Add a new --labels-to-copy CLI flag that allows users to specify which
labels from Kubernetes workloads should be extracted and included in
scan reports. This makes it easier to tie scan results back to app
teams or repositories by including relevant labels like 'app', 'team',
or 'environment' in the report output.
Changes:
- Add LabelsToCopy field to ScanInfo and OPASessionObj structs
- Add --labels-to-copy flag to scan command
- Add ResourceLabels field to PostureReportWithSeverity for JSON output
- Implement extractResourceLabels function to extract specified labels
- Add unit tests for label extraction functionality
Fixes#1660🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Signed-off-by: majiayu000 <1835304752@qq.com>
Fixes#1617. The kustomize build was failing for overlays that reference
base configurations in parent directories (e.g., ../../base). This was
because krusty.MakeDefaultOptions() defaults to LoadRestrictionsRootOnly,
which prevents loading resources from outside the kustomize directory.
Changed LoadRestrictions to LoadRestrictionsNone to allow overlays to
properly resolve and merge base configurations during scanning.
Added tests to verify:
- Overlay directories can successfully load resources from base directories
- Base directories continue to work as before
- The merged configuration includes resources from both base and overlay
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Signed-off-by: majiayu000 <1835304752@qq.com>
- Add isHTTPURL helper function for better code reusability
- Improve comments to clarify why ContextDir is returned
- Enhance error message for unrecognized git repositories
Co-authored-by: matthyx <20683409+matthyx@users.noreply.github.com>
- Add URL detection (http:// and https://) in getScanningContext
- Prevent URLs from being joined with current working directory
- Add test cases for self-hosted GitLab URLs
- Ensure proper error handling when git clone fails
Co-authored-by: matthyx <20683409+matthyx@users.noreply.github.com>
hey! added the default matchers option for image scanning as requested in #1838. now you can choose between stock matchers and CPE matchers when scanning images.
what's new:
- added --use-default-matchers flag to scan/image/patch commands
- true = stock matchers (default behavior)
- false = CPE matchers (more precise)
usage:
# use CPE matchers for more precise detection
kubescape scan image nginx:latest --use-default-matchers=false
# or in scan command
kubescape scan --scan-images --use-default-matchers=false
everything's backward compatible - existing code works exactly the same. just added the new option for folks who want more control over their vulnerability detection.
fixes#1838
Signed-off-by: aadarsh-nagrath <anagrath1@gmail.com>
Wrote new tests to cover the unhandled statements in the
`NewFixPathLocationResolver` and `ResolveLocation` functions.
Signed-off-by: VaibhavMalik4187 <vaibhavmalik2018@gmail.com>
Signed-off-by: cbrom <kb.cbrom@gmail.com>
changed test input to clearly show its not a valid
Signed-off-by: cbrom <kb.cbrom@gmail.com>
added tests for valid json input to JSONDecoder function
Signed-off-by: cbrom <kb.cbrom@gmail.com>
check for specific error message instead of just error return
Signed-off-by: cbrom <kb.cbrom@gmail.com>
check for specific error message instead of just error return
Signed-off-by: cbrom <kb.cbrom@gmail.com>
package imports added
Signed-off-by: cbrom <kb.cbrom@gmail.com>
removed unnecessary mock json file
Signed-off-by: cbrom <kb.cbrom@gmail.com>
min function moved to kscloudapi.go
Signed-off-by: cbrom <kb.cbrom@gmail.com>
added necessary functions to make a post api call
Signed-off-by: cbrom <kb.cbrom@gmail.com>
getLatestVersion now uses KSCloudAPI functions
Signed-off-by: cbrom <kb.cbrom@gmail.com>
reverted moved function min back
Signed-off-by: cbrom <kb.cbrom@gmail.com>
removed unncessary functions and simplified post method
Signed-off-by: cbrom <kb.cbrom@gmail.com>
modified call to APIPostRequest
Signed-off-by: cbrom <kb.cbrom@gmail.com>
renamed HTTPPost request function and added httpClient param (for testing purposes)
Signed-off-by: cbrom <kb.cbrom@gmail.com>
changed function name call
Signed-off-by: cbrom <kb.cbrom@gmail.com>
removed HTTPPost function test
Signed-off-by: cbrom <kb.cbrom@gmail.com>
net/http imported
Signed-off-by: cbrom <kb.cbrom@gmail.com>
bytes import removed
Signed-off-by: cbrom <kb.cbrom@gmail.com>
test added for HTTPPost function
Signed-off-by: cbrom <kb.cbrom@gmail.com>
removed json decoder as it is not necessary anymore
Signed-off-by: cbrom <kb.cbrom@gmail.com>
removed HttpPost function
Signed-off-by: cbrom <kb.cbrom@gmail.com>
Matthias Bertschy
majiayu000andClaude Opus 4.5
copilot-swe-agent[bot]andmatthyx
Yehudah Tor
aadarsh-nagrath
Eng Zer Jun
Amir Malka
Ben
jnathangreeg
David Wertenteil
fanqiaojun
YiscahLevySilas1
mmmmmmorty
MMMMMMorty
VaibhavMalik4187
Yuval Leibovich
Daniel Grunberger
Mehdi Moussaif
sulemaanhamza
cbrom