feat(secure): add imageConfigLabelWithValueAndLabelsExist predicate#721
Merged
tembleking merged 1 commit intomasterfrom Mar 23, 2026
Merged
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
Adds support for Sysdig Secure’s new composite image label predicate imageConfigLabelWithValueAndLabelsExist to the sysdig_secure_vulnerability_rule_bundle resource, enabling rules that require a label key/value match plus the presence of additional labels.
Changes:
- Extends the v2 API model to include
requiredLabelsin predicate extras. - Adds Terraform schema + read/write mapping for
label_with_value_and_required_labelsunderrule.image_label. - Updates docs and acceptance tests to cover the new predicate.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
sysdig/internal/client/v2/vulnerability_rule_bundle_model.go |
Adds RequiredLabels to predicate extras for API (un)marshalling. |
sysdig/resource_sysdig_secure_vulnerability_rule_bundle.go |
Introduces the new nested block in schema and maps it to/from the backend predicate type. |
sysdig/resource_sysdig_secure_vulnerability_rule_bundle_test.go |
Adds an acceptance test step asserting state fields for the new predicate. |
website/docs/r/secure_vulnerability_rule_bundle.md |
Documents the new label_with_value_and_required_labels block and provides example usage. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
… to vulnerability rule bundles Adds support for Sysdig Secure's composite image label predicate, enabling rules that require a label key/value match plus the presence of additional labels. Also adds mutual exclusivity validation for image_label sub-blocks, converting a silent state-drift bug into a clear error message.
tembleking
force-pushed
the
feat/image-config-label-with-value-and-required-labels
branch
from
8755d30 to
801e582
Compare
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
mateobur
approved these changes
Mar 23, 2026
tembleking
deleted the
feat/image-config-label-with-value-and-required-labels
branch
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The backend shipped a new composite image label predicate (
imageConfigLabelWithValueAndLabelsExist) that allows rules like "IF label Vendor exists AND its value contains BNPP, THEN labels Team and Org must also exist."This adds the new
label_with_value_and_required_labelsblock to theimage_labelrule type insysdig_secure_vulnerability_rule_bundle, following the exact same patterns as the existing three imageConfigLabel predicates.RequiredLabelsfield toVulnerabilityRulePredicateExtralabel_with_value_and_required_labelsblock withtarget_label,target_value, andrequired_labels