feat(trivy): add extraVolumes, extraVolumeMounts and defaultDataVolum…

templates/trivy/trivy-sts.yaml

@@ -144,16 +144,21 @@ spec:
             - name: api-server
               containerPort: {{ template "harbor.trivy.containerPort" . }}
           volumeMounts:
+          {{- if .Values.trivy.defaultDataVolumeMount.enabled }}
           - name: data
             mountPath: /home/scanner/.cache
             subPath: {{ .Values.persistence.persistentVolumeClaim.trivy.subPath }}
             readOnly: false
+          {{- end }}
           {{- if .Values.internalTLS.enabled }}
           - name: trivy-internal-certs
             mountPath: /etc/harbor/ssl/trivy
           {{- end }}
           {{- if .Values.caBundleSecretName }}
 {{ include "harbor.caBundleVolumeMount" . | indent 10 }}
+          {{- end }}
+          {{- with .Values.trivy.extraVolumeMounts }}
+          {{- toYaml . | nindent 10 }}
           {{- end }}
           livenessProbe:
             httpGet:
@@ -188,14 +193,24 @@ spec:
 {{ include "harbor.caBundleVolume" . | indent 6 }}
       {{- end }}
       {{- if not .Values.persistence.enabled }}
+      {{- if .Values.trivy.defaultDataVolumeMount.enabled }}
       - name: "data"
         emptyDir: {}
+      {{- end }}
       {{- else if $trivy.existingClaim }}
+      {{- if .Values.trivy.defaultDataVolumeMount.enabled }}
       - name: "data"
         persistentVolumeClaim:
           claimName: {{ $trivy.existingClaim }}
       {{- end }}
       {{- end }}
+      {{- with .Values.trivy.extraVolumes }}
+      {{- toYaml . | nindent 6 }}
+      {{- end }}
+      {{- else if .Values.trivy.extraVolumes }}
+      volumes:
+      {{- toYaml .Values.trivy.extraVolumes | nindent 6 }}
+      {{- end }}
     {{- with .Values.trivy.nodeSelector }}
       nodeSelector:
 {{ toYaml . | indent 8 }}
@@ -211,7 +226,7 @@ spec:
     {{- if .Values.trivy.priorityClassName }}
       priorityClassName: {{ .Values.trivy.priorityClassName }}
     {{- end }}
-{{- if and .Values.persistence.enabled (not $trivy.existingClaim) }}
+{{- if and .Values.persistence.enabled (not $trivy.existingClaim) .Values.trivy.defaultDataVolumeMount.enabled }}
   volumeClaimTemplates:
   - apiVersion: v1
     kind: PersistentVolumeClaim

values.yaml

@@ -960,6 +960,13 @@ trivy:
     failureThreshold: 3
     successThreshold: 1
   extraEnvVars: []
+  # defaultDataVolumeMount controls whether the default `data` volume is mounted at /home/scanner/.cache
+  # Set enabled to false when using extraVolumeMounts to override the cache and reports paths individually,
+  # to avoid mount conflicts with the parent path.
+  defaultDataVolumeMount:
+    enabled: true
+  extraVolumeMounts: []
+  extraVolumes: []
   nodeSelector: {}
   tolerations: []
   affinity: {}