I can't get configauditreport with Conftest Scanner

[sofiafernandezmoreno]

I'm using this starboard-conftest-config but I can't create any configaudit with Conftest Scanner

apiVersion: v1
data:
  conftest.imageRef: openpolicyagent/conftest:v0.30.0
  conftest.createConfig: 'true'
  conftest.resources.limits.cpu: 300m
  conftest.resources.limits.memory: 300M
  conftest.resources.requests.cpu: 50m
  conftest.resources.requests.memory: 50M
  conftest.library.configmap.rego: |
    package kubernetes.validating.configmap

    import future.keywords.in

    sensitive_denylist := [
      "pass",
      "secret",
      "key",
      "token",
      "password",
      "username",
    ]

    check_sensitive(keys, denylist) {
      _ = keys[key]
      contains(key, denylist[_])
    }

    deny[msg] {
      input.kind == "ConfigMap"
      input.data = keys
      check_sensitive(keys, sensitive_denylist)
      msg := {
        "publicId": "K00001",
        "title": "ConfigMap exposes sensitive data",
        "severity": "high",
        "msg": "input.data",
        "issue": "",
        "impact": "",
        "remediation": "",
        "references": [],
      }
    }

kind: ConfigMap
metadata:
  name: starboard-conftest-config
  namespace: starboard-system

Otherwise, I'm using thisConfigMap to get the correct scanner:

apiVersion: v1
kind: ConfigMap
metadata:
  namespace: starboard-system
  name: starboard
  labels:
    helm.sh/chart: starboard-operator-0.10.2
    app.kubernetes.io/name: starboard-operator
    app.kubernetes.io/instance: starboard-operator
    app.kubernetes.io/version: 0.15.2
    app.kubernetes.io/managed-by: Helm
data:
  vulnerabilityReports.scanner: Trivy
  kube-bench.imageRef: docker.io/aquasec/kube-bench:v0.6.6
  compliance.failEntriesLimit: '10'
  configAuditReports.scanner: Conftest

I don't want getting scanner of Stardboard:

kubectl get configaudit -A                                                         SIGINT(2) ↵  10187  19:34:28  
NAMESPACE            NAME                                           SCANNER     AGE
default              replicaset-nginx-6799fc88d8                    Starboard   6m14s
local-path-storage   replicaset-local-path-provisioner-547f784dff   Starboard   19m

[danielpacak]

In Starboard v0.15.0+ we'll be using built-in configuration audit scanner, which is much more efficient than plugin-based scanners such as Conftest. What's more, we're going to remove plugin-based scanners and maintain only the built-in scanner.

Anyways, if you still want to use Conftest in v0.15.0 you can do that by setting these environment variables:

• OPERATOR_CONFIG_AUDIT_SCANNER_ENABLED=true
• OPERATOR_CONFIG_AUDIT_SCANNER_BUILTIN=false

PS It's quite easy to migrate Conftest policies to the built-in scanner based on this tutorial.