Repository: aquasecurity/starboard
Pull request #1064 (2022-03-23 15:32:55)

feat(trivy): Add dbRepository flag to get advisory database from OCI registry
This PR adds `--db-repository` flag to trivy plugin and helm config. The flag is introduced in https://github.com/aquasecurity/trivy/pull/1873 

Related issue in GitLab: [#350232](https://gitlab.com/gitlab-org/gitlab/-/issues/350232)

CLAassistant: [![CLA assistant check](https://cla-assistant.io/pull/badge/not_signed)](https://cla-assistant.io/aquasecurity/starboard?pullRequest=1064) <br/>Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our [Contributor License Agreement](https://cla-assistant.io/aquasecurity/starboard?pullRequest=1064) before we can accept your contribution.<br/><sub>You have signed the CLA already but the status is still pending? Let us [recheck](https://cla-assistant.io/check/aquasecurity/starboard?pullRequest=1064) it.</sub>
CLAassistant: [![CLA assistant check](https://cla-assistant.io/pull/badge/not_signed)](https://cla-assistant.io/aquasecurity/starboard?pullRequest=1064) <br/>Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our [Contributor License Agreement](https://cla-assistant.io/aquasecurity/starboard?pullRequest=1064) before we can accept your contribution.<br/><sub>You have signed the CLA already but the status is still pending? Let us [recheck](https://cla-assistant.io/check/aquasecurity/starboard?pullRequest=1064) it.</sub>
ksashikumar: @knqyf263 Could you please review this dependent PR also? Thanks 🙂 
codecov[bot]: # [Codecov](https://codecov.io/gh/aquasecurity/starboard/pull/1064?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity) Report
> Merging [#1064](https://codecov.io/gh/aquasecurity/starboard/pull/1064?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity) (d922ec2) into [main](https://codecov.io/gh/aquasecurity/starboard/commit/674408e065f60f97b5ffaaffa2eeae3d720ba13c?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity) (674408e) will **decrease** coverage by `16.45%`.
> The diff coverage is `100.00%`.

```diff
@@             Coverage Diff             @@
##             main    #1064       +/-   ##
===========================================
- Coverage   58.17%   41.71%   -16.46%     
===========================================
  Files          71       53       -18     
  Lines        9247     7923     -1324     
===========================================
- Hits         5379     3305     -2074     
- Misses       3330     4422     +1092     
+ Partials      538      196      -342     
```


| [Impacted Files](https://codecov.io/gh/aquasecurity/starboard/pull/1064?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity) | Coverage Δ | |
|---|---|---|
| [pkg/plugin/trivy/plugin.go](https://codecov.io/gh/aquasecurity/starboard/pull/1064/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL3BsdWdpbi90cml2eS9wbHVnaW4uZ28=) | `81.02% <100.00%> (-0.41%)` | :arrow_down: |
| [pkg/plugin/factory.go](https://codecov.io/gh/aquasecurity/starboard/pull/1064/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL3BsdWdpbi9mYWN0b3J5Lmdv) | `0.00% <0.00%> (-81.49%)` | :arrow_down: |
| [pkg/kubehunter/scanner.go](https://codecov.io/gh/aquasecurity/starboard/pull/1064/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL2t1YmVodW50ZXIvc2Nhbm5lci5nbw==) | `0.00% <0.00%> (-74.49%)` | :arrow_down: |
| [pkg/configauditreport/scanner.go](https://codecov.io/gh/aquasecurity/starboard/pull/1064/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL2NvbmZpZ2F1ZGl0cmVwb3J0L3NjYW5uZXIuZ28=) | `0.00% <0.00%> (-68.24%)` | :arrow_down: |
| [pkg/kubehunter/model.go](https://codecov.io/gh/aquasecurity/starboard/pull/1064/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL2t1YmVodW50ZXIvbW9kZWwuZ28=) | `0.00% <0.00%> (-62.86%)` | :arrow_down: |
| [pkg/configauditreport/controller.go](https://codecov.io/gh/aquasecurity/starboard/pull/1064/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL2NvbmZpZ2F1ZGl0cmVwb3J0L2NvbnRyb2xsZXIuZ28=) | `0.00% <0.00%> (-61.54%)` | :arrow_down: |
| [pkg/vulnerabilityreport/scanner.go](https://codecov.io/gh/aquasecurity/starboard/pull/1064/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL3Z1bG5lcmFiaWxpdHlyZXBvcnQvc2Nhbm5lci5nbw==) | `0.00% <0.00%> (-59.44%)` | :arrow_down: |
| [pkg/vulnerabilityreport/controller.go](https://codecov.io/gh/aquasecurity/starboard/pull/1064/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL3Z1bG5lcmFiaWxpdHlyZXBvcnQvY29udHJvbGxlci5nbw==) | `0.00% <0.00%> (-57.32%)` | :arrow_down: |
| [pkg/operator/controller/ciskubebenchreport.go](https://codecov.io/gh/aquasecurity/starboard/pull/1064/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL29wZXJhdG9yL2NvbnRyb2xsZXIvY2lza3ViZWJlbmNocmVwb3J0Lmdv) | `0.00% <0.00%> (-56.18%)` | :arrow_down: |
| [pkg/kube/runnable\_job.go](https://codecov.io/gh/aquasecurity/starboard/pull/1064/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL2t1YmUvcnVubmFibGVfam9iLmdv) | `0.00% <0.00%> (-55.89%)` | :arrow_down: |
| ... and [32 more](https://codecov.io/gh/aquasecurity/starboard/pull/1064/diff?src=pr&el=tree-more&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity) | |

