popeye icon indicating copy to clipboard operation
popeye copied to clipboard

Incorrect counting of scanned resources or non-intuitive scoring

Open taintedkernel opened this issue 3 years ago • 0 comments




Describe the bug When I exclude codes from being scanned, the end result is that my score is lower whereas I'd expect the opposite.

To Reproduce Steps to reproduce the behavior:

  1. On my cluster and with the current excludes I have in place (105 & 108), under the report for this namespace I have a score of 42 for pods: 14 scanned, 0 error, 8 warning, 6 info, 0 OK.
  2. If I add 206 and 301 to excluded the results become: score 0, scanned 2, error 0, warning 2, info 0, OK 0.
  3. For completeness, this is the relevant spinach config:
popeye:
  excludes:
    v1/pods:
    - name: rx:.*
      codes:
      - 105 # named ports for liveness/readiness probes
      - 108 # unnamed ports
      - 206 # pod disruption budget
      - 301 # service account mounted
...

Expected behavior If I exclude a code that appears on all of my pods (and many of these have only this particular code), the report ends up giving a score of zero along with a count of zero for 'OK'. This seems like unusual behavior to me; if I filter out codes I would expect the pods that have only this code would be listed in the 'OK' state and thus the score would be higher, not lower.

Screenshots If applicable, add screenshots to help explain your problem.

Versions (please complete the following information):

  • OS: Ubuntu 20.04.3
  • Popeye latest master (f150b2a)
  • K8s microk8s v1.21.5-3

Additional context I think this might be related or a repro of #111 but not entirely sure - more then happy to continue the discussion there if necessary.

taintedkernel avatar Oct 13 '21 03:10 taintedkernel