Fix: enable SecurityException CRDs in keepLocal mode#349
Conversation
MockPlatform.GetCVEExceptions() was returning empty, bypassing SecurityException CRDs when kubevuln runs without cloud credentials. - Add SecurityExceptionRepository to MockPlatform - Lift seRepo initialization before the keepLocal/cloud branch - Export ConvertToVulnerabilityExceptionPolicies for cross-package use - MockPlatform.GetCVEExceptions now reads CRDs via the repository Note: In keepLocal mode, exceptions are read and available via GetCVEExceptions, but SubmitCVE (which applies exceptions to reports) is a no-op. This will be addressed when the operator watcher triggers full rescans in Phase 2. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: Ben <ben@armosec.io>
|
Warning Rate limit exceeded
Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 6 minutes and 23 seconds. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
📝 WalkthroughWalkthroughThis pull request integrates CRD-based security exception handling into the CVE scanning pipeline. The mock platform now accepts a security exception repository and conditionally returns CRD-derived exception policies. Security exceptions are applied to CVE manifests during scanning to move ignored matches to the ignored list. CRD client configuration is enhanced with improved performance parameters. Changes
Sequence DiagramsequenceDiagram
participant ScanService
participant MockPlatform
participant SecurityExceptionRepo
participant Adapter as v1.Adapter
participant CVEManifest as GrypeDocument
ScanService->>MockPlatform: GetCVEExceptions(ctx)
MockPlatform->>SecurityExceptionRepo: GetSecurityExceptions(namespace)
SecurityExceptionRepo-->>MockPlatform: seList, cseList
MockPlatform->>Adapter: ConvertToVulnerabilityExceptionPolicies()
Adapter-->>MockPlatform: vulnExceptionList
MockPlatform-->>ScanService: domain.CVEExceptions
ScanService->>ScanService: applyExceptionsToManifest(cve)
ScanService->>Adapter: ApplySecurityExceptions(doc, exceptions)
Adapter->>CVEManifest: Iterate Matches
Adapter->>CVEManifest: Move match to IgnoredMatches
Adapter->>CVEManifest: Set AppliedIgnoreRules
Adapter-->>ScanService: filtered CVEManifest
ScanService->>ScanService: Store filtered CVE & summary
Estimated code review effort🎯 4 (Complex) | ⏱️ ~60 minutes Possibly related PRs
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Summary:
|
Moves excepted CVEs from GrypeDocument.Matches to IgnoredMatches with AppliedIgnoreRules for audit trail. Respects expiredOnFix. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: Ben <ben@armosec.io>
Calls platform.GetCVEExceptions and filters GrypeDocument.Matches before StoreCVE/StoreCVESummary. Excepted CVEs move to IgnoredMatches. Applies to all three scan paths: full CVE, filtered CVE, and ScanCVE. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: Ben <ben@armosec.io>
The ScanCVE and ScanCP methods skip the CVE scan when a cached manifest exists, which also skipped exception filtering. Now exceptions are applied to cached manifests too, and the filtered result is re-stored. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: Ben <ben@armosec.io>
The dynamic client for SecurityException CRDs shares the default rate limiter (QPS=5) with the typed client, causing context canceled errors during concurrent scans. Give it a dedicated config with higher QPS/Burst limits. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: Ben <ben@armosec.io>
The scan context may be canceled by rate limiting before the dynamic client completes the CRD listing. Use a detached context with a 30s timeout for SecurityException listing. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: Ben <ben@armosec.io>
Manual Test Results (kind cluster)Tested all 10 user stories from the test plan:
Evidence: nginx:1.21 scan: 616 matches → 607 matches + 9 in Bugs found and fixed during testing:
|
|
Summary:
|
There was a problem hiding this comment.
Pull request overview
This PR aims to ensure SecurityException CRDs are respected when kubevuln runs in keepLocal mode by wiring the SecurityException repository into the local (MockPlatform) path and applying the resulting exception policies during scanning.
Changes:
- Wire
SecurityExceptionRepositoryinto keepLocal mode (MockPlatform.GetCVEExceptions) and initialize it for both keepLocal/cloud incmd/http/main.go. - Apply SecurityException policies to Grype CVE manifests during
ScanCPandScanCVE, and exportConvertToVulnerabilityExceptionPoliciesfor cross-package use. - Adjust APIServer CRD listing behavior (dynamic client config + detached timeout context) and update/add unit tests.
Reviewed changes
Copilot reviewed 10 out of 10 changed files in this pull request and generated 6 comments.
Show a summary per file
| File | Description |
|---|---|
| repositories/apiserver.go | Tunes dynamic client config and changes CRD listing to use a detached timeout context. |
| core/services/scan.go | Applies exceptions to manifests before persisting and adds helper applyExceptionsToManifest. |
| core/services/scan_test.go | Updates mock platform construction to match new signature. |
| cmd/http/main.go | Initializes SecurityException repo for both keepLocal and cloud paths; passes repo to platform. |
| cmd/http/main_test.go | Updates mock platform construction to match new signature. |
| adapters/v1/securityexception.go | Exports conversion helper and adds ApplySecurityExceptions that mutates Grype docs. |
| adapters/v1/securityexception_test.go | Updates conversion tests and adds tests for ApplySecurityExceptions. |
| adapters/v1/backend.go | Updates callsite to exported conversion helper. |
| adapters/mockplatform.go | Adds SecurityException repo to keepLocal platform path and reads CRDs in GetCVEExceptions. |
| adapters/mockplatform_test.go | Updates mock platform construction to match new signature. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| var remaining []v1beta1.Match | ||
| for _, m := range doc.Matches { | ||
| isFixed := m.Vulnerability.Fix.State == "fixed" | ||
| matched := getCVEExceptionMatchCVENameFromList(exceptions, m.Vulnerability.ID, isFixed) | ||
| if len(matched) > 0 { |
There was a problem hiding this comment.
ApplySecurityExceptions decides to ignore a match solely based on CVE ID (getCVEExceptionMatchCVENameFromList) and whether the vuln is fixed. It does not evaluate the exception scope (e.g., Designatores produced from spec.match.resources, namespace-only vs specific workload, etc.). Since CRD exceptions are listed at namespace/cluster scope and then merged, this can incorrectly ignore CVEs for unrelated workloads in the same namespace. Recommend filtering the exception list to the current workload (namespace/kind/name/container/image) before applying, or updating the matching logic to require a designator/resource match in addition to CVE ID.
There was a problem hiding this comment.
Acknowledged — manifests are per-image not per-workload, so designator/resource matching can't be applied at this level. This is a known Phase 1 limitation documented in the test plan (US5). Phase 2 adds workload-scoped handling.
| // applyExceptionsToManifest filters the CVE manifest using SecurityException policies. | ||
| func (s *ScanService) applyExceptionsToManifest(ctx context.Context, cve *domain.CVEManifest) { | ||
| if cve == nil || cve.Content == nil { | ||
| return | ||
| } | ||
| exceptions, err := s.platform.GetCVEExceptions(ctx) | ||
| if err != nil { | ||
| logger.L().Ctx(ctx).Warning("failed to get CVE exceptions for filtering", helpers.Error(err)) | ||
| return | ||
| } | ||
| if len(exceptions) > 0 { | ||
| v1.ApplySecurityExceptions(cve.Content, exceptions) | ||
| } |
There was a problem hiding this comment.
PR description notes that in keepLocal mode exceptions are read but do not affect the stored VulnerabilityManifest (raw Grype output). With the new applyExceptionsToManifest calls before StoreCVE/StoreCVESummary, exceptions will now alter what gets persisted (when c.Storage is true), changing that behavior. Either update the PR description/docs to match the new behavior, or adjust the implementation to preserve raw manifests and apply exceptions only for reporting.
There was a problem hiding this comment.
