fairwinds-insights.yaml

# TODO: move this file once it's configurable

options:
  organization: fairwinds-production
  repositoryName: FairwindsOps/charts
manifests:
  helm:
  - name: insights-agent
    path: ./stable/insights-agent
    valuesFile: stable/insights-agent/ci/test-values.yaml
  - name: insights-admission
    path: ./stable/insights-admission
    valuesFile: stable/insights-admission/ci/test-values.yaml

exemptions:
  - image: quay.io/fairwinds/nova
    report: trivy
    reason: Nova's image is built from the scratch base image, and is unscannable

  - filename: stable/insights-agent/templates/test/test-pod.yaml
    report: polaris
    reason: This file is specifically meant to trigger Polaris findings

  - filename: stable/insights-agent/templates/test/test-deployment.yaml
    report: polaris
    reason: This file is specifically meant to trigger Polaris findings

  - filename: stable/insights-admission/templates/test-deployment.yaml
    report: polaris
    reason: This file is specifically meant to trigger Polaris findings

  - filename: stable/insights-agent/templates/kube-bench/cronjob.yaml
    report: polaris
    checks:
      - hostPIDSet
      - runAsRootAllowed
    reason: kube-bench needs special permissions to do its job

  - filename: stable/insights-agent/charts/prometheus/templates/server/deploy.yaml
    report: polaris
    reason: We don't control a lot of this

  - filename: stable/insights-agent/charts/prometheus/charts/kube-state-metrics/templates/deployment.yaml
    report: polaris
    reason: We don't control a lot of this

  - filename: stable/insights-agent/templates/opa/check.yaml
    report: pluto
    reason: We support both the new and deprecated CRD resources

  - filename: stable/insights-agent/templates/opa/instance.yaml
    report: pluto
    reason: We support both the new and deprecated CRD resources