Merge pull request #81 from opzkit/checkovs

chore: disable unwanted checks

.github/workflows/build.yml

@@ -1,4 +1,5 @@
 name: Build
+permissions: read-all
 
 on: [ push, workflow_dispatch ]
 

.github/workflows/checkov.yaml

@@ -1,4 +1,5 @@
 name: checkov
+permissions: read-all
 
 # Controls when the workflow will run
 on:

.github/workflows/commitlint.yaml

@@ -1,4 +1,5 @@
 name: Lint Commit Messages
+permissions: read-all
 
 on: [pull_request]
 

k8s.tf

@@ -375,8 +375,8 @@ data "aws_security_group" "nodes" {
 }
 
 module "cluster_autoscaler" {
-  source       = "opzkit/k8s-addons-cluster-autoscaler/aws"
-  version      = "1.28.2"
+  source = "git::https://github.com/opzkit/terraform-aws-k8s-addons-cluster-autoscaler.git?ref=f2237759ca43fbfac35c998b7c26e0b7887b160c"
+  #   version = "1.28.2"
   replicas     = local.min_number_of_nodes > 1 ? 2 : 1
   cluster_name = var.name
 }

s3.tf

@@ -1,16 +1,28 @@
 resource "aws_s3_bucket" "issuer" {
+  #checkov:skip=CKV_AWS_18
+  #checkov:skip=CKV_AWS_21
+  #checkov:skip=CKV_AWS_144
+  #checkov:skip=CKV_AWS_145
+  #checkov:skip=CKV2_AWS_6
+  #checkov:skip=CKV2_AWS_61
+  #checkov:skip=CKV2_AWS_62
   bucket        = "${replace(var.name, ".", "-")}-irsa-issuer"
   force_destroy = true
 }
 
 resource "aws_s3_bucket_ownership_controls" "issuer" {
+  #checkov:skip=CKV2_AWS_65
   bucket = aws_s3_bucket.issuer.id
   rule {
     object_ownership = "BucketOwnerPreferred"
   }
 }
 
 resource "aws_s3_bucket_public_access_block" "issuer" {
+  #checkov:skip=CKV_AWS_53
+  #checkov:skip=CKV_AWS_54
+  #checkov:skip=CKV_AWS_55
+  #checkov:skip=CKV_AWS_56
   bucket                  = aws_s3_bucket.issuer.id
   block_public_acls       = false
   block_public_policy     = false