fix: forward HTTPS_PROXY/no_proxy to the sbom-scanner sidecar

[matthyx]

Overview

Follow-up to #898. The sbom-scanner sidecar (added to node-agent and kubevuln for OOM isolation) pulls image data over HTTPS itself but never received global.httpsProxy/no_proxy the way the main container does. In clusters that route egress through a proxy — especially with global.networkPolicy.createEgressRules enabled, which only opens egress to DNS, the API server, and the proxy IP/port — the sidecar had no route to the registry at all.

Adds the same HTTPS_PROXY/no_proxy env vars to the sbom-scanner container in:

• charts/kubescape-operator/templates/kubevuln/deployment.yaml
• charts/kubescape-operator/templates/node-agent/_node-agent.tpl

How to Test

helm unittest charts/kubescape-operator

Added two new test cases in tests/snapshot_test.yaml asserting the sidecar picks up HTTPS_PROXY/no_proxy when global.httpsProxy is set. Full suite (60 tests / 996 snapshots) passes unchanged plus the 2 new tests.

Checklist before requesting a review

• New and existing unit tests pass locally with my changes

AI-skills: none

Summary by CodeRabbit

• New Features

  • SBOM scanner components now support configured HTTPS proxy settings.
  • Added support for combined proxy bypass rules through the no_proxy environment variable.
  • Proxy settings are applied conditionally when an HTTPS proxy is configured.

• Tests

  • Added coverage verifying proxy environment variables for SBOM scanner components.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 89749b4d-aaca-471b-b681-e993900f07b5

📥 Commits

Reviewing files that changed from the base of the PR and between 05139a7 and e99f60e.

📒 Files selected for processing (3)

• charts/kubescape-operator/templates/kubevuln/deployment.yaml
• charts/kubescape-operator/templates/node-agent/_node-agent.tpl
• charts/kubescape-operator/tests/snapshot_test.yaml

---

📝 Walkthrough

Walkthrough

The Helm chart now forwards global HTTPS proxy settings and combined no-proxy values to node-agent and kubevuln SBOM scanner sidecars. Snapshot tests verify both rendered configurations.

Changes

SBOM scanner proxy support

Layer / File(s)	Summary
Node-agent proxy propagation charts/kubescape-operator/templates/node-agent/_node-agent.tpl, charts/kubescape-operator/tests/snapshot_test.yaml	The node-agent SBOM scanner template accepts no_proxy_envar_list, renders HTTPS_PROXY and no_proxy when configured, and passes the parameter during rendering. Snapshot coverage verifies the output.
Kubevuln proxy propagation charts/kubescape-operator/templates/kubevuln/deployment.yaml, charts/kubescape-operator/tests/snapshot_test.yaml	The kubevuln SBOM scanner renders HTTPS_PROXY and no_proxy from the global proxy settings. Snapshot coverage verifies the output.

Estimated code review effort: 2 (Simple) | ~10 minutes

Mergeability Score: ⚪ Minimal · up to e99f6

This localized change forwards the configured HTTPS proxy settings to the sbom-scanner sidecar and adds coverage for the new behavior; no actionable merge-blocking risk remains after normal checks and review.

Sequence Diagram(s)

sequenceDiagram
  participant GlobalProxyConfiguration
  participant HelmTemplates
  participant SBOMScannerSidecars
  GlobalProxyConfiguration->>HelmTemplates: provide httpsProxy and noProxy values
  HelmTemplates->>SBOMScannerSidecars: render HTTPS_PROXY and combined no_proxy
  SBOMScannerSidecars-->>HelmTemplates: produce configured pod specifications

Loading

Suggested reviewers: slashben

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes forwarding HTTPS_PROXY and no_proxy to the SBOM scanner sidecar, which is the main change.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/sbom-scanner-proxy-env

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

⚠️ @matthyx — this PR's node-agent render drifts from the approved GKE Autopilot allowlist (armo-kubescape-node-agent-1.40-v2).

On GKE Autopilot the node-agent would be rejected by GKE Warden until Google approves a matching allowlist, so customers could not install this chart version.

To unblock this PR:

1. Open a Gerrit allowlist update at gke-ap-allowlist.googlesource.com/ARMO (see scripts/gke-allowlist/README.md), then update the vendored gke-allowlist/ copy once approved.
2. A maintainer adds the allowlist-drift-ack label to this PR to acknowledge the drift and pass the check.

Drift detail

# drift report: charts/kubescape-operator
#   allowlist: gke-allowlist/armo-kubescape-node-agent-1.40-v2.yaml
CLASS: spec-drift  (NEW allowlist version required)
  - container 'sbom-scanner': env HTTPS_PROXY not in allowlist
  - container 'sbom-scanner': env no_proxy not in allowlist

[matthyx]

cc @slashben we'll need a new autopilot submission

[matthyx]

Code review: this looks correct and well-tested.

• node-agent/_node-agent.tpl: no_proxy_envar_list is now threaded through to node-agent.sbomScannerContainer the same way it already is for node-agent.container, and the call site update (nodeAgent.podSpec → node-agent.sbomScannerContainer) passes it correctly.
• kubevuln/deployment.yaml: $no_proxy_envar_list is defined at file scope (top of the template) so it's in scope for the new sbom-scanner block; the added HTTPS_PROXY/no_proxy env entries are an exact mirror of the existing block for the main kubevuln container.
• New snapshot tests assert the right container index for both the node-agent daemonset and the kubevuln deployment, and match the existing test style in this file.
• helm unittest coverage (60 tests / 996 snapshots + 2 new) is consistent with the PR description.

Holding off on approval for one reason: the allowlist-drift check is failing — the new sbom-scanner env vars (HTTPS_PROXY, no_proxy) aren't in the approved GKE Autopilot allowlist (armo-kubescape-node-agent-1.40-v2), so on GKE Autopilot this node-agent spec would be rejected by GKE Warden until Google approves an updated allowlist. I see this is already being tracked (cc @slashben re: new autopilot submission) — once the Gerrit allowlist update lands and a maintainer adds allowlist-drift-ack, this is good to merge from my side.