Update Snyk configuration file to exclude vendor directory with a prefix

[kwilczynski]

What type of PR is this?

/kind other
/assign kwilczynski

What this PR does / why we need it:

Some security scanners, such as the csmock, wrap the Snyk scanner and often hand paths directly to it that are fully qualified. This seems to make Snyk not apply the exclude configuration correctly, since the vendor directory can have a prefix (of some other top-level directory), for example:

"file_name": "cri-tools-3c91ebf539bd2035d60813386f5b1f023937423f/vendor/k8s.io/apimachinery/pkg/util/managedfields/pod.yaml"

The above would result in Snyk not respecting directory exclusion and scanning the content of the vendor directory, which is undesirable.

Thus, we add a wildcard to accept any prefix in front of the vendor directory, should any be provided.

Related to:

• Add a .snyk file to configure the Snyk security scanner #1315

Which issue(s) this PR fixes:

None

Special notes for your reviewer:

None

Does this PR introduce a user-facing change?

None

[k8s-ci-robot]

@kwilczynski: The label(s) kind/other cannot be applied, because the repository doesn't have them.

In response to this:

What type of PR is this?

/kind other
/assign kwilczynski

What this PR does / why we need it:

Some security scanners, such as the csmock, wrap the Snyk scanner and often hand paths directly to it that are fully qualified. This seems to make Snyk not apply the exclude configuration correctly, since the vendor directory can have a prefix (of some other top-level directory), for example:

"file_name": "cri-tools-3c91ebf539bd2035d60813386f5b1f023937423f/vendor/k8s.io/apimachinery/pkg/util/managedfields/pod.yaml"

The above would result in Snyk not respecting directory exclusion and scanning the content of the vendor directory, which is undesirable.

Thus, we add a wildcard to accept any prefix in front of the vendor directory, should any be provided.

Related to:

• Add a .snyk file to configure the Snyk security scanner #1315

Which issue(s) this PR fixes:

None

Special notes for your reviewer:

None

Does this PR introduce a user-facing change?

None

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[kannon92]

Do we need both?

[kannon92]

We followed up offline. I think this is fine as is.

/lgtm

[feiskyer]

LGTM

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: feiskyer, kwilczynski

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [feiskyer]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment