Disabling rego policies

[benglewis]

Hi 👋 ,

I am using GitHub Container Registry for my Docker images in my Kubernetes cluster and I get multiple MEDIUM level security risks raised by trivy-operator, the checks KSV032 (image must be from Azure container registry), KSV033 (image must be from GCP GCR), KSV034 (image must not start with an empty prefix or a defined public registry domain) KSV035 (image must be from AWS ECR).

Is there any way to disable these checks? Is there a particular reason that Azure container registry/GCP GCR/AWS ECR are preferred over GitHub Container Register (GHCR) or Docker Hub?

[chen-keinan]

@benglewis are you looking to disable specific rego policies or all together ?

[benglewis]

Specific ones

[chen-keinan]

@benglewis currently is not supported but could be a nice enhancement, do you mind opening an issue for it ?

[gueguet]

Hello !

@chen-keinan does it mean that the ignoreFile key has no impact for configauditreport object ? Is it only impacting vulnerabilityreports ?

Thanks !

[chen-keinan]

correct