------

[Continue to review full report at Codecov](https://codecov.io/gh/aquasecurity/starboard/pull/1064?src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity).
> **Legend** - [Click here to learn more](https://docs.codecov.io/docs/codecov-delta?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity)
> `Δ = absolute <relative> (impact)`, `ø = not affected`, `? = missing data`
> Powered by [Codecov](https://codecov.io/gh/aquasecurity/starboard/pull/1064?src=pr&el=footer&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity). Last update [674408e...d922ec2](https://codecov.io/gh/aquasecurity/starboard/pull/1064?src=pr&el=lastupdated&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity). Read the [comment docs](https://docs.codecov.io/docs/pull-request-comments?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity).

ksashikumar: @chen-keinan Thanks for the comments, I've addressed them 🙂 Could you please take an another look?
chen-keinan: > @chen-keinan Thanks for the comments, I've addressed them 🙂 Could you please take an another look?

Thank you for the update; LGTM!!
knqyf263: Note that `--db-repository` was added in v0.25.1, but it had a critical bug. Please use v0.25.2 or greater.
chen-keinan: @ksashikumar this PR should also include the trivy version change from : trivy:0.24.2 to trivy:0.25.1 (the version that support `--db-repository` flag)  Its used in various places in the code:
 example: `values.yaml` , `starboard.yaml` etc. (test files)
ksashikumar: > @ksashikumar this PR should also include the trivy version change from : `trivy:0.24.2` to `trivy:0.25.2` (the version that support `--db-repository` flag) Its used in various places in the code: example: `values.yaml` , `starboard.yaml` etc. (test files)

@chen-keinan Thanks for that! I've updated the version in the files. Could you please take another look?
chen-keinan: @ksashikumar thank you for this effort; LGTM.
ksashikumar: > @ksashikumar thank you for this effort; need also to update trivy version on `itest--> matcher.go and matcher_test.go` I think this is the cause for the `Integration tests --> Run integration tests / Starboard CLI` to fail

@chen-keinan Oops, I missed that. Thanks for letting me know. I've fixed that 👍 

Patch:
diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index 207d255..591fa29 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -29,6 +29,15 @@ env:
   GO_VERSION: "1.17"
   KIND_VERSION: "v0.11.1"
   KIND_IMAGE: "kindest/node:v1.21.1@sha256:69860bda5563ac81e3c0057d654b5253219618a22ec3a346306239bba8cfa1a6"
+
+# Disable permissions granted to the GITHUB_TOKEN for all the available scopes.
+permissions: {}
+
+# Cancel any in-flight jobs for the same PR branch so there's only one active at a time.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   verify-code:
     name: Verify code
diff --git a/.github/workflows/publish-docs.yaml b/.github/workflows/publish-docs.yaml
index a237afd..e850bb6 100644
--- a/.github/workflows/publish-docs.yaml
+++ b/.github/workflows/publish-docs.yaml
@@ -1,26 +1,32 @@
 ---
 # This is a manually triggered workflow to build and publish the MkDocs from the
-# main branch to GitHub pages at https://aquasecurity.github.io/starboard.
+# specified Git revision to GitHub pages on https://aquasecurity.github.io/starboard.
 name: Publish documentation
 
