# Accepted misconfiguration findings, each with a reason and an expiry date.
#
# The expiry is the point. An ignore without one is a permanent hole that nobody revisits;
# trivy stops honouring these entries after the date, the gate goes red, and someone has to
# look again. Re-dating an entry is a decision. Letting it lapse silently is not possible.
#
# Nothing here is suppressed because it was inconvenient. Both entries are inherent to what
# a control plane that installs arbitrary Helm charts *is*, and both are documented in
# ARCHITECTURE.md under "The provisioner is privileged".

misconfigurations:
  - id: KSV-0041
    # "ClusterRole shouldn't have access to manage resource 'secrets'"
    #
    # This is true and it is the design. Helm stores release state as Secrets in the
    # release's namespace, so anything that runs `helm upgrade --install` must be able to
    # create and read Secrets there. The worker installs into a namespace per tenant, and
    # those namespaces are created at provision time, so the grant cannot be enumerated in
    # advance and ends up cluster-scoped.
    #
    # The consequence, stated plainly: svcforge can read any Secret in the cluster,
    # including ServiceAccount tokens, and can therefore impersonate any workload. It is a
    # privileged component. Treat compromise of the worker as compromise of the cluster.
    #
    # The real fix is per-namespace Roles bound at provision time, which needs RBAC write
    # permission — itself an escalation path unless carefully constrained. That is a
    # larger piece of work than this reference implementation takes on, and pretending
    # otherwise by hiding the finding would be worse than recording it.
    statement: "helm stores release state in Secrets; namespaces are created per tenant at runtime"
    expired_at: 2026-10-01

  - id: KSV-0056
    # "ClusterRole should not have create/update/delete on services, endpoints, ..."
    #
    # Same root cause. A chart that installs Elasticsearch creates a Service; the
    # provisioner has to be able to create it. The interception risk the rule describes is
    # real and follows from the same privileged position as KSV-0041.
    statement: "installing a chart necessarily creates the Services that chart defines"
    expired_at: 2026-10-01