"trivy.ignorefile" is ignored in client/server scans

[felixb-denic]

Hey,

just wanted to check if what I'm encountering is intended behavior or a bug:

We run the trivy-operator in our cluster which works fine. Now we also want to use trivy in our ci pipelines, and to save on resources we activated operator.builtInTrivyServer so we can use the client/server model.

Now I added some CVEs to trivy.ignorefile in the helm values of the operator, and they get correctly dropped on scans that are executed by the operator when launching a new workload in the cluster, but when I run a test manually with the trivy-cli and use --server= to connect to the trivy server inside the cluster, the ignorefile has no effect and the ignored CVEs appear in the report.

Is this intended? My intention was to have a "global ignorefile" which gets picked up by all our pipelines.

Best,
Felix