This Kubernetes operator listens for vulnerability reports generated by the Trivy Operator and forwards them to Defect Dojo for further analysis and tracking.
Change default DEFECT_DOJO_PRODUCT_TYPE_NAME to allow empty values
Description
This MR modifies the default value of DEFECT_DOJO_PRODUCT_TYPE_NAME to allow empty strings as valid values. The change is motivated by the DefectDojo API's reimport-scan endpoint behavior, which only requires product_name and engagement_name for scan reimports, making the product_type_name parameter optional. This aligns our implementation with the API's capabilities and simplifies the configuration when using reimport functionality.
Technical Context
The DefectDojo API endpoint reimport-scan can operate with just:
product_name
engagement_name
Current Implementation Issue:
With the mandatory product_type_name configuration, if a product already exists in DefectDojo with the same name but under a different product_type, the API call fails due to a conflict
This forces users to ensure product_type alignment even when it's not necessary for the reimport operation
Making product_type_name optional avoids these conflicts and allows better integration with existing DefectDojo products
Changes
Update README.md to document empty string as a valid option for DEFECT_DOJO_PRODUCT_TYPE_NAME
Modify src/settings.py to set default DEFECT_DOJO_PRODUCT_TYPE_NAME to empty string
Documentation
Updated README.md to reflect the new default value and usage options, including explanation of API endpoint behavior and conflict resolution.
Change default DEFECT_DOJO_PRODUCT_TYPE_NAME to allow empty values
Description
This MR modifies the default value of DEFECT_DOJO_PRODUCT_TYPE_NAME to allow empty strings as valid values. The change is motivated by the DefectDojo API's
reimport-scan
endpoint behavior, which only requiresproduct_name
andengagement_name
for scan reimports, making theproduct_type_name
parameter optional. This aligns our implementation with the API's capabilities and simplifies the configuration when using reimport functionality.Technical Context
The DefectDojo API endpoint
reimport-scan
can operate with just:Current Implementation Issue:
Changes
Documentation
Updated README.md to reflect the new default value and usage options, including explanation of API endpoint behavior and conflict resolution.