merge: upstream/main + recover wildcards/signing on projection-v1

[entlein]

Summary

Brings the node-agent fork's `main` up to upstream parity AND recovers the fork's wildcard + tamper-detection behaviour on top of upstream's projection-v1 reshape.

Supersedes PR #41 (wildcards) and PR #42 (matcher cache). The matcher cache is intentionally NOT in this branch — upstream's projection-v1 (kubescape#788/kubescape#799) already pre-compiles + caches per-profile, so a per-call matcher cache would duplicate effort.

Upstream commits merged (8)

SHA	Subject	Notes
kubescape#803	improve logging for missing profileDataRequired	clean
kubescape#800	exec path symmetric resolver	clean
kubescape#797	learning-period label on TS CPs	clean
kubescape#798	syft v1.32.0-ks.2 perf	clean
kubescape#791	client CA from kubelet config	clean
kubescape#772	services from API	clean
kubescape#799	Rule-Aware Profile Projection	major reshape (53 files, +3131/-440)
kubescape#788	Replace AP+NN cache with CP	major reshape (51 files, +4643/-1997)

Wildcard + signing recovery (fork-only, layered ON TOP of projection)

Network wildcards (spec §5.7, §5.8)

• `projectField` accepts a per-surface `isDynamic` classifier (was `isPathSurface` bool). Path surfaces use `containsDynamicSegment` (⋯); network surfaces use `isNetworkIPWildcard` / `isNetworkDNSWildcard` so CIDRs, `*` sentinel, and DNS wildcards route to `Patterns` rather than `Values`.
• `extractEgressAddresses` / `extractIngressAddresses` now pull `n.IPAddresses[]` (storage v0.0.2 list form) alongside the deprecated singular `n.IPAddress`.
• CEL helpers (`nn.was_address_in_`, `nn.is_domain_in_`) consult `Values` + `All` + `Patterns` via `networkmatch.MatchIP` / `MatchDNS`.
• `matchIPField` canonicalises observed IPs (`net.ParseIP`) so IPv6 expanded forms and `::ffff:` IPv4-mapped addresses still hit the Values fast path.
• `matchDNSField` normalises trailing dots on observed names against Values.

Exec-args matching (restored on projection)

• `ProjectedContainerProfile.ExecsByPath map[string][]string` carries the per-Path Args slice. Upstream's projection-v1 explicitly dropped argv matching as "future work"; this re-adds it cleanly.
• `wasExecutedWithArgs` runs `dynamicpathdetector.CompareExecArgs` against the matched profile entry. Back-compat: a path with no `ExecsByPath` entry matches with no argv constraint.

Tamper detection (signing)

• `ContainerProfileCacheImpl.tamperAlertExporter` + `tamperEmitted` fields re-added on the new upstream struct. The R1016 "Signed profile tampered" wiring keeps working.

Mock parity

• `RuleObjectCacheMock.GetProjectedContainerProfile` mirrors the production projection: routes wildcards to Patterns, populates `ExecsByPath`.
• `ensureProjectedAllInit` fixed (no longer mis-sets `All=true`, which is the match-any sentinel, not a comprehensiveness hint).

Known port/protocol gap (out-of-scope here, in the spec)

`was_address_port_protocol_in_*` still degrades to address-only matching on the projection. Restoring port/protocol requires an `AddressPortsByAddr` projection field that upstream noted as future work. Spec §4.7 describes per-neighbor port lists; the unit tests document the degradation (`wildcard_test.go:340-380`). No production rule in `tests/chart/templates/node-agent/default-rules.yaml` uses this helper, so component tests stay green.

Test plan

• `go build ./...` clean
• 46/48 packages green (`pkg/containerwatcher/v2/tracers` and `pkg/validator` are pre-existing eBPF kernel-permission failures, reproduce on main)
• Wildcard tests: leading-* RFC 4592, mid-⋯, trailing-*, CIDR membership, IPv6 canonicalisation, IPv4-mapped, trailing-dot normalisation
• Exec-args restored: `TestExecWithArgsInProfile` + `TestExecWithArgsWildcardInProfile` both pass
• Fixture-walk: 20 user-facing YAML examples parse strict against v1beta1 + behave per the headers
• Tamper detection: `pkg/objectcache/containerprofilecache` package tests green

Storage dep

`go.mod` pinned to `k8sstormcenter/storage@b23d85f0` = `merge/upstream-profile-rearch` on the storage fork (companion PR #31 there).

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

📝 Walkthrough

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch merge/upstream-profile-rearch

[coderabbitai]

Actionable comments posted: 7

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/component-tests.yaml:
- Line 114: Update the GitHub Actions step that references the setup action:
replace the usage of actions/setup-go@v4 with actions/setup-go@v5 to adopt the
recommended version; locate the workflow step that currently uses the symbol
"actions/setup-go@v4" and change it to "actions/setup-go@v5", ensuring no other
changes to the step configuration are required and the Go version inputs remain
intact.

In `@cmd/main.go`:
- Around line 398-401: When calling config.LoadServiceURLs in main (the block
that sets failureReporter via sbommanagerv1.NewHTTPSbomFailureReporter), ensure
failures are logged: if svcErr != nil log a warning/error with svcErr.Error()
and contextual message that service URL load failed, and if svcErr == nil but
services.GetReportReceiverHttpUrl() == "" log a warning that SBOM failure
reporting is disabled due to empty report receiver URL; keep the existing
successful-case log for enabled reporting. This ensures both LoadServiceURLs
errors and empty URL cases are explicitly logged with context.

In `@pkg/objectcache/containerprofilecache/projection_apply.go`:
- Around line 217-228: extractExecsByPath currently aliases
cp.Spec.Execs[*].Args into the returned map which permits external mutation of
the original ContainerProfile; to fix, ensure you clone each ExecCall.Args slice
before assigning into the map inside extractExecsByPath (detect nil vs empty
slice properly), i.e. for each e in cp.Spec.Execs copy the contents of e.Args
into a new slice and store that under m[e.Path] so mutations of the projected
map do not affect cp.Spec.Execs.

In `@pkg/rulebindingmanager/cache/cache.go`:
- Around line 200-202: The loop that does a blocking send to each notifier
(iterating over notifiers and doing *n <-
rulebindingmanager.RuleBindingNotify{}) can hang RefreshRuleBindingsRules() if a
receiver is slow; change the fan-out to perform non-blocking sends or bounded
enqueue with drop/coalesce. Replace the direct blocking send in the loop with a
select that attempts to send on *n and falls back to either a default branch
(drop the event) or a timed case (e.g., use a short timeout) so slow/unread
channels do not block; alternatively ensure notifier channels are buffered and
coalesce by only sending when the channel is empty to avoid queuing duplicates.
Target the notifier send in the loop over notifiers and update the send strategy
accordingly.

In `@pkg/rulemanager/cel/libraries/applicationprofile/open_test.go`:
- Around line 203-208: The test in open_test.go weakens the
ap.was_path_opened_with_flags contract by expecting true when flags ("O_WRONLY")
don't match the recorded event; update the test case (the one with name "Path
matches but flags don't match" / containerID "test-container-id" / path
"/etc/passwd") to set expectedResult to false so the
ap.was_path_opened_with_flags helper continues to require flag equality, or
alternatively rename/deprecate the helper to a path-only name if you
intentionally want path-only semantics; ensure the change is made in the test
case for ap.was_path_opened_with_flags so behavior remains consistent.

In `@pkg/rulemanager/cel/libraries/cache/function_cache.go`:
- Around line 87-91: The code currently assumes values[0] is non-nil before
calling values[0].Value(), which can panic; update the guard in the function
that uses the values slice (the branch that checks "if len(values) == 0 || oc ==
nil") to also verify values[0] != nil (and ideally values[0].Value() != nil)
before calling Value(); if nil, return "" same as when the slice is empty, then
proceed with the type assertion to containerIDStr only after this nil-check to
avoid panics during rule evaluation.

In `@pkg/rulemanager/cel/libraries/networkneighborhood/network.go`:
- Around line 43-45: The code currently treats ProjectedField.All as an
unconditional match by returning true for any field that has field.All set;
remove that unconditional return and instead treat ProjectedField.All as a
projection/retention mode (i.e., do not implicitly match unknown IPs/DNS) —
change the branch in the function containing "if field.All { return true }" so
it either skips special-casing (continue evaluation) or only matches when the
profile explicitly contains the value, and implement proper wildcard handling
via an explicit wildcard flag (e.g., ProjectedField.Wildcard) if wildcard
semantics are required; apply the same change to the other occurrence around the
second block (lines 66-68).

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 79cb8537-b2c8-4c97-9adf-2009c1d5b532

📥 Commits

Reviewing files that changed from the base of the PR and between a3fdc33 and d714d21.

⛔ Files ignored due to path filters (1)

• go.sum is excluded by !**/*.sum

📒 Files selected for processing (79)

• .github/workflows/component-tests.yaml
• .gitignore
• README.md
• cmd/main.go
• go.mod
• pkg/config/config.go
• pkg/containerprofilemanager/v1/event_reporting.go
• pkg/containerprofilemanager/v1/event_reporting_test.go
• pkg/metricsmanager/metrics_manager_interface.go
• pkg/metricsmanager/metrics_manager_mock.go
• pkg/metricsmanager/metrics_manager_noop.go
• pkg/metricsmanager/prometheus/prometheus.go
• pkg/objectcache/containerprofilecache/containerprofilecache.go
• pkg/objectcache/containerprofilecache/containerprofilecache_test.go
• pkg/objectcache/containerprofilecache/init_eviction_test.go
• pkg/objectcache/containerprofilecache/lock_stress_test.go
• pkg/objectcache/containerprofilecache/projection_apply.go
• pkg/objectcache/containerprofilecache/projection_apply_test.go
• pkg/objectcache/containerprofilecache/projection_compile.go
• pkg/objectcache/containerprofilecache/projection_compile_test.go
• pkg/objectcache/containerprofilecache/projection_trie.go
• pkg/objectcache/containerprofilecache/projection_trie_test.go
• pkg/objectcache/containerprofilecache/reconciler.go
• pkg/objectcache/containerprofilecache/reconciler_test.go
• pkg/objectcache/containerprofilecache/shared_pointer_race_test.go
• pkg/objectcache/containerprofilecache/t8_overlay_refresh_test.go
• pkg/objectcache/containerprofilecache_interface.go
• pkg/objectcache/projection_types.go
• pkg/objectcache/v1/mock.go
• pkg/rulebindingmanager/cache/cache.go
• pkg/rulemanager/cel/cel.go
• pkg/rulemanager/cel/libraries/applicationprofile/ap.go
• pkg/rulemanager/cel/libraries/applicationprofile/capability.go
• pkg/rulemanager/cel/libraries/applicationprofile/exec.go
• pkg/rulemanager/cel/libraries/applicationprofile/exec_test.go
• pkg/rulemanager/cel/libraries/applicationprofile/http.go
• pkg/rulemanager/cel/libraries/applicationprofile/open.go
• pkg/rulemanager/cel/libraries/applicationprofile/open_test.go
• pkg/rulemanager/cel/libraries/applicationprofile/syscall.go
• pkg/rulemanager/cel/libraries/cache/function_cache.go
• pkg/rulemanager/cel/libraries/networkneighborhood/fixtures_test.go
• pkg/rulemanager/cel/libraries/networkneighborhood/integration_test.go
• pkg/rulemanager/cel/libraries/networkneighborhood/network.go
• pkg/rulemanager/cel/libraries/networkneighborhood/network_test.go
• pkg/rulemanager/cel/libraries/networkneighborhood/nn.go
• pkg/rulemanager/cel/libraries/networkneighborhood/wildcard_test.go
• pkg/rulemanager/profilehelper/profilehelper.go
• pkg/rulemanager/rule_manager.go
• pkg/rulemanager/rulepolicy.go
• pkg/rulemanager/types/v1/profiledata.go
• pkg/rulemanager/types/v1/profiledata_test.go
• pkg/rulemanager/types/v1/types.go
• tests/chart/crds/rules.crd.yaml
• tests/chart/templates/node-agent/configmap.yaml
• tests/chart/templates/node-agent/default-rules.yaml
• tests/chart/values.yaml
• tests/component_test.go
• tests/resources/malicious-job.yaml
• tests/resources/network-wildcards/01-literal-ipv4.yaml
• tests/resources/network-wildcards/02-literal-ipv6.yaml
• tests/resources/network-wildcards/03-cidr-ipv4.yaml
• tests/resources/network-wildcards/04-cidr-ipv6.yaml
• tests/resources/network-wildcards/05-any-ip-sentinel.yaml
• tests/resources/network-wildcards/06-any-as-cidr.yaml
• tests/resources/network-wildcards/07-mixed-ip-list.yaml
• tests/resources/network-wildcards/08-deprecated-ipaddress.yaml
• tests/resources/network-wildcards/09-dns-literal.yaml
• tests/resources/network-wildcards/10-dns-leading-wildcard.yaml
• tests/resources/network-wildcards/11-dns-mid-ellipsis.yaml
• tests/resources/network-wildcards/12-dns-trailing-star.yaml
• tests/resources/network-wildcards/13-dns-trailing-dot-normalisation.yaml
• tests/resources/network-wildcards/14-recursive-star-rejected.yaml
• tests/resources/network-wildcards/15-egress-and-ingress.yaml
• tests/resources/network-wildcards/16-egress-none.yaml
• tests/resources/network-wildcards/17-realistic-stripe-api.yaml
• tests/resources/network-wildcards/18-cluster-dns-via-mid-ellipsis.yaml
• tests/resources/network-wildcards/19-port-protocol-with-cidr.yaml
• tests/resources/network-wildcards/20-multi-container-mixed-wildcards.yaml
• tests/resources/network-wildcards/README.md

[github-actions]

Performance Benchmark Results

Node-Agent Resource Usage

Metric	BEFORE	AFTER	Delta
Avg CPU (cores)	0.000	0.000	N/A
Peak CPU (cores)	0.000	0.000	N/A
Avg Memory (MiB)	0.000	0.000	N/A
Peak Memory (MiB)	0.000	0.000	N/A

Dedup Effectiveness

No data available.

