Behaviour of StatefulSet Without Service Name

[adberger]

Is the current behaviour of https://github.com/Checkmarx/kics/tree/master/assets/queries/k8s/statefulset_without_service_name as it is expected to be?

What if resource.spec.clusterIP isn't set at all?
What if only a fraction of the labels match between service.spec.selector == stateful.spec.template.metadata.labels?

service:
  spec:
    selector:
      foo: bar

statefulset
  spec:
    template:
      metadata:
        labels:
          foo: bar
          goo: sar

[cxMiguelSilva]

Hi @adberger, hope you are doing great!
Regarding the first question, according to the kubernetes documentation the statefulset requires a headless service that is done setting the clusterIP to None (https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#limitations), we do not verify if clusterIP is set due to it being required and not optional.
Regarding the second question, if only a fraction of the labels match the output will be false and the count not increased.
Let me know if I you have any other doubt!

[adberger]

@cxMiguelSilva Thanks for the reply.

In my opinion this should work but doesn't:

apiVersion: v1
kind: Service
metadata:
  name: nginx2
  namespace: nginx2
  labels:
    app: nginx2
spec:
  ports:
  - port: 80
    name: web
  clusterIP: None
  selector:
    app: nginx2
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: web2
  namespace: nginx2
spec:
  selector:
    matchLabels:
      app: nginx2
  serviceName: "nginx2"
  replicas: 3
  template:
    metadata:
      labels:
        app: nginx2
        foo: bar
    spec:
      terminationGracePeriodSeconds: 10
      containers:
      - name: nginx2
        image: k8s.gcr.io/nginx-slim:0.8
        ports:
        - containerPort: 80
          name: web
        volumeMounts:
        - name: www
          mountPath: /usr/share/nginx/html
  volumeClaimTemplates:
  - metadata:
      name: www
    spec:
      accessModes: [ "ReadWriteOnce" ]
      storageClassName: "my-storage-class"
      resources:
        requests:
          storage: 1Gi

When I remove the label foo: bar it works.
If you ask me, a pod should be able to have more labels than the service selector.
Because the service still operates properly on behalf of the matching labels.

[cxMiguelSilva]

Your are right, the a pod should be able to have more labels than the service selector.
We have already created a PR #5303 to fix the issue.
Thank you so much for your input @adberger !! If you have any other questions, let us know 😉!