fix issue #111 #112

.dockerignore

@@ -2,5 +2,16 @@
 README.md
 /execs
 *_test.go
-k8s
-*.yml
+*.yml
+/krew
+/notes
+/junit
+/dist
+/change_logs
+/assets
+/.github
+/.idea
+/.vscode
+/aa_dead
+/k8s
+/k8s1

Dockerfile

@@ -1,25 +1,20 @@
 # -----------------------------------------------------------------------------
 # Build...
-FROM golang:1.13.5-alpine AS build
+FROM golang:1.14.4-alpine AS build
 
-ENV VERSION=v0.8.0 GO111MODULE=on PACKAGE=github.com/derailed/popeye
+WORKDIR /popeye
 
-WORKDIR /go/src/$PACKAGE
-
-COPY go.mod go.sum main.go ./
+COPY go.mod go.sum main.go Makefile ./
 COPY internal internal
+COPY cmd cmd
 COPY types types
 COPY pkg pkg
-COPY cmd cmd
-
-RUN apk update && apk upgrade ;\
-  apk --no-cache add git ca-certificates ;\
-  CGO_ENABLED=0 GOOS=linux go build -o /go/bin/popeye \
-  -trimpath -ldflags="-w -s -X $PACKAGE/cmd.version=$VERSION" *.go
+RUN apk --no-cache add make git gcc libc-dev curl ca-certificates && make build
 
 # -----------------------------------------------------------------------------
 # Image...
 FROM alpine:3.11.2
 COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
-COPY --from=build /go/bin/popeye /bin/popeye
+COPY --from=build /popeye/execs/popeye /bin/popeye
+
 ENTRYPOINT [ "/bin/popeye" ]

internal/issues/collector.go

@@ -68,6 +68,7 @@ func (c *Collector) AddCode(ctx context.Context, code config.ID, args ...interfa
 		panic(fmt.Errorf("No code with ID %d", code))
 	}
 	if !c.ShouldExclude(run.SectionGVR.String(), run.FQN, code) {
+		fmt.Println("ADD Issue", run.FQN, code)
 		c.addIssue(run.FQN, New(run.SectionGVR, Root, co.Severity, co.Format(code, args...)))
 	}
 }

internal/sanitize/dp.go

@@ -60,7 +60,7 @@ func (d *Deployment) Sanitize(ctx context.Context) error {
 		podsMetrics(d, pmx)
 		d.checkUtilization(ctx, over, dp, pmx)
 
-		if d.Config.ExcludeFQN(internal.MustExtractSectionGVR(ctx), fqn) {
+		if d.NoConcerns(fqn) && d.Config.ExcludeFQN(internal.MustExtractSectionGVR(ctx), fqn) {
 			d.ClearOutcome(fqn)
 		}
 	}

internal/sanitize/ds.go

@@ -56,7 +56,7 @@ func (d *DaemonSet) Sanitize(ctx context.Context) error {
 		podsMetrics(d, pmx)
 		d.checkUtilization(ctx, over, ds, pmx)
 
-		if d.Config.ExcludeFQN(internal.MustExtractSectionGVR(ctx), fqn) {
+		if d.NoConcerns(fqn) && d.Config.ExcludeFQN(internal.MustExtractSectionGVR(ctx), fqn) {
 			d.ClearOutcome(fqn)
 		}
 	}

internal/sanitize/hpa.go

@@ -85,7 +85,7 @@ func (h *HorizontalPodAutoscaler) Sanitize(ctx context.Context) error {
 		tcpu.Add(*list.Cpu())
 		tmem.Add(*list.Memory())
 
-		if h.Config.ExcludeFQN(internal.MustExtractSectionGVR(ctx), fqn) {
+		if h.NoConcerns(fqn) && h.Config.ExcludeFQN(internal.MustExtractSectionGVR(ctx), fqn) {
 			h.ClearOutcome(fqn)
 		}
 	}

internal/sanitize/ing.go

@@ -43,7 +43,7 @@ func (i *Ingress) Sanitize(ctx context.Context) error {
 
 		i.checkDeprecation(ctx, ing)
 
-		if i.Config.ExcludeFQN(internal.MustExtractSectionGVR(ctx), fqn) {
+		if i.NoConcerns(fqn) && i.Config.ExcludeFQN(internal.MustExtractSectionGVR(ctx), fqn) {
 			i.ClearOutcome(fqn)
 		}
 	}

internal/sanitize/node.go

@@ -61,7 +61,7 @@ func (n *Node) Sanitize(ctx context.Context) error {
 			n.checkUtilization(ctx, nmx[fqn])
 		}
 
-		if n.Config.ExcludeFQN(internal.MustExtractSectionGVR(ctx), fqn) {
+		if n.NoConcerns(fqn) && n.Config.ExcludeFQN(internal.MustExtractSectionGVR(ctx), fqn) {
 			n.ClearOutcome(fqn)
 		}
 	}

internal/sanitize/np.go

@@ -48,7 +48,7 @@ func (n *NetworkPolicy) Sanitize(ctx context.Context) error {
 		n.checkDeprecation(ctx, np)
 		n.checkRefs(ctx, np)
 
-		if n.Config.ExcludeFQN(internal.MustExtractSectionGVR(ctx), fqn) {
+		if n.NoConcerns(fqn) && n.Config.ExcludeFQN(internal.MustExtractSectionGVR(ctx), fqn) {
 			n.ClearOutcome(fqn)
 		}
 	}

internal/sanitize/pdb.go

@@ -40,7 +40,7 @@ func (p *PodDisruptionBudget) Sanitize(ctx context.Context) error {
 
 		p.checkInUse(ctx, pdb)
 
-		if p.Config.ExcludeFQN(internal.MustExtractSectionGVR(ctx), fqn) {
+		if p.NoConcerns(fqn) && p.Config.ExcludeFQN(internal.MustExtractSectionGVR(ctx), fqn) {
 			p.ClearOutcome(fqn)
 		}
 	}

internal/sanitize/pod.go

@@ -83,7 +83,7 @@ func (p *Pod) Sanitize(ctx context.Context) error {
 		containerMetrics(pmx, cmx)
 		p.checkUtilization(ctx, po, cmx)
 
-		if p.Config.ExcludeFQN(internal.MustExtractSectionGVR(ctx), fqn) {
+		if p.NoConcerns(fqn) && p.Config.ExcludeFQN(internal.MustExtractSectionGVR(ctx), fqn) {
 			p.ClearOutcome(fqn)
 		}
 	}

internal/sanitize/psp.go

@@ -38,7 +38,7 @@ func (p *PodSecurityPolicy) Sanitize(ctx context.Context) error {
 
 		p.checkDeprecation(ctx, psp)
 
-		if p.Config.ExcludeFQN(internal.MustExtractSectionGVR(ctx), fqn) {
+		if p.NoConcerns(fqn) && p.Config.ExcludeFQN(internal.MustExtractSectionGVR(ctx), fqn) {
 			p.ClearOutcome(fqn)
 		}
 	}

internal/sanitize/pv.go

@@ -37,7 +37,7 @@ func (p *PersistentVolume) Sanitize(ctx context.Context) error {
 
 		p.checkBound(ctx, pv.Status.Phase)
 
-		if p.Config.ExcludeFQN(internal.MustExtractSectionGVR(ctx), fqn) {
+		if p.NoConcerns(fqn) && p.Config.ExcludeFQN(internal.MustExtractSectionGVR(ctx), fqn) {
 			p.ClearOutcome(fqn)
 		}
 	}

internal/sanitize/pvc.go

@@ -48,7 +48,7 @@ func (p *PersistentVolumeClaim) Sanitize(ctx context.Context) error {
 		p.InitOutcome(fqn)
 		ctx = internal.WithFQN(ctx, fqn)
 		defer func(fqn string, ctx context.Context) {
-			if p.Config.ExcludeFQN(internal.MustExtractSectionGVR(ctx), fqn) {
+			if p.NoConcerns(fqn) && p.Config.ExcludeFQN(internal.MustExtractSectionGVR(ctx), fqn) {
 				p.ClearOutcome(fqn)
 			}
 		}(fqn, ctx)

internal/sanitize/rb.go

@@ -49,7 +49,7 @@ func (r *RoleBinding) Sanitize(ctx context.Context) error {
 			}
 		}
 