[entlein]

@coderabbitai resolve

[coderabbitai]

✅ Actions performed

Comments resolved and changes approved.

[coderabbitai]

✅ Actions performed

Review triggered.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

Actionable comments posted: 1

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

pkg/rulemanager/cel/libraries/applicationprofile/ap.go (1)

51-304: 🧹 Nitpick | 🔵 Trivial | ⚡ Quick win

Factor the overload scaffolding into one helper.

The metric gate, profile-hash cache scoping, and ConvertProfileNotAvailableErrToBool path are now duplicated in every binding. Centralizing that flow will make it much harder for future helpers to miss one of the three behaviors.

♻️ Sketch of the extraction

+func (l *apLibrary) bindCachedBoolHelper(
+	overloadName string,
+	metricName string,
+	argTypes []*cel.Type,
+	fn func(...ref.Val) ref.Val,
+) cel.FunctionOpt {
+	expectedArgs := len(argTypes)
+
+	return cel.Overload(
+		overloadName, argTypes, cel.BoolType,
+		cel.FunctionBinding(func(values ...ref.Val) ref.Val {
+			if len(values) != expectedArgs {
+				return types.NewErr("expected %d arguments, got %d", expectedArgs, len(values))
+			}
+			if l.detailedMetrics && l.metrics != nil {
+				l.metrics.IncHelperCall(metricName)
+			}
+			cachedFunc := l.functionCache.WithCache(fn, metricName, cache.HashForContainerProfile(l.objectCache))
+			return cache.ConvertProfileNotAvailableErrToBool(cachedFunc(values...), false)
+		}),
+	)
+}
+
 func (l *apLibrary) Declarations() map[string][]cel.FunctionOpt {
 	return map[string][]cel.FunctionOpt{
 		"ap.was_executed": {
-			cel.Overload(
-				"ap_was_executed", []*cel.Type{cel.StringType, cel.StringType}, cel.BoolType,
-				cel.FunctionBinding(func(values ...ref.Val) ref.Val {
-					...
-				}),
-			),
+			l.bindCachedBoolHelper(
+				"ap_was_executed",
+				"ap.was_executed",
+				[]*cel.Type{cel.StringType, cel.StringType},
+				func(args ...ref.Val) ref.Val { return l.wasExecuted(args[0], args[1]) },
+			),
 		},

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pkg/rulemanager/cel/libraries/applicationprofile/ap.go` around lines 51 -
304, The Declarations() overload bindings duplicate the same scaffold (metrics
gate l.detailedMetrics & l.metrics.IncHelperCall, wrapping the domain call,
using l.functionCache.WithCache(...,
cache.HashForContainerProfile(l.objectCache)), and post-processing with
cache.ConvertProfileNotAvailableErrToBool), so extract a helper (e.g.,
buildBoolOverload or makeAPBoolBinding) that accepts the overload name, expected
arity/types, the domain call wrapper (like l.wasExecuted, l.wasExecutedWithArgs,
l.wasPathOpened, l.wasPathOpenedWithSuffix, l.wasPathOpenedWithPrefix,
l.wasSyscallUsed, l.wasCapabilityUsed, l.wasEndpointAccessed,
l.wasEndpointAccessedWithMethod, l.wasEndpointAccessedWithMethods,
l.wasEndpointAccessedWithPrefix, l.wasEndpointAccessedWithSuffix,
l.wasHostAccessed), and the metric key; have the helper perform the arg-count
check, metrics increment, create wrapperFunc calling the provided domain
function, call l.functionCache.WithCache(wrapperFunc, metricKey,
cache.HashForContainerProfile(l.objectCache)), invoke the cached func with
values..., and return cache.ConvertProfileNotAvailableErrToBool(result, false);
then replace each inline cel.FunctionBinding in Declarations() with a call to
that helper to remove duplication.

♻️ Duplicate comments (1)

tests/component_test.go (1)

3537-3605: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Fail fast on ExecIntoPod errors in Test_32 subtests.

These subtests still log err but continue. If exec fails, both R0001 and R0040 may be absent, producing false passes for “must stay silent” cases.

✅ Minimal fix

 t.Run("sh_dash_c_matches_wildcard_trailing", func(t *testing.T) {
   wl := setup(t)
   stdout, stderr, err := wl.ExecIntoPod([]string{"sh", "-c", "echo hi"}, "curl")
   t.Logf("sh -c 'echo hi' → err=%v stdout=%q stderr=%q", err, stdout, stderr)
+  require.NoError(t, err, "exec must succeed before asserting R0001/R0040 behavior")
@@
 t.Run("sh_dash_x_mismatches_R0040", func(t *testing.T) {
@@
   t.Logf("sh -x 'echo hi' → err=%v stdout=%q stderr=%q", err, stdout, stderr)
+  require.NoError(t, err, "exec must succeed before asserting R0001/R0040 behavior")
@@
 t.Run("echo_hello_matches_wildcard_trailing", func(t *testing.T) {
@@
   t.Logf("echo hello world from test → err=%v stdout=%q stderr=%q", err, stdout, stderr)
+  require.NoError(t, err, "exec must succeed before asserting R0001/R0040 behavior")
@@
 t.Run("echo_goodbye_mismatches_R0040", func(t *testing.T) {
@@
   t.Logf("echo goodbye world → err=%v stdout=%q stderr=%q", err, stdout, stderr)
+  require.NoError(t, err, "exec must succeed before asserting R0001/R0040 behavior")

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@tests/component_test.go` around lines 3537 - 3605, The subtests call
wl.ExecIntoPod(...) and log err but continue, which can hide execution failures;
update each Test_32 subtest (e.g., the blocks calling ExecIntoPod in
"sh_dash_c_matches_wildcard_trailing", "sh_dash_x_mismatches_R0040",
"echo_hello_matches_wildcard_trailing", "echo_goodbye_mismatches_R0040") to fail
fast when ExecIntoPod returns an error by asserting success immediately (use
require.NoError(t, err) or t.Fatalf with a clear message) right after the
ExecIntoPod call before calling waitAlerts/assertR0001Silent/countByRule so
tests don't produce false passes.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@pkg/rulebindingmanager/cache/cache.go`:
- Around line 128-176: Handlers AddHandler, ModifyHandler, and DeleteHandler are
calling addRuleBinding, modifiedRuleBinding, and deleteRuleBinding (and their
downstream helpers) without passing the watcher ctx, allowing long-running k8s
work to continue even after context cancellation while c.mutex is held; fix by
threading the supplied ctx into those calls (change signatures of
addRuleBinding, modifiedRuleBinding, deleteRuleBinding and any internal helpers
that currently use context.Background() to accept a context) and replace
internal uses of context.Background() with the propagated ctx so cancellation
unblocks work and avoids holding c.mutex during canceled operations.

---

Outside diff comments:
In `@pkg/rulemanager/cel/libraries/applicationprofile/ap.go`:
- Around line 51-304: The Declarations() overload bindings duplicate the same
scaffold (metrics gate l.detailedMetrics & l.metrics.IncHelperCall, wrapping the
domain call, using l.functionCache.WithCache(...,
cache.HashForContainerProfile(l.objectCache)), and post-processing with
cache.ConvertProfileNotAvailableErrToBool), so extract a helper (e.g.,
buildBoolOverload or makeAPBoolBinding) that accepts the overload name, expected
arity/types, the domain call wrapper (like l.wasExecuted, l.wasExecutedWithArgs,
l.wasPathOpened, l.wasPathOpenedWithSuffix, l.wasPathOpenedWithPrefix,
l.wasSyscallUsed, l.wasCapabilityUsed, l.wasEndpointAccessed,
l.wasEndpointAccessedWithMethod, l.wasEndpointAccessedWithMethods,
l.wasEndpointAccessedWithPrefix, l.wasEndpointAccessedWithSuffix,
l.wasHostAccessed), and the metric key; have the helper perform the arg-count
check, metrics increment, create wrapperFunc calling the provided domain
function, call l.functionCache.WithCache(wrapperFunc, metricKey,
cache.HashForContainerProfile(l.objectCache)), invoke the cached func with
values..., and return cache.ConvertProfileNotAvailableErrToBool(result, false);
then replace each inline cel.FunctionBinding in Declarations() with a call to
that helper to remove duplication.

---

Duplicate comments:
In `@tests/component_test.go`:
- Around line 3537-3605: The subtests call wl.ExecIntoPod(...) and log err but
continue, which can hide execution failures; update each Test_32 subtest (e.g.,
the blocks calling ExecIntoPod in "sh_dash_c_matches_wildcard_trailing",
"sh_dash_x_mismatches_R0040", "echo_hello_matches_wildcard_trailing",
"echo_goodbye_mismatches_R0040") to fail fast when ExecIntoPod returns an error
by asserting success immediately (use require.NoError(t, err) or t.Fatalf with a
clear message) right after the ExecIntoPod call before calling
waitAlerts/assertR0001Silent/countByRule so tests don't produce false passes.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 1730d651-bd2c-4ce6-8f21-6415cbe798c4

📥 Commits

Reviewing files that changed from the base of the PR and between 656deb5 and f3e3d20.

📒 Files selected for processing (9)

• pkg/objectcache/containerprofilecache/projection.go
• pkg/objectcache/containerprofilecache/test32_projection_test.go
• pkg/rulebindingmanager/cache/cache.go
• pkg/rulebindingmanager/cache/cache_test.go
• pkg/rulemanager/cel/libraries/applicationprofile/ap.go
• pkg/rulemanager/cel/libraries/applicationprofile/integration_test.go
• pkg/rulemanager/cel/libraries/applicationprofile/open.go
• pkg/rulemanager/cel/libraries/applicationprofile/open_test.go
• tests/component_test.go

[github-actions]

Performance Benchmark Results

Node-Agent Resource Usage

Metric	BEFORE	AFTER	Delta
Avg CPU (cores)	0.226	0.222	-1.8%
Peak CPU (cores)	0.238	0.233	-2.1%
Avg Memory (MiB)	336.288	269.195	-20.0%
Peak Memory (MiB)	338.117	270.387	-20.0%

Dedup Effectiveness (AFTER only)

Event Type	Passed	Deduped	Ratio
capabilities	0	0	N/A
hardlink	6000	0	0.0%
http	1762	119391	98.5%
network	903	77994	98.9%
open	29849	621788	95.4%
symlink	6000	0	0.0%
syscall	972	1878	65.9%

Event Counters

Metric	BEFORE	AFTER
capability_counter	9	9
dns_counter	1401	1437
exec_counter	7266	7188
network_counter	95068	94536
open_counter	789901	781827
syscall_counter	3520	3586

[entlein]

@coderabbitai review

Addresses the major finding on cache.go:176: ctx is now propagated through addRuleBinding / deleteRuleBinding / modifiedRuleBinding so the watcher's cancellation signal reaches the K8s List calls. New TestRBCacheHelpers_CtxFirstArg pins the contract.

