Merge pull request #988 from snyk/fix/sanitize-workloadMetadata

RUN-1968 fix: sanitize workload metadata

Author: minsiyang

package-lock.json

@@ -24,6 +24,9 @@ export function buildImageMetadata(
 
   const containerNameToSpec: { [key: string]: V1Container } = {};
   for (const container of podSpec.containers) {
+    delete container.args;
+    delete container.env;
+    delete container.command;
     containerNameToSpec[container.name] = container;
   }
 

src/supervisor/metadata-extractor.ts

@@ -48,6 +48,12 @@ spec:
           successThreshold: 1
           timeoutSeconds: 5
         name: hello-world
+        args: [something]
+        env: 
+          - name: NODE_EXTRA_CA_CERTS
+            value: "important info"
+        command:
+          - "do something"
         ports:
         - containerPort: 8080
           name: http

test/fixtures/sidecar-containers/deployment.yaml

@@ -124,5 +124,10 @@ describe('metadata extractor tests', () => {
         imageName: 'eu.gcr.io/cookie/hello-world:1.20191125.132107-4664980',
       }),
     );
+    const container = imageMetadataResult[0].podSpec.containers[0];
+
+    expect(container.args).toBeUndefined();
+    expect(container.command).toBeUndefined();
+    expect(container.env).toBeUndefined();
   });
 });