---
report_file: "docs/_data/cves.csv"
report_dir: "reports"
images_file: "images-sources.txt"
images_teams_file: "configs/images-teams.txt"
sources_teams_file: "configs/sources-teams.txt"
eol_file: "configs/eol.yml"
repo:
  git_url: "https://github.com/"
  owner: "rancherlabs"
  repo: "image-scanning"
  dashboard:
    title: "Image-Scanning Dashboard"
    label: "dashboard"
  issue:
    title: "[CVE Report]"
    label: "cve-report"
    label_prefix: "cve/"
    team_prefix: "team/"
    critical_label: "critical"
    mirrored_image_label: "image/mirrored"
    rancher_image_label: "image/rancher-built"
  issue_failure:
    title: "[Scan Failures] Failed images"
    label: "scan-failure"
cves:
  status:
    default: "under_investigation"
    not_affected: "not_affected"
    affected: "affected"
    fixed: "fixed"
  justification:
    jus_1: "component_not_present"
    jus_2: "vulnerable_code_not_present"
    jus_3: "vulnerable_code_not_in_execute_path"
    jus_4: "vulnerable_code_cannot_be_controlled_by_adversary"
    jus_5: "inline_mitigations_already_exist"
    jus_6: "upstream"
labels:
  teams:
    - collie
    - elemental
    - fleet
    - frameworks
    - harvester
    - highlander
    - hostbusters
    - longhorn
    - mapps
    - neuvector
    - observation_backup
    - rke2-k3s
    - security
    - socket
    - windows
images:
  # The tier 1 images is a small subset of core images published by Rancher in
  # each release. These images are built by us (are not mirrored). They are
  # considered critical in terms of exposure and visibility to customers. These
  # must be the first images to be prioritized when fixing CVEs.
  # Add new tear 1 images here, and then add their team ownership in the
  # configs/images-teams.txt file.
  tier1:
    # Rancher
    - rancher/aks-operator
    - rancher/backup-restore-operator
    - rancher/cis-operator
    - rancher/eks-operator
    - rancher/fleet
    - rancher/fleet-agent
    - rancher/gitjob
    - rancher/gke-operator
    - rancher/hardened-kubernetes
    - rancher/hyperkube
    - rancher/k3s-upgrade
    - rancher/machine
    - rancher/nginx-ingress-controller
    - rancher/rancher
    - rancher/rancher-agent
    - rancher/rancher-csp-adapter
    - rancher/rancher-webhook
    - rancher/rke2-cloud-provider
    - rancher/rke2-runtime
    - rancher/rke2-upgrade
    - rancher/rke-tools
    - rancher/security-scan
    - rancher/shell
    - rancher/system-agent
    - rancher/system-agent-installer-k3s
    - rancher/system-agent-installer-rke2
    - rancher/system-upgrade-controller
    - rancher/ui-plugin-operator
    # Harvester
    - rancher/support-bundle-kit
    - rancher/harvester
    - rancher/harvester-cluster-repo
    - rancher/harvester-eventrouter
    - rancher/harvester-load-balancer
    - rancher/harvester-load-balancer-webhook
    - rancher/harvester-network-controller
    - rancher/harvester-network-helper
    - rancher/harvester-network-webhook
    - rancher/harvester-node-disk-manager
    - rancher/harvester-node-manager
    - rancher/harvester-node-manager-webhook
    - rancher/harvester-pcidevices
    - rancher/harvester-seeder
    - rancher/harvester-upgrade
    - rancher/harvester-vm-import-controller
    - rancher/harvester-webhook
    # Longhorn
    - longhornio/backing-image-manager
    - longhornio/csi-attacher
    - longhornio/csi-node-driver-registrar
    - longhornio/csi-provisioner
    - longhornio/csi-resizer
    - longhornio/csi-snapshotter
    - longhornio/livenessprobe
    - longhornio/longhorn-engine
    - longhornio/longhorn-instance-manager
    - longhornio/longhorn-manager
    - longhornio/longhorn-share-manager
    - longhornio/longhorn-ui
    - longhornio/support-bundle-kit
scanner:
  tool: "trivy"
  scanners: "vuln"
  format: "json"
  report: "scan.json"
  severity: "CRITICAL,HIGH"
