Update sensitiveContainerEnvVar.yaml

checks/sensitiveContainerEnvVar.yaml

@@ -11,40 +11,35 @@ schemaString: |
       items:
         type: object
         oneOf:
-          - required: ["name", "value"]
-            properties:
-              name:
-                type: string
-                '$comment': These environment variable names will be disallowed.
-                allOf:
-                  - not:
-                      pattern: '(?i)^AWS_SECRET_ACCESS_KEY$'
-                  - not:
-                      pattern: '(?i)^GOOGLE_APPLICATION_CREDENTIALS$'
-                  - not:
-                      pattern: '(?i)^AZURE_.+KEY$'
-                  - not:
-                      pattern: '(?i)^OCI_CLI_KEY_CONTENT$'
-                  - not:
-                      pattern: '(?i)password'
-                  - not:
-                      pattern: '(?i)token'
-                  - not:
-                      pattern: '(?i)bearer'
-                  - not:
-                      pattern: '(?i)secret'
-                    '$comment': This allows variable names not excluded above.
-                  - pattern: '(?i).*'
-              value:
-                type: string
-                '$comment': These environment variable values will be disallowed.
-                allOf:
+        - not:
+            required: ["value"]
+        - properties:
+            name:
+              type: string
+              '$comment': These environment variable names will be disallowed.
+              allOf:
                 - not:
-                    '$comment': THis matches variations like begin private key, begin rsa private key ...
-                    pattern: '(?i)\s*-BEGIN\s+.*PRIVATE KEY-\s*'
-          - required: ["name", "valueFrom"]
-            properties:
-              name:
-                type: string
-              valueFrom:
-                type: object
+                    pattern: '(?i)^AWS_SECRET_ACCESS_KEY$'
+                - not:
+                    pattern: '(?i)^GOOGLE_APPLICATION_CREDENTIALS$'
+                - not:
+                    pattern: '(?i)^AZURE_.+KEY$'
+                - not:
+                    pattern: '(?i)^OCI_CLI_KEY_CONTENT$'
+                - not:
+                    pattern: '(?i)password'
+                - not:
+                    pattern: '(?i)token'
+                - not:
+                    pattern: '(?i)bearer'
+                - not:
+                    pattern: '(?i)secret'
+                  '$comment': This allows variable names not excluded above.
+                - pattern: '(?i).*'
+            value:
+              type: string
+              '$comment': These environment variable values will be disallowed.
+              allOf:
+              - not:
+                  '$comment': This matches variations like begin private key, begin rsa private key ...
+                  pattern: '(?i)\s*-BEGIN\s+.*PRIVATE KEY-\s*'

test/checks/sensitiveContainerEnvVar/success.valid_env_vars.yaml

@@ -9,6 +9,7 @@ spec:
     env:
     - name: greeting
       value: hello
+    - name: empty
     image: nginx
     ports:
     - containerPort: 80