checkov icon indicating copy to clipboard operation
checkov copied to clipboard

Make skipping checks framework-aware

Open ferrarimarco opened this issue 8 months ago • 5 comments

Describe the issue

Hi! In our repository, we have two directories:

  • A set of plain Kubernetes descriptors. Example: a deployment that doesn't need any templating, so no Kustomize, no Helm...
  • A set of Kubernetes descriptors that we customize with Kustomize.

We're running Checkov as follows: checkov --config-file /path-to-config-file/.checkov.yaml

The config file is quite simple:

---
directory:
  - path/to/the/directory/containing/the/two/directories/mentioned/above

quiet: false
...

kustomize is available in the PATH, so we see the kustomize framework checks passing as expected.

Given that we don't specify any framework, Checkov also runs the kubernetes framework. The kubernetes framework reports some failures against the files that we customize with Kustomize, as expected, because Kustomize didn't run.

Is there a way we can configure Checkov to handle this use case without having to configure the specific frameworks we want to run?

Examples

https://github.com/super-linter/super-linter/pull/5763

Version (please complete the following information):

  • Checkov Version: 3.2.125

Additional context

The skipping mechanism and the baseline mechanism don't seem to take into account the framework.

ferrarimarco avatar Jun 18 '24 12:06 ferrarimarco