-		if r.Config.ExcludeFQN(internal.MustExtractSectionGVR(ctx), fqn) {
+		if r.NoConcerns(fqn) && r.Config.ExcludeFQN(internal.MustExtractSectionGVR(ctx), fqn) {
 			r.ClearOutcome(fqn)
 		}
 	}

internal/sanitize/ro.go

@@ -52,7 +52,7 @@ func (r *Role) checkInUse(ctx context.Context, refs *sync.Map) {
 			r.AddCode(ctx, 400)
 		}
 
-		if r.Config.ExcludeFQN(internal.MustExtractSectionGVR(ctx), fqn) {
+		if r.NoConcerns(fqn) && r.Config.ExcludeFQN(internal.MustExtractSectionGVR(ctx), fqn) {
 			r.ClearOutcome(fqn)
 		}
 	}

internal/sanitize/rs.go

@@ -44,7 +44,7 @@ func (r *ReplicaSet) Sanitize(ctx context.Context) error {
 		r.checkHealth(ctx, rs)
 		r.checkDeprecation(ctx, rs)
 
-		if r.Config.ExcludeFQN(internal.MustExtractSectionGVR(ctx), fqn) {
+		if r.NoConcerns(fqn) && r.Config.ExcludeFQN(internal.MustExtractSectionGVR(ctx), fqn) {
 			r.ClearOutcome(fqn)
 		}
 	}

internal/sanitize/sa.go

@@ -89,7 +89,7 @@ func (s *ServiceAccount) Sanitize(ctx context.Context) error {
 			s.AddCode(ctx, 400)
 		}
 
-		if s.Config.ExcludeFQN(internal.MustExtractSectionGVR(ctx), fqn) {
+		if s.NoConcerns(fqn) && s.Config.ExcludeFQN(internal.MustExtractSectionGVR(ctx), fqn) {
 			s.ClearOutcome(fqn)
 		}
 	}

internal/sanitize/sts.go

@@ -62,7 +62,7 @@ func (s *StatefulSet) Sanitize(ctx context.Context) error {
 		s.checkContainers(ctx, st)
 		s.checkUtilization(ctx, over, st, pmx)
 
-		if s.Config.ExcludeFQN(internal.MustExtractSectionGVR(ctx), fqn) {
+		if s.NoConcerns(fqn) && s.Config.ExcludeFQN(internal.MustExtractSectionGVR(ctx), fqn) {
 			s.ClearOutcome(fqn)
 		}
 	}

internal/sanitize/svc.go

@@ -54,7 +54,7 @@ func (s *Service) Sanitize(ctx context.Context) error {
 		s.checkEndpoints(ctx, svc.Spec.Selector, svc.Spec.Type)
 		s.checkType(ctx, svc.Spec.Type)
 
-		if s.Config.ExcludeFQN(internal.MustExtractSectionGVR(ctx), fqn) {
+		if s.NoConcerns(fqn) && s.Config.ExcludeFQN(internal.MustExtractSectionGVR(ctx), fqn) {
 			s.ClearOutcome(fqn)
 		}
 	}

pkg/config/excludes.go

@@ -1,6 +1,7 @@
 package config
 
 import (
+	"fmt"
 	"regexp"
 	"strings"
 
@@ -64,8 +65,10 @@ func (e Excludes) ShouldExclude(section, fqn string, code ID) bool {
 
 // Match checks if a given named should be excluded.
 func (e Exclusions) Match(resource string, code ID) bool {
+	fmt.Printf("Match %q -- %v\n", resource, code)
 	for _, exclude := range e {
 		if exclude.Match(resource) && hasCode(exclude.Codes, code) {
+			fmt.Println("  MATCHED!!")
 			return true
 		}
 	}