security(k8s): disposition CKV_SECRET_6 — 31 findings are key references, not secret material

[devantler]

🤖 Generated by the Agentic Engineer

First control-family slice of #2787, which asks for the findings to be grouped by check id and each group dispositioned once.

Evidence

scripts/megalinter-scan-counts.sh reproduces CI's checkov scan. At origin/main it reports 68 failing checks, of which 31 are CKV_SECRET_6 (Base64 High Entropy String) — the entire secrets framework contribution, and the single largest family (46%).

All 31 sites were read individually. Every one is a name or a reference, never secret material:

Shape	Sites	Example
secretKey: in an ExternalSecret spec.data[]	21	- secretKey: db-password
secretKey: in a PushSecret spec.data[].match	5	secretKey: r2_access_key_id
HelmRelease value naming an existing Secret, or a key in one	4	existingSecretPasswordKey: redis-password
Literal placeholder	1	password: PLACEHOLDER

The values live in OpenBao; these lines only declare what the key is called and where it comes from. The clearest single demonstration that the heuristic is misfiring is that it flags the literal string PLACEHOLDER.

This is the same class the repository already triaged when it removed gitleaks — .mega-linter.yml records those findings as "generic-api-key hits on ExternalSecret/PushSecret key references — Vault paths naming where a secret lives, not secret material".

Expected behaviour

checkov reports 0 CKV_SECRET_6 on k8s/, and CKV_SECRET_6 stays live everywhere else in the tree.

Acceptance criteria

• Every one of the 31 sites carries a scoped skip naming the control and its reason.
• The reproduced checkov total drops 68 → 37, with the drop attributable to CKV_SECRET_6 alone.
• No blanket or config-level disable of CKV_SECRET_6; the control still fires elsewhere in the tree.
• Both overlays validate.

Rough size: small. Part of #2787.

[coderabbitai]

🔗 Related PRs

#2442 - fix(kubescape): make C-0015 secret-list exceptions take effect [merged]
#2446 - fix(kubescape): except C-0007 delete-capable RBAC by object, not namespace [merged]
#2507 - fix(apps): make actual-budget openid schema offline-resolvable [merged]
#2847 - fix(ci): report what the Kubescape scan actually found [merged]
#2860 - security(k8s): record an explicit service-account-token verdict per workload [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!