Skip to content

feat: Provide credentials in imagePullSecret without global access #2584

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
afdesk wants to merge 159 commits into from
Closed

feat: Provide credentials in imagePullSecret without global access #2584

afdesk wants to merge 159 commits into from

Conversation

@afdesk
Copy link
Contributor

@afdesk afdesk commented Jun 2, 2025

Description

Related issues

  • Close #XXX

Checklist

  • I've read the guidelines for contributing to this repository.
  • I've added tests that prove my fix is effective or that my feature works.
  • I've updated the documentation with the relevant information (if needed).
  • I've added usage information (if the PR introduces new options)
  • I've included a "before" and "after" example to the description (if the PR is a user interface change).

maltemorgenstern and others added 30 commits June 27, 2024 21:51
@maltemorgenstern
feat: Provide credentials in imagePullSecret without global access
2354b90 
When running a cluster that contains images from a private registry one
needs to configure authentication. This is done by using kubernetes
ImagePullSecrets. By default the trivy-operator is able to read the
secrets attached to a target workload and use them to access the
container registry.

While this is necessary when working with different registries inside
the cluster, this comes with one security downside: the operator needs
access to all secrets inside the cluster.

If all images are being pulled from a single private registry then
one ImagePullSecret can be used for all of them. The easiest one to
use is inside the operator namespace.

This change does not impact any deployments running with default
settings (global access enabled). But in case one disables that
access this allows to instead read a single ImagePullSecret and
use it for all images.
@maltemorgenstern
test: Add tests for CredentialsByServer function
72b9b9e 
The unit tests have been fixed and now cover three different scenarios:
- No credentials have been configured at all
- ImagePullSecret for workload exists but global access is disabled
- ImagePullSecret for workload exists and global access is enabled

Also a small typo in the CONTRIBUTING.md is being fixed.
@maltemorgenstern
fix: Allow trivy-operator to update secrets in the operator namespace
46ef0f6 
In [1] the trivy-operator updates the temporary secrets to reflect the ownership by
each scan job. This requires the 'update' persmission for secrets - otherwise the
call with result in an error ("forbidden").

While the ClusterRole has this permission the Role does not. This needs to be added
to run the trivy-operator without global access - while still using imagePullSecrets
to configure authentication for private registries.

[1]: https://github.com/aquasecurity/trivy-operator/blob/d5d7e3d25c5e98f92c6a596af639b1f8df721869/pkg/vulnerabilityreport/controller/workload.go#L380-L389
@chen-keinan @afdesk
fix: helm param gcr service account auth (#2108)
8e65408 
* fix: helm param gcr service account auth

Signed-off-by: chenk <hen.keinan@gmail.com>

* fix: gcr basic auth

Signed-off-by: chenk <hen.keinan@gmail.com>

* fix: gcr basic auth

Signed-off-by: chenk <hen.keinan@gmail.com>

---------

Signed-off-by: chenk <hen.keinan@gmail.com>
@chen-keinan @afdesk
chore: bump github.com/hashicorp/go-getter-v1.7.5 (#2162)
81d6cd2 
Signed-off-by: chenk <hen.keinan@gmail.com>
@dependabot @afdesk
build(deps): bump github.com/aws/aws-sdk-go from 1.54.6 to 1.54.11 (#…
ae5b527 
…2164)

Bumps [github.com/aws/aws-sdk-go](https://github.com/aws/aws-sdk-go) from 1.54.6 to 1.54.11.
- [Release notes](https://github.com/aws/aws-sdk-go/releases)
- [Commits](aws/aws-sdk-go@v1.54.6...v1.54.11)

---
updated-dependencies:
- dependency-name: github.com/aws/aws-sdk-go
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@chen-keinan @afdesk
feat: dynamic compliance reports (#2160)
9d3b738 
* feat: dynamic compliance reports

