security(k8s): decide how vendored upstream bundles carry checkov dispositions (16 findings, 43% of #2787)

[devantler]

🤖 Generated by the Agentic Engineer

Evidence

Two files hold 16 of the 37 checkov findings remaining under #2787 — 43% of the backlog —
and both are vendored upstream release bundles:

File	Findings	Check ids
k8s/bases/infrastructure/controllers/cdi/cdi-operator.yaml	8	CKV_K8S_11, _13, _15, _155, _22, _38, _40, _43
k8s/bases/infrastructure/controllers/kubevirt/kubevirt-operator.yaml	8	same eight

Both are multi-document upstream release manifests (~5.8k lines for CDI), and git log shows
exactly one commit each — 61885392 feat: add KubeVirt and CDI operators to platform — so
neither has ever been hand-edited. The repo already treats them as vendored: cdi/kustomization.yaml
adjusts them through kustomize patches: rather than editing the file.

Problem

The two mechanisms this backlog has used so far both fail here:

• Inline checkov.io/skipN annotations (the mechanism security(k8s): disposition CKV_SECRET_6 — 31 findings are key references, not secret material #2892/security(k8s): disposition CKV_K8S_40 — 11 findings whose UID is load-bearing #2898 use) would mean editing the
  vendored bundle. The next vendor bump overwrites it, and the finding returns with no signal.
• A kustomize patch does not help, because checkov scans the file on disk, not the rendered
  output.

--skip-path would work mechanically but is far too broad — it would drop every check on both
files, not the eight that are genuinely upstream's.

Worth deciding

Which of these is the durable convention for vendored upstream manifests, given the platform
vendors more of them over time:

1. Regenerate with a documented fetch step that appends the dispositions, so a bump reproduces
   them instead of dropping them.
2. Move the bundles behind a HelmRelease or OCI source so they are not files in the tree at all
   — the coredns deployment already carries a TODO: Rework ... into a helm-release for the same
   reason.
3. A path-and-check-scoped exclusion expressed once, if checkov can express it without
   suppressing unrelated checks on the same path.

The answer decides how ~43% of #2787's remaining backlog is closed, so it is worth settling before
dispositioning the eight checks individually.

Acceptance criteria

• A convention is recorded for vendored upstream manifests, with its rationale.
• It survives a vendor bump — a bump does not silently reintroduce the sixteen findings.
• It does not suppress checks that are genuinely ours on those paths.
• Applied to both bundles; checkov's kubernetes framework drops accordingly.

Rough size: medium — the decision is the work; applying it is small. Part of #2787.