Allow container exclusions based on regex

README.md

@@ -299,16 +299,18 @@ popeye:
   # Excludes excludes certain resources from Popeye scans
   excludes:
     v1/pods:
-    # In the monitoring namespace excludes all probes check on pod's containers.
-    - name: rx:monitoring
-      codes:
-      - 102
-    # Excludes all istio-proxy container scans for pods in the icx namespace.
-    - name: rx:icx/.*
-      containers:
-        # Excludes istio init/sidecar container from scan!
-        - istio-proxy
-        - istio-init
+      # In the monitoring namespace excludes all probes check on pod's containers.
+      - name: rx:monitoring
+        codes:
+        - 102
+      # Excludes all istio-proxy container scans for pods in the icx namespace.
+      - name: rx:icx/.*
+        containers:
+          # Excludes istio init/sidecar container from scan!
+          - istio-proxy
+          - istio-init
+          # Excludes the same containers, but with a regex
+          - rx:^istio
     # ConfigMap sanitizer exclusions...
     v1/configmaps:
       # Excludes key must match the singular form of the resource.

pkg/config/excludes.go

@@ -57,6 +57,9 @@ func (e Excludes) ExcludeContainer(gvr, fqn, container string) bool {
 
 func in(ss []string, victim string) bool {
 	for _, s := range ss {
+		if isRegex(s) {
+			return rxMatch(s, victim)
+		}
 		if s == victim {
 			return true
 		}

pkg/config/excludes_test.go

@@ -163,6 +163,19 @@ func TestExcludes(t *testing.T) {
 			res:     "bleeblah",
 			code:    101,
 		},
+		"no_exclude_if_containers": {
+			excludes: config.Excludes{
+				"fred": {
+					config.Exclusion{Name: "rx:bird", Codes: []config.ID{100, 200, 300}, Containers: []string{"mike"}},
+					config.Exclusion{Name: "bb", Codes: []config.ID{100, 200, 300}},
+					config.Exclusion{Name: "cc", Codes: []config.ID{100, 200, 300}},
+				},
+			},
+			section: "fred",
+			res:     "birds",
+			code:    101,
+			e:       false,
+		},
 	}
 
 	for k := range uu {
@@ -172,3 +185,68 @@ func TestExcludes(t *testing.T) {
 		})
 	}
 }
+
+func TestExcludeContainer(t *testing.T) {
+	tests := []struct {
+		name      string
+		gvr       string
+		fqn       string
+		container string
+		excludes  config.Excludes
+		want      bool
+	}{
+		{
+			name:      "no excludes, no match",
+			gvr:       "v1/pods",
+			fqn:       "pod-1",
+			container: "container-1",
+			excludes:  nil,
+			want:      false,
+		},
+		{
+			name:      "match",
+			gvr:       "v1/pods",
+			fqn:       "aa",
+			container: "container-1",
+			excludes: config.Excludes{
+				"v1/pods": {
+					config.Exclusion{Name: "aa", Codes: []config.ID{100, 200, 300}, Containers: []string{"container-1"}},
+				},
+			},
+			want: true,
+		},
+		{
+			name:      "match regex",
+			gvr:       "v1/pods",
+			fqn:       "aa",
+			container: "container-1",
+			excludes: config.Excludes{
+				"v1/pods": {
+					config.Exclusion{Name: "aa", Codes: []config.ID{100, 200, 300}, Containers: []string{"rx:cont"}},
+				},
+			},
+			want: true,
+		},
+		{
+			name:      "no match regex",
+			gvr:       "v1/pods",
+			fqn:       "aa",
+			container: "cron-tainer-1",
+			excludes: config.Excludes{
+				"v1/pods": {
+					config.Exclusion{Name: "aa", Codes: []config.ID{100, 200, 300}, Containers: []string{"rx:cont"}},
+				},
+			},
+			want: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := tt.excludes.ExcludeContainer(tt.gvr, tt.fqn, tt.container)
+			if got != tt.want {
+				t.Errorf("got %v, want %v", got, tt.want)
+			}
+		})
+	}
+}