Skip to content

feat(core): support regex-based label selector matching for standalone policies - #2808

Open
Rucha0901 wants to merge 1 commit into
kubearmor:mainfrom
Rucha0901:feat/unorchestrated-regex-selectors
Open

feat(core): support regex-based label selector matching for standalone policies#2808
Rucha0901 wants to merge 1 commit into
kubearmor:mainfrom
Rucha0901:feat/unorchestrated-regex-selectors

Conversation

@Rucha0901

Copy link
Copy Markdown
Contributor

Purpose of PR?:
This PR implements POSIX regular expression matching for selector label values in standalone (unorchestrated) KubeArmor. It addresses the existing TODO to support regex-based matching for label selectors like kubearmor.io/container.name and other custom labels.

Fixes #2807

Does this PR introduce a breaking change?
No.

If the changes in this PR are manually verified, list down the scenarios covered::
Unit tests have been added to verify:

  1. Compiling valid regex patterns inside standalone policies during parsing and loading.
  2. Handling invalid regex patterns (validating that pb.PolicyStatus_Invalid is returned).
  3. Evaluative matching of container metadata identities against regex patterns (e.g. wildcards, character ranges).
  4. Failure to match container metadata when the label value does not match the regex pattern.

These tests were compiled and run on the target OS (Linux).

Additional information for reviewer? :
This changes KubeArmor's standalone policy loading and parsing in unorchestratedUpdates.go and updates types.go to hold compiled regular expressions in a transient IdentitiesRegexp field on SelectorType and EndPoint to avoid compiling them on every match event.

Checklist:

  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)
  • This change requires a documentation update
  • PR Title follows the convention of feat(core): support regex-based label selector matching for standalone policies
  • Commit has unit tests
  • Commit has integration tests

…e policies

Signed-off-by: Rucha0901 <imt_2025071@iiitm.ac.in>
@Rucha0901
Rucha0901 force-pushed the feat/unorchestrated-regex-selectors branch from 4d60f45 to a0ea108 Compare July 26, 2026 15:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

feat(core): support regex-based label selector matching for standalone policies

1 participant