 on:
   workflow_dispatch:
     inputs:
       ref:
-        description: The branch, tag or SHA to deploy.
+        description: The branch, tag or SHA to deploy, e.g. v0.0.1
         required: true
+
+# Disable permissions granted to the GITHUB_TOKEN for all the available scopes.
+permissions: {}
+
 jobs:
   deploy:
     name: Deploy documentation
     runs-on: ubuntu-20.04
+    permissions:
+      contents: write
     steps:
       - name: Checkout main
-        uses: actions/checkout@v3
+        uses: actions/checkout@a12a3943b4bdde767164f792f33f40b04645d846
         with:
           ref: ${{ github.event.inputs.ref }}
           fetch-depth: 0
           persist-credentials: true
-      - uses: actions/setup-python@9c644ca2ab8e57ea0a487b5ec2f8290740378bfd
+      - uses: actions/setup-python@21c0493ecfd34b1217f0a90ec19a327f3cc0a048
         with:
           python-version: 3.x
       - run: |
diff --git a/.github/workflows/publish-helm-chart.yaml b/.github/workflows/publish-helm-chart.yaml
index 9b81159..b23d8e0 100644
--- a/.github/workflows/publish-helm-chart.yaml
+++ b/.github/workflows/publish-helm-chart.yaml
@@ -7,7 +7,7 @@ on:
   workflow_dispatch:
     inputs:
       ref:
-        description: The branch, tag or SHA to publish.
+        description: The branch, tag or SHA to publish, e.g. v0.0.1
         required: true
 env:
   HELM_REP: helm-charts
diff --git a/.github/workflows/release-snapshot.yaml b/.github/workflows/release-snapshot.yaml
index 5d9c5c4..e71001d 100644
--- a/.github/workflows/release-snapshot.yaml
+++ b/.github/workflows/release-snapshot.yaml
@@ -1,15 +1,18 @@
 ---
-# Release snapshot on CRON schedule or on demand.
+# Release snapshot on CRON schedule (every night) or on demand.
 name: Release snapshot
 
 on:
   workflow_dispatch: {}
   schedule:
-    - cron: "0 0 * * *"  # every night
+    - cron: "0 0 * * *"
 
 env:
   GO_VERSION: "1.17"
 
