From 3f57bab9d3e1efc15c69c26f67b6410739c737f1 Mon Sep 17 00:00:00 2001
From: KaifAhmad1 <kaifahmad087@gmail.com>
Date: Wed, 24 Jun 2026 13:55:41 +0530
Subject: [PATCH] fix(ci): suppress false-positive checkov K8s checks on
 Knative YAML; drop redundant seccomp annotation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

checkov scans deploy/gcp/cloudrun-service.yaml as a Kubernetes resource
(it has apiVersion: serving.knative.dev/v1) and raises CKV_K8S_28 /
CKV_K8S_30. Adding those annotations to spec.template.metadata.annotations
caused checkov to crash (exit 1 with no SARIF output) — likely a bug in
checkov's AppArmor check when it tries to match the annotation container
name against containers in a Knative RevisionSpec. Fix:
  - Remove the AppArmor / seccomp annotations from the template metadata
  - Add checkov:skip comments at the file top so the false-positive checks
    are suppressed cleanly (Cloud Run enforces these at platform level)

Also drop the legacy seccomp.security.alpha.kubernetes.io/pod annotation
from deploy/helm/knowledge-explorer/values.yaml: run #186 confirmed that
the modern podSecurityContext.seccompProfile.type: RuntimeDefault field
already satisfies CKV_K8S_28 for the Helm chart without the annotation.
Adding the annotation alongside the modern field was causing the same
crash in checkov's Helm-rendered output.
---
 deploy/gcp/cloudrun-service.yaml           | 4 ++--
 deploy/helm/knowledge-explorer/values.yaml | 3 ---
 2 files changed, 2 insertions(+), 5 deletions(-)

diff --git a/deploy/gcp/cloudrun-service.yaml b/deploy/gcp/cloudrun-service.yaml
index 987fb862..2a48138d 100644
--- a/deploy/gcp/cloudrun-service.yaml
+++ b/deploy/gcp/cloudrun-service.yaml
@@ -1,3 +1,5 @@
+# checkov:skip=CKV_K8S_28:Cloud Run enforces seccomp at the platform level; this Knative YAML is not a K8s deployment
+# checkov:skip=CKV_K8S_30:Cloud Run enforces AppArmor at the platform level; this Knative YAML is not a K8s deployment
 apiVersion: serving.knative.dev/v1
 kind: Service
 metadata:
@@ -12,8 +14,6 @@ spec:
       annotations:
         autoscaling.knative.dev/minScale: "0"
         autoscaling.knative.dev/maxScale: "10"
-        container.apparmor.security.beta.kubernetes.io/explorer: runtime/default
-        seccomp.security.alpha.kubernetes.io/pod: runtime/default
     spec:
       containerConcurrency: 80
       timeoutSeconds: 300
diff --git a/deploy/helm/knowledge-explorer/values.yaml b/deploy/helm/knowledge-explorer/values.yaml
index 78577d88..7b5914b0 100644
--- a/deploy/helm/knowledge-explorer/values.yaml
+++ b/deploy/helm/knowledge-explorer/values.yaml
@@ -13,9 +13,6 @@ fullnameOverride: ""
 podAnnotations:
   # AppArmor — must match the container name defined in the Deployment template ("explorer").
   container.apparmor.security.beta.kubernetes.io/explorer: runtime/default
-  # Legacy seccomp annotation — required by older Terrascan/checkov versions
-  # that predate the seccompProfile field in PodSecurityContext.
-  seccomp.security.alpha.kubernetes.io/pod: runtime/default
 podLabels: {}
 
 podSecurityContext: