-
Notifications
You must be signed in to change notification settings - Fork 243
Description
Title
FindContainerImages does not detect images in initContainers and CronJob jobTemplate
Description
Summary
The current implementation of FindContainerImages only extracts container images from:
spec.template.spec.containers.image
However, Kubernetes manifests can reference container images in additional valid fields which are currently not handled.
Missing Fields
The function does not detect images from:
spec.template.spec.initContainers.image
spec.jobTemplate.spec.template.spec.containers.image (CronJob)
spec.jobTemplate.spec.template.spec.initContainers.image (CronJob)
There is already a TODO comment in the code mentioning this limitation.
Impact
Because of this limitation:
Images used in initContainers are ignored.
CronJob images may not be detected.
Image tracking or diff logic relying on this function may be incomplete.
Manifest analysis becomes inaccurate for certain workloads.
Suggested Improvement
Extend FindContainerImages to also extract images from:
spec.template.spec.initContainers.image
spec.jobTemplate.spec.template.spec.containers.image
spec.jobTemplate.spec.template.spec.initContainers.image
This can be implemented using the existing nestedStringSlice helper for consistency.