-
DescriptionI would like to ignore ksv114 rule (https://avd.aquasec.com/misconfig/ksv114), but the described config is not working anymore Desired Behaviorexceptions not ignored Actual Behaviorexceptions ignored Reproduction Steps1. `wget https://github.com/cert-manager/cert-manager/releases/download/v1.16.1/cert-manager.yaml`
2.
mkdir -p trivy_policy && cat > trivy_policy/ksv114_exception.rego <<EOF
package builtin.kubernetes.KSV114
exception[rules] {
input.kind == "ClusterRole"
input.metadata.name == "cert-manager-cainjector"
rules := [""]
}
EOF
Operating SystemmacOS Sonoma VersionVersion: 0.57.0
Vulnerability DB:
Version: 2
UpdatedAt: 2024-10-29 06:17:43.289538659 +0000 UTC
NextUpdate: 2024-10-30 06:17:43.289538499 +0000 UTC
DownloadedAt: 2024-10-29 11:17:48.449548 +0000 UTC
Check Bundle:
Digest: sha256:9cc30e6eb1c0dc0b4a4791b61c3dbff8799d08daeac893c08317e7b054ecab14
DownloadedAt: 2024-11-15 11:16:52.270695 +0000 UTCChecklist
|
Beta Was this translation helpful? Give feedback.
Answered by
nikpivkin
Nov 20, 2024
Replies: 2 comments 1 reply
-
|
Are you trying to ignore a check? You can do via https://aquasecurity.github.io/trivy/v0.57/docs/scanner/misconfiguration/#skipping-resources-by-inline-comments FYI Rego |
Beta Was this translation helpful? Give feedback.
1 reply
-
|
I completely missed that deprecation. In my case, source code is from 3td party and I don't want to manual edit it at every upgrade because this is an unmaintainable approach. |
Beta Was this translation helpful? Give feedback.
-
|
Hi @bovy89 ! You can ignore a check by content. For example, you know that the package trivy
import rego.v1
default ignore := false
ignore if {
input.AVDID == "AVD-KSV-0114"
some line in input.CauseMetadata.Code.Lines
contains(line.Content, "validatingwebhookconfigurations")
}You can read about ignoring checks with Rego in the documentation: https://trivy.dev/v0.57/docs/configuration/filtering/#by-rego |
Beta Was this translation helpful? Give feedback.
0 replies
Answer selected by
simar7
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Hi @bovy89 !
You can ignore a check by content. For example, you know that the
AVD-KSV-0114check should not be triggered for thevalidatingwebhookconfigurationsresource, then you can write the following ignore rule: