jklein
70c7106fe8
ci/run-trivy-config.sh renders every changed chart before scanning it and exits non-zero when the render fails - which it does for freesailarr, because the chart is excluded from the install-test and therefore has no ci/freesailarr/test-values.yaml to fall back on. The scan job would go red without ever scanning anything. The file supplies only the values the chart declares required (secret ref, cluster issuer, the three media claims and one ingress host per app, since the chart has no global ingress.domain) and nothing that would alter the security posture the scan is meant to look at.
40 lines
1.2 KiB
YAML
40 lines
1.2 KiB
YAML
# Render values for the misconfiguration scan only (ci/run-trivy-config.sh).
|
|
#
|
|
# freesailarr has no ci/freesailarr/test-values.yaml because it is excluded from
|
|
# the install-test (gluetun never becomes healthy without a real Wireguard key),
|
|
# but it is still scanned - the chart runs nine containers with several
|
|
# documented hardening deviations, which is exactly what the scan should see.
|
|
#
|
|
# Only the values the chart declares `required` - nothing that changes the
|
|
# security posture (no securityContext, image, capability or resource overrides).
|
|
# The ingress hosts are per app since the chart has no global ingress.domain.
|
|
secrets:
|
|
gluetunSecretRef: op://Vault/scan/placeholder
|
|
ingress:
|
|
clusterIssuer: letsencrypt
|
|
media:
|
|
downloads:
|
|
existingClaim: scan-downloads
|
|
movies:
|
|
existingClaim: scan-movies
|
|
tv:
|
|
existingClaim: scan-tv
|
|
qbittorrent:
|
|
ingress:
|
|
host: qbittorrent.scan.example.com
|
|
prowlarr:
|
|
ingress:
|
|
host: prowlarr.scan.example.com
|
|
radarr:
|
|
ingress:
|
|
host: radarr.scan.example.com
|
|
sonarr:
|
|
ingress:
|
|
host: sonarr.scan.example.com
|
|
seerr:
|
|
ingress:
|
|
host: seerr.scan.example.com
|
|
bazarr:
|
|
ingress:
|
|
host: bazarr.scan.example.com
|