+# Disable permissions granted to the GITHUB_TOKEN for all the available scopes.
+permissions: {}
+
 jobs:
   release-snapshot:
     name: Release unversioned snapshot
diff --git a/deploy/crd/ciskubebenchreports.crd.yaml b/deploy/crd/ciskubebenchreports.crd.yaml
index 7ce195a..94f4b5d 100644
--- a/deploy/crd/ciskubebenchreports.crd.yaml
+++ b/deploy/crd/ciskubebenchreports.crd.yaml
@@ -5,7 +5,7 @@ metadata:
   name: ciskubebenchreports.aquasecurity.github.io
   labels:
     app.kubernetes.io/managed-by: starboard
-    app.kubernetes.io/version: "0.15.2"
+    app.kubernetes.io/version: "0.15.3"
 spec:
   group: aquasecurity.github.io
   versions:
diff --git a/deploy/crd/clustercompliancedetailreports.crd.yaml b/deploy/crd/clustercompliancedetailreports.crd.yaml
index 90ddc69..a49c021 100644
--- a/deploy/crd/clustercompliancedetailreports.crd.yaml
+++ b/deploy/crd/clustercompliancedetailreports.crd.yaml
@@ -5,7 +5,7 @@ metadata:
   name: clustercompliancedetailreports.aquasecurity.github.io
   labels:
     app.kubernetes.io/managed-by: starboard
-    app.kubernetes.io/version: "0.15.2"
+    app.kubernetes.io/version: "0.15.3"
 spec:
   group: aquasecurity.github.io
   versions:
diff --git a/deploy/crd/clustercompliancereports.crd.yaml b/deploy/crd/clustercompliancereports.crd.yaml
index 606e130..1765170 100644
--- a/deploy/crd/clustercompliancereports.crd.yaml
+++ b/deploy/crd/clustercompliancereports.crd.yaml
@@ -5,7 +5,7 @@ metadata:
   name: clustercompliancereports.aquasecurity.github.io
   labels:
     app.kubernetes.io/managed-by: starboard
-    app.kubernetes.io/version: "0.15.2"
+    app.kubernetes.io/version: "0.15.3"
 spec:
   group: aquasecurity.github.io
   scope: Cluster
diff --git a/deploy/crd/clusterconfigauditreports.crd.yaml b/deploy/crd/clusterconfigauditreports.crd.yaml
index a9ad383..024429e 100644
--- a/deploy/crd/clusterconfigauditreports.crd.yaml
+++ b/deploy/crd/clusterconfigauditreports.crd.yaml
@@ -5,7 +5,7 @@ metadata:
   name: clusterconfigauditreports.aquasecurity.github.io
   labels:
     app.kubernetes.io/managed-by: starboard
-    app.kubernetes.io/version: "0.15.2"
+    app.kubernetes.io/version: "0.15.3"
 spec:
   group: aquasecurity.github.io
   versions:
@@ -23,9 +23,9 @@ spec:
           description: The age of the report
         - jsonPath: .report.summary.criticalCount
           type: integer
-          name: Critial
+          name: Critical
           priority: 1
-          description: The number of failed checks with critial severity
+          description: The number of failed checks with critical severity
         - jsonPath: .report.summary.highCount
           type: integer
           name: High
diff --git a/deploy/crd/clustervulnerabilityreports.crd.yaml b/deploy/crd/clustervulnerabilityreports.crd.yaml
index c2daea1..7e32d3b 100644
--- a/deploy/crd/clustervulnerabilityreports.crd.yaml
+++ b/deploy/crd/clustervulnerabilityreports.crd.yaml
@@ -5,7 +5,7 @@ metadata:
   name: clustervulnerabilityreports.aquasecurity.github.io
   labels:
     app.kubernetes.io/managed-by: starboard
-    app.kubernetes.io/version: "0.15.2"
+    app.kubernetes.io/version: "0.15.3"
 spec:
   group: aquasecurity.github.io
   versions:
diff --git a/deploy/crd/configauditreports.crd.yaml b/deploy/crd/configauditreports.crd.yaml
index 142f1fd..16ce378 100644
--- a/deploy/crd/configauditreports.crd.yaml
+++ b/deploy/crd/configauditreports.crd.yaml
@@ -5,7 +5,7 @@ metadata:
   name: configauditreports.aquasecurity.github.io
   labels:
     app.kubernetes.io/managed-by: starboard
-    app.kubernetes.io/version: "0.15.2"
+    app.kubernetes.io/version: "0.15.3"
 spec:
   group: aquasecurity.github.io
   versions:
@@ -23,9 +23,9 @@ spec:
           description: The age of the report
         - jsonPath: .report.summary.criticalCount
           type: integer
-          name: Critial
+          name: Critical
           priority: 1
-          description: The number of failed checks with critial severity
+          description: The number of failed checks with critical severity
         - jsonPath: .report.summary.highCount
           type: integer
           name: High
diff --git a/deploy/crd/kubehunterreports.crd.yaml b/deploy/crd/kubehunterreports.crd.yaml
index 5d2d348..92b611a 100644
--- a/deploy/crd/kubehunterreports.crd.yaml
+++ b/deploy/crd/kubehunterreports.crd.yaml
@@ -5,7 +5,7 @@ metadata:
   name: kubehunterreports.aquasecurity.github.io
   labels:
     app.kubernetes.io/managed-by: starboard
-    app.kubernetes.io/version: "0.15.2"
+    app.kubernetes.io/version: "0.15.3"
 spec:
   group: aquasecurity.github.io
   versions:
diff --git a/deploy/crd/vulnerabilityreports.crd.yaml b/deploy/crd/vulnerabilityreports.crd.yaml
index c3eafb5..eb88b06 100644
--- a/deploy/crd/vulnerabilityreports.crd.yaml
+++ b/deploy/crd/vulnerabilityreports.crd.yaml
@@ -5,7 +5,7 @@ metadata:
   name: vulnerabilityreports.aquasecurity.github.io
   labels:
     app.kubernetes.io/managed-by: starboard
-    app.kubernetes.io/version: "0.15.2"
+    app.kubernetes.io/version: "0.15.3"
 spec:
   group: aquasecurity.github.io
   versions:
diff --git a/deploy/helm/Chart.yaml b/deploy/helm/Chart.yaml
index 99ab92c..c565e17 100644
--- a/deploy/helm/Chart.yaml
+++ b/deploy/helm/Chart.yaml
@@ -6,12 +6,12 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.10.2
+version: 0.10.3
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
-appVersion: 0.15.2
+appVersion: 0.15.3
 
 # kubeVersion: A SemVer range of compatible Kubernetes versions (optional)
 
diff --git a/deploy/helm/templates/config.yaml b/deploy/helm/templates/config.yaml
index 923b136..39ffe65 100644
--- a/deploy/helm/templates/config.yaml
+++ b/deploy/helm/templates/config.yaml
@@ -63,6 +63,7 @@ data:
   trivy.nonSslRegistry.{{ $key }}: {{ $registry | quote }}
   {{- end }}
   trivy.severity: {{ .severity | quote }}
+  trivy.dbRepository: {{ .dbRepository | quote }}
   {{- if .ignoreUnfixed }}
   trivy.ignoreUnfixed: {{ .ignoreUnfixed | quote }}
   {{- end }}
diff --git a/deploy/helm/values.yaml b/deploy/helm/values.yaml
index fb8fb30..819ae65 100644
--- a/deploy/helm/values.yaml
+++ b/deploy/helm/values.yaml
@@ -100,7 +100,7 @@ trivy:
   createConfig: true
 
   # imageRef the Trivy image reference.
-  imageRef: docker.io/aquasec/trivy:0.24.2
+  imageRef: docker.io/aquasec/trivy:0.25.2
 
