processorhandlerutils.go +++ b/core/pkg/opaprocessor/processorhandlerutils.go @@ -8,6 +8,7 @@ import ( "github.com/armosec/k8s-interface/workloadinterface" "github.com/armosec/opa-utils/reporthandling" "github.com/armosec/opa-utils/reporthandling/apis" + "github.com/armosec/opa-utils/reporthandling/results/v1/reportsummary" resources "github.com/armosec/opa-utils/resources" ) @@ -46,7 +47,7 @@ func (opap *OPAProcessor) updateResults() { // set result summary // map control to error - controlToInfoMap := mapControlToInfo(opap.ResourceToControlsMap, opap.InfoMap) + controlToInfoMap := mapControlToInfo(opap.ResourceToControlsMap, opap.InfoMap, opap.Report.SummaryDetails.Controls) opap.Report.SummaryDetails.InitResourcesSummary(controlToInfoMap) // for f := range opap.PostureReport.FrameworkReports { // // set exceptions @@ -60,17 +61,29 @@ func (opap *OPAProcessor) updateResults() { // } } -func mapControlToInfo(mapResourceToControls map[string][]string, infoMap map[string]apis.StatusInfo) map[string]apis.StatusInfo { +func mapControlToInfo(mapResourceToControls map[string][]string, infoMap map[string]apis.StatusInfo, controlSummary reportsummary.ControlSummaries) map[string]apis.StatusInfo { controlToInfoMap := make(map[string]apis.StatusInfo) for resource, statusInfo := range infoMap { - controls := mapResourceToControls[resource] - for _, control := range controls { - controlToInfoMap[control] = statusInfo + controlIDs := mapResourceToControls[resource] + for _, controlID := range controlIDs { + ctrl := controlSummary.GetControl(reportsummary.EControlCriteriaID, controlID) + if ctrl != nil { + resources := ctrl.NumberOfResources() + // Check that there are no K8s resources too + if isEmptyResources(resources) { + controlToInfoMap[controlID] = statusInfo + } + } + } } return controlToInfoMap } +func isEmptyResources(counters reportsummary.ICounters) bool { + return counters.Failed() == 0 && counters.Excluded() == 0 && counters.Passed() == 0 +} + func getAllSupportedObjects(k8sResources *cautils.K8SResources, armoResources *cautils.ArmoResources, allResources map[string]workloadinterface.IMetadata, rule *reporthandling.PolicyRule) []workloadinterface.IMetadata { k8sObjects := []workloadinterface.IMetadata{} k8sObjects = append(k8sObjects, getKubernetesObjects(k8sResources, allResources, rule.Match)...)