[entlein]

Linking to kubescape/node-agent#862

Simple substitution should do the trick.

Summary by CodeRabbit

• Bug Fixes
  • Updated security rule expressions to use the correct application-profile helper namespace.
  • Improved detection consistency across process, file, syscall, capability, DNS, token, network, link, and egress-baseline checks.

[coderabbitai]

Warning

Review limit reached

@entlein, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 15 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 65ca8c1f-f49d-45be-ba29-738437f8be0d

📥 Commits

Reviewing files that changed from the base of the PR and between 5b096a7 and f5e73ad.

📒 Files selected for processing (37)

• pkg/rules/r0001-unexpected-process-launched/README.md
• pkg/rules/r0001-unexpected-process-launched/unexpected-process-launched.yaml
• pkg/rules/r0002-unexpected-file-access/README.md
• pkg/rules/r0002-unexpected-file-access/unexpected-file-access.yaml
• pkg/rules/r0003-unexpected-system-call/README.md
• pkg/rules/r0003-unexpected-system-call/unexpected-system-call.yaml
• pkg/rules/r0004-unexpected-capability-used/README.md
• pkg/rules/r0004-unexpected-capability-used/unexpected-capability-used.yaml
• pkg/rules/r0005-unexpected-domain-request/README.md
• pkg/rules/r0005-unexpected-domain-request/unexpected-domain-request.yaml
• pkg/rules/r0006-unexpected-service-account-token-access/README.md
• pkg/rules/r0006-unexpected-service-account-token-access/unexpected-service-account-token-access.yaml
• pkg/rules/r0007-kubernetes-client-executed/README.md
• pkg/rules/r0007-kubernetes-client-executed/kubernetes-client-executed.yaml
• pkg/rules/r0008-read-environment-variables-procfs/README.md
• pkg/rules/r0008-read-environment-variables-procfs/read-environment-variables-procfs.yaml
• pkg/rules/r0009-ebpf-program-load/README.md
• pkg/rules/r0009-ebpf-program-load/ebpf-program-load.yaml
• pkg/rules/r0010-unexpected-sensitive-file-access/README.md
• pkg/rules/r0010-unexpected-sensitive-file-access/unexpected-sensitive-file-access.yaml
• pkg/rules/r0011-unexpected-egress-network-traffic/README.md
• pkg/rules/r0011-unexpected-egress-network-traffic/unexpected-egress-network-traffic.yaml
• pkg/rules/r0040-unexpected-process-arguments/README.md
• pkg/rules/r0040-unexpected-process-arguments/unexpected-process-arguments.yaml
• pkg/rules/r1001-exec-binary-not-in-base-image/README.md
• pkg/rules/r1001-exec-binary-not-in-base-image/exec-binary-not-in-base-image.yaml
• pkg/rules/r1003-malicious-ssh-connection/README.md
• pkg/rules/r1003-malicious-ssh-connection/malicious-ssh-connection.yaml
• pkg/rules/r1004-exec-from-mount/exec-from-mount.yaml
• pkg/rules/r1006-unshare-syscall/README.md
• pkg/rules/r1006-unshare-syscall/unshare-syscall.yaml
• pkg/rules/r1009-crypto-mining-related-port/README.md
• pkg/rules/r1009-crypto-mining-related-port/crypto-mining-related-port.yaml
• pkg/rules/r1010-symlink-created-over-sensitive-file/README.md
• pkg/rules/r1010-symlink-created-over-sensitive-file/symlink-created-over-sensitive-file.yaml
• pkg/rules/r1012-hardlink-created-over-sensitive-file/README.md
• pkg/rules/r1012-hardlink-created-over-sensitive-file/hardlink-created-over-sensitive-file.yaml

📝 Walkthrough

Walkthrough

Rule expressions in rules-crd.yaml now use the cp application-profile helper namespace for process, file, syscall, capability, DNS, token, network, and link detection.

Changes

Application-profile helper namespace migration

Layer / File(s)	Summary
Update rule helper namespaces rules-crd.yaml	Detection rules replace ap and nn helper references with equivalent cp references. The rule conditions and control flow remain unchanged.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Suggested reviewers: matthyx

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the objective of replacing old profiletypes with containerprofiles.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@rules-crd.yaml`:
- Line 149: Update the R0005 and R0040 source rule definitions under pkg/rules
to use the cp.* expression references, then regenerate rules-crd.yaml with
gen.sh (or apply the equivalent synchronized CRD changes if it is
authoritative). Ensure the generated expressions match the updated source
definitions.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: b2aca665-fcb9-4380-9258-46a6fffbe321

📥 Commits

Reviewing files that changed from the base of the PR and between e2fe00e and 5b096a7.

📒 Files selected for processing (1)

• rules-crd.yaml

[entlein]

@matthyx : I think, this one should be merged now that node-agent has the cp as default. It changes zero logic. WDYT?

[matthyx]

The test check is failing hard — every rule package touched by this migration fails to compile at runtime with undeclared reference to 'cp':

ERROR: <input>:1:2: undeclared reference to 'cp' (in container '')
!cp.was_executed(event.containerId, ...)
 .^
ERROR: <input>:1:17: undeclared reference to 'was_executed' (in container '')

18 of 18 touched rule test packages fail for the same reason (r0001, r0002, r0003, r0004, r0005, r0006, r0007, r0008, r0009, r0010, r0011, r0040, r1001, r1003, r1004, r1006, r1009, r1010, r1012). Full run: https://github.com/kubescape/rulelibrary/actions/runs/30835904504/job/95965102027

Root cause: go.mod still pins github.com/kubescape/node-agent v0.3.147, and that version's CEL engine doesn't register a cp (container profile) function library — only ap/nn are declared. The ap.*/nn.* → cp.* rename in this PR is correct as a rename, but it's not actually true yet that "node-agent has the cp as default" for the version this repo currently depends on.

Requesting changes: please bump the node-agent dependency to a version that registers the cp CEL namespace (or confirm which release adds it) before merging — otherwise every rule that was renamed here is silently disabled at runtime, not just failing in CI.

[matthyx]

Following up on the CI failure: worth flagging a rollout-sequencing concern before this merges, separate from the compile error itself.

Some downstream consumers of rules-crd.yaml sync it to running agents on a cadence that's decoupled from the node-agent image/binary version — so merging this the moment a cp-aware node-agent is tagged would still push cp.* expressions to every agent still on an older build in one shot, not just a handful of stragglers. Right now that's effectively the whole fleet, since no tagged node-agent release includes the cp namespace yet (v0.3.179 predates it).

The good news is ap./nn. were restored as permanent aliases alongside cp shortly after the breaking rename, so there's no functional pressure to rush this: ap./nn.-based rules keep working indefinitely. Suggested sequencing:

1. Cut a node-agent release that includes the alias-restoration commit (or later).
2. Bump this PR's go.mod to that release (per the CI failure above).
3. Hold merging until fleet adoption of that node-agent version is high enough that the remaining pre-upgrade agents are an acceptable residual risk — or, if the rule-distribution pipeline supports it, gate the CRD push itself on the receiving agent's version so under-versioned agents keep getting the current ruleset instead of silently losing coverage on R0001–R1012.

No urgency to force this through before that's sorted out.