[coderabbitai]

🧩 Analysis chain

---

🏁 Script executed:

#!/bin/bash
# Check the ctx propagation in cache.go
rg -n "ctx" pkg/rulebindingmanager/cache/cache.go -A2 -B2 | head -80

echo "---"
# Check the new test
rg -n "TestRBCacheHelpers_CtxFirstArg" pkg/rulebindingmanager/cache/ -A 30

Length of output: 7321

---

@entlein: The ctx propagation fix looks solid. Here's a quick verification summary:

pkg/rulebindingmanager/cache/cache.go

• addRuleBinding(ctx context.Context, ...), modifiedRuleBinding(ctx context.Context, ...), and deleteRuleBinding(ctx context.Context, ...) all now carry the watcher's ctx as their first argument.
• The two K8s API calls that previously would have used context.Background() now use the propagated ctx:
  • Line 270: Namespaces().List(ctx, ...)
  • Line 285: Pods(...).List(ctx, ...)
• AddHandler, ModifyHandler, and DeleteHandler all correctly thread their ctx down to the respective helpers.

pkg/rulebindingmanager/cache/cache_test.go — TestRBCacheHelpers_CtxFirstArg

• Typed function variable assignments (var addFn func(context.Context, ...) ...) provide a compile-time guard — signature drift causes a build failure immediately.
• The reflect check adds a runtime assertion with a diagnostic that explicitly references the original finding (PR #43 / cache.go:176).

This is a robust approach to preventing regression. Triggering a full review of the PR now.

✅ Actions performed

Full review triggered.

[coderabbitai]

Actionable comments posted: 9

♻️ Duplicate comments (1)

tests/component_test.go (1)

3546-3548: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Fail fast if ExecIntoPod fails before asserting R0001/R0040 outcomes.

Line 3546, Line 3565, Line 3583, and Line 3602 assert alert behavior without first requiring success of the preceding exec call. In the “must stay silent” cases, a failed exec can incorrectly pass the subtest (no alerts observed). Add require.NoError(t, err) immediately after each ExecIntoPod(...) in these subtests.

Suggested minimal fix

@@
 		stdout, stderr, err := wl.ExecIntoPod([]string{"sh", "-c", "echo hi"}, "curl")
 		t.Logf("sh -c 'echo hi' → err=%v stdout=%q stderr=%q", err, stdout, stderr)
+		require.NoError(t, err)
@@
 		stdout, stderr, err := wl.ExecIntoPod([]string{"sh", "-x", "echo hi"}, "curl")
 		t.Logf("sh -x 'echo hi' → err=%v stdout=%q stderr=%q", err, stdout, stderr)
+		require.NoError(t, err)
@@
 		stdout, stderr, err := wl.ExecIntoPod([]string{"echo", "hello", "world", "from", "test"}, "curl")
 		t.Logf("echo hello world from test → err=%v stdout=%q stderr=%q", err, stdout, stderr)
+		require.NoError(t, err)
@@
 		stdout, stderr, err := wl.ExecIntoPod([]string{"echo", "goodbye", "world"}, "curl")
 		t.Logf("echo goodbye world → err=%v stdout=%q stderr=%q", err, stdout, stderr)
+		require.NoError(t, err)

Also applies to: 3565-3567, 3583-3585, 3602-3604

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@tests/component_test.go` around lines 3546 - 3548, Tests are asserting alert
outcomes without verifying ExecIntoPod succeeded; update each affected subtest
to fail-fast by adding require.NoError(t, err) immediately after the
ExecIntoPod(...) call (before calling assertR0001Silent, assert.Equal,
countByRule, etc.), so references like ExecIntoPod, assertR0001Silent,
countByRule and assert.Equal only run when err is nil; apply this change to the
subtests that currently call ExecIntoPod and then assert R0001/R0040 outcomes.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@pkg/objectcache/containerprofilecache/containerprofilecache.go`:
- Around line 617-636: Update the comment in
ContainerProfileCacheImpl.SetProjectionSpec to describe the nudge channel's
coalescing semantics: explain that c.nudge is a buffered channel of capacity 1
and the non-blocking send intentionally drops extra signals because the
reconciler will always observe the latest spec (c.currentSpec) on its next
reconciliation tick, making multiple nudges idempotent/safe; mention that
specGeneration and optional metrics (metricsManager.IncProjectionSpecHashChange)
still record each change even if the channel send is coalesced so state and
observability remain correct.

In `@pkg/rulemanager/cel/libraries/applicationprofile/exec.go`:
- Around line 93-118: Exact-path entries in cp.Execs.Values must short-circuit
decision: if pathStr is present and cp.ExecsByPath[pathStr] exists but
dynamicpathdetector.CompareExecArgs(profileArgs, runtimeArgs) returns false,
return types.Bool(false) immediately instead of falling through to
cp.Execs.Patterns; update the block that checks cp.Execs.Values to return false
on non-matching args (while preserving the existing behavior that a missing
cp.ExecsByPath entry returns true), so that exact-match logic in the function
(referencing cp.Execs.Values, cp.ExecsByPath,
dynamicpathdetector.CompareExecArgs, cp.Execs.Patterns and
dynamicpathdetector.CompareDynamic) always takes precedence over pattern
matching.

In `@pkg/rulemanager/cel/libraries/applicationprofile/http.go`:
- Around line 74-84: The current path-only loop in the projection (iterating
cp.Endpoints.Values and cp.Endpoints.Patterns and returning types.Bool(true) on
dynamicpathdetector.CompareDynamic) makes
ap.was_endpoint_accessed_with_method(s) ignore HTTP verbs; change the logic to
perform verb-aware matching: after a path match, consult the endpoint->methods
mapping (e.g., the method map associated with cp.Endpoints or whatever structure
stores methods for each path) to verify the requested method is present before
returning true; if the method map is not yet implemented or the method is not
found, return a conservative non-match (types.Bool(false>) or the established
error path rather than returning true. Apply the same change to the other
similar block that mirrors this logic (the other ap.was_endpoint_* projection
code).

In `@pkg/rulemanager/cel/libraries/cache/function_cache.go`:
- Around line 115-117: The loop over extraKeyFn can panic if a nil callback is
present; update the loop that constructs key (the for _, fn := range extraKeyFn
block) to skip nil entries before invoking them (e.g., if fn == nil { continue
}) so you only call fn(values) when fn is non-nil, preserving the existing key
concatenation logic.

In `@pkg/rulemanager/cel/libraries/parse/parse.go`:
- Around line 69-77: The code currently returns an absolute argv[0] when
argv0[0]=='/' before checking exepathStr; change the precedence so that
exepathStr is treated as authoritative when non-empty: in the function handling
argv0/exepath (the code referencing argv0 and exepathStr and returning
types.String), first check if exepathStr != "" and return
types.String(exepathStr), and only if exepathStr is empty fall back to
validating argv0 (e.g., ensure len(argv0)>0 and argv0[0]=='/') before returning
types.String(argv0); update any related comments to reflect that event.exepath
is authoritative.

In `@pkg/rulemanager/profilehelper/profilehelper.go`:
- Around line 12-16: GetProjectedContainerProfile currently dereferences
objectCache by calling objectCache.ContainerProfileCache() without checking for
nil; add a nil-check for objectCache at the start of
GetProjectedContainerProfile and return an appropriate error (e.g., "nil object
cache") if it's nil before calling objectCache.ContainerProfileCache(), keeping
the existing error behavior for a nil ContainerProfileCache.

In `@README.md`:
- Around line 347-352: The README entry for "wasExecutedWithArgs(containerID,
path, args)" is stale: update the v1 Behaviour cell to state that it matches
both path and arguments (including wildcard-aware matching) instead of saying
args are ignored, and remove or replace the incorrect note claiming per-argument
matching (ExecArgsByPath) will be added in a future version; ensure the table
text explicitly references wasExecutedWithArgs and ExecArgsByPath so readers
know current argument-matching behavior is supported in v1.

In `@tests/resources/network-wildcards/19-port-protocol-with-cidr.yaml`:
- Around line 3-18: Update the fixture comment to reflect the current known
limitation that the matcher is address-only for the
was_address_port_protocol_in_* family (e.g.,
nn.was_address_port_protocol_in_egress) instead of enforcing full
(IP,port,protocol) tuples: change the expectations and explanatory text to
explicitly state “address-only matching — ports/protocols not currently
enforced” (or add a “Known limitation” note) so the documented behavior no
longer asserts port/protocol enforcement that the implementation does not
perform.

In `@tests/resources/network-wildcards/README.md`:
- Line 74: Replace the incorrect acronym "SBoBs" with "SBOMs" in the migration
note that reads "Producers writing v0.0.2-conformant SBoBs SHOULD use
`ipAddresses` (plural)." — update the string "SBoBs" to "SBOMs" so the text
correctly reads "Producers writing v0.0.2-conformant SBOMs SHOULD use
`ipAddresses` (plural)."

---

Duplicate comments:
In `@tests/component_test.go`:
- Around line 3546-3548: Tests are asserting alert outcomes without verifying
ExecIntoPod succeeded; update each affected subtest to fail-fast by adding
require.NoError(t, err) immediately after the ExecIntoPod(...) call (before
calling assertR0001Silent, assert.Equal, countByRule, etc.), so references like
ExecIntoPod, assertR0001Silent, countByRule and assert.Equal only run when err
is nil; apply this change to the subtests that currently call ExecIntoPod and
then assert R0001/R0040 outcomes.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 8b2e3cd7-b6cb-415f-8545-50fc0d5278e3

📥 Commits

Reviewing files that changed from the base of the PR and between a3fdc33 and 8b34f59.

⛔ Files ignored due to path filters (1)

• go.sum is excluded by !**/*.sum

📒 Files selected for processing (86)

