Skip to content

fix: default accessGlobalSecretsAndServiceAccount to false #2942

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
rzala wants to merge 1 commit into
base: main
Choose a base branch
from
Open

fix: default accessGlobalSecretsAndServiceAccount to false #2942

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion deploy/helm/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,7 +42,7 @@ Keeps security report resources updated
| nodeCollector.volumeMounts | list | `[{"mountPath":"/var/lib/etcd","name":"var-lib-etcd","readOnly":true},{"mountPath":"/var/lib/kubelet","name":"var-lib-kubelet","readOnly":true},{"mountPath":"/var/lib/kube-scheduler","name":"var-lib-kube-scheduler","readOnly":true},{"mountPath":"/var/lib/kube-controller-manager","name":"var-lib-kube-controller-manager","readOnly":true},{"mountPath":"/etc/systemd","name":"etc-systemd","readOnly":true},{"mountPath":"/lib/systemd/","name":"lib-systemd","readOnly":true},{"mountPath":"/etc/kubernetes","name":"etc-kubernetes","readOnly":true},{"mountPath":"/etc/cni/net.d/","name":"etc-cni-netd","readOnly":true}]` | node-collector pod volume mounts definition for collecting config files information |
| nodeCollector.volumes | list | `[{"hostPath":{"path":"/var/lib/etcd"},"name":"var-lib-etcd"},{"hostPath":{"path":"/var/lib/kubelet"},"name":"var-lib-kubelet"},{"hostPath":{"path":"/var/lib/kube-scheduler"},"name":"var-lib-kube-scheduler"},{"hostPath":{"path":"/var/lib/kube-controller-manager"},"name":"var-lib-kube-controller-manager"},{"hostPath":{"path":"/etc/systemd"},"name":"etc-systemd"},{"hostPath":{"path":"/lib/systemd"},"name":"lib-systemd"},{"hostPath":{"path":"/etc/kubernetes"},"name":"etc-kubernetes"},{"hostPath":{"path":"/etc/cni/net.d/"},"name":"etc-cni-netd"}]` | node-collector pod volumes definition for collecting config files information |
| nodeSelector | object | `{}` | nodeSelector set the operator nodeSelector |
| operator.accessGlobalSecretsAndServiceAccount | bool | `true` | accessGlobalSecretsAndServiceAccount The flag to enable access to global secrets/service accounts to allow `vulnerability scan job` to pull images from private registries |
| operator.accessGlobalSecretsAndServiceAccount | bool | `false` | accessGlobalSecretsAndServiceAccount The flag to enable access to global secrets/service accounts to allow `vulnerability scan job` to pull images from private registries |
| operator.annotations | object | `{}` | additional annotations for the operator deployment |
| operator.batchDeleteDelay | string | `"10s"` | batchDeleteDelay the duration to wait before deleting another batch of config audit reports. |
| operator.batchDeleteLimit | int | `10` | batchDeleteLimit the maximum number of config audit reports deleted by the operator when the plugin's config has changed. |
Expand Down
2 changes: 1 addition & 1 deletion deploy/helm/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -116,7 +116,7 @@ operator:
# -- batchDeleteDelay the duration to wait before deleting another batch of config audit reports.
batchDeleteDelay: 10s
# -- accessGlobalSecretsAndServiceAccount The flag to enable access to global secrets/service accounts to allow `vulnerability scan job` to pull images from private registries
accessGlobalSecretsAndServiceAccount: true
accessGlobalSecretsAndServiceAccount: false
