karmor probe doesn't limit scope of a policy to a namespace

[kareem-DA]

Bug Report

karmor probe cli incorrectly links policies to workload in different namespaces.

I am applying a policy to my cluster. To check that I got the labels correct and that the policy was applied to my workload, I ran the "karmor probe" command. I saw in the report that the policy was applied. After looking a little closer, I saw that I actually applied the policy to the default namespace, not the namespace where my workload was. "karmor probe" still linked them

General Information

• Environment description GKE and Kind
• Kernel version
• Orchestration system version in use (e.g. kubectl version, ...)
  $ kubectl version
  Client Version: v1.31.1
  Kustomize Version: v5.4.2
  Server Version: v1.30.3-gke.196900
• Link to relevant artifacts (policies, deployments scripts, ...)
• Target containers/pods

To Reproduce

1. Create Namespace
2. Start workload in namespace. (kubectl exec -n validator -i -t postgres-0 -- bash)
3. Apply wrong policy

kind: KubeArmorPolicy                                                                                     |    - path: /etc/passwd
metadata:                                                                                                 |    - path: /etc/shadow
  name: block-file-access                                                                                 |  message: Warning! access sensitive files detected
    # namespace: validator   # Use the appropriate namespace                                              |  selector:
spec:                                                                                                     |    matchLabels:
  tags: ["block-file-access"]                                                                             |      app: postgres
  message: "Blocking access to /etc/secretfile for unauthorized processes"                                |  severity: 3
  selector:                                                                                               |  tags:
    matchLabels:                                                                                          |  - MITRE
      app: postgres   # Replace with your application's label                                             |  - FIGHT
  file:                                                                                                   |  - FGT1021
    matchDirectories:                                                                                     |  - 5G
      - dir: /                                                                                            |  - MITRE_T1021_Remote_Services
        fromSource:                                                                                       |---
          - path: /usr/lib/postgresql/14/bin/postgres                                                     |apiVersion: security.kubearmor.com/v1
    matchPaths:                                                                                           |kind: KubeArmorPolicy
    - path: /etc/passwd                                                                                   |metadata:
      fromSource:                                                                                         |  name: postgres-14-system-owner-discovery
        - path: /usr/bin/psql                                                                             |  namespace: validator
        - path: /usr/lib/postgresql/14/bin/psql                                                           |spec:
        - path: /usr/bin/head                                                                             |  action: Block
      action: Allow                                                                                       |  message: System owner discovery command execution denied
    - path: /etc/passwd                                                                                   |  process:
      action: Block                                                                                       |    matchPaths:
    severity: 5                                                                                           |    - execname: who
  action: Block

4. Run karmor probe.

In the included screen shot, you can see that there is only 1 policy on the system and that it is in the default namespace, yet the policy is listed under a workload in the validator namespace.

Expected behavior

In this example, the policy shouldn't be listed at all. There aren't any workloads that should apply.

Screenshots

If applicable, add screenshots to help explain your problem.

[daemon1024]

Ack, need improvements in client side tooling.
We are working on exposing all of this information from KubeArmor itself as part of kubearmor/kubearmor-client#304

[jokestax]

@kareem-DA i think this pr Link should solve this issue