Turn off the docker scan option completely.

[ysaakpr]

Describe the feature
I use flux cd as purely for GitOps, which means, i update my kubernetes configurations through the CI pipeline and which at the end updates the git with the appropriate changes. But when i go through i can still see lots of logs saying its scanning all my docker images and ignoring them. Are there a way to turn off the pod scanning for docker images and stop those specific logs, which is actually confusing.

What would the new user story look like?
How would the new interaction with Flux look like? E.g.
0. User should able to turn on or off the docker scan options at a global level.

[stefanprodan]

You can disable the image scanning with --registry-exclude-image=* see the FAQ for more details: https://docs.fluxcd.io/en/stable/faq.html#can-i-disable-flux-registry-scanning

[squaremo]

@ysaakpr Let us know if this works for you, and we can close the issue (or just close if you're happy).

[ysaakpr]

Hi squaremo, it worked, but look through the code it's still scanning for all the deployed pods and matching with the given exclude glob. It would be an ideal case to disable the feature using another flag.

[squaremo]

@ysaakpr I see what you mean, OK. Switching scanning off would involve some code detangling (and some design -- for instance, would it make sense to be able to switch scanning off, but still have automated upgrades? ). Logically, though, it is a completely reasonable desideratum.

[runningman84]

how can I use registry-exclude-image to exclude multiple images?

[hiddeco]

@runningman84 literally copied from the doc link posted above:

--registry-exclude-image=docker.io/*,quay.io/*

[max-lobur]

Exclude works for me, but still, I would like to have a flag which disables registry scans completely. If wildcard matching syntax ever broken - I'm fucked up :(.
Registry on/off flag would be bulletproof.

[ysaakpr]

I think for time being we can add a flag --disable-image-scan and apply the exclude image internally, and later we could add more specific changes to this feature

[2opremio]

--registry-scanning=false was just added in #2745 , I will update the FAQ