Signed-off-by: chenk <hen.keinan@gmail.com>

* feat: dynamic compliance reports

Signed-off-by: chenk <hen.keinan@gmail.com>

* feat: dynamic compliance reports

Signed-off-by: chenk <hen.keinan@gmail.com>

* feat: dynamic compliance reports

Signed-off-by: chenk <hen.keinan@gmail.com>

* feat: dynamic compliance reports

Signed-off-by: chenk <hen.keinan@gmail.com>

* feat: dynamic compliance reports

Signed-off-by: chenk <hen.keinan@gmail.com>

* feat: dynamic compliance reports

Signed-off-by: chenk <hen.keinan@gmail.com>

* feat: dynamic compliance reports

Signed-off-by: chenk <hen.keinan@gmail.com>

* feat: dynamic compliance reports

Signed-off-by: chenk <hen.keinan@gmail.com>

* feat: dynamic compliance reports

Signed-off-by: chenk <hen.keinan@gmail.com>

* feat: dynamic compliance reports

Signed-off-by: chenk <hen.keinan@gmail.com>

* feat: dynamic compliance reports

Signed-off-by: chenk <hen.keinan@gmail.com>

* feat: dynamic compliance reports

Signed-off-by: chenk <hen.keinan@gmail.com>

* feat: dynamic compliance reports

Signed-off-by: chenk <hen.keinan@gmail.com>

* feat: dynamic compliance reports

Signed-off-by: chenk <hen.keinan@gmail.com>

* feat: dynamic compliance reports

Signed-off-by: chenk <hen.keinan@gmail.com>

* feat: dynamic compliance reports

Signed-off-by: chenk <hen.keinan@gmail.com>

* feat: dynamic compliance reports

Signed-off-by: chenk <hen.keinan@gmail.com>

---------

Signed-off-by: chenk <hen.keinan@gmail.com>
@chen-keinan @afdesk
release: prepare v0.22.0 (#2166)
5337fa2 
* release: prepare v0.22.0

Signed-off-by: chenk <hen.keinan@gmail.com>

* release: prepare v0.22.0

Signed-off-by: chenk <hen.keinan@gmail.com>

---------

Signed-off-by: chenk <hen.keinan@gmail.com>
# Conflicts:
#	deploy/static/trivy-operator.yaml
@verdel @afdesk
fix: remove null checks values from ClusterComplianceReport in helm c…
db38872 
…hart (#2168)

Signed-off-by: Vadim Aleksandrov <valeksandrov@me.com>
@Talbalash-legit @afdesk
Update configuration.md, added sbom generation flag (#2163)
338b96b
@kimdre @afdesk
feat: add options to Helm chart to load Trivy config from custom conf…
2ed726f 
…igmap or secret (#2174)

* fix: add value to Helm Chart to load Trivy configuration from custom secret

* style: fix indentation

* feat: add trivy.valuesFromConfigMap

* docs: add new values to configuration.md

* docs: generate docs
@dependabot @afdesk
build(deps): bump github.com/aws/aws-sdk-go from 1.54.6 to 1.54.15 (#…
ace0d1f 
…2177)

Bumps [github.com/aws/aws-sdk-go](https://github.com/aws/aws-sdk-go) from 1.54.6 to 1.54.15.
- [Release notes](https://github.com/aws/aws-sdk-go/releases)
- [Commits](aws/aws-sdk-go@v1.54.6...v1.54.15)

---
updated-dependencies:
- dependency-name: github.com/aws/aws-sdk-go
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@Dimonyga @afdesk
platform and type - no metadata values (#2179)
c454f54
@Dimonyga @afdesk
chore: Update chart 0.24.1 (#2180)
099da3f 
* Update chart

* Update README.md
@dependabot @afdesk
build(deps): bump golang.org/x/net from 0.26.0 to 0.27.0 (#2176)
ba1ab19 
Bumps [golang.org/x/net](https://github.com/golang/net) from 0.26.0 to 0.27.0.
- [Commits](golang/net@v0.26.0...v0.27.0)

---
updated-dependencies:
- dependency-name: golang.org/x/net
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@kersten @afdesk
Add hashing for vulnKey. (#2183)
6f00f5b
@dependabot @afdesk
build(deps): bump github.com/aws/aws-sdk-go from 1.54.15 to 1.54.19 (#…
e89f9d6 
…2187)

