Support Trivy's ignorePolicy #1890
Open
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Hi @reasonerjt , Could you please take a look at this PR when you have a chance? Let me know if there's anything I can clarify or improve. Thanks in advance! 🙏 We need this feature asap for our Harbor instance and it would be great if this can be included into your repo. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This is a starter PR to support Trivy's
--ignore-policyoption as documented hereTrivy currently isn't packaged with any
.regofile, and there is no way to specify a list of policies in.regoformat for Trivy to ignore when reporting vulnerabilities.This PR provides an option in
values.yamlto set a certain set of policies for Trivy to ignore. The option istrivy.ignorePolicy, which can be set to eithernone,basicoradvanced.basicandadvancedoptions are from Trivy's example policies.This PR provides hard-coded policies for ease of use, which does come with limitations. We might want to allow users to create custom policies. If there is a need for this, we can further develop this PR to support it.