From e016650f912813adab3e46397d0369421a936513 Mon Sep 17 00:00:00 2001 From: jklein Date: Sun, 23 Aug 2026 23:33:16 +0200 Subject: [PATCH] rss-bridge: qualify the image registry, except the port-80 finding Two findings from the Trivy config scan that landed on main in #129. AVD-KSV-0125 is fixed rather than excepted: writing the image as docker.io/rssbridge/rss-bridge puts a real registry in the registry position instead of "rssbridge", which is what ci/trivy/data/ksv0125.yaml asks for. Verified in k3d that the qualified reference resolves to the same digest (sha256:0eca99b2...) and still runs. AVD-KSV-0117 (containerPort below 1024) becomes a scoped, documented exception. nginx listens on 80 inside the image, and the entrypoint's only way to change that is a sed against /etc/nginx/sites-enabled/default which a read-only root filesystem rejects - so the alternative to port 80 is giving up readOnlyRootFilesystem. The premise of the check does not hold here anyway: the container binds 80 as uid 33 with all capabilities dropped and no NET_BIND_SERVICE. trivy config now reports 0 to act on for this chart. --- ci/trivy/trivyignore.yaml | 5 +++++ rss-bridge/templates/rss-bridge.deployment.yaml | 6 +++++- 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/ci/trivy/trivyignore.yaml b/ci/trivy/trivyignore.yaml index 4d61c72..15dd3a7 100644 --- a/ci/trivy/trivyignore.yaml +++ b/ci/trivy/trivyignore.yaml @@ -108,3 +108,8 @@ misconfigurations: - id: AVD-KSV-0119 paths: ["**/homeassistant.yaml"] statement: "NET_RAW is the capability in question and is added on purpose for device discovery; see AVD-KSV-0022." + + # --- rss-bridge: port 80 is fixed by the image ---------------------------- + - id: AVD-KSV-0117 + paths: ["**/rss-bridge.yaml"] + statement: "nginx inside the image listens on 80, and the only way the entrypoint offers to change it (HTTP_PORT) is a sed against /etc/nginx/sites-enabled/default, which a read-only root filesystem rejects - so the alternative to port 80 would be giving up readOnlyRootFilesystem. The premise of the check does not apply here either: the container binds 80 as uid 33 with ALL capabilities dropped and no NET_BIND_SERVICE, verified in k3d. Renaming is also not free - the Service selects the port by name (rss-bridge-port), which is what keeps the takeover of the existing installation a no-op." diff --git a/rss-bridge/templates/rss-bridge.deployment.yaml b/rss-bridge/templates/rss-bridge.deployment.yaml index 6fabb53..7a6fdd9 100644 --- a/rss-bridge/templates/rss-bridge.deployment.yaml +++ b/rss-bridge/templates/rss-bridge.deployment.yaml @@ -27,7 +27,11 @@ spec: {{- include "rss-bridge.podSecurityContext" .Values.rssBridge.securityContext | nindent 8 }} containers: - name: {{ .Release.Name }}-{{ .Chart.Name }}-deployment - image: "rssbridge/rss-bridge:{{ .Chart.AppVersion }}" + # Registry written out in full on purpose: an unqualified Docker Hub + # reference puts "rssbridge" in the registry position, which says + # nothing about where the image comes from and is reported as an + # untrusted registry (AVD-KSV-0125). See ci/trivy/data/ksv0125.yaml. + image: "docker.io/rssbridge/rss-bridge:{{ .Chart.AppVersion }}" imagePullPolicy: IfNotPresent env: {{- range $value := .Values.rssBridge.env }}