Bumps [github.com/aws/aws-sdk-go](https://github.com/aws/aws-sdk-go) from 1.54.15 to 1.54.19.
- [Release notes](https://github.com/aws/aws-sdk-go/releases)
- [Commits](aws/aws-sdk-go@v1.54.15...v1.54.19)

---
updated-dependencies:
- dependency-name: github.com/aws/aws-sdk-go
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot @afdesk
build(deps): bump actions/setup-python from 5.1.0 to 5.1.1 (#2185)
8829edd 
Bumps [actions/setup-python](https://github.com/actions/setup-python) from 5.1.0 to 5.1.1.
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](actions/setup-python@82c7e63...39cd149)

---
updated-dependencies:
- dependency-name: actions/setup-python
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@3xAG @afdesk
docs: Grafana Dashboard - Add headless parameter to values.yaml (#2190)
51156c1 
* Add headless: false to values.yaml. Removed this line from the documentation as no longer needed. Run the following command to remove the headless setting by editing the trivy-operator service:
clusterIP: None

* Added additional clarification comment for the values.

* Removed Command
@dependabot @afdesk
build(deps): bump github.com/google/go-containerregistry (#2186)
2e74a2d 
Bumps [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry) from 0.19.2 to 0.20.0.
- [Release notes](https://github.com/google/go-containerregistry/releases)
- [Changelog](https://github.com/google/go-containerregistry/blob/main/.goreleaser.yml)
- [Commits](google/go-containerregistry@v0.19.2...v0.20.0)

---
updated-dependencies:
- dependency-name: github.com/google/go-containerregistry
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot @afdesk
build(deps): bump k8s.io/cli-runtime from 0.30.2 to 0.30.3 (#2198)
e95bef2 
Bumps [k8s.io/cli-runtime](https://github.com/kubernetes/cli-runtime) from 0.30.2 to 0.30.3.
- [Commits](kubernetes/cli-runtime@v0.30.2...v0.30.3)

---
updated-dependencies:
- dependency-name: k8s.io/cli-runtime
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot @afdesk
build(deps): bump github.com/aws/aws-sdk-go from 1.54.19 to 1.54.20 (#…
537b8d6 
…2195)

Bumps [github.com/aws/aws-sdk-go](https://github.com/aws/aws-sdk-go) from 1.54.19 to 1.54.20.
- [Release notes](https://github.com/aws/aws-sdk-go/releases)
- [Changelog](https://github.com/aws/aws-sdk-go/blob/main/CHANGELOG_PENDING.md)
- [Commits](aws/aws-sdk-go@v1.54.19...v1.54.20)

---
updated-dependencies:
- dependency-name: github.com/aws/aws-sdk-go
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot @afdesk
build(deps): bump docker/login-action from 3.2.0 to 3.3.0 (#2193)
a7e4b8c 
Bumps [docker/login-action](https://github.com/docker/login-action) from 3.2.0 to 3.3.0.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](docker/login-action@v3.2.0...v3.3.0)

---
updated-dependencies:
- dependency-name: docker/login-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot @afdesk
build(deps): bump github.com/onsi/gomega from 1.33.1 to 1.34.0 (#2207)
4fc6277 
Bumps [github.com/onsi/gomega](https://github.com/onsi/gomega) from 1.33.1 to 1.34.0.
- [Release notes](https://github.com/onsi/gomega/releases)
- [Changelog](https://github.com/onsi/gomega/blob/master/CHANGELOG.md)
- [Commits](onsi/gomega@v1.33.1...v1.34.0)

---
updated-dependencies:
- dependency-name: github.com/onsi/gomega
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot @afdesk
build(deps): bump github.com/onsi/ginkgo/v2 from 2.19.0 to 2.19.1 (#2203
486dae0 
)