# -- builtInTrivyServer The flag enables the usage of built-in trivy server in cluster. It also overrides the following trivy params with built-in values
# trivy.mode = ClientServer and serverURL = http://<serverServiceName>.<trivy operator namespace>:4975
builtInTrivyServer: false
Expand Down
2 changes: 1 addition & 1 deletion deploy/static/trivy-operator.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3028,7 +3028,7 @@ data:
OPERATOR_WEBHOOK_BROADCAST_CUSTOM_HEADERS: ""
OPERATOR_SEND_DELETED_REPORTS: "false"
OPERATOR_PRIVATE_REGISTRY_SCAN_SECRETS_NAMES: "{}"
OPERATOR_ACCESS_GLOBAL_SECRETS_SERVICE_ACCOUNTS: "true"
OPERATOR_ACCESS_GLOBAL_SECRETS_SERVICE_ACCOUNTS: "false"
OPERATOR_BUILT_IN_TRIVY_SERVER: "false"
TRIVY_SERVER_HEALTH_CHECK_CACHE_EXPIRATION: "10h"
OPERATOR_MERGE_RBAC_FINDING_WITH_CONFIG_AUDIT: "false"
Expand Down
2 changes: 1 addition & 1 deletion docs/getting-started/installation/configuration.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,7 @@ You can configure Trivy-Operator to control its behavior and adapt it to your ne
| `OPERATOR_VULNERABILITY_SCANNER_SCAN_ONLY_CURRENT_REVISIONS` | `true` | The flag to enable vulnerability scanner to only scan the current revision of a deployment |
| `OPERATOR_INFRA_ASSESSMENT_SCANNER_ENABLED` | `true` | The flag to enable cluster infra assessment scanner |
| `OPERATOR_CLUSTER_COMPLIANCE_ENABLED` | `true` | The flag to enable cluster compliance scanner |
| `OPERATOR_ACCESS_GLOBAL_SECRETS_SERVICE_ACCOUNTS` | `true` | The flag to enable access to global secrets/service accounts to allow `vulnerability scan job` to pull images from private registries |
| `OPERATOR_ACCESS_GLOBAL_SECRETS_SERVICE_ACCOUNTS` | `false` | The flag to enable access to global secrets/service accounts to allow `vulnerability scan job` to pull images from private registries |
| `OPERATOR_SCANNER_REPORT_TTL` | `"24h"` | The flag to set how long a report should exist. When a old report is deleted a new one will be created by the controller. It can be set to `""` to disabled the TTL for vulnerability scanner. |
| `OPERATOR_LEADER_ELECTION_ENABLED` | `false` | The flag to enable operator replica leader election |
| `OPERATOR_LEADER_ELECTION_ID` | `trivy-operator-lock` | The name of the resource lock for leader election |
Expand Down
2 changes: 1 addition & 1 deletion pkg/operator/etc/config.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,7 +55,7 @@ type Config struct {
WebhookBroadcastCustomHeaders string `env:"OPERATOR_WEBHOOK_BROADCAST_CUSTOM_HEADERS"`
WebhookSendDeletedReports bool `env:"OPERATOR_SEND_DELETED_REPORTS" envDefault:"false"`
TargetWorkloads string `env:"OPERATOR_TARGET_WORKLOADS" envDefault:"Pod,ReplicaSet,ReplicationController,StatefulSet,DaemonSet,CronJob,Job"`
AccessGlobalSecretsAndServiceAccount bool `env:"OPERATOR_ACCESS_GLOBAL_SECRETS_SERVICE_ACCOUNTS" envDefault:"true"`
AccessGlobalSecretsAndServiceAccount bool `env:"OPERATOR_ACCESS_GLOBAL_SECRETS_SERVICE_ACCOUNTS" envDefault:"false"`
PrivateRegistryScanSecretsNames string `env:"OPERATOR_PRIVATE_REGISTRY_SCAN_SECRETS_NAMES"`
BuiltInTrivyServer bool `env:"OPERATOR_BUILT_IN_TRIVY_SERVER" envDefault:"false"`
TrivyServerHealthCheckCacheExpiration *time.Duration `env:"TRIVY_SERVER_HEALTH_CHECK_CACHE_EXPIRATION" envDefault:"10h"`
Expand Down
Loading