   # mode is the Trivy client mode. Either Standalone or ClientServer. Depending
   # on the active mode other settings might be applicable or required.
@@ -176,6 +176,9 @@ trivy:
   # Trivy client to Trivy server. Only applicable in ClientServer mode.
   #
   # serverCustomHeaders: "foo=bar"
+
+  dbRepository: "ghcr.io/aquasecurity/trivy-db"
+
 compliance:
   # failEntriesLimit the flag to limit the number of fail entries per control check in the cluster compliance detail report
   failEntriesLimit: 10
diff --git a/deploy/specs/nsa-1.0.yaml b/deploy/specs/nsa-1.0.yaml
index c87c7c0..eea5c09 100644
--- a/deploy/specs/nsa-1.0.yaml
+++ b/deploy/specs/nsa-1.0.yaml
@@ -6,7 +6,7 @@ metadata:
   labels:
     app.kubernetes.io/name: starboard-operator
     app.kubernetes.io/instance: starboard-operator
-    app.kubernetes.io/version: "0.15.2"
+    app.kubernetes.io/version: "0.15.3"
     app.kubernetes.io/managed-by: kubectl
 spec:
   name: nsa
diff --git a/deploy/static/01-starboard-operator.ns.yaml b/deploy/static/01-starboard-operator.ns.yaml
index 9c0f217..6d11d6b 100644
--- a/deploy/static/01-starboard-operator.ns.yaml
+++ b/deploy/static/01-starboard-operator.ns.yaml
@@ -6,5 +6,5 @@ metadata:
   labels:
     app.kubernetes.io/name: starboard-operator
     app.kubernetes.io/instance: starboard-operator
-    app.kubernetes.io/version: "0.15.2"
+    app.kubernetes.io/version: "0.15.3"
     app.kubernetes.io/managed-by: kubectl
diff --git a/deploy/static/02-starboard-operator.rbac.yaml b/deploy/static/02-starboard-operator.rbac.yaml
index ef8ee4d..042098b 100644
--- a/deploy/static/02-starboard-operator.rbac.yaml
+++ b/deploy/static/02-starboard-operator.rbac.yaml
@@ -7,7 +7,7 @@ metadata:
   labels:
     app.kubernetes.io/name: starboard-operator
     app.kubernetes.io/instance: starboard-operator
-    app.kubernetes.io/version: "0.15.2"
+    app.kubernetes.io/version: "0.15.3"
     app.kubernetes.io/managed-by: kubectl
 ---
 apiVersion: rbac.authorization.k8s.io/v1
@@ -17,7 +17,7 @@ metadata:
   labels:
     app.kubernetes.io/name: starboard-operator
     app.kubernetes.io/instance: starboard-operator
-    app.kubernetes.io/version: "0.15.2"
+    app.kubernetes.io/version: "0.15.3"
     app.kubernetes.io/managed-by: kubectl
 rules:
   - apiGroups:
@@ -166,7 +166,7 @@ metadata:
   labels:
     app.kubernetes.io/name: starboard-operator
     app.kubernetes.io/instance: starboard-operator
-    app.kubernetes.io/version: "0.15.2"
+    app.kubernetes.io/version: "0.15.3"
     app.kubernetes.io/managed-by: kubectl
 roleRef:
   apiGroup: rbac.authorization.k8s.io
diff --git a/deploy/static/03-starboard-operator.config.yaml b/deploy/static/03-starboard-operator.config.yaml
index 07b5632..efad718 100644
--- a/deploy/static/03-starboard-operator.config.yaml
+++ b/deploy/static/03-starboard-operator.config.yaml
@@ -7,7 +7,7 @@ metadata:
   labels:
     app.kubernetes.io/name: starboard-operator
     app.kubernetes.io/instance: starboard-operator
-    app.kubernetes.io/version: "0.15.2"
+    app.kubernetes.io/version: "0.15.3"
     app.kubernetes.io/managed-by: kubectl
 ---
 apiVersion: v1
@@ -18,7 +18,7 @@ metadata:
   labels:
     app.kubernetes.io/name: starboard-operator
     app.kubernetes.io/instance: starboard-operator
-    app.kubernetes.io/version: "0.15.2"
+    app.kubernetes.io/version: "0.15.3"
     app.kubernetes.io/managed-by: kubectl
 ---
 apiVersion: v1
@@ -29,7 +29,7 @@ metadata:
   labels:
     app.kubernetes.io/name: starboard-operator
     app.kubernetes.io/instance: starboard-operator
-    app.kubernetes.io/version: "0.15.2"
+    app.kubernetes.io/version: "0.15.3"
     app.kubernetes.io/managed-by: kubectl
 data:
   vulnerabilityReports.scanner: "Trivy"
@@ -45,13 +45,14 @@ metadata:
   labels:
     app.kubernetes.io/name: starboard-operator
     app.kubernetes.io/instance: starboard-operator
