Repository navigation
feat(notifications): add actor fields to NewRuntimeIncident - #712
Conversation
Carry the Kubernetes user (name and groups) of admission incidents such as exec to pod, so alert channels (Slack, Teams, etc.) can show who triggered the incident. JSON tags match kubescape/messaging RuntimeIncidentIngesterOnFinishedMessage (v0.0.114), which users-notification-service passes through as the notification data. Signed-off-by: Ben <ben@armosec.io>
slashben
added
the
ai-assisted
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configuration
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
The new fields omit BSON tags required by the repository-wide serialization convention.
Review effort: Balanced
Findings: 2
Open (2)
What changed in this PR
Adds Kubernetes actor metadata to runtime incident notification payloads.
Changes:
- Adds optional username and group fields.
- Adds JSON contract tests and documentation.
| File | Description |
|---|---|
notifications/runtimeincidents.go |
Adds actor fields. |
notifications/runtimeincidents_test.go |
Tests decoding and omission. |
docs/features/runtime-incident-actor.md |
Documents the contract. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Coverage Report for CI Build 37616023381Warning No base build found for commit Coverage: 52.094%Details
Uncovered ChangesNo uncovered changes found. Coverage RegressionsRequires a base build to compare against. How to fix this → Coverage Stats
💛 - Coveralls |
Keep json and bson tag names aligned per AGENTS.md, pin them with a bson round-trip test, and describe the tags in the feature doc. Signed-off-by: Ben <ben@armosec.io>
rotemamsa
left a comment
rotemamsa
left a comment
There was a problem hiding this comment.
Looks good. Small and backward compatible, tags are pinned by tests. Please link a SUB ticket and update the PR body (it still says JSON tags only). For the backend follow-up, both event-ingester-service and users-notification-service need kubescape/messaging >= v0.0.114.
Summary
Adds optional
UserNameandUserGroupsfields tonotifications.NewRuntimeIncident.A customer asked for the actor in runtime incident Slack alerts (e.g. who ran "Exec to pod"). Admission incidents already record the requesting Kubernetes user in
AdmissionAlert.UserInfo, but the notification payload drops it.The JSON tags (
userName,userGroups) match the fields added toRuntimeIncidentIngesterOnFinishedMessagein kubescape/messaging#113 (released in v0.0.114). users-notification-service passes that message through as the notification data, so matching tags are what carries the actor into the template data.Notes
omitempty, so existing producers and consumers are unaffected.NewRuntimeIncidentis never stored in MongoDB and none of its fields carry bson tags.runtimeincidents_test.gocovering decoding of the actor fields and their omission when empty.docs/features/runtime-incident-actor.mddescribing the contract.AI-skills: armosec-shared-rules:writing-docs | cmds: /model