security(k8s): the KSV-0109 dispositions are per-file, so a credential added later to either ConfigMap would be suppressed #3242

🤖 Generated by the Agentic Engineer

Evidence

KSV-0109 "ConfigMap stores secrets" is the trivy check that actually matches credential-shaped key
names. Measured on a scratch ConfigMap carrying two obvious credentials:

data:
  db_password: hunter2plaintext
  api_token: abc123def456

KSV-0109  : FIRES — "stores secrets in key(s) or value(s) '{"api_token"...'"
KSV-01010 : 0 findings

So the two ConfigMap checks have genuinely different match sets, and KSV-0109 is the one carrying
the credential-detection weight.

.trivyignore.yaml disposes KSV-0109 for two files:

Both reasons are correct for the content reviewed at the time. The concern is what they imply
going forward: because the disposition is per-file rather than per-key, a credential added to either
file later would be suppressed by an exception written when the file held none — and nothing would
report it, because the count would not move.

k8s/clusters/local/bootstrap/config-map.yaml carries no KSV-0109 disposition, so it is
already covered; this is specifically about the other two.

Why this is filed rather than fixed in #3241

#3241 disposes KSV-01010 and adds a boundary test for it. Extending that PR to re-scope a
different, older check would mix two concerns and put a behaviour change inside a disposition PR.
The KSV-01010 guard added there already asserts its own matched-key sets, so the pattern to follow
exists.

Smallest useful change

Give the two KSV-0109 dispositions the same content-premise assertion the KSV-01010 ones now
have — assert the matched key set for each excepted file equals the reviewed set, so a newly added
credential key changes the set and fails instead of being silently excepted.

scripts/tests/test-trivyignore-configmap-content-boundary.sh (from #3241) already implements this
shape and can be extended rather than duplicated.

Acceptance criteria

• Each KSV-0109-excepted file has its reviewed matched-key set asserted.
• A credential-shaped key added to either file fails the assertion — proven RED/GREEN, with the
  mutation asserted to have landed and the file restored byte-identically.
• The check skips explicitly, rather than failing, on a trivy version that does not emit it.
• No finding count moves as a result of this change.

Size: small — extends an existing test; no manifest change expected.

Part of #2787