-    app.kubernetes.io/version: "0.15.2"
+    app.kubernetes.io/version: "0.15.3"
     app.kubernetes.io/managed-by: kubectl
 data:
-  trivy.imageRef: "docker.io/aquasec/trivy:0.24.2"
+  trivy.imageRef: "docker.io/aquasec/trivy:0.25.2"
   trivy.mode: "Standalone"
   trivy.severity: "UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL"
   trivy.timeout: "5m0s"
+  trivy.dbRepository: "ghcr.io/aquasecurity/trivy-db"
   trivy.resources.requests.cpu: 100m
   trivy.resources.requests.memory: 100M
   trivy.resources.limits.cpu: 500m
@@ -65,7 +66,7 @@ metadata:
   labels:
     app.kubernetes.io/name: starboard-operator
     app.kubernetes.io/instance: starboard-operator
-    app.kubernetes.io/version: "0.15.2"
+    app.kubernetes.io/version: "0.15.3"
     app.kubernetes.io/managed-by: kubectl
 data:
   polaris.imageRef: "quay.io/fairwinds/polaris:4.2"
diff --git a/deploy/static/04-starboard-operator.policies.yaml b/deploy/static/04-starboard-operator.policies.yaml
index 7258497..cf8b391 100644
--- a/deploy/static/04-starboard-operator.policies.yaml
+++ b/deploy/static/04-starboard-operator.policies.yaml
@@ -7,7 +7,7 @@ metadata:
   labels:
     app.kubernetes.io/name: starboard-operator
     app.kubernetes.io/instance: starboard-operator
-    app.kubernetes.io/version: "0.15.2"
+    app.kubernetes.io/version: "0.15.3"
     app.kubernetes.io/managed-by: kubectl
 data:
   library.kubernetes.rego: "package lib.kubernetes\n\ndefault is_gatekeeper = false\n\nis_gatekeeper
diff --git a/deploy/static/05-starboard-operator.deployment.yaml b/deploy/static/05-starboard-operator.deployment.yaml
index 512ed0f..5a86be4 100644
--- a/deploy/static/05-starboard-operator.deployment.yaml
+++ b/deploy/static/05-starboard-operator.deployment.yaml
@@ -7,7 +7,7 @@ metadata:
   labels:
     app.kubernetes.io/name: starboard-operator
     app.kubernetes.io/instance: starboard-operator
-    app.kubernetes.io/version: "0.15.2"
+    app.kubernetes.io/version: "0.15.3"
     app.kubernetes.io/managed-by: kubectl
   annotations:
     prometheus.io/path: /metrics
@@ -30,7 +30,7 @@ metadata:
   labels:
     app.kubernetes.io/name: starboard-operator
     app.kubernetes.io/instance: starboard-operator
-    app.kubernetes.io/version: "0.15.2"
+    app.kubernetes.io/version: "0.15.3"
     app.kubernetes.io/managed-by: kubectl
 spec:
   replicas: 1
@@ -50,7 +50,7 @@ spec:
       automountServiceAccountToken: true
       containers:
         - name: "starboard-operator"
-          image: "docker.io/aquasec/starboard-operator:0.15.2"
+          image: "docker.io/aquasec/starboard-operator:0.15.3"
           imagePullPolicy: IfNotPresent
           env:
             - name: OPERATOR_NAMESPACE
diff --git a/deploy/static/starboard.yaml b/deploy/static/starboard.yaml
index 5f9e82f..6838d6d 100644
--- a/deploy/static/starboard.yaml
+++ b/deploy/static/starboard.yaml
@@ -5,7 +5,7 @@ metadata:
   name: vulnerabilityreports.aquasecurity.github.io
   labels:
     app.kubernetes.io/managed-by: starboard
-    app.kubernetes.io/version: "0.15.2"
+    app.kubernetes.io/version: "0.15.3"
 spec:
   group: aquasecurity.github.io
   versions:
@@ -249,7 +249,7 @@ metadata:
   name: configauditreports.aquasecurity.github.io
   labels:
     app.kubernetes.io/managed-by: starboard
-    app.kubernetes.io/version: "0.15.2"
+    app.kubernetes.io/version: "0.15.3"
 spec:
   group: aquasecurity.github.io
   versions:
@@ -267,9 +267,9 @@ spec:
           description: The age of the report
         - jsonPath: .report.summary.criticalCount
           type: integer
-          name: Critial
+          name: Critical
           priority: 1
-          description: The number of failed checks with critial severity
+          description: The number of failed checks with critical severity
         - jsonPath: .report.summary.highCount