• .github/workflows/component-tests.yaml
• .gitignore
• README.md
• cmd/main.go
• go.mod
• pkg/config/config.go
• pkg/containerprofilemanager/v1/event_reporting.go
• pkg/containerprofilemanager/v1/event_reporting_test.go
• pkg/exporters/alert_manager.go
• pkg/metricsmanager/metrics_manager_interface.go
• pkg/metricsmanager/metrics_manager_mock.go
• pkg/metricsmanager/metrics_manager_noop.go
• pkg/metricsmanager/prometheus/prometheus.go
• pkg/objectcache/containerprofilecache/containerprofilecache.go
• pkg/objectcache/containerprofilecache/containerprofilecache_test.go
• pkg/objectcache/containerprofilecache/init_eviction_test.go
• pkg/objectcache/containerprofilecache/lock_stress_test.go
• pkg/objectcache/containerprofilecache/projection.go
• pkg/objectcache/containerprofilecache/projection_apply.go
• pkg/objectcache/containerprofilecache/projection_apply_test.go
• pkg/objectcache/containerprofilecache/projection_compile.go
• pkg/objectcache/containerprofilecache/projection_compile_test.go
• pkg/objectcache/containerprofilecache/projection_trie.go
• pkg/objectcache/containerprofilecache/projection_trie_test.go
• pkg/objectcache/containerprofilecache/reconciler.go
• pkg/objectcache/containerprofilecache/reconciler_test.go
• pkg/objectcache/containerprofilecache/shared_pointer_race_test.go
• pkg/objectcache/containerprofilecache/t8_overlay_refresh_test.go
• pkg/objectcache/containerprofilecache/tamper_alert_test.go
• pkg/objectcache/containerprofilecache/test32_projection_test.go
• pkg/objectcache/containerprofilecache_interface.go
• pkg/objectcache/projection_types.go
• pkg/objectcache/v1/mock.go
• pkg/rulebindingmanager/cache/cache.go
• pkg/rulebindingmanager/cache/cache_test.go
• pkg/rulemanager/cel/cel.go
• pkg/rulemanager/cel/libraries/applicationprofile/ap.go
• pkg/rulemanager/cel/libraries/applicationprofile/capability.go
• pkg/rulemanager/cel/libraries/applicationprofile/exec.go
• pkg/rulemanager/cel/libraries/applicationprofile/exec_test.go
• pkg/rulemanager/cel/libraries/applicationprofile/http.go
• pkg/rulemanager/cel/libraries/applicationprofile/integration_test.go
• pkg/rulemanager/cel/libraries/applicationprofile/open.go
• pkg/rulemanager/cel/libraries/applicationprofile/open_test.go
• pkg/rulemanager/cel/libraries/applicationprofile/syscall.go
• pkg/rulemanager/cel/libraries/cache/function_cache.go
• pkg/rulemanager/cel/libraries/networkneighborhood/fixtures_test.go
• pkg/rulemanager/cel/libraries/networkneighborhood/integration_test.go
• pkg/rulemanager/cel/libraries/networkneighborhood/network.go
• pkg/rulemanager/cel/libraries/networkneighborhood/network_test.go
• pkg/rulemanager/cel/libraries/networkneighborhood/nn.go
• pkg/rulemanager/cel/libraries/networkneighborhood/wildcard_test.go
• pkg/rulemanager/cel/libraries/parse/parse.go
• pkg/rulemanager/cel/libraries/parse/parselib.go
• pkg/rulemanager/cel/libraries/parse/parsing_test.go
• pkg/rulemanager/profilehelper/profilehelper.go
• pkg/rulemanager/rule_manager.go
• pkg/rulemanager/rulepolicy.go
• pkg/rulemanager/types/v1/profiledata.go
• pkg/rulemanager/types/v1/profiledata_test.go
• pkg/rulemanager/types/v1/types.go
• tests/chart/templates/node-agent/default-rule-binding.yaml
• tests/chart/templates/node-agent/default-rules.yaml
• tests/component_test.go
• tests/resources/malicious-job.yaml
• tests/resources/network-wildcards/01-literal-ipv4.yaml
• tests/resources/network-wildcards/02-literal-ipv6.yaml
• tests/resources/network-wildcards/03-cidr-ipv4.yaml
• tests/resources/network-wildcards/04-cidr-ipv6.yaml
• tests/resources/network-wildcards/05-any-ip-sentinel.yaml
• tests/resources/network-wildcards/06-any-as-cidr.yaml
• tests/resources/network-wildcards/07-mixed-ip-list.yaml
• tests/resources/network-wildcards/08-deprecated-ipaddress.yaml
• tests/resources/network-wildcards/09-dns-literal.yaml
• tests/resources/network-wildcards/10-dns-leading-wildcard.yaml
• tests/resources/network-wildcards/11-dns-mid-ellipsis.yaml
• tests/resources/network-wildcards/12-dns-trailing-star.yaml
• tests/resources/network-wildcards/13-dns-trailing-dot-normalisation.yaml
• tests/resources/network-wildcards/14-recursive-star-rejected.yaml
• tests/resources/network-wildcards/15-egress-and-ingress.yaml
• tests/resources/network-wildcards/16-egress-none.yaml
• tests/resources/network-wildcards/17-realistic-stripe-api.yaml
• tests/resources/network-wildcards/18-cluster-dns-via-mid-ellipsis.yaml
• tests/resources/network-wildcards/19-port-protocol-with-cidr.yaml
• tests/resources/network-wildcards/20-multi-container-mixed-wildcards.yaml
• tests/resources/network-wildcards/README.md

[coderabbitai]

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Exact path match should return false when args don't match, not fall through to pattern matching.

If pathStr exists in cp.Execs.Values and has a corresponding ExecsByPath entry with non-matching args, the function falls through to check cp.Execs.Patterns. This allows an exact path with strict args to be bypassed by a less-specific dynamic pattern, which seems incorrect—exact matches should take precedence.

Proposed fix

 	// Exact path match: walk the profile's Args for that path via
 	// CompareExecArgs (handles ⋯ single-arg and * zero-or-more tokens).
 	if _, ok := cp.Execs.Values[pathStr]; ok {
 		if profileArgs, ok := cp.ExecsByPath[pathStr]; ok {
 			if dynamicpathdetector.CompareExecArgs(profileArgs, runtimeArgs) {
 				return types.Bool(true)
 			}
+			// Exact path matched but args did not — do not fall through to
+			// pattern matching; return false after checking pod spec.
+			if l.isExecInPodSpec(containerID, path).Value().(bool) {
+				return types.Bool(true)
+			}
+			return types.Bool(false)
 		} else {
 			// No ExecsByPath entry for this path — back-compat: treat as
 			// "no argv constraint", match.
 			return types.Bool(true)
 		}
 	}

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pkg/rulemanager/cel/libraries/applicationprofile/exec.go` around lines 93 -
118, Exact-path entries in cp.Execs.Values must short-circuit decision: if
pathStr is present and cp.ExecsByPath[pathStr] exists but
dynamicpathdetector.CompareExecArgs(profileArgs, runtimeArgs) returns false,
return types.Bool(false) immediately instead of falling through to
cp.Execs.Patterns; update the block that checks cp.Execs.Values to return false
on non-matching args (while preserving the existing behavior that a missing
cp.ExecsByPath entry returns true), so that exact-match logic in the function
(referencing cp.Execs.Values, cp.ExecsByPath,
dynamicpathdetector.CompareExecArgs, cp.Execs.Patterns and
dynamicpathdetector.CompareDynamic) always takes precedence over pattern
matching.

[coderabbitai]

⚠️ Potential issue | 🟠 Major | 🏗️ Heavy lift

Method-aware helpers currently ignore HTTP method semantics.

ap.was_endpoint_accessed_with_method and ap.was_endpoint_accessed_with_methods now return true on path match alone. This can hide method violations (e.g., POST queried, only GET observed), which weakens rule enforcement.

Please restore verb-aware matching in projection (e.g., method map per path). Until that exists, return a conservative non-match/error path instead of path-only success.

Also applies to: 113-123

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pkg/rulemanager/cel/libraries/applicationprofile/http.go` around lines 74 -
84, The current path-only loop in the projection (iterating cp.Endpoints.Values
and cp.Endpoints.Patterns and returning types.Bool(true) on
dynamicpathdetector.CompareDynamic) makes
ap.was_endpoint_accessed_with_method(s) ignore HTTP verbs; change the logic to
perform verb-aware matching: after a path match, consult the endpoint->methods
mapping (e.g., the method map associated with cp.Endpoints or whatever structure
stores methods for each path) to verify the requested method is present before
returning true; if the method map is not yet implemented or the method is not
found, return a conservative non-match (types.Bool(false>) or the established
error path rather than returning true. Apply the same change to the other
similar block that mirrors this logic (the other ap.was_endpoint_* projection
code).

[coderabbitai]

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Skip nil extraKeyFn callbacks before invocation.

A nil callback in extraKeyFn will panic when called.

Suggested patch

-		for _, fn := range extraKeyFn {
-			key += "|" + fn(values)
+		for _, keyFn := range extraKeyFn {
+			if keyFn == nil {
+				continue
+			}
+			key += "|" + keyFn(values)
 		}

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	for _, fn := range extraKeyFn {
	key += "|" + fn(values)
	}
	for _, keyFn := range extraKeyFn {
	if keyFn == nil {
	continue
	}
	key += "|" + keyFn(values)
	}

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pkg/rulemanager/cel/libraries/cache/function_cache.go` around lines 115 -
117, The loop over extraKeyFn can panic if a nil callback is present; update the
loop that constructs key (the for _, fn := range extraKeyFn block) to skip nil
entries before invoking them (e.g., if fn == nil { continue }) so you only call
fn(values) when fn is non-nil, preserving the existing key concatenation logic.

[coderabbitai]

⚠️ Potential issue | 🔴 Critical | 🏗️ Heavy lift

Do not trust absolute argv[0] over exepath for identity.

Line 69–77 introduces a spoofing path: argv[0] is process-controlled, so an attacker can present an allowlisted absolute path while executing a different binary. Use event.exepath as authoritative when available.

Safer precedence sketch

-    // Tier 1: absolute argv[0] wins. Symlink-faithful.
-    if len(argv0) > 0 && argv0[0] == '/' {
-        return types.String(argv0)
-    }
+    // Prefer kernel-resolved executable path when present.
+    if exepathStr != "" {
+        return types.String(exepathStr)
+    }
+    // Fall back to argv[0] only when exepath is unavailable.
+    if len(argv0) > 0 && argv0[0] == '/' {
+        return types.String(argv0)
+    }
@@
-    // Tier 2: kernel-authoritative exepath when argv[0] is bare/empty.
-    if exepathStr != "" {
-        return types.String(exepathStr)
-    }
+    // exepath handled above.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pkg/rulemanager/cel/libraries/parse/parse.go` around lines 69 - 77, The code
currently returns an absolute argv[0] when argv0[0]=='/' before checking
exepathStr; change the precedence so that exepathStr is treated as authoritative
when non-empty: in the function handling argv0/exepath (the code referencing
argv0 and exepathStr and returning types.String), first check if exepathStr !=
"" and return types.String(exepathStr), and only if exepathStr is empty fall
back to validating argv0 (e.g., ensure len(argv0)>0 and argv0[0]=='/') before
returning types.String(argv0); update any related comments to reflect that
event.exepath is authoritative.

[coderabbitai]

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Guard nil object cache before dereference.

This helper calls objectCache.ContainerProfileCache() without checking whether objectCache is nil, which can panic instead of returning an error.

Suggested patch

 func GetProjectedContainerProfile(objectCache objectcache.ObjectCache, containerID string) (*objectcache.ProjectedContainerProfile, string, error) {
+	if objectCache == nil {
+		return nil, "", errors.New("object cache is nil")
+	}
 	cpc := objectCache.ContainerProfileCache()
 	if cpc == nil {
 		return nil, "", errors.New("no container profile cache available")
 	}

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	func GetProjectedContainerProfile(objectCache objectcache.ObjectCache, containerID string) (*objectcache.ProjectedContainerProfile, string, error) {
	cpc := objectCache.ContainerProfileCache()
	if cpc == nil {
	return nil, "", errors.New("no container profile cache available")
	}
	func GetProjectedContainerProfile(objectCache objectcache.ObjectCache, containerID string) (*objectcache.ProjectedContainerProfile, string, error) {
	if objectCache == nil {
	return nil, "", errors.New("object cache is nil")
	}
	cpc := objectCache.ContainerProfileCache()
	if cpc == nil {
	return nil, "", errors.New("no container profile cache available")
	}

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pkg/rulemanager/profilehelper/profilehelper.go` around lines 12 - 16,
GetProjectedContainerProfile currently dereferences objectCache by calling
objectCache.ContainerProfileCache() without checking for nil; add a nil-check
for objectCache at the start of GetProjectedContainerProfile and return an
appropriate error (e.g., "nil object cache") if it's nil before calling
objectCache.ContainerProfileCache(), keeping the existing error behavior for a
nil ContainerProfileCache.

[coderabbitai]

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Fix stale wasExecutedWithArgs behavior docs.

This table entry contradicts current behavior: argument matching is active (including wildcard-aware matching), not path-only. Keeping this text will mislead rule authors and can cause incorrect detections.

Suggested doc fix

-| `wasExecutedWithArgs(containerID, path, args)` | Equivalent to `wasExecuted(containerID, path)` — the `args` list is validated for type correctness but is **not** matched against the recorded argument list. Any execution of the given path returns `true` regardless of its arguments. | Full per-argument matching (`ExecArgsByPath`) will be added in a future version. |
+| `wasExecutedWithArgs(containerID, path, args)` | Matches `path` **and** execution arguments against the projected profile. Argument matching supports anchored literal args and wildcard tokens used by the matcher. | Prefer this helper when argv constraints matter; use `wasExecuted` for path-only checks. |

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	### CEL Helper Limitations (v1)
	| Helper | v1 Behaviour | Note |
	|--------|-------------|------|
	| `wasExecutedWithArgs(containerID, path, args)` | Equivalent to `wasExecuted(containerID, path)` — the `args` list is validated for type correctness but is **not** matched against the recorded argument list. Any execution of the given path returns `true` regardless of its arguments. | Full per-argument matching (`ExecArgsByPath`) will be added in a future version. |
	### CEL Helper Limitations (v1)
	| Helper | v1 Behaviour | Note |
	|--------|-------------|------|
	| `wasExecutedWithArgs(containerID, path, args)` | Matches `path` **and** execution arguments against the projected profile. Argument matching supports anchored literal args and wildcard tokens used by the matcher. | Prefer this helper when argv constraints matter; use `wasExecuted` for path-only checks. |

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@README.md` around lines 347 - 352, The README entry for
"wasExecutedWithArgs(containerID, path, args)" is stale: update the v1 Behaviour
cell to state that it matches both path and arguments (including wildcard-aware
matching) instead of saying args are ignored, and remove or replace the
incorrect note claiming per-argument matching (ExecArgsByPath) will be added in
a future version; ensure the table text explicitly references
wasExecutedWithArgs and ExecArgsByPath so readers know current argument-matching
behavior is supported in v1.