Bumps [github.com/onsi/ginkgo/v2](https://github.com/onsi/ginkgo) from 2.19.0 to 2.19.1.
- [Release notes](https://github.com/onsi/ginkgo/releases)
- [Changelog](https://github.com/onsi/ginkgo/blob/master/CHANGELOG.md)
- [Commits](onsi/ginkgo@v2.19.0...v2.19.1)

---
updated-dependencies:
- dependency-name: github.com/onsi/ginkgo/v2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot @afdesk
build(deps): bump github.com/aws/aws-sdk-go from 1.54.20 to 1.55.5 (#…
cd8b695 
…2215)

Bumps [github.com/aws/aws-sdk-go](https://github.com/aws/aws-sdk-go) from 1.54.20 to 1.55.5.
- [Release notes](https://github.com/aws/aws-sdk-go/releases)
- [Commits](aws/aws-sdk-go@v1.54.20...v1.55.5)

---
updated-dependencies:
- dependency-name: github.com/aws/aws-sdk-go
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot @afdesk
build(deps): bump sigstore/cosign-installer from 3.5.0 to 3.6.0 (#2225)
04cd74c 
Bumps [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer) from 3.5.0 to 3.6.0.
- [Release notes](https://github.com/sigstore/cosign-installer/releases)
- [Commits](sigstore/cosign-installer@v3.5.0...v3.6.0)

---
updated-dependencies:
- dependency-name: sigstore/cosign-installer
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot @afdesk
build(deps): bump github.com/google/go-containerregistry (#2224)
a825365 
Bumps [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry) from 0.20.0 to 0.20.2.
- [Release notes](https://github.com/google/go-containerregistry/releases)
- [Changelog](https://github.com/google/go-containerregistry/blob/main/.goreleaser.yml)
- [Commits](google/go-containerregistry@v0.20.0...v0.20.2)

---
updated-dependencies:
- dependency-name: github.com/google/go-containerregistry
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot @afdesk
build(deps): bump golangci/golangci-lint-action from 6.0.1 to 6.1.0 (#…
91a467d 
…2213)

Bumps [golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action) from 6.0.1 to 6.1.0.
- [Release notes](https://github.com/golangci/golangci-lint-action/releases)
- [Commits](golangci/golangci-lint-action@v6.0.1...v6.1.0)

---
updated-dependencies:
- dependency-name: golangci/golangci-lint-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot @afdesk
build(deps): bump github.com/onsi/gomega from 1.34.0 to 1.34.1 (#2214)
714287b 
Bumps [github.com/onsi/gomega](https://github.com/onsi/gomega) from 1.34.0 to 1.34.1.
- [Release notes](https://github.com/onsi/gomega/releases)
- [Changelog](https://github.com/onsi/gomega/blob/master/CHANGELOG.md)
- [Commits](onsi/gomega@v1.34.0...v1.34.1)

---
updated-dependencies:
- dependency-name: github.com/onsi/gomega
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
afdesk and others added 26 commits June 2, 2025 15:51
@afdesk
refactor: split evaluation function into evaluate and filter
0406972
@afdesk
refactor: accurate titles for methods and comments
96ec975
@afdesk
fix: a mistake in the method call
66bcbc1
@afdesk
test: add test cases for default configs
a2a44ef
@peschmae @afdesk
docs(helm): Add trivy.existingSecret to README
bd44058
@emmanuel-ferdman @afdesk
docs: update trivy fs source
737958f 
Signed-off-by: Emmanuel Ferdman <emmanuelferdman@gmail.com>
@afdesk
fix: skip ConfigMap caching
f239a05
@afdesk
test: add test cases for exclude images
759fa73
@simar7 @afdesk
chore(deps): bump golangci-lint to v2.1.2
bc550eb
@afdesk
ci: increase timeout for integration tests
e72aa71
@afdesk
chore: bumps up UBI to version 9
2a7e98d
@mmorel-35 @afdesk
chore(deps): bump golangci-lint to v2.1.6
d837afb 
Signed-off-by: Matthieu MOREL <matthieu.morel35@gmail.com>
@mmorel-35 @afdesk
fix: enable staticcheck linters
b6c0c2c
@mmorel-35 @afdesk
fix: enable errorlint linters
15d7e48 
Signed-off-by: Matthieu MOREL <matthieu.morel35@gmail.com>
@afdesk
feat: add using Trivy config file
6d1e1d2
@afdesk
chore: add test cases
707b9e0
@afdesk
fix: update args for the main container
0849d34
@afdesk @simar7
Update deploy/helm/values.yaml
5000ae9 
Co-authored-by: simar7 <1254783+simar7@users.noreply.github.com>
@afdesk @simar7
Update deploy/helm/README.md
dc85789 
Co-authored-by: simar7 <1254783+simar7@users.noreply.github.com>
@tanderson @afdesk
fix: remove oci artifact construction at startup
4931fe5
@mmorel-35 @simar7 @afdesk
fix: enable contextcheck and usetesting linters (#2562)
d5e0a00 
* fix: enable contextcheck and usetesting linters