           type: integer
           name: High
@@ -306,7 +306,7 @@ metadata:
   name: clusterconfigauditreports.aquasecurity.github.io
   labels:
     app.kubernetes.io/managed-by: starboard
-    app.kubernetes.io/version: "0.15.2"
+    app.kubernetes.io/version: "0.15.3"
 spec:
   group: aquasecurity.github.io
   versions:
@@ -324,9 +324,9 @@ spec:
           description: The age of the report
         - jsonPath: .report.summary.criticalCount
           type: integer
-          name: Critial
+          name: Critical
           priority: 1
-          description: The number of failed checks with critial severity
+          description: The number of failed checks with critical severity
         - jsonPath: .report.summary.highCount
           type: integer
           name: High
@@ -362,7 +362,7 @@ metadata:
   name: ciskubebenchreports.aquasecurity.github.io
   labels:
     app.kubernetes.io/managed-by: starboard
-    app.kubernetes.io/version: "0.15.2"
+    app.kubernetes.io/version: "0.15.3"
 spec:
   group: aquasecurity.github.io
   versions:
@@ -412,7 +412,7 @@ metadata:
   name: clustercompliancereports.aquasecurity.github.io
   labels:
     app.kubernetes.io/managed-by: starboard
-    app.kubernetes.io/version: "0.15.2"
+    app.kubernetes.io/version: "0.15.3"
 spec:
   group: aquasecurity.github.io
   scope: Cluster
@@ -549,7 +549,7 @@ metadata:
   name: clustercompliancedetailreports.aquasecurity.github.io
   labels:
     app.kubernetes.io/managed-by: starboard
-    app.kubernetes.io/version: "0.15.2"
+    app.kubernetes.io/version: "0.15.3"
 spec:
   group: aquasecurity.github.io
   versions:
@@ -592,7 +592,7 @@ metadata:
   labels:
     app.kubernetes.io/name: starboard-operator
     app.kubernetes.io/instance: starboard-operator
-    app.kubernetes.io/version: "0.15.2"
+    app.kubernetes.io/version: "0.15.3"
     app.kubernetes.io/managed-by: kubectl
 ---
 apiVersion: v1
@@ -603,7 +603,7 @@ metadata:
   labels:
     app.kubernetes.io/name: starboard-operator
     app.kubernetes.io/instance: starboard-operator
-    app.kubernetes.io/version: "0.15.2"
+    app.kubernetes.io/version: "0.15.3"
     app.kubernetes.io/managed-by: kubectl
 ---
 apiVersion: rbac.authorization.k8s.io/v1
@@ -613,7 +613,7 @@ metadata:
   labels:
     app.kubernetes.io/name: starboard-operator
     app.kubernetes.io/instance: starboard-operator
-    app.kubernetes.io/version: "0.15.2"
+    app.kubernetes.io/version: "0.15.3"
     app.kubernetes.io/managed-by: kubectl
 rules:
   - apiGroups:
@@ -762,7 +762,7 @@ metadata:
   labels:
     app.kubernetes.io/name: starboard-operator
     app.kubernetes.io/instance: starboard-operator
-    app.kubernetes.io/version: "0.15.2"
+    app.kubernetes.io/version: "0.15.3"
     app.kubernetes.io/managed-by: kubectl
 roleRef:
   apiGroup: rbac.authorization.k8s.io
@@ -781,7 +781,7 @@ metadata:
   labels:
     app.kubernetes.io/name: starboard-operator
     app.kubernetes.io/instance: starboard-operator
-    app.kubernetes.io/version: "0.15.2"
+    app.kubernetes.io/version: "0.15.3"
     app.kubernetes.io/managed-by: kubectl
 ---
 apiVersion: v1
@@ -792,7 +792,7 @@ metadata:
   labels:
     app.kubernetes.io/name: starboard-operator
     app.kubernetes.io/instance: starboard-operator
-    app.kubernetes.io/version: "0.15.2"
+    app.kubernetes.io/version: "0.15.3"
     app.kubernetes.io/managed-by: kubectl
 ---
 apiVersion: v1
@@ -803,7 +803,7 @@ metadata:
   labels:
     app.kubernetes.io/name: starboard-operator
     app.kubernetes.io/instance: starboard-operator
-    app.kubernetes.io/version: "0.15.2"
+    app.kubernetes.io/version: "0.15.3"
     app.kubernetes.io/managed-by: kubectl
 data:
   vulnerabilityReports.scanner: "Trivy"
@@ -819,13 +819,14 @@ metadata:
   labels:
     app.kubernetes.io/name: starboard-operator
     app.kubernetes.io/instance: starboard-operator
