Helm chart: how do I configure our docker credentials

[mkotsalainen]

I run into docker rate limts when using Trivy Operator installed via Helm Chart. I tried adding our dockerhub credentials like so:

    privateRegistryScanSecretsNames:
      core: dockerhub

But that doesn't seem to work. We have a dockerhub secret in the core namespace that I want to use.

The documentation in the values says this about using that variable:

trivy-operator/deploy/helm/values.yaml

Line 93 in eb495d1

# privateRegistryScanSecretsNames is map of namespace:secrets which can be used to authenticate in private registries in case if there no imagePullSecrets provided

What if we have multiple image pull secrets in the same namespace? That won't work because then they would all share the same key. Am I missing something?

[chen-keinan]

@mkotsalainen there are various ways work with private registries or using secrets the popular is setting the imagePullSecret

regarding the privateRegistryScanSecretsNames I assume it make sense to enhance it for one -> many.
do you mind opening an issue to support namespace with multi secrets

[mkotsalainen]

Actually I tried setting the imagePullSecret also like so:

  trivy:
    imagePullSecret: dockerhub

Maybe I'm doing it wrong? Also I thought that secret was only for pulling the trivy image itself, not the other images? For context, the trivy operator lives in the core namespace along with the dockerhub secret.

I'll open ticket regarding privateRegistryScanSecretsNames

[chen-keinan]

trivy operator take the ImagePullSecret with in workload or service account to pull images from private registries or public with limit which require credential as in your case

[thibva]

Actually I noticed that the imagePullSecrets can be configured on multiple levels inside the values.yaml file.

For trivy image :

trivy:
  repository: "some-registry.com/your/image"
  tag: "0.37.2"
  PullSecrets:
    - name: "your-secret"

For trivy-operator image :

image:
  repository: "some-registry.com/your/image"
  # tag is an override of the image tag, which is by default set by the
  # appVersion field in Chart.yaml.
  tag: "0.11.1"
  pullPolicy: Always
  pullSecrets:
    - name: "your-secret"

For nodeCollector, i'm doing it this way :
in values.yaml file

rbac:
  create: true
serviceAccount:
  # Specifies whether a service account should be created.
  create: false
  annotations: {}
  name: "global-trivy-operator"

in my CD pipeline :

kubectl -n <NAMESPACE> create sa global-trivy-operator
kubectl -n <NAMESPACE> patch sa global-trivy-operator -p '{"imagePullSecrets":[{"name":"your-secret}]}'

helm repo add [...]
helm repo update
helm upgrade --install --wait <HELM_CHART_NAME> <HELM_REPO_NAME>/<HELM_CHART_NAME> --version <HELM_CHART_VERSION> --namespace <NAMESPACE> --values ./values.yaml