Overview:

ACS 4.8.0 has been released with a bug where ROX_SCANNER_V4=true is set on sensor when using deployment bundles.

I just realized that this bug is not yet fixed – neither on master, nor in 4.8.x. Sensor deployment bundles still set this environment variable to true (which is wrong) even though they come without scanner V4 (which is expected).

The previous attempt at fixing this (commit ec3d30b8a2e63524f17db4642466356fa0bb06f2) is not sufficient.

My suspicion is that the remaining problem comes from this code: https://github.com/stackrox/stackrox/blob/2152fc5569c6855ba3d073a6a64205d081a87991/central/clusters/deployer.go#L127

Here we inject environment variables for the set of enabled feature flags, which would pull in ROX_SCANNER_V4=true.