Is it possible to skip rules for 1 container in a deployment that has many?

[timothystewart6]

e.g.

you have a deployment like so:

      - name: cloudsql-proxy # we want to skip rules
        image: gcr.io/cloudsql-docker/gce-proxy:latest # 3rd party container
        imagePullPolicy: IfNotPresent
        # readinessProbe # 3rd party container that does not have a readinessProbe (only an example, they actually do)
      - name: some-other-container # we want to apply rules
        image: registry.example.com # 1st party container
        imagePullPolicy: Always
        readinessProbe: # 1st party container that does have a readinessProbe
          httpGet:
            path: /readiness
            port: 8080
          initialDelaySeconds: 30
          periodSeconds: 3
          timeoutSeconds: 3
          failureThreshold: 2
        command:

We would like to skip rules for the first container but not the second. I don't think we can use annotations on the container (because they don't support them) and applying the skip rule to the deployment would then skip the rules for the item we need to check

[adifayer]

Hey @timothystewart6!
For now, you can skip a specific container in a deployment is by creating a custom rule and filter out this container within that rule. I would love to hear more about your use case! In what cases would you like to skip a specific container? Would you like to skip it entirely, or for specific rules?

[timothystewart6]

Thank you! I'd love to see an example of that somewhere. I didn't see one on the docs page. Regarding the use case, it's mainly for sidecars on deployments. This sidecar above is Google's proxy for connecting to Cloud SQL and while they have some recommended values for requests, and probes, not all sidecars do. As a developer, we sometimes do not have control over 3rd party containers however we do over 1st party.

This leaves me a few options:

1. Ignore the deployment altogether (not really an option)
2. Ignore a rule for the whole deployment like readiness probe etc (not great because my other container in this deployment has a readiness probe)
3. Create a global ignore rule to ignore this container (this is the best option, that you pointed out but I am unsure of how to do this)

I have also updated the example to better illustrate the use case.

[adifayer]

Hey there @timothystewart6 ! Thank you for elaborating on your use case, it helped me a lot!
We currently support skipping on namespace level, kind and resource name. However, if there are specific validations you would like to run against some containers in a deployment, that is possible via a [custom rule] - https://hub.datree.io/custom-rules/custom-rules-overview, we can assist in creating such a rule if you'd like :)

Finally, we do understand your use case and see the value of this feature for our users, and hence opened an issue in our project-
#940