|
3 | 3 | quiet: true |
4 | 4 |
|
5 | 5 | skip-check: |
6 | | -# https://www.checkov.io/5.Policy%20Index/kubernetes.html |
7 | | -- CKV_K8S_15 # Image Pull Policy should be Always |
8 | | -- CKV_K8S_21 # The default namespace should not be used |
9 | | -- CKV_K8S_22 # Use read-only filesystem for containers where possible |
10 | | -- CKV_K8S_35 # Prefer using secrets as files over secrets as environment variables |
11 | | -- CKV_K8S_38 # Ensure that Service Account Tokens are only mounted where necessary |
12 | | -- CKV_K8S_40 # Containers should run as a high UID to avoid host conflict |
13 | | -- CKV_K8S_43 # Image should use digest |
14 | | -- CKV2_K8S_5 # No ServiceAccount/Node should be able to read all secrets |
15 | | -- CKV2_K8S_6 # Minimize the admission of pods which lack an associated NetworkPolicy |
16 | | -# https://www.checkov.io/5.Policy%20Index/dockerfile.html |
17 | | -- CKV_DOCKER_2 # Ensure that HEALTHCHECK instructions have been added to container images |
18 | | -# https://www.checkov.io/5.Policy%20Index/secrets.html |
19 | | -- CKV_SECRET_6 # Base64 High Entropy String |
20 | | -# https://www.checkov.io/5.Policy%20Index/github_actions.html |
21 | | -- CKV2_GHA_1 # Ensure top-level permissions are not set to write-all |
22 | | -- CKV_GHA_7 # The build output cannot be affected by user parameters other than the build entry point and the top-level source location. GitHub Actions workflow_dispatch inputs MUST be empty. |
| 6 | + # https://www.checkov.io/5.Policy%20Index/kubernetes.html |
| 7 | + - CKV_K8S_15 # Image Pull Policy should be Always |
| 8 | + - CKV_K8S_21 # The default namespace should not be used |
| 9 | + - CKV_K8S_22 # Use read-only filesystem for containers where possible |
| 10 | + - CKV_K8S_35 # Prefer using secrets as files over secrets as environment variables |
| 11 | + - CKV_K8S_38 # Ensure that Service Account Tokens are only mounted where necessary |
| 12 | + - CKV_K8S_40 # Containers should run as a high UID to avoid host conflict |
| 13 | + - CKV_K8S_43 # Image should use digest |
| 14 | + - CKV2_K8S_5 # No ServiceAccount/Node should be able to read all secrets |
| 15 | + - CKV2_K8S_6 # Minimize the admission of pods which lack an associated NetworkPolicy |
| 16 | + # https://www.checkov.io/5.Policy%20Index/dockerfile.html |
| 17 | + - CKV_DOCKER_2 # Ensure that HEALTHCHECK instructions have been added to container images |
| 18 | + # https://www.checkov.io/5.Policy%20Index/secrets.html |
| 19 | + - CKV_SECRET_6 # Base64 High Entropy String |
| 20 | + # https://www.checkov.io/5.Policy%20Index/github_actions.html |
| 21 | + - CKV2_GHA_1 # Ensure top-level permissions are not set to write-all |
| 22 | + - CKV_GHA_7 # The build output cannot be affected by user parameters other than the build entry point and the top-level source location. GitHub Actions workflow_dispatch inputs MUST be empty. |
0 commit comments