Add --exclude-resources flag for skipping resource types during collection

cmd/sonobuoy/app/args.go

@@ -489,6 +489,13 @@ func AddNamespacePSAEnforceLevelFlag(str *string, flags *pflag.FlagSet) {
 	)
 }
 
+func AddExcludeResourcesFlag(strs *[]string, flags *pflag.FlagSet) {
+	flags.StringSliceVar(
+		strs, "exclude-resources", nil,
+		"Resources to exclude from collection (e.g. MachineConfig,PackageManifest). Applied after the implicit secrets filter.",
+	)
+}
+
 // Used if we're just setting the given string as the value; focus and skip need
 // regexp validation first.
 type envVarModierFlag struct {

cmd/sonobuoy/app/gen.go

@@ -87,6 +87,7 @@ func GenFlagSet(cfg *genFlags, rbac RBACMode) *pflag.FlagSet {
 	AddServiceAccountNameFlag(&cfg.sonobuoyConfig.ServiceAccountName, genset)
 	AddExistingServiceAccountFlag(&cfg.sonobuoyConfig.ExistingServiceAccount, genset)
 	AddNamespacePSAEnforceLevelFlag(&cfg.sonobuoyConfig.NamespacePSAEnforceLevel, genset)
+	AddExcludeResourcesFlag(&cfg.sonobuoyConfig.ExcludeResources, genset)
 
 	AddNamespaceFlag(&cfg.sonobuoyConfig.Namespace, genset)
 	AddDNSNamespaceFlag(&cfg.dnsNamespace, genset)

pkg/config/config.go

@@ -128,7 +128,8 @@ type Config struct {
 	///////////////////////////////////////////////
 	// Query options
 	///////////////////////////////////////////////
-	Resources []string      `json:"Resources" mapstructure:"Resources"`
+	Resources        []string `json:"Resources" mapstructure:"Resources"`
+	ExcludeResources []string `json:"ExcludeResources,omitempty" mapstructure:"ExcludeResources,omitempty"`
 	Filters   FilterOptions `json:"Filters" mapstructure:"Filters"`
 	Limits    LimitConfig   `json:"Limits" mapstructure:"Limits"`
 	QPS       float32       `json:"QPS,omitempty" mapstructure:"QPS"`

pkg/discovery/query.go

@@ -69,7 +69,7 @@ func QueryCluster(restConf *rest.Config, cfg *config.Config) error {
 
 	// Run the queries
 	recorder := NewQueryRecorder()
-	clusterResources, nsResources, err := getAllFilteredResources(apiHelper, cfg.Resources)
+	clusterResources, nsResources, err := getAllFilteredResources(apiHelper, cfg.Resources, cfg.ExcludeResources)
 	if err != nil {
 		return errors.Wrap(err, "unable to filter resources")
 	}
@@ -338,17 +338,17 @@ func QueryResources(
 
 // getAllFilteredResources figure out which resources we want to query for based on the filter list and whether
 // or not we are considering namespaced objects or not.
-func getAllFilteredResources(client *dynamic.APIHelper, wantResources []string) (clusterResources, nsResources []schema.GroupVersionResource, retErr error) {
+func getAllFilteredResources(client *dynamic.APIHelper, wantResources []string, excludeResources []string) (clusterResources, nsResources []schema.GroupVersionResource, retErr error) {
 	groupResources, err := getResources(client)
 	if err != nil {
 		return nil, nil, errors.Wrap(err, "choosing resources to gather")
 	}
-	return filterResources(groupResources, false, wantResources),
-		filterResources(groupResources, true, wantResources),
+	return filterResources(groupResources, false, wantResources, excludeResources),
+		filterResources(groupResources, true, wantResources, excludeResources),
 		nil
 }
 
-func filterResources(gvrs map[schema.GroupVersion][]metav1.APIResource, namespaced bool, wantResources []string) []schema.GroupVersionResource {
+func filterResources(gvrs map[schema.GroupVersion][]metav1.APIResource, namespaced bool, wantResources []string, excludeResources []string) []schema.GroupVersionResource {
 	results := []schema.GroupVersionResource{}
 	for gv, resources := range gvrs {
 		for _, res := range resources {
@@ -383,6 +383,11 @@ func filterResources(gvrs map[schema.GroupVersion][]metav1.APIResource, namespac
 				}
 			}
 
