checkov
checkov copied to clipboard
Make skipping checks framework-aware
Describe the issue
Hi! In our repository, we have two directories:
- A set of plain Kubernetes descriptors. Example: a deployment that doesn't need any templating, so no Kustomize, no Helm...
- A set of Kubernetes descriptors that we customize with Kustomize.
We're running Checkov as follows: checkov --config-file /path-to-config-file/.checkov.yaml
The config file is quite simple:
---
directory:
- path/to/the/directory/containing/the/two/directories/mentioned/above
quiet: false
...
kustomize
is available in the PATH
, so we see the kustomize
framework checks passing as expected.
Given that we don't specify any framework, Checkov also runs the kubernetes
framework. The kubernetes
framework reports some failures against the files that we customize with Kustomize, as expected, because Kustomize didn't run.
Is there a way we can configure Checkov to handle this use case without having to configure the specific frameworks we want to run?
Examples
https://github.com/super-linter/super-linter/pull/5763
Version (please complete the following information):
- Checkov Version:
3.2.125
Additional context
The skipping mechanism and the baseline mechanism don't seem to take into account the framework.