🤖 Generated by the Daily AI Engineer
Problem
The headlamp-exceptions ConfigMap (k8s/bases/infrastructure/controllers/kubescape/config-map-headlamp-exceptions.yaml) is a hand-maintained JSON mirror of the ClusterSecurityException CRs, and it has drifted badly:
- 4 CSEs are missing entirely from the mirror:
kubescape-privileged, readonly-rootfs-pending, talos-cis-control-plane-false-positives, talos-cis-worker-false-positives.
- Resource scopes diverge:
delete-capable-rbac-by-design has 26 matchers in the CRs but 3 in the mirror; batch-workloads 2 vs 1; pod-security-mutations control counts differ (4 vs 5).
The Headlamp Kubescape plugin therefore shows a different (stale) exception set than the operator and CI actually apply — the UI mis-reports posture.
Proposed direction
Stop hand-maintaining the mirror: scripts/generate-kubescape-exceptions.py (added by #2584) already derives the exact PostureExceptionPolicy JSON from the CSE CRs. Either regenerate the ConfigMap's exceptionPolicies key from that output (with a CI drift check comparing the two), or — better long-term — drop the mirror once the Headlamp plugin can read the CRDs directly (upstream capability to verify). Reason strings may need light copy-editing for UI brevity, which the generator's output can carry as-is.
Rough size
S–M — one script/CI hookup plus a regenerated ConfigMap; the compare-and-fail drift gate is the part worth doing carefully.
Part of #2447.
Problem
The
headlamp-exceptionsConfigMap (k8s/bases/infrastructure/controllers/kubescape/config-map-headlamp-exceptions.yaml) is a hand-maintained JSON mirror of theClusterSecurityExceptionCRs, and it has drifted badly:kubescape-privileged,readonly-rootfs-pending,talos-cis-control-plane-false-positives,talos-cis-worker-false-positives.delete-capable-rbac-by-designhas 26 matchers in the CRs but 3 in the mirror;batch-workloads2 vs 1;pod-security-mutationscontrol counts differ (4 vs 5).The Headlamp Kubescape plugin therefore shows a different (stale) exception set than the operator and CI actually apply — the UI mis-reports posture.
Proposed direction
Stop hand-maintaining the mirror:
scripts/generate-kubescape-exceptions.py(added by #2584) already derives the exactPostureExceptionPolicyJSON from the CSE CRs. Either regenerate the ConfigMap'sexceptionPolicieskey from that output (with a CI drift check comparing the two), or — better long-term — drop the mirror once the Headlamp plugin can read the CRDs directly (upstream capability to verify). Reason strings may need light copy-editing for UI brevity, which the generator's output can carry as-is.Rough size
S–M — one script/CI hookup plus a regenerated ConfigMap; the compare-and-fail drift gate is the part worth doing carefully.
Part of #2447.