+			if len(excludeResources) > 0 && sliceContains(excludeResources, res.Name) {
+				logrus.Infof("Resource %v is in ExcludeResources list. Skipping %v query.", res.Name, res.Name)
+				continue
+			}
+
 			results = append(results, gv.WithResource(res.Name))
 		}
 	}

pkg/discovery/query_test.go

@@ -48,9 +48,10 @@ func TestFilterResources(t *testing.T) {
 	}
 
 	tcs := []struct {
-		desc          string
-		ns            bool
-		wantResources []string
+		desc             string
+		ns               bool
+		wantResources    []string
+		excludeResources []string
 
 		// To test some things we may not want to worry about the whole list
 		// and instead worry about some custom concern, hence the customCheck.
@@ -114,12 +115,49 @@ func TestFilterResources(t *testing.T) {
 			expect: []schema.GroupVersionResource{
 				{Group: "", Version: "v1", Resource: "secrets"},
 			},
+		}, {
+			desc:             "Excludes resources in ExcludeResources list",
+			wantResources:    []string{"pods", "configmaps"},
+			excludeResources: []string{"configmaps"},
+			ns:               true,
+			expect: []schema.GroupVersionResource{
+				{Group: "", Version: "v1", Resource: "pods"},
+			},
+		}, {
+			desc:             "ExcludeResources with nil list excludes nothing",
+			wantResources:    []string{"pods"},
+			excludeResources: nil,
+			ns:               true,
+			expect: []schema.GroupVersionResource{
+				{Group: "", Version: "v1", Resource: "pods"},
+			},
+		}, {
+			desc:             "ExcludeResources does not affect resources not in list",
+			wantResources:    []string{"pods", "configmaps"},
+			excludeResources: []string{"services"},
+			ns:               true,
+			expect: []schema.GroupVersionResource{
+				{Group: "", Version: "v1", Resource: "pods"},
+				{Group: "", Version: "v1", Resource: "configmaps"},
+			},
+		}, {
+			desc:             "ExcludeResources works when querying everything implicitly",
+			excludeResources: []string{"configmaps"},
+			ns:               true,
+			customCheck: func(gvrList []schema.GroupVersionResource) error {
+				for _, gvr := range gvrList {
+					if gvr.Resource == "configmaps" {
+						return fmt.Errorf("Expected configmaps to be excluded but found gvr: %#v", gvr)
+					}
+				}
+				return nil
+			},
 		},
 	}
 
 	for _, tc := range tcs {
 		t.Run(tc.desc, func(t *testing.T) {
-			out := filterResources(resourceMap, tc.ns, tc.wantResources)
+			out := filterResources(resourceMap, tc.ns, tc.wantResources, tc.excludeResources)
 			if tc.customCheck != nil {
 				err := tc.customCheck(out)
 				if err != nil {

test/integration/testdata/gen-mode-and-focus.golden

@@ -20,6 +20,7 @@ Flags:
       --e2e-repo envModifier                     Specify a registry to use as the default for pulling Kubernetes test images. Same as providing --e2e-repo-config but specifying the same repo repeatedly.
       --e2e-repo-config yaml-filepath            Specify a yaml file acting as KUBE_TEST_REPO_LIST, overriding registries for test images.
       --e2e-skip envModifier                     Specify the E2E_SKIP value for the e2e plugin, specifying which tests to skip. Shorthand for --plugin-env=e2e.E2E_SKIP=<string>
+      --exclude-resources strings                Resources to exclude from collection (e.g. MachineConfig,PackageManifest). Applied after the implicit secrets filter.
       --existing-service-account                 If true, use an existing service account, else attempt to create one.
   -f, --file -                                   If set, loads the file as if it were the output from sonobuoy gen. Set to - to read from stdin.
       --force-image-pull-policy                  Force plugins' imagePullPolicy to match the value for the Sonobuoy pod

