From b19da4e580a6103162cd3c04979c4757dbe71c54 Mon Sep 17 00:00:00 2001 From: Justin Klein Date: Sat, 3 Oct 2026 20:45:56 +0000 Subject: [PATCH] fix(garage): a comment in the ConfigMap tripped Trivy's KSV-0109 Run 446 reported one HIGH finding, and it was prose, not data: the line "metrics_require_token = true plus a token to close it" sits inside the ConfigMap's data block, and KSV-0109 reads a = assignment with a credential-ish key name as a stored secret - comments included. The ConfigMap holds no credential at all; the RPC secret arrives as an environment variable precisely so that it cannot. Reworded rather than excepted: an entry in ci/trivy/trivyignore.yaml would carry a permanent exception for one sentence, and the next reader of the report would have to re-establish that the ConfigMap really is secret-free. The replacement names the mechanism at the line, so the shape does not come back. --- garage/templates/garage.configmap.yaml | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/garage/templates/garage.configmap.yaml b/garage/templates/garage.configmap.yaml index 362cf02..b368519 100644 --- a/garage/templates/garage.configmap.yaml +++ b/garage/templates/garage.configmap.yaml @@ -153,10 +153,16 @@ data: # WHAT IS AND IS NOT REACHABLE AS A RESULT, stated precisely because "no # token" reads like "nothing is open": # /health open, by design, and the probes depend on it - # /metrics OPEN TOO - metrics_require_token defaults to false, so with - # no metrics_token the endpoint needs no authentication. That - # is internal metrics on a ClusterIP port; set - # metrics_require_token = true plus a token to close it. + # /metrics OPEN TOO - the metrics_require_token switch defaults to + # false, so without a metrics credential the endpoint needs no + # authentication. That is internal metrics on a ClusterIP port; + # to close it, set that switch true and add a credential. + # + # (And a note for whoever edits these lines: do NOT write them + # as " = " with a credential-ish key name. Trivy's + # KSV-0109 reads an assignment inside this ConfigMap's DATA - + # comments included - as a stored secret and reports HIGH. It + # cost one run here, 2026-10-03.) # everything else 401/403 until a token exists. Note that a config # token is not the only way to get one: Garage 2.x also keeps # admin tokens in the cluster ("garage admin-token create"),