Opt out of misconfig for specific k8s role

[kyrofa]

Question

I'm using trivy k8s to scan my cluster. I have a particular service account and role that is used for automating deployments, and its capabilities are such that deployments can actually happen, which as you can imagine trivy is complaining about. I know I can use .trivyignore to opt out of that entire issue, but honestly I don't want to. I WANT to be notified of these kinds of things, just not for this specific role. I see the docs talking about the experimental .trivyignore.yaml that includes the ability to specify paths: is there anything similar for my situation?

Thanks for your help!

Target

Kubernetes

Scanner

Misconfiguration

Output Format

None

Mode

Standalone

Operating System

Ubuntu 20.04

Version

$ trivy --version
Version: 0.51.1
Vulnerability DB:
  Version: 2
  UpdatedAt: 2024-05-22 18:12:26.384511718 +0000 UTC
  NextUpdate: 2024-05-23 00:12:26.384511447 +0000 UTC
  DownloadedAt: 2024-05-22 19:52:06.62139173 +0000 UTC
Java DB:
  Version: 1
  UpdatedAt: 2024-05-22 15:18:06.330086849 +0000 UTC
  NextUpdate: 2024-05-25 15:18:06.330086559 +0000 UTC
  DownloadedAt: 2024-05-22 17:33:54.580120705 +0000 UTC
Check Bundle:
  Digest: sha256:6d0771effa53c6cf8130861fc3ac28f5515c35a028edb4bb1e67261b9218c80e
  DownloadedAt: 2024-05-22 17:27:16.041469293 +0000 UTC

[simar7]

In other words, are you trying to say that you would like to ignore certain misconfiguration checks for specific k8s roles? I don't think that is supported today via the .trivyignore.yaml file for k8s resources but maybe we can add this as a feature request, cc @chen-keinan?

[kyrofa]

Yes exactly. There is totally value in this check, but this particular role is working as designed. Each namespace has a "deploy" role defined with the ability to deploy exactly what is supposed to be in that namespace, which includes deployments, ingress rules, and network policies.

Is trivy just expecting all deployments to be done by cluster admins or something?

[chen-keinan]

@kyrofa I'll convert this issue #6758 to feature request and add it to our backlog

[kyrofa]

Thank you my friend.