telekom-mms / trivy-dojo-report-operator

This Kubernetes operator listens for vulnerability reports generated by the Trivy Operator and forwards them to Defect Dojo for further analysis and tracking.
GNU General Public License v3.0
13 stars 15 forks source link

Allow variable DEFECT_DOJO_PRODUCT_TYPE_NAME empty #83

Closed tidusete closed 2 weeks ago

tidusete commented 2 weeks ago

Change default DEFECT_DOJO_PRODUCT_TYPE_NAME to allow empty values

Description

This MR modifies the default value of DEFECT_DOJO_PRODUCT_TYPE_NAME to allow empty strings as valid values. The change is motivated by the DefectDojo API's reimport-scan endpoint behavior, which only requires product_name and engagement_name for scan reimports, making the product_type_name parameter optional. This aligns our implementation with the API's capabilities and simplifies the configuration when using reimport functionality.

Technical Context

  1. The DefectDojo API endpoint reimport-scan can operate with just:

    • product_name
    • engagement_name
  2. Current Implementation Issue:

    • With the mandatory product_type_name configuration, if a product already exists in DefectDojo with the same name but under a different product_type, the API call fails due to a conflict
    • This forces users to ensure product_type alignment even when it's not necessary for the reimport operation
    • Making product_type_name optional avoids these conflicts and allows better integration with existing DefectDojo products

Changes

Documentation

Updated README.md to reflect the new default value and usage options, including explanation of API endpoint behavior and conflict resolution.