fix(trivy-operator): stop asserting fixability the alert cannot verify

The backlog alert described every counted finding as having a published fix.
Nothing in the expression establishes that. trivy_image_vulnerabilities
counts by severity and carries no fixed_version label, so the claim rested
entirely on trivy.ignoreUnfixed being true, which drops unfixed CVEs at scan
time so they never reach a report.

That coupling was invisible. Setting ignoreUnfixed to false left the alert
firing on CVEs nobody can act on while still calling the backlog actionable.

The annotations now derive their wording from that value instead of
asserting it, so turning it off changes what the alert says about itself.
Same correction applied to the values.yaml comments, which still described
the alert as a ticket rather than a page.

Author: ashish1099

argocd-helm-charts/trivy-operator/templates/prometheusrule.yaml

@@ -49,6 +49,18 @@ spec:
         # filter this count is never zero on a real cluster, so marking it
         # critical would get it muted within a week — and a muted receiver
         # takes the health alert above down with it.
+        #
+        # Fixability is NOT in this expression. trivy_image_vulnerabilities
+        # counts by severity and carries no fixed_version label, so nothing
+        # here can filter on whether a fix exists. Every counted finding is
+        # fixable only because trivy.ignoreUnfixed makes Trivy drop unfixed
+        # CVEs at scan time, so they never reach a report to be counted.
+        #
+        # The wording below is derived from that value rather than asserting
+        # it. Setting ignoreUnfixed to false would otherwise leave this alert
+        # working but quietly claiming something untrue — counting CVEs nobody
+        # can act on while still calling them actionable.
+        {{- $fixableOnly := index .Values "trivy-operator" "trivy" "ignoreUnfixed" }}
         - alert: ClusterVulnerabilityBacklog
           expr: |
             sum(trivy_image_vulnerabilities{severity=~"Critical|High"})
@@ -57,6 +69,6 @@ spec:
           labels:
             severity: warning
           annotations:
-            summary: "Cluster has {{ "{{ $value }}" }} fixable Critical/High CVEs"
-            description: "Fixable Critical/High findings exceed the threshold of {{ .Values.kubeaid.prometheusRule.backlogThreshold }}. Every finding counted here has a published fix, so the backlog is actionable. Per-image detail: kubectl get vulnerabilityreports -A."
+            summary: "Cluster has {{ "{{ $value }}" }} {{ if $fixableOnly }}fixable {{ end }}Critical/High CVEs"
+            description: "Critical/High findings exceed the threshold of {{ .Values.kubeaid.prometheusRule.backlogThreshold }}. {{ if $fixableOnly }}Every finding counted has a published fix, so the backlog is actionable.{{ else }}This count includes CVEs with no published fix, because trivy.ignoreUnfixed is false — some of it may not be actionable.{{ end }} Per-image detail: kubectl get vulnerabilityreports -A."
 {{- end }}

argocd-helm-charts/trivy-operator/values.yaml

@@ -41,14 +41,17 @@ kubeaid:
     enabled: true
 
     # TrivyOperatorMetricsMissing — the scanner is producing nothing, so the
-    # cluster is unscanned rather than clean. Pages. Long enough to ride out an
-    # operator restart or a missed scrape, short enough that a genuinely dead
-    # scanner does not go unnoticed for a working day.
+    # cluster is unscanned rather than clean. Severity critical. Long enough to
+    # ride out an operator restart or a missed scrape, short enough that a
+    # genuinely dead scanner does not go unnoticed for a working day.
     blindFor: "1h"
 
-    # ClusterVulnerabilityBacklog — fixable Critical/High findings above this
-    # count. Ticket, never a page: with ignoreUnfixed the count is still never
-    # zero on a real cluster, so paging would be muted within a week.
+    # ClusterVulnerabilityBacklog — Critical/High findings above this count.
+    # Severity warning: with ignoreUnfixed the count is still never zero on a
+    # real cluster, so marking it critical would get the receiver muted.
+    #
+    # Whether these are all fixable depends on trivy.ignoreUnfixed above, not
+    # on the alert — the metric it counts carries no fixed_version label.
     #
     # Tune per cluster. The default is deliberately high: an alert that fires
     # on day one everywhere teaches operators to ignore it.