[github-actions]

Performance Benchmark Results

Node-Agent Resource Usage

Metric	BEFORE	AFTER	Delta
Avg CPU (cores)	0.215	0.199	-7.1%
Peak CPU (cores)	0.226	0.212	-6.4%
Avg Memory (MiB)	315.837	276.587	-12.4%
Peak Memory (MiB)	317.051	278.277	-12.2%

Dedup Effectiveness (AFTER only)

Event Type	Passed	Deduped	Ratio
capabilities	2	0	0.0%
hardlink	6000	0	0.0%
http	1764	119396	98.5%
network	907	77993	98.8%
open	31492	620260	95.2%
symlink	6000	0	0.0%
syscall	989	1887	65.6%

Event Counters

Metric	BEFORE	AFTER
capability_counter	9	9
dns_counter	1450	1426
exec_counter	7252	7132
network_counter	95379	93807
open_counter	789184	777139
syscall_counter	3666	3476

[entlein]

@coderabbitai review

Adds 5 chart-audit fixes that restore upstream's profile-projection feature surface (lost during the merge):

• 1b8f4b8 restore profileDataRequired field in rules CRD schema
• 6371181 restore profileProjection runtime config block (configmap + values.yaml)
• 8a63e3c restore profileDataRequired on all 20 rules (matches upstream byte-for-byte)
• 007d760 restore state-block filters on R0006, R0008, R1009
• 2e2077b revert R1006 profileDependency from 2 (NotRequired) to 1 (Optional)

[coderabbitai]

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Inspect the 5 chart-audit fix commits
git log --oneline -10

echo "=== CRD schema change ==="
git show 1b8f4b84 --stat

echo "=== profileProjection config block ==="
git show 63711813 --stat

echo "=== profileDataRequired on rules ==="
git show 8a63e3c1 --stat

echo "=== state-block filters ==="
git show 007d760d --stat

echo "=== R1006 profileDependency revert ==="
git show 2e2077b9 --stat

Length of output: 5728

---

🏁 Script executed:

#!/bin/bash
# Check current state of key files affected by the chart-audit fixes

echo "=== Rules CRD schema (profileDataRequired field) ==="
fd -e yaml -e json "runtimerulealertbinding\|rulesets\|rules" tests/chart/crds/ --exec grep -l "profileDataRequired" {} 2>/dev/null || echo "not found, checking all crds..."
fd -e yaml -e json . tests/chart/crds/ 2>/dev/null | head -20

echo "=== default-rules.yaml profileDataRequired presence ==="
grep -c "profileDataRequired" tests/chart/templates/node-agent/default-rules.yaml 2>/dev/null || echo "not found"

echo "=== configmap profileProjection ==="
fd -e yaml . tests/chart/templates/ --exec grep -l "profileProjection" {} 2>/dev/null

echo "=== values.yaml profileProjection ==="
grep -A5 "profileProjection" tests/chart/values.yaml 2>/dev/null || echo "not found in values.yaml"

echo "=== R1006 profileDependency value ==="
grep -A3 "R1006\|profileDependency" tests/chart/templates/node-agent/default-rules.yaml 2>/dev/null | head -30

Length of output: 1072

---

🏁 Script executed:

#!/bin/bash
# Verify R1006 profileDependency specifically
echo "=== R1006 block in default-rules.yaml ==="
grep -n "R1006" tests/chart/templates/node-agent/default-rules.yaml -A 15 | head -30

echo ""
echo "=== configmap.yaml profileProjection wiring ==="
grep -n "profileProjection\|detailedMetrics\|strictValidation" tests/chart/templates/node-agent/configmap.yaml

echo ""
echo "=== CRD profileDataRequired schema snippet ==="
grep -n "profileDataRequired" tests/chart/crds/rules.crd.yaml -A 5

echo ""
echo "=== state-block filters on R0006/R0008/R1009 ==="
for rule in R0006 R0008 R1009; do
  echo "--- $rule ---"
  grep -n "$rule" tests/chart/templates/node-agent/default-rules.yaml -A 20 | grep -E "includePrefixes|ports|state|$rule" | head -10
done

Length of output: 1601

---

@entlein: All 5 chart-audit fixes verified and look correct. Here's a quick summary:

Commit	File(s)	Status
1b8f4b8 CRD schema	rules.crd.yaml line 78 — profileDataRequired: type: object, x-kubernetes-preserve-unknown-fields: true	✅
6371181 configmap + values	configmap.yaml line 40 wires {{- .Values.nodeAgent.config.profileProjection | toJson }}; values.yaml has detailedMetricsEnabled: true, strictValidation: false	✅
8a63e3c 20 rules declarations	default-rules.yaml — exactly 20 profileDataRequired entries, one per rule	✅
007d760 state-block filters	R0006 state.includePrefixes (line 214), R0008 state.includePrefixes (line 272), R1009 state.ports (line 585)	✅
2e2077b R1006 revert	profileDependency: 1 (line 515) — correctly set to Optional, not NotRequired	✅

One thing worth noting: the CRD uses x-kubernetes-preserve-unknown-fields: true for profileDataRequired rather than a typed sub-schema. This is pragmatic (avoids schema churn as the field evolves), but means the API server won't validate the inner structure at admission time — a follow-up to add a typed sub-schema may be worth tracking.

Triggering a full review now.

✅ Actions performed

Full review triggered.

[coderabbitai]

Actionable comments posted: 8

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (3)

pkg/rulemanager/cel/libraries/networkneighborhood/integration_test.go (1)

213-250: 🧹 Nitpick | 🔵 Trivial | ⚡ Quick win

Add at least one negative was_address_port_protocol_in_* case for absent address.

After the v1 degradation updates, this helper no longer has a false assertion path in this suite. Please keep one case where the address is not in profile to prevent an accidental “always true” regression.

Suggested test addition

+		{
+			name:           "Check absent egress address with port/protocol",
+			expression:     `nn.was_address_port_protocol_in_egress(containerID, "192.168.1.200", 80, "TCP")`,
+			expectedResult: false,
+		},

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pkg/rulemanager/cel/libraries/networkneighborhood/integration_test.go` around
lines 213 - 250, Add at least one negative test case that exercises
nn.was_address_port_protocol_in_egress or
nn.was_address_port_protocol_in_ingress with an address that is not present in
the profile and assert expectedResult: false; specifically, add a test entry
(alongside the existing table of test cases) that uses containerID and a clearly
absent IP (e.g., "203.0.113.5") with some port/protocol and sets expectedResult
to false so the suite contains a failing-path for the post-v1 degradation
behavior of
was_address_port_protocol_in_egress/was_address_port_protocol_in_ingress.

tests/chart/templates/node-agent/default-rules.yaml (1)

52-75: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

R0040 needs profileDataRequired.execs.

This rule calls both ap.was_executed(...) and ap.was_executed_with_args(...), but unlike the other exec-based rules it never declares the execs surface. Under rule-aware projection that leaves the helper without the data it needs, so the new rule can silently stop matching.

Suggested fix

       - name: "Unexpected process arguments"
         enabled: true
         id: "R0040"
         description: "Process path is allowed by profile but argument vector does not match any profile entry's arg pattern (literal or wildcard ⋯/*)"
@@
         profileDependency: 0
+        profileDataRequired:
+          execs: all
         severity: 1

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@tests/chart/templates/node-agent/default-rules.yaml` around lines 52 - 75,
The new rule R0040 uses ap.was_executed(...) and ap.was_executed_with_args(...)
but does not declare the exec surface, so add profileDataRequired.execs to this
rule's metadata; update the rule block for "R0040" to include
profileDataRequired: { execs: true } (or the equivalent schema used elsewhere)
so the ap helper receives exec data when rule-aware projection runs and the
expressions ap.was_executed and ap.was_executed_with_args can operate correctly.

pkg/rulemanager/cel/libraries/applicationprofile/ap.go (1)

51-305: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Keep ap.was_path_opened_with_flags as a compatibility overload.

Declarations() no longer exports this helper. Any existing custom CEL rule that still calls ap.was_path_opened_with_flags will now fail compilation after upgrade, which is a hard break in the public rule surface. Unless every consumer was migrated in lockstep, keep a shim overload here instead of removing it outright.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pkg/rulemanager/cel/libraries/applicationprofile/ap.go` around lines 51 -
305, Declarations() removed the ap.was_path_opened_with_flags overload which
breaks compatibility; re-add a shim overload named
"ap.was_path_opened_with_flags" in the returned map following the same pattern
as the other helpers: register a cel.Overload (mirror argument types used
previously), call l.metrics.IncHelperCall when l.detailedMetrics && l.metrics !=
nil, wrap the real implementation via wrapperFunc that calls
l.wasPathOpenedWithFlags (the compatibility shim) and pass it through
l.functionCache.WithCache with the same
cache.HashForContainerProfile(l.objectCache) keying, then return
cache.ConvertProfileNotAvailableErrToBool(result, false) so the "profile not
available" error is converted to false after caching.

♻️ Duplicate comments (6)

README.md (1)

347-352: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Fix stale wasExecutedWithArgs behavior documentation.

Line 351 contradicts current behavior: wasExecutedWithArgs now matches both path and args (via projected exec args), not path-only.

Suggested doc fix

-| `wasExecutedWithArgs(containerID, path, args)` | Equivalent to `wasExecuted(containerID, path)` — the `args` list is validated for type correctness but is **not** matched against the recorded argument list. Any execution of the given path returns `true` regardless of its arguments. | Full per-argument matching (`ExecArgsByPath`) will be added in a future version. |
+| `wasExecutedWithArgs(containerID, path, args)` | Matches `path` and execution arguments against the projected profile (`ExecsByPath`). | Use this when argv constraints matter; use `wasExecuted` for path-only checks. |

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@README.md` around lines 347 - 352, Update the CEL helper table entry for
wasExecutedWithArgs to reflect current behavior: change the v1 Behaviour to
state that wasExecutedWithArgs(containerID, path, args) matches both path and
args (it validates and compares projected exec args against the recorded
argument list) instead of implying it only matches path; update the Note to
remove the “will be added” remark and reference ExecArgsByPath only if still
relevant (or delete the future-work sentence), and ensure the table text
mentions that per-argument matching is implemented via projected exec args
comparison.

tests/resources/network-wildcards/README.md (1)

74-74: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Fix acronym typo: SBoBs → SBOMs.

Line 74 has a typo that breaks terminology consistency.

Suggested fix

-Producers writing v0.0.2-conformant SBoBs SHOULD use `ipAddresses` (plural).
+Producers writing v0.0.2-conformant SBOMs SHOULD use `ipAddresses` (plural).

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@tests/resources/network-wildcards/README.md` at line 74, The README contains
a typographical error: the acronym "SBoBs" should be "SBOMs"; update the text
fragment "Producers writing v0.0.2-conformant SBoBs SHOULD use `ipAddresses`
(plural)." to read "Producers writing v0.0.2-conformant SBOMs SHOULD use
`ipAddresses` (plural)." so the terminology is consistent (locate the exact
string "SBoBs" in the README and replace it with "SBOMs").

pkg/rulemanager/profilehelper/profilehelper.go (1)

12-16: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Guard objectCache against nil before dereference.

Line 13 dereferences objectCache unconditionally; nil input can panic instead of returning an error.

Suggested fix

 func GetProjectedContainerProfile(objectCache objectcache.ObjectCache, containerID string) (*objectcache.ProjectedContainerProfile, string, error) {
+	if objectCache == nil {
+		return nil, "", errors.New("object cache is nil")
+	}
 	cpc := objectCache.ContainerProfileCache()
 	if cpc == nil {
 		return nil, "", errors.New("no container profile cache available")
 	}

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pkg/rulemanager/profilehelper/profilehelper.go` around lines 12 - 16,
GetProjectedContainerProfile currently dereferences objectCache without checking
for nil; add an initial nil guard that returns (nil, "", error) when objectCache
is nil before calling objectCache.ContainerProfileCache(), so the function
safely handles a nil input and avoids a panic. Identify the function
GetProjectedContainerProfile and insert the check at its start, returning an
appropriate error message (e.g., "nil objectCache") if objectCache == nil, then
proceed to call ContainerProfileCache() as before.

pkg/rulemanager/cel/libraries/cache/function_cache.go (1)

115-117: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Guard against nil callbacks in extraKeyFn before invocation.

A nil function in the extraKeyFn slice will panic when called at line 116. This was flagged in a previous review but remains unaddressed.

