fix(kubescape): generate the Headlamp exception mirror from the CRs

k8s/bases/infrastructure/cluster-security-exceptions/talos-cis-control-plane-false-positives.yaml

@@ -28,6 +28,15 @@ apiVersion: kubescape.io/v1beta1
 kind: ClusterSecurityException
 metadata:
   name: talos-cis-control-plane-false-positives
+  annotations:
+    # Keep this exception out of the Headlamp mirror ConfigMap. The plugin only
+    # evaluates WORKLOAD posture scans, and every control below is a host-scanner
+    # finding on the control-plane node (file permissions/ownership, API-server
+    # flags) that never attaches to a workload — so it cannot be expressed as a
+    # workload exception. Without this marker the generator would emit a
+    # cluster-wide `kind: ".*"` designator for it, which the plugin would apply
+    # to every workload in the cluster.
+    platform.devantler.tech/headlamp-mirror: exclude
 spec:
   reason: >-
     CIS control-plane checks that are false positives on Talos Linux, matching

k8s/bases/infrastructure/cluster-security-exceptions/talos-cis-worker-false-positives.yaml

@@ -31,6 +31,15 @@ apiVersion: kubescape.io/v1beta1
 kind: ClusterSecurityException
 metadata:
   name: talos-cis-worker-false-positives
+  annotations:
+    # Keep this exception out of the Headlamp mirror ConfigMap. The plugin only
+    # evaluates WORKLOAD posture scans, and every control below is a host-scanner
+    # finding on the worker node (kubelet config file permissions/ownership and
+    # kubelet flags) that never attaches to a workload — so it cannot be
+    # expressed as a workload exception. Without this marker the generator would
+    # emit a cluster-wide `kind: ".*"` designator for it, which the plugin would
+    # apply to every workload in the cluster.
+    platform.devantler.tech/headlamp-mirror: exclude
 spec:
   reason: >-
     CIS worker-node checks that are false positives on Talos Linux, matching Sidero's