ROX-34071: Add Evaluation Filter to Policy Engine by c-du · Pull Request #20760 · stackrox/stackrox

c-du · 2026-05-21T16:56:28Z

Description

Adds EvaluationFilter to policy engine that allows policies to pre-filter entities before policy evaluation.
This PR introduces the policy engine change only — concrete filter implementations will follow in a separate PR.

Key decisions:

EvaluationFilter defines a interface: Create EvaluationFilter for each feature which is a struct with isNonDefault and apply function fields, composed via slices. T
Filters compiled once at policy compilation:
CompileEvaluationFilter is called
in newCompiledPolicy and the result is stored on compiledPolicy.
Matchers are filter-unaware — filtering happens in MatchAgainst* methods before
delegating.
Feature-flagged: Gated by ROX_EVALUATION_FILTER (disabled by
default).
Empty proto: The EvaluationFilter message has no fields yet.
Fields for base image and container types will be added in the
follow-up PR.

User-facing documentation

CHANGELOG.md is updated OR update is not needed
documentation PR is created and is linked above OR is not needed

Testing and quality

the change is production ready: the change is
GA, or
otherwise the functionality is gated by a [feature flag](https://github.
com/stackrox/stackrox/blob/master/pkg/features/README.md)
CI results are
[inspected](https://docs.google.com/document/d/1d5ga073jkv4CO1kAJqp8MPGp
C6E1bwyrCGZ7S5wKg3w/edit?tab=t.0#heading=h.w4ercgtcg0xp)

Automated testing

Testing and quality

the change is production ready: the change is GA, or otherwise the functionality is gated by a feature flag
CI results are inspected

How I validated my change

Unit tests in pkg/booleanpolicy/filter/
Integration tests in pkg/booleanpolicy/ exercise filters end-to-end through
the matcher
Existing runtime_criteria_test.go updated for MatchKubeEvent signature change
Feature flag disabled by default
We have another branch cong/boo/eval-filter-detection that have the proto type implementation of base image and container type filters with tests and benchmark tests which is on top of this PR. We keep running these tests to make sure there are no regressions from our tests results in design review.

change me!

openshift-ci · 2026-05-21T16:56:33Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

github-actions · 2026-05-21T17:07:07Z

🚀 Build Images Ready

Images are ready for commit 648fb7b. To use with deploy scripts:

export MAIN_IMAGE_TAG=4.12.x-87-g648fb7b1be

coderabbitai · 2026-06-03T17:18:44Z

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 21.05% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and specifically summarizes the main change: introducing an evaluation filter mechanism to the policy engine, matching the PR's core objective.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description check	✅ Passed	The PR description covers key implementation details, design decisions, testing approach, and feature-flag gating comprehensively.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch cong/eval-filter

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

coderabbitai

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@pkg/booleanpolicy/filter/filter.go`:
- Around line 19-20: The Apply method should guard against a nil callback to
avoid panics: in EvaluationFilter.Apply, check if f.apply is nil and if so
return the original dep and imgs unchanged; otherwise call and return
f.apply(dep, imgs). Update the Apply implementation (referencing
EvaluationFilter.Apply and the underlying f.apply callback) so a
zero-value/partially built filter becomes a no-op instead of panicking.

In `@pkg/detection/compiled_policy.go`:
- Around line 311-332: applyFilters currently returns changed=true whenever
cp.filters is non-empty; change it to compute whether outputs actually differ by
comparing the resulting dep and imgs to the inputs (e.g., check pointer/identity
or deep-equality on deployment and images slice contents) and only return true
when dep or imgs differ; in applyImageFilters, when ed.Images is empty treat
that as the image being removed and return (nil, true) instead of returning the
original image so image-exclusion filters are honored; keep
NetworkPoliciesApplied copied from the original ed and ensure equality
comparison logic handles both length and element differences so cache
invalidation only happens on real changes.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Enterprise

Run ID: 0683b4b2-39db-4e59-a567-a286a0e5800b

📥 Commits

Reviewing files that changed from the base of the PR and between df1303a and ee5b976.

