rule(macro user_known_k8s_client_container): have more strict condition to avoid false positives

[rung]

Signed-off-by: Hiroki Suezawa suezawa@gmail.com

What type of PR is this?
/kind rule-update

Any specific area of the project related to this PR?
/area rules

What this PR does / why we need it:

• What this PR does

  • Modify user_known_k8s_client_container macro to have more strict condition.
  • Add image info to output of The docker client is executed in a container

• Why We need it

  • As I discussed on rule(The docker client is executed in a container): modify condition to reduce false positive #955 (comment), I would like to have more strict condition for GCP(GKE).
  • To know image info when getting false positives, I would like to add image info to output.

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

• Output Sample

{"output":"18:14:42.779407953: Warning Docker or kubernetes client executed in container (user=root k8s.ns=kube-system k8s.pod=fluentd-gcp-scaler-54ccb89d5-nqb7c container=42bcc1ab542b parent=scaler.sh cmdline=kubectl get ds -n kube-system fluentd-gcp-v3.1.1 -o jsonpath={.spec.template.spec.containers[?(@.name=='fluentd-gcp')].resources.requests.cpu} image=k8s.gcr.io/fluentd-gcp-scaler:0.5.2) k8s.ns=kube-system k8s.pod=fluentd-gcp-scaler-54ccb89d5-nqb7c container=42bcc1ab542b k8s.ns=kube-system k8s.pod=fluentd-gcp-scaler-54ccb89d5-nqb7c container=42bcc1ab542b","priority":"Warning","rule":"The docker client is executed in a container","time":"2019-12-06T18:14:42.779407953Z", "output_fields": {"container.id":"42bcc1ab542b","container.image.repository":"k8s.gcr.io/fluentd-gcp-scaler","container.image.tag":"0.5.2","evt.time":1575656082779407953,"k8s.ns.name":"kube-system","k8s.pod.name":"fluentd-gcp-scaler-54ccb89d5-nqb7c","proc.cmdline":"kubectl get ds -n kube-system fluentd-gcp-v3.1.1 -o jsonpath={.spec.template.spec.containers[?(@.name=='fluentd-gcp')].resources.requests.cpu}","proc.pname":"scaler.sh","user.name":"root"}}

Does this PR introduce a user-facing change?:

rule(macro user_known_k8s_client_container): when executing the docker client, exclude fluentd-gcp-scaler container running in the `kube-system` namespace to avoid false positives

[rung]

/assign @Kaizhe

[Kaizhe]

Please see my comments

[leodido]

Overall LGTM.

Agree with @Kaizhe about the rephrasing.

[rung]

@Kaizhe @leodido Thank you! I rephrased.

[Kaizhe]

/lgtm

[poiana]

LGTM label has been added.

Git tree hash: 0012b11a360f9257a3386ce99fd890ea41ed035e

[Kaizhe]

@rung appreciate your quick response to this PR. You help make our community a better place to work with :)

[rung]

@Kaizhe Hi! Thank you for your review.
Could you approve this PR manually? It seems this isn't approved on GitHub yet.

[poiana]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Kaizhe, leodido

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• rules/OWNERS [Kaizhe,leodido]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment