Make operational container scanning severity filter configurable
Proposal
Operational Container Scanning runs Container Scanning in the context of a Kubernetes Cluster. This gives customers insight into what's actually deployed and running in their environments. Much like container scanning, the option to have Trivy filter out findings beneath a severity threshold is possible. We should allow users to configure this behavior as well, so that they can tailor reported vulnerabilities to their specification.
Implementation
-
Add a --severity
or--severity-threshold
flag to thetrivy-k8s-wrapper
. -
Update the gitlab-agent
project's wrapper schema, so that it exposes this configuration value. You can use Support custom ocs trivy k8s wrapper image (gitlab-org/cluster-integration/gitlab-agent!1733 - merged) as a reference point on how to do this. -
Update the configuration documentation
/cc @johncrowley @onaaman
Edited by Nick Ilieskou