Good catch — the description was from the initial commit before we added manifest filtering. Will update.
| // apply security exceptions before storing | ||
| s.applyExceptionsToManifest(ctx, &cvep) | ||
|
|
There was a problem hiding this comment.
ScanCP calls platform.GetCVEExceptions multiple times per container scan (once for cve, once for cvep, and then again inside BackendAdapter.SubmitCVE). In cloud mode this can add extra backend round-trips per scan. Consider caching exceptions for the scan context (e.g., store them in ctx/value once) or restructuring so exceptions are fetched once and reused for filtering + submission.
There was a problem hiding this comment.
Valid optimization. For keepLocal mode it's just a dynamic client list (fast). For cloud mode, SubmitCVE has its own GetCVEExceptions call which we can't easily deduplicate without a larger refactor. Will consider caching in a follow-up.
| // Use a detached context with timeout — the scan context may be canceled | ||
| // before the CRD listing completes due to rate limiting. | ||
| listCtx, cancel := context.WithTimeout(context.Background(), 30*time.Second) |
There was a problem hiding this comment.
GetSecurityExceptions creates listCtx from context.Background(), which drops request-scoped values (trace/span, logger fields, auth info carried via ctx values). Since the goal is only to avoid cancellation, prefer deriving from context.WithoutCancel(ctx) and then applying the timeout, so listing is still correlated with the original request/trace while remaining resilient to cancellation.
| // Use a detached context with timeout — the scan context may be canceled | |
| // before the CRD listing completes due to rate limiting. | |
| listCtx, cancel := context.WithTimeout(context.Background(), 30*time.Second) | |
| // Preserve request-scoped context values while avoiding cancellation from | |
| // the scan context, then bound the listing with a timeout. | |
| listCtx, cancel := context.WithTimeout(context.WithoutCancel(ctx), 30*time.Second) |
There was a problem hiding this comment.
Fixed in 01b049f — using context.WithoutCancel(ctx) now. Good suggestion.
| // apply security exceptions before storing | ||
| s.applyExceptionsToManifest(ctx, &cve) | ||
|
|
There was a problem hiding this comment.
applyExceptionsToManifest mutates cve.Content in-place before both storage and platform.SubmitCVE. In cloud mode, BackendAdapter.SubmitCVE converts only GrypeDocument.Matches (it ignores IgnoredMatches), so moving findings out of Matches will cause ignored CVEs to be omitted from the uploaded report rather than being reported with exception metadata. Consider either (a) applying exceptions on a deep copy used only for local storage, or (b) extending the reporting conversion to also handle IgnoredMatches (or avoid mutating the document before submission).
There was a problem hiding this comment.
Fixed in 01b049f — applyExceptionsToManifest now returns a deep copy. Original is preserved for SubmitCVE, filtered copy used only for storage.
| // apply security exceptions to cached manifest | ||
| s.applyExceptionsToManifest(ctx, &cve) | ||
|
|
||
| if s.storage { | ||
| // store summary CVE if it does not exist | ||
| if cveSumm, err := s.cveRepository.GetCVESummary(ctx); err != nil || cveSumm == nil { | ||
| err = s.cveRepository.StoreCVESummary(ctx, cve, domain.CVEManifest{}, false) | ||
| if err != nil { | ||
| logger.L().Ctx(ctx).Warning("storing CVE summary", helpers.Error(err), | ||
| helpers.String("imageSlug", slug)) | ||
| // no continue, storing the CVE summary is not critical | ||
| } | ||
| // re-store with exceptions applied | ||
| err = s.cveRepository.StoreCVE(ctx, cve, false) | ||
| if err != nil { | ||
| logger.L().Ctx(ctx).Warning("storing CVE with exceptions", helpers.Error(err), | ||
| helpers.String("imageSlug", slug)) | ||
| // no continue, storing the CVE is not critical | ||
| } | ||
| err = s.cveRepository.StoreCVESummary(ctx, cve, domain.CVEManifest{}, false) | ||
| if err != nil { |
There was a problem hiding this comment.
