fixing #171

Azure · Dec 6, 2023 · 8e540da · 8e540da
1 parent b12d47d
commit 8e540da
Show file tree

Hide file tree

Showing 2 changed files with 22 additions and 1 deletion.
diff --git a/internal/scanners/aks/rules.go b/internal/scanners/aks/rules.go
@@ -265,7 +265,7 @@ func (a *AKSScanner) GetRules() map[string]scanners.AzureRule {
 				c := target.(*armcontainerservice.ManagedCluster)
 				defaultMaxSurge := false
 				for _, profile := range c.Properties.AgentPoolProfiles {
-					if profile.UpgradeSettings.MaxSurge == nil || (profile.UpgradeSettings.MaxSurge == ref.Of("1")) {
+					if profile.UpgradeSettings == nil || profile.UpgradeSettings.MaxSurge == nil || (profile.UpgradeSettings.MaxSurge == ref.Of("1")) {
 						defaultMaxSurge = true
 						break
 					}

diff --git a/internal/scanners/aks/rules_test.go b/internal/scanners/aks/rules_test.go
@@ -547,6 +547,27 @@ func TestAKSScanner_Rules(t *testing.T) {
 				result: "",
 			},
 		},
+		{
+			name: "AKSScanner Max Surge with nil UpgradeSettings",
+			fields: fields{
+				rule: "aks-016",
+				target: &armcontainerservice.ManagedCluster{
+					SKU: &armcontainerservice.ManagedClusterSKU{
+						Tier: getSKUTierPaid(),
+					},
+					Properties: &armcontainerservice.ManagedClusterProperties{
+						AgentPoolProfiles: []*armcontainerservice.ManagedClusterAgentPoolProfile{
+							{},
+						},
+					},
+				},
+				scanContext: &scanners.ScanContext{},
+			},
+			want: want{
+				broken: true,
+				result: "",
+			},
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {