jklein
1ae5e1a7c3
Adds a trivy-config job to the PR pipeline that renders each changed chart with Helm and runs `trivy config` over the rendered manifests. Reporting only - TRIVY_CONFIG_MODE=report always exits 0, so the job never blocks a PR. Rendered manifests rather than the chart directory: `trivy config <chart-dir>` renders with default values, which fails on every chart here because of their required() values - and Trivy does not fail with it, it logs "Skipping chart" and prints an empty, green report. Values come from the install-test fixtures (ci/<chart>/test-values.yaml), the only committed per-chart values in the repo; none of them touches securityContext, images or capabilities, so the scan sees the chart's own hardening. Charts without fixtures get ci/trivy/values/<chart>.yaml. Exceptions live in ci/trivy/trivyignore.yaml in Trivy's native ignore-file schema, each with a statement - the script refuses to run without one and reports suppressed findings with their reason instead of hiding them. AVD-KSV-0125 is configured instead of excepted: ci/trivy/data/ksv0125.yaml lists the trusted registries, so the check stays able to flag a genuinely foreign source. Refs #84.
16 lines
675 B
YAML
16 lines
675 B
YAML
# Render values for the misconfiguration scan only (ci/run-trivy-config.sh).
|
|
#
|
|
# Used for charts that have no ci/<chart>/test-values.yaml because they are
|
|
# excluded from the install-test. template-chart is excluded there for its
|
|
# placeholder image, which a static scan never pulls - so it is still scanned:
|
|
# it is the scaffold every new chart is copied from, and a finding in it is
|
|
# inherited by every chart that follows.
|
|
#
|
|
# Only the values the chart declares `required` - nothing that would change the
|
|
# security posture the scan is meant to look at.
|
|
ingress:
|
|
domain: scan.example.com
|
|
clusterIssuer: letsencrypt
|
|
secrets:
|
|
xxxSecretRef: op://Vault/scan/placeholder
|