🛡️ Proposed fix

 		for _, fn := range extraKeyFn {
+			if fn == nil {
+				continue
+			}
 			key += "|" + fn(values)
 		}

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pkg/rulemanager/cel/libraries/cache/function_cache.go` around lines 115 -
117, The loop that builds the cache key calls functions from the extraKeyFn
slice without nil-checks, which can panic; update the iteration over extraKeyFn
(the loop using "for _, fn := range extraKeyFn" that appends to key using
fn(values)) to guard against nil callbacks by checking "if fn == nil" and
skipping (or handling) nil entries before invoking fn(values), leaving key and
values behavior unchanged otherwise.

pkg/rulemanager/cel/libraries/parse/parse.go (1)

60-82: ⚠️ Potential issue | 🔴 Critical | 🏗️ Heavy lift

argv[0] spoofing risk remains: attacker-controlled absolute argv[0] is trusted over kernel-resolved exepath.

The comment at lines 49-52 claims "the kernel only exposes an absolute argv[0] when execve was called with that exact path" — this is incorrect. The kernel does not validate argv[0]; it's entirely process-controlled and can be set to any string by the caller of execve().

An attacker can execute /usr/bin/malware with argv[0]="/bin/sh" (an absolute path), and this code will return "/bin/sh", causing the rule to match against the wrong profile entry.

The symlink-faithful rationale for busybox is valid, but it conflicts with security. Consider:

1. Trusting exepath first (kernel-authoritative) and accepting the busybox mismatch as a false positive, or
2. Only trusting argv[0] when it matches exepath's basename or is a known symlink resolution.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pkg/rulemanager/cel/libraries/parse/parse.go` around lines 60 - 82, The
current getExecPathWithExePath trusts an attacker-controlled absolute argv[0]
over the kernel-provided exepath (exepath param), which allows spoofing; change
the logic in getExecPathWithExePath so that when exepath (exepathStr) is
non-empty it is returned first (kernel-authoritative), and only accept argv[0]
as the exec path if either exepathStr is empty or argv[0] is explicitly
validated to match exepath (e.g., compare path.Base(argv0) ==
path.Base(exepathStr) or resolve symlinks/real paths before trusting argv0);
update callers (getExecPath and getExecPathWithExePath) to follow this
ordering/validation and ensure error handling still uses
types.MaybeNoSuchOverloadErr(exepath) when exepath is not a string.

pkg/rulemanager/cel/libraries/applicationprofile/http.go (1)

74-84: ⚠️ Potential issue | 🟠 Major | 🏗️ Heavy lift

Method-aware endpoint helpers still ignore HTTP methods.

Both helpers validate the method/methods argument and then return true on path match alone. That widens ap.was_endpoint_accessed_with_method(s) into a plain path check, so a profile that only observed GET /foo will also allow POST /foo. Either project methods per path or fail closed when method data is unavailable.

Also applies to: 113-123

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@go.mod`:
- Around line 70-72: The k8s.io/* modules are version-skewed: update the go.mod
entry for k8s.io/kubectl to v0.35.3 so it matches k8s.io/api,
k8s.io/apimachinery, and k8s.io/client-go (ensure the module string
"k8s.io/kubectl" is changed to version v0.35.3 and run `go mod tidy` / `go mod
download` to validate and regenerate the go.sum).

In `@pkg/objectcache/containerprofilecache/projection_apply.go`:
- Around line 40-44: The current shallow copy of cp.Spec.PolicyByRuleId into
pcp.PolicyByRuleId using maps.Copy allows RulePolicy.AllowedProcesses (a slice)
to remain shared and violates Apply's purity; instead, allocate
pcp.PolicyByRuleId and for each entry in cp.Spec.PolicyByRuleId copy the
RulePolicy value into a new variable, deep-copy its AllowedProcesses slice (make
a new slice and copy elements or use append to a nil slice) and store that new
RulePolicy in pcp.PolicyByRuleId so no internal slice references point back to
cp.Spec.PolicyByRuleId.

In `@pkg/objectcache/containerprofilecache/projection_trie.go`:
- Around line 5-10: The top-level comment for type trie incorrectly states it is
a byte-level trie; update the comment to state it is rune-keyed (using children
map[rune]*trie), explain it operates on Unicode runes rather than raw bytes, and
adjust complexity wording to reflect O(m) where m is the number of runes in the
query; keep the note that it’s used by FieldSpec for prefix and suffix
(reversed-insertion) matching and that terminal marks pattern ends.

In `@pkg/objectcache/v1/mock.go`:
- Around line 187-193: The mock currently forces pcp.Endpoints.All = true
whenever spec.Endpoints.InUse or !specInstalled, which misrepresents selective
projections; change the logic in the block that references specInstalled,
spec.Endpoints.InUse, cp.Spec.Endpoints so that you do NOT set pcp.Endpoints.All
= true unconditionally—instead set pcp.Endpoints.All = false and populate
pcp.Endpoints.Values from cp.Spec.Endpoints (pcp.Endpoints.Values[e.Endpoint] =
struct{}{}) to mirror selective exact/prefix/suffix behavior, and only set All =
true in the mock when the source projection explicitly indicates an "all"
projection (leave All untouched otherwise).
- Around line 167-176: The mock currently adds an explicit empty slice for
unconstrained execs, breaking the "absent means no argv constraint" contract;
update the loop that builds pcp.ExecsByPath so it only inserts an entry when
e.Args is non-nil (i.e., remove the branch that sets pcp.ExecsByPath[e.Path] =
[]string{} and instead skip adding any map key when e.Args == nil), keeping the
existing allocation of pcp.ExecsByPath and otherwise assigning
pcp.ExecsByPath[e.Path] = e.Args for constrained execs.

In `@pkg/rulemanager/cel/libraries/applicationprofile/integration_test.go`:
- Around line 88-90: The test removed coverage for flag-aware checking; restore
it by adding a new integration test case alongside the existing path-only case
that calls ap.was_path_opened_with_flags(containerID, "/etc/passwd", O_RDONLY /*
or appropriate flag constant */) and asserts expectedResult true (or false as
appropriate), leaving the existing ap.was_path_opened(containerID,
"/etc/passwd") test intact; locate the test table in integration_test.go and add
an entry using the unique symbol ap.was_path_opened_with_flags to ensure both
behaviors are covered.

In `@pkg/rulemanager/cel/libraries/networkneighborhood/network.go`:
- Around line 164-181: The helper currently ignores port/protocol projection and
always falls back to matchIPField, widening matches; change
was_address_port_protocol_in_* to detect whether AddressPortsByAddr is projected
and return a conservative "profile not available" result when it isn't.
Specifically, after calling profilehelper.GetProjectedContainerProfile (cp,
proj, err := ...), if err != nil return cache.NewProfileNotAvailableErr as
before, but if the projection/structure indicating AddressPortsByAddr is missing
(e.g., proj indicates projection missing or
cp.EgressAddresses.AddressPortsByAddr is nil/not populated) then return
cache.NewProfileNotAvailableErr(...) (or another conservative miss used
elsewhere) instead of calling matchIPField; only call matchIPField when the
address-only projection is valid and AddressPortsByAddr is intentionally absent.
Ensure you reference the symbols GetProjectedContainerProfile,
cp.EgressAddresses, AddressPortsByAddr, was_address_port_protocol_in_* and
matchIPField when implementing the check.

In `@tests/resources/network-wildcards/README.md`:
- Around line 14-16: Update the README text so the rejected example matches the
actual fixture content: replace the inline snippet `dnsNames: ["**"]` with the
fixture's value `dnsNames: ["**.example.com."]` (or otherwise mention
`**.example.com.`) so the README and the fixture are consistent; verify the
sentence that follows still reads correctly with the updated token example.

---

Outside diff comments:
In `@pkg/rulemanager/cel/libraries/applicationprofile/ap.go`:
- Around line 51-305: Declarations() removed the ap.was_path_opened_with_flags
overload which breaks compatibility; re-add a shim overload named
"ap.was_path_opened_with_flags" in the returned map following the same pattern
as the other helpers: register a cel.Overload (mirror argument types used
previously), call l.metrics.IncHelperCall when l.detailedMetrics && l.metrics !=
nil, wrap the real implementation via wrapperFunc that calls
l.wasPathOpenedWithFlags (the compatibility shim) and pass it through
l.functionCache.WithCache with the same
cache.HashForContainerProfile(l.objectCache) keying, then return
cache.ConvertProfileNotAvailableErrToBool(result, false) so the "profile not
available" error is converted to false after caching.

In `@pkg/rulemanager/cel/libraries/networkneighborhood/integration_test.go`:
- Around line 213-250: Add at least one negative test case that exercises
nn.was_address_port_protocol_in_egress or
nn.was_address_port_protocol_in_ingress with an address that is not present in
the profile and assert expectedResult: false; specifically, add a test entry
(alongside the existing table of test cases) that uses containerID and a clearly
absent IP (e.g., "203.0.113.5") with some port/protocol and sets expectedResult
to false so the suite contains a failing-path for the post-v1 degradation
behavior of
was_address_port_protocol_in_egress/was_address_port_protocol_in_ingress.

In `@tests/chart/templates/node-agent/default-rules.yaml`:
- Around line 52-75: The new rule R0040 uses ap.was_executed(...) and
ap.was_executed_with_args(...) but does not declare the exec surface, so add
profileDataRequired.execs to this rule's metadata; update the rule block for
"R0040" to include profileDataRequired: { execs: true } (or the equivalent
schema used elsewhere) so the ap helper receives exec data when rule-aware
projection runs and the expressions ap.was_executed and
ap.was_executed_with_args can operate correctly.

---

Duplicate comments:
In `@pkg/rulemanager/cel/libraries/cache/function_cache.go`:
- Around line 115-117: The loop that builds the cache key calls functions from
the extraKeyFn slice without nil-checks, which can panic; update the iteration
over extraKeyFn (the loop using "for _, fn := range extraKeyFn" that appends to
key using fn(values)) to guard against nil callbacks by checking "if fn == nil"
and skipping (or handling) nil entries before invoking fn(values), leaving key
and values behavior unchanged otherwise.

In `@pkg/rulemanager/cel/libraries/parse/parse.go`:
- Around line 60-82: The current getExecPathWithExePath trusts an
attacker-controlled absolute argv[0] over the kernel-provided exepath (exepath
param), which allows spoofing; change the logic in getExecPathWithExePath so
that when exepath (exepathStr) is non-empty it is returned first
(kernel-authoritative), and only accept argv[0] as the exec path if either
exepathStr is empty or argv[0] is explicitly validated to match exepath (e.g.,
compare path.Base(argv0) == path.Base(exepathStr) or resolve symlinks/real paths
before trusting argv0); update callers (getExecPath and getExecPathWithExePath)
to follow this ordering/validation and ensure error handling still uses
types.MaybeNoSuchOverloadErr(exepath) when exepath is not a string.

In `@pkg/rulemanager/profilehelper/profilehelper.go`:
- Around line 12-16: GetProjectedContainerProfile currently dereferences
objectCache without checking for nil; add an initial nil guard that returns
(nil, "", error) when objectCache is nil before calling
objectCache.ContainerProfileCache(), so the function safely handles a nil input
and avoids a panic. Identify the function GetProjectedContainerProfile and
insert the check at its start, returning an appropriate error message (e.g.,
"nil objectCache") if objectCache == nil, then proceed to call
ContainerProfileCache() as before.

In `@README.md`:
- Around line 347-352: Update the CEL helper table entry for wasExecutedWithArgs
to reflect current behavior: change the v1 Behaviour to state that
wasExecutedWithArgs(containerID, path, args) matches both path and args (it
validates and compares projected exec args against the recorded argument list)
instead of implying it only matches path; update the Note to remove the “will be
added” remark and reference ExecArgsByPath only if still relevant (or delete the
future-work sentence), and ensure the table text mentions that per-argument
matching is implemented via projected exec args comparison.

In `@tests/resources/network-wildcards/README.md`:
- Line 74: The README contains a typographical error: the acronym "SBoBs" should
be "SBOMs"; update the text fragment "Producers writing v0.0.2-conformant SBoBs
SHOULD use `ipAddresses` (plural)." to read "Producers writing v0.0.2-conformant
SBOMs SHOULD use `ipAddresses` (plural)." so the terminology is consistent
(locate the exact string "SBoBs" in the README and replace it with "SBOMs").

