Attention Iron Bank Customers: On March 27, 2025, we are moving SBOM artifacts from the Anchore Scan job to the Build job to streamline the container hardening pipeline. If you currently download SBOMs from the Anchore Scan job, you can still get them from the Build job and from other sources, including IBFE and image attestations.
This package MR includes a default value modification in kyverno-reporter/chart/values.yaml to disable API token auto-mounting for the kyverno-reporter ServiceAccount.
This essentially means that Pods leveraging the kyverno-reporter ServiceAccount, by default, will not have access to their Kubernetes API token (previously mounted at /var/run/secrets/kubernetes.io/serviceaccount/token).
Since this package deals with the Kubernetes API heavily - the kyverno-reporter Pod overrides this behavior at the Pod spec-level here. As such, a Kyverno policy exception will be made for this Pod.
