fix: ignore apps.kubernetes.io/pod-index when generating network policies

[ANAMASGARD]

Sanitize legacy ContainerProfile neighbors that still carry per-replica StatefulSet labels so GenerateNetworkPolicy collapses them into a single workload-level peer rule that remains valid after scale-up.

Related: kubescape/node-agent#942

Overview

Current behavior: IsIgnoredLabel already strips statefulset.kubernetes.io/pod-name, but not apps.kubernetes.io/pod-index. Legacy learned neighbors that differ only by per-replica identity labels therefore become one GeneratedNetworkPolicy peer rule per StatefulSet replica, so scaling up denies traffic to new pods.

Future behavior: apps.kubernetes.io/pod-index is ignored in removeLabels() (via IsIgnoredLabel). Three otherwise-identical neighbors (replicas 0/1/2) collapse into one ingress peer and one egress peer with only workload labels (e.g. app.kubernetes.io/name=db).

This is the generation-time / backward-compatibility half of the fix. New profiles should stop learning replica-specific selectors in the companion kubescape/node-agent change.

How to Test

go test ./pkg/apis/softwarecomposition/networkpolicy/v2/ \
  -run 'TestRemoveLabels|TestGenerateNetworkPolicy_StatefulSetPeerCollapsesReplicas' \
  -count=1

Expected:

• TestRemoveLabels strips both apps.kubernetes.io/pod-index and statefulset.kubernetes.io/pod-name
• TestGenerateNetworkPolicy_StatefulSetPeerCollapsesReplicas ingress and egress subtests each assert len(rules)==1, one peer, selector {"app.kubernetes.io/name":"db"}, no identity labels

Related issues/PRs

• Related: kubescape/node-agent#942
• Companion: kubescape/node-agent PR — strip StatefulSet pod-identity labels from network peer selectors (link after opening)

Checklist before requesting a review

• My code follows the style guidelines of this project
• I have commented on my code, particularly in hard-to-understand areas
• I have performed a self-review of my code
• If it is a core feature, I have added thorough tests.
• New and existing unit tests pass locally with my changes (targeted #942 regressions verified; full go test ./... not re-run in this environment)

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Team

Run ID: 386731e0-bd54-46c8-b4d8-2561d4fd2d02

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[matthyx]

Reviewed the generation-time compatibility fix. Ignoring apps.kubernetes.io/pod-index alongside statefulset.kubernetes.io/pod-name correctly collapses legacy per-replica selectors, and the ingress/egress regression coverage exercises the intended behavior. I found no blockers. Verified with go test ./... -count=1.