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 9c8850bd-d10b-45f8-bde1-807ee83675a3

📥 Commits

Reviewing files that changed from the base of the PR and between a3fdc33 and 2e2077b.

⛔ Files ignored due to path filters (1)

• go.sum is excluded by !**/*.sum

📒 Files selected for processing (89)

• .github/workflows/component-tests.yaml
• .gitignore
• README.md
• cmd/main.go
• go.mod
• pkg/config/config.go
• pkg/containerprofilemanager/v1/event_reporting.go
• pkg/containerprofilemanager/v1/event_reporting_test.go
• pkg/exporters/alert_manager.go
• pkg/metricsmanager/metrics_manager_interface.go
• pkg/metricsmanager/metrics_manager_mock.go
• pkg/metricsmanager/metrics_manager_noop.go
• pkg/metricsmanager/prometheus/prometheus.go
• pkg/objectcache/containerprofilecache/containerprofilecache.go
• pkg/objectcache/containerprofilecache/containerprofilecache_test.go
• pkg/objectcache/containerprofilecache/init_eviction_test.go
• pkg/objectcache/containerprofilecache/lock_stress_test.go
• pkg/objectcache/containerprofilecache/projection.go
• pkg/objectcache/containerprofilecache/projection_apply.go
• pkg/objectcache/containerprofilecache/projection_apply_test.go
• pkg/objectcache/containerprofilecache/projection_compile.go
• pkg/objectcache/containerprofilecache/projection_compile_test.go
• pkg/objectcache/containerprofilecache/projection_trie.go
• pkg/objectcache/containerprofilecache/projection_trie_test.go
• pkg/objectcache/containerprofilecache/reconciler.go
• pkg/objectcache/containerprofilecache/reconciler_test.go
• pkg/objectcache/containerprofilecache/shared_pointer_race_test.go
• pkg/objectcache/containerprofilecache/t8_overlay_refresh_test.go
• pkg/objectcache/containerprofilecache/tamper_alert_test.go
• pkg/objectcache/containerprofilecache/test32_projection_test.go
• pkg/objectcache/containerprofilecache_interface.go
• pkg/objectcache/projection_types.go
• pkg/objectcache/v1/mock.go
• pkg/rulebindingmanager/cache/cache.go
• pkg/rulebindingmanager/cache/cache_test.go
• pkg/rulemanager/cel/cel.go
• pkg/rulemanager/cel/libraries/applicationprofile/ap.go
• pkg/rulemanager/cel/libraries/applicationprofile/capability.go
• pkg/rulemanager/cel/libraries/applicationprofile/exec.go
• pkg/rulemanager/cel/libraries/applicationprofile/exec_test.go
• pkg/rulemanager/cel/libraries/applicationprofile/http.go
• pkg/rulemanager/cel/libraries/applicationprofile/integration_test.go
• pkg/rulemanager/cel/libraries/applicationprofile/open.go
• pkg/rulemanager/cel/libraries/applicationprofile/open_test.go
• pkg/rulemanager/cel/libraries/applicationprofile/syscall.go
• pkg/rulemanager/cel/libraries/cache/function_cache.go
• pkg/rulemanager/cel/libraries/networkneighborhood/fixtures_test.go
• pkg/rulemanager/cel/libraries/networkneighborhood/integration_test.go
• pkg/rulemanager/cel/libraries/networkneighborhood/network.go
• pkg/rulemanager/cel/libraries/networkneighborhood/network_test.go
• pkg/rulemanager/cel/libraries/networkneighborhood/nn.go
• pkg/rulemanager/cel/libraries/networkneighborhood/wildcard_test.go
• pkg/rulemanager/cel/libraries/parse/parse.go
• pkg/rulemanager/cel/libraries/parse/parselib.go
• pkg/rulemanager/cel/libraries/parse/parsing_test.go
• pkg/rulemanager/profilehelper/profilehelper.go
• pkg/rulemanager/rule_manager.go
• pkg/rulemanager/rulepolicy.go
• pkg/rulemanager/types/v1/profiledata.go
• pkg/rulemanager/types/v1/profiledata_test.go
• pkg/rulemanager/types/v1/types.go
• tests/chart/crds/rules.crd.yaml
• tests/chart/templates/node-agent/configmap.yaml
• tests/chart/templates/node-agent/default-rule-binding.yaml
• tests/chart/templates/node-agent/default-rules.yaml
• tests/chart/values.yaml
• tests/component_test.go
• tests/resources/malicious-job.yaml
• tests/resources/network-wildcards/01-literal-ipv4.yaml
• tests/resources/network-wildcards/02-literal-ipv6.yaml
• tests/resources/network-wildcards/03-cidr-ipv4.yaml
• tests/resources/network-wildcards/04-cidr-ipv6.yaml
• tests/resources/network-wildcards/05-any-ip-sentinel.yaml
• tests/resources/network-wildcards/06-any-as-cidr.yaml
• tests/resources/network-wildcards/07-mixed-ip-list.yaml
• tests/resources/network-wildcards/08-deprecated-ipaddress.yaml
• tests/resources/network-wildcards/09-dns-literal.yaml
• tests/resources/network-wildcards/10-dns-leading-wildcard.yaml
• tests/resources/network-wildcards/11-dns-mid-ellipsis.yaml
• tests/resources/network-wildcards/12-dns-trailing-star.yaml
• tests/resources/network-wildcards/13-dns-trailing-dot-normalisation.yaml
• tests/resources/network-wildcards/14-recursive-star-rejected.yaml
• tests/resources/network-wildcards/15-egress-and-ingress.yaml
• tests/resources/network-wildcards/16-egress-none.yaml
• tests/resources/network-wildcards/17-realistic-stripe-api.yaml
• tests/resources/network-wildcards/18-cluster-dns-via-mid-ellipsis.yaml
• tests/resources/network-wildcards/19-port-protocol-with-cidr.yaml
• tests/resources/network-wildcards/20-multi-container-mixed-wildcards.yaml
• tests/resources/network-wildcards/README.md

[coderabbitai]

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🌐 Web query:

For Go Kubernetes modules, is it supported to mix k8s.io/api/apimachinery/client-go v0.35.x with k8s.io/kubectl v0.34.1? What is the official compatibility guidance?

💡 Result:

Mixing k8s.io/client-go v0.35.x with k8s.io/kubectl v0.34.1 in a single Go module is not recommended and can lead to dependency resolution conflicts [1][2]. Official Kubernetes guidance requires that all k8s.io/* modules (such as client-go, apimachinery, api, and kubectl) within a single project be kept at the same minor version [1][3]. Kubernetes libraries are designed to be used as a cohesive set, and mixing versions often results in build errors, runtime panics, or "module provides package" errors due to the way these packages share internal dependencies and type definitions [4][2][3]. Key points regarding compatibility: 1. Version Consistency: You should align all k8s.io dependencies to the same minor version (e.g., all at v0.34.x or all at v0.35.x) to ensure they are compatible with each other [3]. 2. Version Skew Policy: While the Kubernetes Version Skew Policy allows for a difference of one minor version between a compiled kubectl binary and a running kube-apiserver [5][6], this policy applies to the operational deployment of components, not to the Go module dependency management of a single application [1]. 3. Dependency Management: Because k8s.io/client-go and other components are often mirrored from the main Kubernetes repository, they share common underlying code [7][8][9]. Using mismatched versions in your go.mod file forces the Go module resolver to attempt to reconcile conflicting requirements, which is frequently unsupported and prone to failure [1][2]. To resolve this, update your go.mod file so that all k8s.io/ dependencies match the same minor version [3]. If you are targeting a specific Kubernetes cluster version, it is best practice to use the corresponding v0.x.y version for all Kubernetes modules [1][7].

Citations:

• 1: client library module versioning kubernetes/kubernetes#110821
• 2: [BUG] Issue with k8s.io/apimachinery v0.34.2 and k8s.io/client-go v0.34.2 kubernetes/kubernetes#135566
• 3: [QUESTION]: Upgrade Go modules to support Kubernetes v1.34 kserve/kserve#4848
• 4: https://groups.google.com/g/golang-nuts/c/J0pNe9HnPek
• 5: https://kubernetes.io/releases/version-skew-policy/
• 6: https://oneuptime.com/blog/post/2026-02-09-cluster-upgrades-version-skew/view
• 7: https://chromium.googlesource.com/external/github.com/kubernetes/client-go.git/+/d014f46af78e19957ac7beba6113036247b44cbd/README.md
• 8: https://github.com/kubernetes/apimachinery
• 9: https://github.com/kubernetes/client-go

---

Align all k8s.io/ modules to the same minor version.*

The modules k8s.io/api, k8s.io/apimachinery, and k8s.io/client-go are at v0.35.3, but k8s.io/kubectl remains at v0.34.1. This version skew is not supported by Kubernetes and will cause build errors, runtime panics, or module resolution failures. Update k8s.io/kubectl to v0.35.3 to match the other k8s.io dependencies.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@go.mod` around lines 70 - 72, The k8s.io/* modules are version-skewed: update
the go.mod entry for k8s.io/kubectl to v0.35.3 so it matches k8s.io/api,
k8s.io/apimachinery, and k8s.io/client-go (ensure the module string
"k8s.io/kubectl" is changed to version v0.35.3 and run `go mod tidy` / `go mod
download` to validate and regenerate the go.sum).

[coderabbitai]

⚠️ Potential issue | 🟠 Major | 🏗️ Heavy lift

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "Shallow-copy site in Apply:"
rg -n -C3 "maps.Copy\\(pcp.PolicyByRuleId, cp.Spec.PolicyByRuleId\\)" pkg/objectcache/containerprofilecache/projection_apply.go

echo
echo "RulePolicy definition (look for [] or map[ fields):"
rg -n -A80 -B2 "type RulePolicy struct"

echo
echo "DeepCopy methods for RulePolicy (if generated):"
rg -n -A20 -B2 "func \\(in \\*RulePolicy\\) DeepCopyInto|func \\(in \\*RulePolicy\\) DeepCopy\\("

Repository: k8sstormcenter/node-agent

Length of output: 454

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Find where v1beta1.RulePolicy is imported from
echo "=== Import statements in projection_apply.go ==="
head -30 pkg/objectcache/containerprofilecache/projection_apply.go | grep -E "import|v1beta1"

echo
echo "=== All files in v1beta1 or similar locations ==="
find . -type f -name "*.go" | grep -i v1beta1 | head -20

echo
echo "=== Search for RulePolicy definition across codebase ==="
rg -n "type RulePolicy struct" --type go

echo
echo "=== Alternative: search for RulePolicy in API definitions ==="
rg -n "RulePolicy" --type go -A 3 | head -100

Repository: k8sstormcenter/node-agent

Length of output: 418

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "=== All RulePolicy usages in codebase ==="
rg -n "RulePolicy" --type go | head -50

echo
echo "=== Check for vendor directory or go.mod ==="
ls -la go.mod go.sum 2>/dev/null || echo "go.mod/go.sum not found"

echo
echo "=== Look for DeepCopy patterns in the codebase ==="
rg -n "DeepCopy|DeepCopyInto" --type go | grep -i "rulepolicy\|policybyruleid" | head -20

echo
echo "=== Check projection_apply.go for full context around PolicyByRuleId ==="
cat -n pkg/objectcache/containerprofilecache/projection_apply.go | head -60

Repository: k8sstormcenter/node-agent

Length of output: 6305

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "=== MergePolicies function implementation ==="
cat -n pkg/utils/rulepolicy.go

echo
echo "=== Check projection_apply_test.go for RulePolicy test cases ==="
cat -n pkg/objectcache/containerprofilecache/projection_apply_test.go | grep -A 30 "PolicyByRuleId"

echo
echo "=== Check if Apply function has documented purity contract ==="
cat -n pkg/objectcache/containerprofilecache/projection_apply.go | head -40

Repository: k8sstormcenter/node-agent

Length of output: 4814

---

Deep-copy PolicyByRuleId values to preserve Apply purity.

The Apply function is documented as a "pure function: no I/O, no mutation of inputs." However, the shallow copy via maps.Copy creates a safety violation. RulePolicy contains a slice field (AllowedProcesses []string), which is a reference type. When maps.Copy copies the struct values, the slices within those structs still point to the same underlying array as the source. Any mutation of the projected RulePolicy.AllowedProcesses slice would mutate the original ContainerProfile, violating the purity contract.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pkg/objectcache/containerprofilecache/projection_apply.go` around lines 40 -
44, The current shallow copy of cp.Spec.PolicyByRuleId into pcp.PolicyByRuleId
using maps.Copy allows RulePolicy.AllowedProcesses (a slice) to remain shared
and violates Apply's purity; instead, allocate pcp.PolicyByRuleId and for each
entry in cp.Spec.PolicyByRuleId copy the RulePolicy value into a new variable,
deep-copy its AllowedProcesses slice (make a new slice and copy elements or use
append to a nil slice) and store that new RulePolicy in pcp.PolicyByRuleId so no
internal slice references point back to cp.Spec.PolicyByRuleId.

