IBM / portieris

A Kubernetes Admission Controller for verifying image trust.
Apache License 2.0
332 stars 78 forks source link

Withdraw support for Vulnerability Advisor policy. #431

Open sjhx opened 1 year ago

sjhx commented 1 year ago

Is your feature request related to a problem? Describe the feature request. We believe that the vulnerability advisor policy type is counterproductive because

  1. It prevents images with fewer but not zero vulnerabilities from being deployed. 1.1 although remaining vulnerabilities can be exempted this is also undesirable because IBM VA exemptions do not have expiry dates so cant be considered temporary
  2. Can "break production" because a live image can have vulnerabilities found which make id denied
  3. IBM Cloud VA is revising the api with v4 available now on opt in which we do not plan to support from Portieris.

Describe the solution that you'd like Recognising that this is a breaking change, remove support to VA policies in a new minor revision. Policies with the vulnerability option will cause image denial with a suitable message.
In a follow up breaking change we expect to revise the polocy schema to remove the vulnerability option.

Describe alternatives you've considered Continue to maintain support for v4 and beyond, discounted for reasons 1 and 2 above, possible but not desirable.

Additional context Add any other context or screenshots about the feature request.