In the cached-manifest branch, the code applies exceptions and then overwrites the stored CVE/summary with the filtered document. This makes exception changes non-reversible without a full rescan (e.g., removing an exception won't bring the CVE back because it was persisted out of Matches). To keep behavior correct when CRDs change, consider keeping the stored manifest raw and applying exceptions only at report/render time, or storing filtered output separately from the raw cache.
There was a problem hiding this comment.
Fixed in 01b049f — cache-hit branches now only re-store when exceptions actually changed the manifest (len(filtered.IgnoredMatches) > len(original.IgnoredMatches)). Also, Phase 2 operator watcher will trigger rescans when CRDs change.
matthyx
left a comment
matthyx
left a comment
There was a problem hiding this comment.
A few concerns around correctness and cache behavior — see inline comments. Great catch on the MockPlatform wiring gap; the core fix is right, but I think the manifest-mutation approach and the cache-hit rewrite need another look before merge.
| if err != nil { | ||
| logger.L().Ctx(ctx).Warning("storing CVE summary with exceptions", helpers.Error(err), | ||
| helpers.String("imageSlug", slug)) | ||
| // no continue, storing the CVE summary is not critical |
There was a problem hiding this comment.
This cache-hit branch used to be:
if cveSumm, err := s.cveRepository.GetCVESummary(ctx); err != nil || cveSumm == nil {
StoreCVESummary(ctx, cve, domain.CVEManifest{}, false)
}i.e. write the summary only if missing. The new code unconditionally writes both StoreCVE and StoreCVESummary on every cache hit. Two issues:
- Doubled API-server writes on every cached scan. For busy clusters this is a meaningful increase in load on the storage backend.
- Overwrites relevancy data with empty
cvep.StoreCVESummary(ctx, cve, domain.CVEManifest{}, false)passes an empty CVE' manifest. If a priorScanCPrun stored a summary that included a real relevant-CVE manifest, this cache-hit path now clobbers it with an empty one. The oldif cveSumm == nilguard prevented that.
Consider either (a) keeping the guard and only re-storing when the stored manifest predates exception application, or (b) loading the existing summary's cvep and passing it through instead of domain.CVEManifest{}. Same issue applies in ScanCVE below.
There was a problem hiding this comment.
Fixed in 01b049f — restored the guard. Cache-hit branch only re-stores when len(filteredCve.Content.IgnoredMatches) > len(cve.Content.IgnoredMatches), preserving the original skip-if-summary-exists behavior and avoiding clobbering relevancy data.
…eck Ignore action - applyExceptionsToManifest returns a filtered copy, preserving the original for SubmitCVE (cloud reports keep ExceptionApplied metadata) - Cache-hit branches only re-store when exceptions actually changed the manifest (avoids unnecessary writes, preserves relevancy data) - ApplySecurityExceptions now checks for Ignore action before filtering - Use context.WithoutCancel instead of context.Background for CRD listing Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: Ben <ben@armosec.io>
Good points! Addressed all of them |
|
Summary:
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
core/services/scan.go (1)
336-364:⚠️ Potential issue | 🟠 Major
cvep.Wlidis no longer set —StoreVEXandSubmitCVEreceive aWlid-less manifest.In the previous version,
cvep.Wlidwas assigned before storage and filtering. After this refactor,filteredCvep.Wlid = scan.Wlidis set on the filtered copy only; the originalcvep(used at line 354 forStoreVEXand line 364 forplatform.SubmitCVE) keeps whatever Wlid value it had before. SinceapplyExceptionsToManifestperforms a shallow copy of the CVE manifest struct, writing tofilteredCvep.Wliddoes not affectcvep.Wlid. This causes cloud reporting and VEX storage to receive manifests without the assigned Wlid.🛠 Suggested fix — set Wlid on the original before filtering
