jklein
1ae5e1a7c3
Adds a trivy-config job to the PR pipeline that renders each changed chart with Helm and runs `trivy config` over the rendered manifests. Reporting only - TRIVY_CONFIG_MODE=report always exits 0, so the job never blocks a PR. Rendered manifests rather than the chart directory: `trivy config <chart-dir>` renders with default values, which fails on every chart here because of their required() values - and Trivy does not fail with it, it logs "Skipping chart" and prints an empty, green report. Values come from the install-test fixtures (ci/<chart>/test-values.yaml), the only committed per-chart values in the repo; none of them touches securityContext, images or capabilities, so the scan sees the chart's own hardening. Charts without fixtures get ci/trivy/values/<chart>.yaml. Exceptions live in ci/trivy/trivyignore.yaml in Trivy's native ignore-file schema, each with a statement - the script refuses to run without one and reports suppressed findings with their reason instead of hiding them. AVD-KSV-0125 is configured instead of excepted: ci/trivy/data/ksv0125.yaml lists the trusted registries, so the check stays able to flag a genuinely foreign source. Refs #84.
23 lines
1.1 KiB
YAML
23 lines
1.1 KiB
YAML
# Trusted registries for AVD-KSV-0125 ("Restrict container images to trusted
|
|
# registries"), loaded via `trivy config --config-data ci/trivy/data`.
|
|
#
|
|
# Deliberately configured instead of ignored. An ignored check also stays quiet
|
|
# when an image from a genuinely foreign source shows up; a configured list only
|
|
# removes the noise and leaves the check able to say something.
|
|
#
|
|
# How the check reads this (builtin.kubernetes.KSV0125): it takes the part of
|
|
# the image reference before the first "/" and requires it to end with one of
|
|
# these entries. Setting the list *replaces* Trivy's built-in default (ACR, ECR
|
|
# and GCR domains) - none of which this fleet uses, so nothing is lost.
|
|
#
|
|
# Note what this does NOT silence: an unqualified Docker Hub image such as
|
|
# "apache/tika:3.2.3" puts "apache" in the registry position, which matches
|
|
# nothing here and is still reported. That is a real finding, not noise - the
|
|
# manifest does not say where the image comes from. It goes away by writing
|
|
# such images as "docker.io/apache/tika", which is why docker.io is listed.
|
|
ksv0125:
|
|
trusted_registries:
|
|
- cr.jk-dev.de
|
|
- ghcr.io
|
|
- docker.io
|