Signed-off-by: Matthieu MOREL <matthieu.morel35@gmail.com>

* fix unused-parameter issue

Signed-off-by: Matthieu MOREL <matthieu.morel35@gmail.com>

---------

Signed-off-by: Matthieu MOREL <matthieu.morel35@gmail.com>
Co-authored-by: simar7 <1254783+simar7@users.noreply.github.com>
@mleykin-squarespace @simar7 @afdesk
feat: copying over original alternate store writing to rebased main b…
de3d1b1 
…ranch (#2578)

* copying over original alternate store writing to rebased main branch

* linting

* more minor lint

* go mod tidy

* fix helm chart lint

---------

Co-authored-by: Simar <simar@linux.com>
@dependabot @afdesk
build(deps): bump the github-actions group across 1 directory with 5 …
e8c45b6 
…updates (#2537)

Bumps the github-actions group with 5 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [aquaproj/aqua-installer](https://github.com/aquaproj/aqua-installer) | `3.1.1` | `3.1.2` |
| [golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action) | `6.5.0` | `7.0.0` |
| [actions/setup-python](https://github.com/actions/setup-python) | `5.4.0` | `5.6.0` |
| [docker/login-action](https://github.com/docker/login-action) | `3.3.0` | `3.4.0` |
| [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer) | `3.8.1` | `3.8.2` |



Updates `aquaproj/aqua-installer` from 3.1.1 to 3.1.2
- [Release notes](https://github.com/aquaproj/aqua-installer/releases)
- [Commits](aquaproj/aqua-installer@v3.1.1...v3.1.2)

Updates `golangci/golangci-lint-action` from 6.5.0 to 7.0.0
- [Release notes](https://github.com/golangci/golangci-lint-action/releases)
- [Commits](golangci/golangci-lint-action@v6.5.0...v7.0.0)

Updates `actions/setup-python` from 5.4.0 to 5.6.0
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](actions/setup-python@v5.4.0...v5.6.0)

Updates `docker/login-action` from 3.3.0 to 3.4.0
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](docker/login-action@v3.3.0...v3.4.0)

Updates `sigstore/cosign-installer` from 3.8.1 to 3.8.2
- [Release notes](https://github.com/sigstore/cosign-installer/releases)
- [Commits](sigstore/cosign-installer@v3.8.1...v3.8.2)

---
updated-dependencies:
- dependency-name: aquaproj/aqua-installer
  dependency-version: 3.1.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: golangci/golangci-lint-action
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/setup-python
  dependency-version: 5.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: docker/login-action
  dependency-version: 3.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: sigstore/cosign-installer
  dependency-version: 3.8.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot @afdesk
build(deps): bump the common group across 1 directory with 5 updates (#…
271482d 
…2580)

