trivy-operator: error failed to apply the policy:

[KateFiroozi]

trivvy-operator logs following error messages:

filter error: filtering error: unable to filter vulnerabilities: failed to apply the policy: unable to prepare for eval: 1 error occurred: trivy.rego:0: rego_parse_error: empty module

Looks like ConfigMap trivy-operator-trivy-config is not correctly mounted on trivy scan jobs.

Using helm chart v. 0.21.3

Config from values file:

  ignoreFile:
    - CVE-20...

  # ignorePolicy: |
  #   # applies to all other workloads
  ignorePolicy.kube-system.azure-.: 

It seems to work properly after removing all ignorePolicy.* from values file and additionally removing all sbomreports from the cluster.
Is ignorePolicy not supported anymore?

[chen-keinan]

@KateFiroozi can you please share you configuration.
by the snippet you put above its look like :

# ignorePolicy: |
  #   # applies to all other workloads
  ignorePolicy.kube-system.azure-.: 

# ignorePolicy is commented

[KateFiroozi]

link to issue: #1986

from values.yaml:

  # ignorePolicy.application.my-app-.: |
  #   # applies to all workloads in namespace "application" with the name pattern "my-app-*"
  # ignorePolicy.kube-system: |
  #   # applies to all workloads in namespace "kube-system"
  # ignorePolicy: |
  #   # applies to all other workloads

In my config, I am using this format # ignorePolicy.application.my-app-.: |:

   ignorePolicy.kube-system.azure-.: |
     package trivy

     import data.lib.trivy

     default ignore = true

[chen-keinan]

the issue has been resolved?

[KateFiroozi]

yes