- // apply security exceptions for storage (copy — original stays intact for SubmitCVE) - filteredCvep := s.applyExceptionsToManifest(ctx, cvep) - - // store filtered CVE' - if s.storage { - filteredCvep.Wlid = scan.Wlid - err = s.cveRepository.StoreCVE(ctx, filteredCvep, true) + // set Wlid on the original so it flows to SubmitCVE/StoreVEX as well + cvep.Wlid = scan.Wlid + + // apply security exceptions for storage (copy — original stays intact for SubmitCVE) + filteredCvep := s.applyExceptionsToManifest(ctx, cvep) + + // store filtered CVE' + if s.storage { + err = s.cveRepository.StoreCVE(ctx, filteredCvep, true)🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@core/services/scan.go` around lines 336 - 364, The problem is that applyExceptionsToManifest returns a shallow copy so setting filteredCvep.Wlid = scan.Wlid only updates the copy and leaves cvep.Wlid unset, causing StoreVEX (cveRepository.StoreVEX) and platform.SubmitCVE to receive manifests without Wlid; fix by assigning the Wlid to the original manifest before filtering (set cvep.Wlid = scan.Wlid prior to calling applyExceptionsToManifest or immediately after obtaining scan.Wlid and before calls to StoreVEX/SubmitCVE) so both cvep and filteredCvep carry the Wlid when you call cveRepository.StoreVEX and s.platform.SubmitCVE.
♻️ Duplicate comments (1)
adapters/v1/securityexception.go (1)
89-112:⚠️ Potential issue | 🟠 Major
ExceptionAppliedmetadata still lost; cloud-modeSummarizestats may regress.
hasIgnoreActionresolves the "Actions not checked" concern, but the second concern from the prior review is still open: by mutatingdoc.Matchesup-front and recording onlyAppliedIgnoreRules: [{Vulnerability: ID}], the link to the originating policy (GUID/name/Actions) is dropped beforeBackendAdapter.SubmitCVErunsSummarize.Summarizeinadapters/v1/backend_utils.gorelies onExceptionApplied[0].Actions[0] == armotypes.Ignoreto populateExcludedSeveritiesStats, so cloud-mode excluded-severity counts will likely be understated oncescan.applyExceptionsToManifestremoves these matches before submission.Worth confirming excluded-severity stats in cloud mode still match pre-PR behavior, or gating the manifest mutation to the storage/keepLocal path and leaving
Summarize-driven filtering intact for cloud submission.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@adapters/v1/securityexception.go` around lines 89 - 112, ApplySecurityExceptions currently drops the original exception metadata by appending only {Vulnerability: ID} to AppliedIgnoreRules and removing matches, which breaks Summarize's reliance on ExceptionApplied.Actions; fix this by preserving the full exception rule info returned by getCVEExceptionMatchCVENameFromList (including GUID/name and ExceptionApplied/Actions) when building v1beta1.IgnoredMatch.AppliedIgnoreRules instead of emitting a minimal Vulnerability-only rule, and/or avoid mutating doc.Matches for cloud submissions so BackendAdapter.SubmitCVE -> Summarize still sees ExceptionApplied; update ApplySecurityExceptions (and its use of hasIgnoreAction/getCVEExceptionMatchCVENameFromList) to copy the full rule metadata required by Summarize.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@adapters/v1/securityexception_test.go`:
- Around line 215-238: The test TestApplySecurityExceptions_ExpiredOnFix
currently passes for the wrong reason because the exception lacks an Ignore
action; update the test's CVEExceptions item to include Actions:
[]string{"Ignore"} so hasIgnoreAction returns true and the ExpiredOnFix path is
actually exercised in ApplySecurityExceptions (reference CVEExceptions,
hasIgnoreAction, ApplySecurityExceptions); additionally add a negative-control
subcase where ExpiredOnFix is false or nil (same exception with Actions:
["Ignore"]) and assert that when a matching fix exists the match is moved into
doc.IgnoredMatches, while when ExpiredOnFix=true it remains in doc.Matches.