Bumps the common group with 5 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [github.com/aquasecurity/trivy-checks](https://github.com/aquasecurity/trivy-checks) | `1.11.2-0.20250529074512-7afea1b738c4` | `1.11.2` |
| [github.com/go-logr/logr](https://github.com/go-logr/logr) | `1.4.2` | `1.4.3` |
| [github.com/onsi/gomega](https://github.com/onsi/gomega) | `1.36.3` | `1.37.0` |
| [k8s.io/apiextensions-apiserver](https://github.com/kubernetes/apiextensions-apiserver) | `0.32.3` | `0.33.1` |
| [sigs.k8s.io/controller-runtime](https://github.com/kubernetes-sigs/controller-runtime) | `0.20.4` | `0.21.0` |



Updates `github.com/aquasecurity/trivy-checks` from 1.11.2-0.20250529074512-7afea1b738c4 to 1.11.2
- [Release notes](https://github.com/aquasecurity/trivy-checks/releases)
- [Commits](https://github.com/aquasecurity/trivy-checks/commits/v1.11.2)

Updates `github.com/go-logr/logr` from 1.4.2 to 1.4.3
- [Release notes](https://github.com/go-logr/logr/releases)
- [Changelog](https://github.com/go-logr/logr/blob/master/CHANGELOG.md)
- [Commits](go-logr/logr@v1.4.2...v1.4.3)

Updates `github.com/onsi/gomega` from 1.36.3 to 1.37.0
- [Release notes](https://github.com/onsi/gomega/releases)
- [Changelog](https://github.com/onsi/gomega/blob/master/CHANGELOG.md)
- [Commits](onsi/gomega@v1.36.3...v1.37.0)

Updates `k8s.io/apiextensions-apiserver` from 0.32.3 to 0.33.1
- [Release notes](https://github.com/kubernetes/apiextensions-apiserver/releases)
- [Commits](kubernetes/apiextensions-apiserver@v0.32.3...v0.33.1)

Updates `sigs.k8s.io/controller-runtime` from 0.20.4 to 0.21.0
- [Release notes](https://github.com/kubernetes-sigs/controller-runtime/releases)
- [Changelog](https://github.com/kubernetes-sigs/controller-runtime/blob/main/RELEASE.md)
- [Commits](kubernetes-sigs/controller-runtime@v0.20.4...v0.21.0)

---
updated-dependencies:
- dependency-name: github.com/aquasecurity/trivy-checks
  dependency-version: 1.11.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: common
- dependency-name: github.com/go-logr/logr
  dependency-version: 1.4.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: common
- dependency-name: github.com/onsi/gomega
  dependency-version: 1.37.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: common
- dependency-name: k8s.io/apiextensions-apiserver
  dependency-version: 0.33.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: common
- dependency-name: sigs.k8s.io/controller-runtime
  dependency-version: 0.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: common
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@maltemorgenstern @afdesk
test: Add tests for CredentialsByServer function
70e1a26 
The unit tests have been fixed and now cover three different scenarios:
- No credentials have been configured at all
- ImagePullSecret for workload exists but global access is disabled
- ImagePullSecret for workload exists and global access is enabled

Also a small typo in the CONTRIBUTING.md is being fixed.

# Conflicts:
#	pkg/kube/secrets_test.go
@maltemorgenstern @afdesk
fix: Allow trivy-operator to update secrets in the operator namespace
74e1f17 
In [1] the trivy-operator updates the temporary secrets to reflect the ownership by
each scan job. This requires the 'update' persmission for secrets - otherwise the
call with result in an error ("forbidden").

While the ClusterRole has this permission the Role does not. This needs to be added
to run the trivy-operator without global access - while still using imagePullSecrets
to configure authentication for private registries.

[1]: https://github.com/aquasecurity/trivy-operator/blob/d5d7e3d25c5e98f92c6a596af639b1f8df721869/pkg/vulnerabilityreport/controller/workload.go#L380-L389
@afdesk afdesk force-pushed the 2158-private-images-without-global-access branch from da9e2d5 to 9545bca Compare June 2, 2025 10:18
@afdesk afdesk closed this Jun 2, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@simar7 simar7 Awaiting requested review from simar7 simar7 will be requested when the pull request is marked ready for review simar7 is a code owner

Assignees

No one assigned

Labels

feature

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.