Erich Blume
2daf6291b7
Prowler's IaC provider hardcodes self._mutelist = None and delegates filtering to Trivy, but doesn't plumb --ignorefile through. The original attempt with --mutelist-file silently no-op'd. Add a wrapper around trivy in our image that injects --ignorefile $TRIVY_IGNOREFILE on `fs` subcommands; switch the IaC cronjob to mount a Trivy-format trivyignore.yaml and set the env var. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
30 lines
639 B
YAML
30 lines
639 B
YAML
---
|
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
|
|
namespace: prowler
|
|
|
|
resources:
|
|
- serviceaccount.yaml
|
|
- rbac.yaml
|
|
- pv-nfs.yaml
|
|
- pvc.yaml
|
|
- cronjob.yaml
|
|
- cronjob-image-scan.yaml
|
|
- cronjob-iac-scan.yaml
|
|
|
|
configMapGenerator:
|
|
- name: prowler-mutelist
|
|
options:
|
|
disableNameSuffixHash: true
|
|
files:
|
|
- mutelist/apiserver.yaml
|
|
- mutelist/control-plane.yaml
|
|
- mutelist/core-pod-security.yaml
|
|
- mutelist/manual-node-checks.yaml
|
|
- mutelist/rbac.yaml
|
|
- mutelist/trivyignore.yaml
|
|
|
|
images:
|
|
- name: registry.ops.eblu.me/blumeops/prowler
|
|
newTag: v5.23.0-7c1cd11
|