fix: strip StatefulSet pod-identity labels from network peer selectors

[ANAMASGARD]

StatefulSet pods carry apps.kubernetes.io/pod-index and statefulset.kubernetes.io/pod-name labels that are per-replica, not workload-level. Carrying them into NetworkNeighbor podSelectors caused GeneratedNetworkPolicy to pin peers to replicas seen during learning, denying traffic when the StatefulSet scales up.

Fixes #942

Overview

Current behavior: When the peer is a StatefulSet, learned NetworkNeighbor.PodSelector includes per-replica identity labels (apps.kubernetes.io/pod-index, statefulset.kubernetes.io/pod-name). That produces one NetworkPolicy peer rule per replica and breaks after scale-up.

Future behavior: Those StatefulSet pod-identity labels are stripped in filterLabels() / DefaultLabelsToIgnore, so peer selectors keep only workload labels (e.g. app.kubernetes.io/name).

This PR fixes learning at the source (new ContainerProfile neighbors). A companion change in kubescape/storage sanitizes legacy profiles that already carry pod-index at GNP generation time.

How to Test

go test ./pkg/containerprofilemanager/v1/ \
  -run 'TestFilterLabels|TestDefaultLabelsToIgnore|TestCreateNetworkNeighbor_StatefulSetPeerStripsPodIdentityLabels' \
  -count=1

Expected: all cases pass, including table-driven replicas 0/1/2 with only app.kubernetes.io/name=db remaining in PodSelector.MatchLabels.

Related issues/PRs

• Fixes StatefulSet peers are selected per pod, so scaling denies the new replicas #942
• Companion: kubescape/storage PR — ignore apps.kubernetes.io/pod-index when generating network policies (link after opening)

Checklist before requesting a review

• My code follows the style guidelines of this project
• I have commented on my code, particularly in hard-to-understand areas
• I have performed a self-review of my code
• If it is a core feature, I have added thorough tests.
• New and existing unit tests pass locally with my changes (targeted StatefulSet peers are selected per pod, so scaling denies the new replicas #942 regressions verified; full go test ./... not re-run in this environment)

Summary by CodeRabbit

• Bug Fixes

  • StatefulSet pod identity labels are now excluded from generated network selectors.
  • Network selectors retain stable workload labels while ignoring replica-specific labels, improving behavior for StatefulSet pods.

• Tests

  • Added coverage validating label filtering and selector generation across multiple StatefulSet replicas.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Team

Run ID: 651fbcec-c5b8-4e6b-9e8b-ab1b16971562

📥 Commits

Reviewing files that changed from the base of the PR and between 4956ea2 and 6f37179.

📒 Files selected for processing (3)

• pkg/containerprofilemanager/v1/containerprofile_manager_test.go
• pkg/containerprofilemanager/v1/event_reporting_test.go
• pkg/containerprofilemanager/v1/network_helpers.go

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The label filter now ignores StatefulSet pod identity labels. Tests verify that generated peer selectors retain workload labels and exclude pod-index and pod-name labels across multiple replicas.

Changes

StatefulSet label filtering

Layer / File(s)	Summary
Extend ignored label set pkg/containerprofilemanager/v1/network_helpers.go, pkg/containerprofilemanager/v1/containerprofile_manager_test.go	DefaultLabelsToIgnore now includes apps.kubernetes.io/pod-index and statefulset.kubernetes.io/pod-name. Tests verify that these labels are removed while app.kubernetes.io/name remains.
Validate generated peer selectors pkg/containerprofilemanager/v1/event_reporting_test.go	Table-driven tests verify that StatefulSet peer selectors retain the application label and exclude pod identity labels for three replicas.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: 🟡 Moderate · up to 6f371

The change correctly broadens StatefulSet peer selection across replicas, but a peer with no remaining labels could generate a policy that matches all pods in a namespace. Confirm or guard the downstream conversion before merging.

Suggested reviewers: matthyx

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 25.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 4 functions across 3 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the primary change: removing StatefulSet pod-identity labels from network peer selectors.
Linked Issues check	✅ Passed	The changes implement issue #942 by filtering apps.kubernetes.io/pod-index and statefulset.kubernetes.io/pod-name while retaining workload labels. Tests verify both label filtering and generated selec…
Out of Scope Changes check	✅ Passed	All changes support issue #942. The implementation updates the ignore list and adds focused tests without unrelated code changes.

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}