⛔ Files ignored due to path filters (7)

central/graphql/resolvers/gen/main.go is excluded by !**/gen/**
generated/api/v1/alert_service.swagger.json is excluded by !**/generated/**
generated/api/v1/detection_service.swagger.json is excluded by !**/generated/**
generated/api/v1/policy_service.swagger.json is excluded by !**/generated/**
generated/storage/policy.pb.go is excluded by !**/*.pb.go, !**/generated/**
generated/storage/policy_vtproto.pb.go is excluded by !**/*.pb.go, !**/generated/**
proto/storage/proto.lock is excluded by !**/*.lock

📒 Files selected for processing (17)

central/policy/customresource/policy.go
central/policy/handlers/handler.go
central/policy/service/service_impl.go
pkg/booleanpolicy/filter/compile.go
pkg/booleanpolicy/filter/compile_test.go
pkg/booleanpolicy/filter/filter.go
pkg/booleanpolicy/filter/filter_test.go
pkg/booleanpolicy/filter/testutils.go
pkg/booleanpolicy/image_criteria_test.go
pkg/booleanpolicy/matcher.go
pkg/booleanpolicy/matcher_impl.go
pkg/booleanpolicy/runtime_criteria_test.go
pkg/booleanpolicy/workload_criteria_test.go
pkg/detection/compiled_policy.go
pkg/detection/runtime/detector.go
pkg/features/list.go
proto/storage/policy.proto

dashrews78 · 2026-06-08T19:13:33Z

+import "github.com/stackrox/rox/generated/storage"
+
+// NewTestFilter creates an EvaluationFilter from a callback for use in tests.
+func NewTestFilter(fn func(*storage.Deployment, []*storage.Image) (*storage.Deployment, []*storage.Image)) EvaluationFilter {


Should we require a test context? Or move it to a test package?

c-du added 6 commits May 20, 2026 21:59

Add Evaluation Filter

1c450fa

resolver

b35e50f

nodefault

cb98cbe

tests

0e7c476

compile with filter

80638dc

more feature guard

a688ba1

openshift-ci Bot added the do-not-merge/work-in-progress label May 21, 2026

github-actions Bot added the area/central label May 21, 2026

c-du marked this pull request as ready for review May 21, 2026 16:56

c-du requested review from a team as code owners May 21, 2026 16:56

openshift-ci Bot removed the do-not-merge/work-in-progress label May 21, 2026

c-du added 2 commits May 26, 2026 22:44

proto

0c2cb70

proto

d6b7394

style

2419efd

c-du force-pushed the cong/eval-filter branch from daf801b to 2419efd Compare June 3, 2026 18:18

Merge branch 'master' into cong/eval-filter

ee5b976

c-du added the ai-review label Jun 3, 2026

coderabbitai Bot reviewed Jun 5, 2026

View reviewed changes

Comment thread pkg/booleanpolicy/filter/filter.go

Comment thread pkg/detection/compiled_policy.go

review

648fb7b

c-du requested review from AlexVulaj, clickboo and ksurabhi91 June 8, 2026 17:27

AlexVulaj approved these changes Jun 8, 2026

View reviewed changes

dashrews78 reviewed Jun 8, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

ROX-34071: Add Evaluation Filter to Policy Engine#20760

ROX-34071: Add Evaluation Filter to Policy Engine#20760
c-du wants to merge 11 commits into
masterfrom
cong/eval-filter

c-du commented May 21, 2026 •

edited

Loading

Uh oh!

openshift-ci Bot commented May 21, 2026

Uh oh!

github-actions Bot commented May 21, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Jun 3, 2026 •

edited

Loading

❌ Failed checks (1 warning)

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

Uh oh!

dashrews78 Jun 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

c-du commented May 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

User-facing documentation

Testing and quality

Automated testing

Testing and quality

How I validated my change

Uh oh!

openshift-ci Bot commented May 21, 2026

Uh oh!

github-actions Bot commented May 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🚀 Build Images Ready

Uh oh!

coderabbitai Bot commented Jun 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

❌ Failed checks (1 warning)

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

dashrews78 Jun 8, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

c-du commented May 21, 2026 •

edited

Loading

github-actions Bot commented May 21, 2026 •

edited

Loading

coderabbitai Bot commented Jun 3, 2026 •

edited

Loading