In `@core/services/scan.go`:
- Line 347: The call to s.cveRepository.StoreCVESummary on the CVEP path passes
the unfiltered variable `cve` which causes ignored matches not to be reflected
in the stored summary; change the first argument to `filteredCve` (so call
StoreCVESummary(ctx, filteredCve, filteredCvep, true)) to mirror the new-CVE
path behavior and ensure summaries reflect filtering (update the invocation
where `cve` is currently passed and optionally add a brief comment explaining
the consistency).
---
Outside diff comments:
In `@core/services/scan.go`:
- Around line 336-364: The problem is that applyExceptionsToManifest returns a
shallow copy so setting filteredCvep.Wlid = scan.Wlid only updates the copy and
leaves cvep.Wlid unset, causing StoreVEX (cveRepository.StoreVEX) and
platform.SubmitCVE to receive manifests without Wlid; fix by assigning the Wlid
to the original manifest before filtering (set cvep.Wlid = scan.Wlid prior to
calling applyExceptionsToManifest or immediately after obtaining scan.Wlid and
before calls to StoreVEX/SubmitCVE) so both cvep and filteredCvep carry the Wlid
when you call cveRepository.StoreVEX and s.platform.SubmitCVE.
---
Duplicate comments:
In `@adapters/v1/securityexception.go`:
- Around line 89-112: ApplySecurityExceptions currently drops the original
exception metadata by appending only {Vulnerability: ID} to AppliedIgnoreRules
and removing matches, which breaks Summarize's reliance on
ExceptionApplied.Actions; fix this by preserving the full exception rule info
returned by getCVEExceptionMatchCVENameFromList (including GUID/name and
ExceptionApplied/Actions) when building v1beta1.IgnoredMatch.AppliedIgnoreRules
instead of emitting a minimal Vulnerability-only rule, and/or avoid mutating
doc.Matches for cloud submissions so BackendAdapter.SubmitCVE -> Summarize still
sees ExceptionApplied; update ApplySecurityExceptions (and its use of
hasIgnoreAction/getCVEExceptionMatchCVENameFromList) to copy the full rule
metadata required by Summarize.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 9d9d5c6a-1d93-4e59-b612-a1fe6e7d741e
📒 Files selected for processing (10)
adapters/mockplatform.goadapters/mockplatform_test.goadapters/v1/backend.goadapters/v1/securityexception.goadapters/v1/securityexception_test.gocmd/http/main.gocmd/http/main_test.gocore/services/scan.gocore/services/scan_test.gorepositories/apiserver.go
…ESummary - TestApplySecurityExceptions_ExpiredOnFix now sets Actions: [Ignore] so it actually tests expiredOnFix behavior, not the action check - Add comment explaining why StoreCVESummary uses original cve + filteredCvep Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: Ben <ben@armosec.io>
|
Summary:
|
Summary
SecurityException CRDs were not being read when kubevuln runs without cloud credentials (keepLocal mode). MockPlatform.GetCVEExceptions() returned empty, completely bypassing the CRD integration.
Root cause: The SecurityExceptionRepository was only wired into the BackendAdapter (cloud path), not the MockPlatform (keepLocal path).
Fix:
SecurityExceptionRepositorytoMockPlatform, read CRDs inGetCVEExceptions()seRepoinitialization before the keepLocal/cloud branch so both paths use itConvertToVulnerabilityExceptionPoliciesfor cross-package usenilrepo (no CRD reading in unit tests)Testing: Found during manual testing in a kind cluster — kubevuln logged "SecurityException CRD integration enabled" but exceptions had no effect because MockPlatform ignored them.
Note: In keepLocal mode,
SubmitCVEis still a no-op, so exceptions are read but don't affect the stored VulnerabilityManifest. This is a known limitation — the stored manifest is always the raw Grype output. Exception-aware reporting will be fully effective when the operator watcher (Phase 2) triggers rescans through the full pipeline.Part of NAUT-1258.
Test plan
🤖 Generated with Claude Code
Summary by CodeRabbit
Release Notes
New Features
Improvements