[coderabbitai]

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Align trie comment with implementation (rune-keyed, not byte-level).

Line 5 currently documents a byte-level trie, but the implementation is rune-keyed (map[rune]*trie).

Suggested wording update

-// trie implements a simple byte-level prefix trie for O(n) prefix matching
+// trie implements a simple rune-level prefix trie for O(n) prefix matching

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	// trie implements a simple byte-level prefix trie for O(n) prefix matching
	// where n is the length of the query string. Used by FieldSpec for prefix and
	// suffix (reversed-insertion) matching.
	type trie struct {
	children map[rune]*trie
	terminal bool // true if this node marks the end of an inserted pattern
	// trie implements a simple rune-level prefix trie for O(n) prefix matching
	// where n is the length of the query string. Used by FieldSpec for prefix and
	// suffix (reversed-insertion) matching.
	type trie struct {
	children map[rune]*trie
	terminal bool // true if this node marks the end of an inserted pattern

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pkg/objectcache/containerprofilecache/projection_trie.go` around lines 5 -
10, The top-level comment for type trie incorrectly states it is a byte-level
trie; update the comment to state it is rune-keyed (using children
map[rune]*trie), explain it operates on Unicode runes rather than raw bytes, and
adjust complexity wording to reflect O(m) where m is the number of runes in the
query; keep the note that it’s used by FieldSpec for prefix and suffix
(reversed-insertion) matching and that terminal marks pattern ends.

[coderabbitai]

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Preserve the “absent means no argv constraint” contract.

When e.Args == nil, this mock writes ExecsByPath[e.Path] = []string{}. The restored matcher contract is the opposite: no map entry means “match any argv”. With the current code, unconstrained execs become “must have zero args” in tests.

Suggested fix

 		pcp.ExecsByPath = make(map[string][]string, len(cp.Spec.Execs))
 		for _, e := range cp.Spec.Execs {
-			if e.Args == nil {
-				pcp.ExecsByPath[e.Path] = []string{}
-				continue
-			}
-			pcp.ExecsByPath[e.Path] = e.Args
+			if e.Args != nil {
+				pcp.ExecsByPath[e.Path] = e.Args
+			}
 		}
+		if len(pcp.ExecsByPath) == 0 {
+			pcp.ExecsByPath = nil
+		}

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	// ExecsByPath: carry per-path Args so the exec-args wildcard matcher
	// (was_executed_with_args / CompareExecArgs) keeps working.
	pcp.ExecsByPath = make(map[string][]string, len(cp.Spec.Execs))
	for _, e := range cp.Spec.Execs {
	if e.Args == nil {
	pcp.ExecsByPath[e.Path] = []string{}
	continue
	}
	pcp.ExecsByPath[e.Path] = e.Args
	}
	// ExecsByPath: carry per-path Args so the exec-args wildcard matcher
	// (was_executed_with_args / CompareExecArgs) keeps working.
	pcp.ExecsByPath = make(map[string][]string, len(cp.Spec.Execs))
	for _, e := range cp.Spec.Execs {
	if e.Args != nil {
	pcp.ExecsByPath[e.Path] = e.Args
	}
	}
	if len(pcp.ExecsByPath) == 0 {
	pcp.ExecsByPath = nil
	}

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pkg/objectcache/v1/mock.go` around lines 167 - 176, The mock currently adds
an explicit empty slice for unconstrained execs, breaking the "absent means no
argv constraint" contract; update the loop that builds pcp.ExecsByPath so it
only inserts an entry when e.Args is non-nil (i.e., remove the branch that sets
pcp.ExecsByPath[e.Path] = []string{} and instead skip adding any map key when
e.Args == nil), keeping the existing allocation of pcp.ExecsByPath and otherwise
assigning pcp.ExecsByPath[e.Path] = e.Args for constrained execs.

[coderabbitai]

🛠️ Refactor suggestion | 🟠 Major | 🏗️ Heavy lift

Mirror selective endpoint projection instead of forcing Endpoints.All=true.

Once spec.Endpoints.InUse is set, the mock currently retains every endpoint and marks the field as All. Production projection only does that for all; selective exact/prefix/suffix rules rely on All=false plus hit maps. With the current mock, tests can bypass undeclared-literal behavior and miss regressions in the HTTP helpers.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pkg/objectcache/v1/mock.go` around lines 187 - 193, The mock currently forces
pcp.Endpoints.All = true whenever spec.Endpoints.InUse or !specInstalled, which
misrepresents selective projections; change the logic in the block that
references specInstalled, spec.Endpoints.InUse, cp.Spec.Endpoints so that you do
NOT set pcp.Endpoints.All = true unconditionally—instead set pcp.Endpoints.All =
false and populate pcp.Endpoints.Values from cp.Spec.Endpoints
(pcp.Endpoints.Values[e.Endpoint] = struct{}{}) to mirror selective
exact/prefix/suffix behavior, and only set All = true in the mock when the
source projection explicitly indicates an "all" projection (leave All untouched
otherwise).

[coderabbitai]

🧹 Nitpick | 🔵 Trivial | ⚡ Quick win

Restore flag-aware assertion coverage in this “all functions” integration suite.

This swap reduces integration coverage of ap.was_path_opened_with_flags(...). Keep the path-only check if needed, but add a separate flag-aware case so both behaviors remain covered.

Proposed patch

 		{
 			name:           "Check file access pattern",
 			expression:     `ap.was_path_opened(containerID, "/etc/passwd")`,
 			expectedResult: true,
 		},
+		{
+			name:           "Check file access pattern with flags",
+			expression:     `ap.was_path_opened_with_flags(containerID, "/etc/passwd", ["O_RDONLY"])`,
+			expectedResult: true,
+		},

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pkg/rulemanager/cel/libraries/applicationprofile/integration_test.go` around
lines 88 - 90, The test removed coverage for flag-aware checking; restore it by
adding a new integration test case alongside the existing path-only case that
calls ap.was_path_opened_with_flags(containerID, "/etc/passwd", O_RDONLY /* or
appropriate flag constant */) and asserts expectedResult true (or false as
appropriate), leaving the existing ap.was_path_opened(containerID,
"/etc/passwd") test intact; locate the test table in integration_test.go and add
an entry using the unique symbol ap.was_path_opened_with_flags to ensure both
behaviors are covered.

[coderabbitai]

⚠️ Potential issue | 🟠 Major | 🏗️ Heavy lift

was_address_port_protocol_in_* now ignores port and protocol.

After the type/range checks, both helpers only call matchIPField(...). A profile entry for TCP/443 therefore also matches UDP/53 as long as the address/CIDR matches, which weakens any rule that relies on the helper name’s 4-tuple semantics. If AddressPortsByAddr is not projected yet, return a conservative miss instead of silently widening the match.

Also applies to: 200-210

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pkg/rulemanager/cel/libraries/networkneighborhood/network.go` around lines
164 - 181, The helper currently ignores port/protocol projection and always
falls back to matchIPField, widening matches; change
was_address_port_protocol_in_* to detect whether AddressPortsByAddr is projected
and return a conservative "profile not available" result when it isn't.
Specifically, after calling profilehelper.GetProjectedContainerProfile (cp,
proj, err := ...), if err != nil return cache.NewProfileNotAvailableErr as
before, but if the projection/structure indicating AddressPortsByAddr is missing
(e.g., proj indicates projection missing or
cp.EgressAddresses.AddressPortsByAddr is nil/not populated) then return
cache.NewProfileNotAvailableErr(...) (or another conservative miss used
elsewhere) instead of calling matchIPField; only call matchIPField when the
address-only projection is valid and AddressPortsByAddr is intentionally absent.
Ensure you reference the symbols GetProjectedContainerProfile,
cp.EgressAddresses, AddressPortsByAddr, was_address_port_protocol_in_* and
matchIPField when implementing the check.

[coderabbitai]

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Correct fixture reference to match the actual invalid example.

Line 14 says dnsNames: ["**"], but the corresponding fixture uses "**.example.com.". Please align the README text with the actual fixture content.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@tests/resources/network-wildcards/README.md` around lines 14 - 16, Update the
README text so the rejected example matches the actual fixture content: replace
the inline snippet `dnsNames: ["**"]` with the fixture's value `dnsNames:
["**.example.com."]` (or otherwise mention `**.example.com.`) so the README and
the fixture are consistent; verify the sentence that follows still reads
correctly with the updated token example.

[github-actions]

Performance Benchmark Results

Node-Agent Resource Usage

Metric	BEFORE	AFTER	Delta
Avg CPU (cores)	0.214	0.205	-4.1%
Peak CPU (cores)	0.224	0.218	-2.6%
Avg Memory (MiB)	311.976	275.399	-11.7%
Peak Memory (MiB)	315.805	276.648	-12.4%

Dedup Effectiveness (AFTER only)

Event Type	Passed	Deduped	Ratio
capabilities	0	0	N/A
hardlink	6000	0	0.0%
http	1709	119454	98.6%
network	897	68306	98.7%
open	30505	621254	95.3%
symlink	6000	0	0.0%
syscall	995	1897	65.6%

Event Counters

Metric	BEFORE	AFTER
capability_counter	7	6
dns_counter	45	200
exec_counter	7116	7288
network_counter	80238	83673
open_counter	775019	793769
syscall_counter	3382	3630

[github-actions]

Performance Benchmark Results

Node-Agent Resource Usage

Metric	BEFORE	AFTER	Delta
Avg CPU (cores)	0.237	0.233	-1.8%
Peak CPU (cores)	0.244	0.241	-1.1%
Avg Memory (MiB)	287.875	264.999	-7.9%
Peak Memory (MiB)	290.461	266.746	-8.2%

Dedup Effectiveness (AFTER only)

Event Type	Passed	Deduped	Ratio
capabilities	0	0	N/A
hardlink	6000	0	0.0%
http	1705	119455	98.6%
network	902	77997	98.9%
open	30758	620996	95.3%
symlink	6000	0	0.0%
syscall	996	1907	65.7%

Event Counters

Metric	BEFORE	AFTER
capability_counter	9	10
dns_counter	1441	1415
exec_counter	7248	7085
network_counter	95247	93177
open_counter	787457	770189
syscall_counter	3518	3645

[github-actions]

Performance Benchmark Results

Node-Agent Resource Usage

Metric	BEFORE	AFTER	Delta
Avg CPU (cores)	0.175	0.180	+3.0%
Peak CPU (cores)	0.184	0.188	+2.3%
Avg Memory (MiB)	320.124	267.237	-16.5%
Peak Memory (MiB)	321.863	269.051	-16.4%

Dedup Effectiveness (AFTER only)

Event Type	Passed	Deduped	Ratio
capabilities	1	0	0.0%
hardlink	6000	0	0.0%
http	1767	119391	98.5%
network	902	77997	98.9%
open	32597	622736	95.0%
symlink	6000	0	0.0%
syscall	984	1893	65.8%

Event Counters

Metric	BEFORE	AFTER
capability_counter	9	10
dns_counter	1443	1440
exec_counter	7261	7204
network_counter	95400	94753
open_counter	793392	787970
syscall_counter	3640	3603

[github-actions]

Performance Benchmark Results

Node-Agent Resource Usage

Metric	BEFORE	AFTER	Delta
Avg CPU (cores)	0.222	0.216	-2.7%
Peak CPU (cores)	0.238	0.236	-0.8%
Avg Memory (MiB)	268.092	265.967	-0.8%
Peak Memory (MiB)	269.539	268.070	-0.5%

Dedup Effectiveness (AFTER only)

Event Type	Passed	Deduped	Ratio
capabilities	2	0	0.0%
hardlink	6000	0	0.0%
http	1704	119459	98.6%
network	903	78000	98.9%
open	31579	620182	95.2%
symlink	6000	0	0.0%
syscall	988	1884	65.6%

Event Counters

Metric	BEFORE	AFTER
capability_counter	9	10
dns_counter	1454	1452
exec_counter	7277	7266
network_counter	95726	95558
open_counter	790881	790988
syscall_counter	3653	3608