mengzhx/semantica
1
0
Fork 0
mirror of https://github.com/semantica-agi/semantica.git synced 2026-08-29 04:26:20 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(ci): suppress CKV_K8S_21 false-positive on Cloud Run Knative YAML

Browse Source 
checkov scans deploy/gcp/cloudrun-service.yaml as a Kubernetes resource
because it has apiVersion: serving.knative.dev/v1. It flags CKV_K8S_21
('default namespace should not be used') because Cloud Run services have
no metadata.namespace field — they are project/region scoped, not
namespace scoped. Add CKV_K8S_21 to .checkov.yaml skip-check and to the
inline skip comment in cloudrun-service.yaml.
This commit is contained in:
KaifAhmad1
2026-06-24 14:13:00 +05:30
parent 52e8f38361
commit bacc37ab77
2 changed files with 12 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.checkov.yaml
+11 -5
View File
@@ -1,11 +1,17 @@
# Checkov configuration — applies when running checkov locally or via the
# bridgecrewio/checkov-action in CI.
#
# CKV_K8S_28 / CKV_K8S_30 are suppressed globally because
# deploy/gcp/cloudrun-service.yaml uses apiVersion: serving.knative.dev/v1
# which checkov scans as a Kubernetes resource. Cloud Run is a fully managed
# platform that enforces seccomp (CKV_K8S_28) and AppArmor (CKV_K8S_30) at
# the infrastructure level without requiring pod-level annotations.
# The rules below are suppressed because deploy/gcp/cloudrun-service.yaml uses
# apiVersion: serving.knative.dev/v1 which checkov scans as a Kubernetes resource.
# Cloud Run is a fully managed platform — K8s namespace, AppArmor, and seccomp
# concepts do not apply to it.
#
# CKV_K8S_21 — "default namespace should not be used": Cloud Run services have no
# namespace concept; checkov sees the absence of metadata.namespace
# as using the "default" namespace.
# CKV_K8S_28 — seccomp profile: Cloud Run enforces this at the platform level.
# CKV_K8S_30 — AppArmor profile: Cloud Run enforces this at the platform level.
skip-check:
- CKV_K8S_21
- CKV_K8S_28
- CKV_K8S_30
deploy/gcp/cloudrun-service.yaml
+1
View File
@@ -1,3 +1,4 @@
# checkov:skip=CKV_K8S_21:Cloud Run has no namespace concept; Knative services are project-scoped not namespace-scoped
# checkov:skip=CKV_K8S_28:Cloud Run enforces seccomp at the platform level; this Knative YAML is not a K8s deployment
# checkov:skip=CKV_K8S_30:Cloud Run enforces AppArmor at the platform level; this Knative YAML is not a K8s deployment
apiVersion: serving.knative.dev/v1