the custom configuration audit policies is not working properly

[33yan]

What steps did you take and what happened:

I follow the below directions and Trivy doesn't pick up my custom audit policy:
https://aquasecurity.github.io/trivy-operator/v0.23.0/tutorials/writing-custom-configuration-audit-policies/

I have also referred to this issue(#1677), but still can not solve the problem.

when I kubectl apply the configmap ,trivy can rescan all the pods but for whatever reason it doesn't pick up my custom audit. Is there some trick that I'm missing?

Environment:
the trivy-operator install info:

helm upgrade --install trivy-operator aqua/trivy-operator \
  --namespace trivy-system \
  --create-namespace \
  --version 0.23.0 \
  --set="trivy.command=filesystem" \
  --set="trivyOperator.scanJobPodTemplateContainerSecurityContext.runAsUser=0" \
  --set="operator.builtInTrivyServer=true" \
  --set="operator.sbomGenerationEnabled=false" \
  --set="trivy.externalRegoPoliciesEnabled=true" \
  --set="trivy.useBuiltinRegoPolicies=true" \
  --set="trivy.useEmbeddedRegoPolicies=false" \
  --set="targetNamespaces=test1" \
  --set="trivy.debug=true"  \
  --set="operator.logDevMode=true"

• Kubernetes version (use kubectl version):
  

• the ConfigMap info:
  
  

apiVersion: v1
data:
  policy.rule1.kinds: '*'
  policy.rule1.rego: |
    package trivyoperator.policy.k8s.custom

    import data.lib.result
    import future.keywords.in
    import data.lib.kubernetes

    __rego_metadata__ := {
      "id": "rule1",
      "title": "rule1",
      "severity": "CRITICAL",
      "type": "Kubernetes Security Check",
      "description": "rule1",
      "recommended_actions": "rule1",
      "url": "https://kubernetes.io/docs/rule1",
    }

    recommended_labels := [
      "app.kubernetes.io/name",
      "app.kubernetes.io/version",
    ]

    deny[res] {
      provided := {label | input.metadata.labels[label]}
      required := {label | label := recommended_labels[_]}
      missing := required - provided
      count(missing) > 0
      msg := sprintf("You must provide labels: %v", [missing])
      res := {"msg": msg}
    }
kind: ConfigMap
metadata:
  annotations:
    kubectl.kubernetes.io/last-applied-configuration: >
      {"apiVersion":"v1","data":{"policy.rule1.kinds":"*","policy.rule1.rego":"package
      trivyoperator.policy.k8s.custom\n\nimport data.lib.result\nimport
      future.keywords.in\nimport data.lib.kubernetes\n\n__rego_metadata__ :=
      {\n  \"id\": \"rule1\",\n  \"title\": \"rule1\",\n  \"severity\":
      \"CRITICAL\",\n  \"type\": \"Kubernetes Security Check\",\n 
      \"description\": \"rule1\",\n  \"recommended_actions\": \"rule1\",\n 
      \"url\": \"https://kubernetes.io/docs/rule1\",\n}\n\nrecommended_labels :=
      [\n  \"app.kubernetes.io/name\",\n 
      \"app.kubernetes.io/version\",\n]\n\ndeny[res] {\n  provided := {label |
      input.metadata.labels[label]}\n  required := {label | label :=
      recommended_labels[_]}\n  missing := required - provided\n  count(missing)
      \u003e 0\n  msg := sprintf(\"You must provide labels: %v\", [missing])\n 
      res := {\"msg\":
      msg}\n}\n"},"kind":"ConfigMap","metadata":{"annotations":{},"labels":{"app.kubernetes.io/instance":"trivy-operator","app.kubernetes.io/managed-by":"kubectl","app.kubernetes.io/name":"trivy-operator","app.kubernetes.io/version":"0.23.0"},"name":"trivy-operator-policies-config","namespace":"trivy-system"}}
    meta.helm.sh/release-name: trivy-operator
    meta.helm.sh/release-namespace: trivy-system
  creationTimestamp: '2024-12-03T09:32:56Z'
  labels:
    app.kubernetes.io/instance: trivy-operator
    app.kubernetes.io/managed-by: kubectl
    app.kubernetes.io/name: trivy-operator
    app.kubernetes.io/version: 0.23.0
    helm.sh/chart: trivy-operator-0.25.0
  managedFields:
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            .: {}
            f:meta.helm.sh/release-name: {}
            f:meta.helm.sh/release-namespace: {}
          f:labels:
            .: {}
            f:app.kubernetes.io/instance: {}
            f:app.kubernetes.io/name: {}
            f:app.kubernetes.io/version: {}
            f:helm.sh/chart: {}
      manager: helm
      operation: Update
      time: '2024-12-03T09:58:25Z'
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:data:
          .: {}
          f:policy.rule1.kinds: {}
          f:policy.rule1.rego: {}
        f:metadata:
          f:annotations:
            f:kubectl.kubernetes.io/last-applied-configuration: {}
          f:labels:
            f:app.kubernetes.io/managed-by: {}
      manager: kubectl-client-side-apply
      operation: Update
      time: '2024-12-04T06:12:33Z'
  name: trivy-operator-policies-config
  namespace: trivy-system
  resourceVersion: '1141024'
  uid: 7c301daf-d3b6-4f57-8a8b-17b3e76c9de1