BREAKING CHANGE(misconf): Removing support for less commonly used Rego features #7961
simar7
announced in
Announcements
Replies: 0 comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
-
Motivation
We will be deprecating some of the Rego features that Trivy currently supports as we believe they are less likely to be used now as there exist better and more commonly used alternatives as described below:
Removing support for
warn
andviolation
check typesCurrently Trivy supports
deny
,warn
andviolation
types. This was previously added when Trivy misconfiguration scanning didn't fully support severities and had to rely on Rego checks themselves to determine the level of the check. With the Rego checks supporting severities just as any other scan type does, there's no need for using these check types.Removing
combined
option for check evaluationCurrently Trivy supports the ability for multiple Rego inputs to be
combined
into one. This feature has limited uses and requires custom checks to be written in a certain way that currently does not fit with the Trivy scanning model.Timeline
These features will be deprecated starting in Trivy v0.58
Beta Was this translation helpful? Give feedback.
All reactions