Add ContainerName

admission/rules/v1/helpers.go

@@ -6,6 +6,7 @@ import (
 
 	v1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 	"k8s.io/apiserver/pkg/admission"
 	"k8s.io/client-go/kubernetes"
 )
@@ -68,3 +69,19 @@ func resolveJob(ownerRef metav1.OwnerReference, namespace string, clientset kube
 	}
 	return "Job", ownerRef.Name, namespace
 }
+
+// GetContainerNameFromExecToPodEvent returns the container name from the admission event for exec operations.
+func GetContainerNameFromExecToPodEvent(event admission.Attributes) string {
+	if event.GetSubresource() == "exec" {
+		if obj := event.GetObject(); obj != nil {
+			if unstructuredObj, ok := obj.(*unstructured.Unstructured); ok {
+				if object, ok := unstructuredObj.Object["object"].(map[string]interface{}); ok {
+					if containerName, ok := object["container"].(string); ok {
+						return containerName
+					}
+				}
+			}
+		}
+	}
+	return ""
+}

admission/rules/v1/r2000_exec_to_pod.go

@@ -77,6 +77,8 @@ func (rule *R2000ExecToPod) ProcessEvent(event admission.Attributes, access inte
 		return nil
 	}
 
+	containerName := GetContainerNameFromExecToPodEvent(event)
+
 	ruleFailure := GenericRuleFailure{
 		BaseRuntimeAlert: apitypes.BaseRuntimeAlert{
 			AlertName:      rule.Name(),
@@ -107,12 +109,13 @@ func (rule *R2000ExecToPod) ProcessEvent(event admission.Attributes, access inte
 			RuleDescription: fmt.Sprintf("Exec to pod detected on pod %s", event.GetName()),
 		},
 		RuntimeAlertK8sDetails: apitypes.RuntimeAlertK8sDetails{
-			PodName:   event.GetName(),
-			Namespace: event.GetNamespace(),
+			PodName:           event.GetName(),
+			Namespace:         event.GetNamespace(),
 			WorkloadName:      workloadName,
 			WorkloadNamespace: workloadNamespace,
 			WorkloadKind:      workloadKind,
 			NodeName:          nodeName,
+			ContainerName:     containerName,
 		},
 		RuleID: R2000ID,
 	}

admission/rules/v1/r2001_portforward.go

@@ -76,7 +76,6 @@ func (rule *R2001PortForward) ProcessEvent(event admission.Attributes, access in
 		logger.L().Error("Failed to get parent workload details", helpers.Error(err))
 		return nil
 	}
-
 	ruleFailure := GenericRuleFailure{
 		BaseRuntimeAlert: apitypes.BaseRuntimeAlert{
 			AlertName:      rule.Name(),