test/integration/testdata/gen-mode-and-rerun.golden

@@ -20,6 +20,7 @@ Flags:
       --e2e-repo envModifier                     Specify a registry to use as the default for pulling Kubernetes test images. Same as providing --e2e-repo-config but specifying the same repo repeatedly.
       --e2e-repo-config yaml-filepath            Specify a yaml file acting as KUBE_TEST_REPO_LIST, overriding registries for test images.
       --e2e-skip envModifier                     Specify the E2E_SKIP value for the e2e plugin, specifying which tests to skip. Shorthand for --plugin-env=e2e.E2E_SKIP=<string>
+      --exclude-resources strings                Resources to exclude from collection (e.g. MachineConfig,PackageManifest). Applied after the implicit secrets filter.
       --existing-service-account                 If true, use an existing service account, else attempt to create one.
   -f, --file -                                   If set, loads the file as if it were the output from sonobuoy gen. Set to - to read from stdin.
       --force-image-pull-policy                  Force plugins' imagePullPolicy to match the value for the Sonobuoy pod

test/integration/testdata/gen-rerunfailed-missing.golden

@@ -20,6 +20,7 @@ Flags:
       --e2e-repo envModifier                     Specify a registry to use as the default for pulling Kubernetes test images. Same as providing --e2e-repo-config but specifying the same repo repeatedly.
       --e2e-repo-config yaml-filepath            Specify a yaml file acting as KUBE_TEST_REPO_LIST, overriding registries for test images.
       --e2e-skip envModifier                     Specify the E2E_SKIP value for the e2e plugin, specifying which tests to skip. Shorthand for --plugin-env=e2e.E2E_SKIP=<string> (default \[Disruptive\]|NoExecuteTaintManager)
+      --exclude-resources strings                Resources to exclude from collection (e.g. MachineConfig,PackageManifest). Applied after the implicit secrets filter.
       --existing-service-account                 If true, use an existing service account, else attempt to create one.
   -f, --file -                                   If set, loads the file as if it were the output from sonobuoy gen. Set to - to read from stdin.
       --force-image-pull-policy                  Force plugins' imagePullPolicy to match the value for the Sonobuoy pod

test/integration/testdata/gen-rerunfailed-no-failures.golden

@@ -20,6 +20,7 @@ Flags:
       --e2e-repo envModifier                     Specify a registry to use as the default for pulling Kubernetes test images. Same as providing --e2e-repo-config but specifying the same repo repeatedly.
       --e2e-repo-config yaml-filepath            Specify a yaml file acting as KUBE_TEST_REPO_LIST, overriding registries for test images.
       --e2e-skip envModifier                     Specify the E2E_SKIP value for the e2e plugin, specifying which tests to skip. Shorthand for --plugin-env=e2e.E2E_SKIP=<string> (default \[Disruptive\]|NoExecuteTaintManager)
+      --exclude-resources strings                Resources to exclude from collection (e.g. MachineConfig,PackageManifest). Applied after the implicit secrets filter.
       --existing-service-account                 If true, use an existing service account, else attempt to create one.
   -f, --file -                                   If set, loads the file as if it were the output from sonobuoy gen. Set to - to read from stdin.
       --force-image-pull-policy                  Force plugins' imagePullPolicy to match the value for the Sonobuoy pod

test/integration/testdata/gen-rerunfailed-not-tarball.golden

@@ -20,6 +20,7 @@ Flags:
       --e2e-repo envModifier                     Specify a registry to use as the default for pulling Kubernetes test images. Same as providing --e2e-repo-config but specifying the same repo repeatedly.
       --e2e-repo-config yaml-filepath            Specify a yaml file acting as KUBE_TEST_REPO_LIST, overriding registries for test images.
       --e2e-skip envModifier                     Specify the E2E_SKIP value for the e2e plugin, specifying which tests to skip. Shorthand for --plugin-env=e2e.E2E_SKIP=<string> (default \[Disruptive\]|NoExecuteTaintManager)
+      --exclude-resources strings                Resources to exclude from collection (e.g. MachineConfig,PackageManifest). Applied after the implicit secrets filter.
       --existing-service-account                 If true, use an existing service account, else attempt to create one.
   -f, --file -                                   If set, loads the file as if it were the output from sonobuoy gen. Set to - to read from stdin.
       --force-image-pull-policy                  Force plugins' imagePullPolicy to match the value for the Sonobuoy pod