aquasecurity / trivy-operator

Kubernetes-native security toolkit
https://aquasecurity.github.io/trivy-operator/latest
Apache License 2.0
1.29k stars 213 forks source link

trivyOperator.scanJobCustomVolumesMount and scanJobCustomVolumes helm values don't work as expected #2263

Open vrevelas opened 2 months ago

vrevelas commented 2 months ago

What steps did you take and what happened:

Installed trivy-operator 0.22.0 with helm chart version 0.24.1 with the following set in my values.yaml (copy-pasted and uncommented from the chart's default values)

trivyOperator:
  scanJobCustomVolumesMount:
   - name: var-lib-etcd
     mountPath: /var/lib/etcd
     readOnly: true
  scanJobCustomVolumes:
   - name: var-lib-etcd
     hostPath:
     path: /var/lib/etcd

The scan-vulnerabilityreport-* Jobs created do contain the custom volume, but it's been converted to an emptyDir. the custom volume mount is missing from both the container and the initContainer:

apiVersion: batch/v1
kind: Job
...
spec:
  template:
    spec:
      containers:
        - args:
...
          volumeMounts:
            - mountPath: /tmp
              name: tmp
            - mountPath: /tmp/scan
              name: scanresult
...
      initContainers:
        - args:
...
          volumeMounts:
            - mountPath: /tmp
              name: tmp
      volumes:
        - emptyDir: {}
          name: tmp
        - emptyDir: {}
          name: scanresult
        - emptyDir: {}
          name: var-lib-etcd

I don't see any relevant errors or warnings in the trivy-operator logs (grepped for "custom", "volume", and "mount", case-insensitive).

What did you expect to happen: I expected the Job's var-lib-etcd volume to be a hostPath, and the container and initContainer volumeMounts to mount the var-lib-etcd volume.

Anything else you would like to add: N/A

Environment:

github-actions[bot] commented 5 days ago

This issue is stale because it has been labeled with inactivity.