Whats the difference between useBuiltinRegoPolicies and policiesBundle

[PG2000]

Hello,

i'm wondering what the difference is between useBuiltinRegoPolicies and policiesBundle

Are they mutual exclusive?

Where can i find the builtinRegoPolicies?

Could not find an answer in the docs so maybe somebody can help me with this?

[chen-keinan]

@PG2000 are the same thing, but you choose to skip useBuiltinRegoPolicies by setting it to false and then you can add your own policies to policies cm.

[PG2000]

ok this makes sense. But why do we need the policiesBundle

[chen-keinan]

once you choose to use built-in policies (policies bundle) then trivy-operator will download the policies package from public registry unless you want to download the policies package on a different registry (private or else in-case of air-gapped env.) so it give you the possibility to configure it.

[PG2000]

ok i misunderstood this.
I thought builtin meant that they were already provided with the operator and nothing must be downloaded.

[chen-keinan]

it use to be like this in the past however now policies are downloaded as misconfig data same as vuln to de-couple it from functionality