-    app.kubernetes.io/version: "0.15.2"
+    app.kubernetes.io/version: "0.15.3"
     app.kubernetes.io/managed-by: kubectl
 data:
-  trivy.imageRef: "docker.io/aquasec/trivy:0.24.2"
+  trivy.imageRef: "docker.io/aquasec/trivy:0.25.2"
   trivy.mode: "Standalone"
   trivy.severity: "UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL"
   trivy.timeout: "5m0s"
+  trivy.dbRepository: "ghcr.io/aquasecurity/trivy-db"
   trivy.resources.requests.cpu: 100m
   trivy.resources.requests.memory: 100M
   trivy.resources.limits.cpu: 500m
@@ -839,7 +840,7 @@ metadata:
   labels:
     app.kubernetes.io/name: starboard-operator
     app.kubernetes.io/instance: starboard-operator
-    app.kubernetes.io/version: "0.15.2"
+    app.kubernetes.io/version: "0.15.3"
     app.kubernetes.io/managed-by: kubectl
 data:
   polaris.imageRef: "quay.io/fairwinds/polaris:4.2"
@@ -1040,7 +1041,7 @@ metadata:
   labels:
     app.kubernetes.io/name: starboard-operator
     app.kubernetes.io/instance: starboard-operator
-    app.kubernetes.io/version: "0.15.2"
+    app.kubernetes.io/version: "0.15.3"
     app.kubernetes.io/managed-by: kubectl
 data:
   library.kubernetes.rego: "package lib.kubernetes\n\ndefault is_gatekeeper = false\n\nis_gatekeeper
@@ -1909,7 +1910,7 @@ metadata:
   labels:
     app.kubernetes.io/name: starboard-operator
     app.kubernetes.io/instance: starboard-operator
-    app.kubernetes.io/version: "0.15.2"
+    app.kubernetes.io/version: "0.15.3"
     app.kubernetes.io/managed-by: kubectl
   annotations:
     prometheus.io/path: /metrics
@@ -1932,7 +1933,7 @@ metadata:
   labels:
     app.kubernetes.io/name: starboard-operator
     app.kubernetes.io/instance: starboard-operator
-    app.kubernetes.io/version: "0.15.2"
+    app.kubernetes.io/version: "0.15.3"
     app.kubernetes.io/managed-by: kubectl
 spec:
   replicas: 1
@@ -1952,7 +1953,7 @@ spec:
       automountServiceAccountToken: true
       containers:
         - name: "starboard-operator"
-          image: "docker.io/aquasec/starboard-operator:0.15.2"
+          image: "docker.io/aquasec/starboard-operator:0.15.3"
           imagePullPolicy: IfNotPresent
           env:
             - name: OPERATOR_NAMESPACE
diff --git a/docs/cli/getting-started.md b/docs/cli/getting-started.md
index 1280c70..3cec2c2 100644
--- a/docs/cli/getting-started.md
+++ b/docs/cli/getting-started.md
@@ -116,7 +116,7 @@ kubectl get configauditreport -o wide
 <summary>Result</summary>
 
 ```
-NAME                          SCANNER     AGE   CRITIAL   HIGH   MEDIUM   LOW
+NAME                          SCANNER     AGE   CRITICAL  HIGH   MEDIUM   LOW
 replicaset-nginx-78449c65d4   Starboard   75s   0         0      6        7
 ```
 </details>
diff --git a/docs/operator/getting-started.md b/docs/operator/getting-started.md
index fd3684d..621eb1a 100644
--- a/docs/operator/getting-started.md
+++ b/docs/operator/getting-started.md
@@ -48,7 +48,7 @@ kubectl get configauditreports -o wide
 <summary>Result</summary>
 
 ```
-NAME                          SCANNER     AGE    CRITIAL   HIGH   MEDIUM   LOW
+NAME                          SCANNER     AGE    CRITICAL  HIGH   MEDIUM   LOW
 replicaset-nginx-78449c65d4   Starboard   2m7s   0         0      6        7
 ```
 </details>
diff --git a/docs/tutorials/writing-custom-configuration-audit-policies.md b/docs/tutorials/writing-custom-configuration-audit-policies.md
index 453edd4..0a8ea13 100644
--- a/docs/tutorials/writing-custom-configuration-audit-policies.md
+++ b/docs/tutorials/writing-custom-configuration-audit-policies.md
@@ -157,7 +157,7 @@ that's failing:
 
 ```console
 $ kubectl get configauditreport configmap-test -o wide
-NAME             SCANNER     AGE   CRITIAL   HIGH   MEDIUM   LOW
+NAME             SCANNER     AGE   CRITICAL  HIGH   MEDIUM   LOW
 configmap-test   Starboard   24s   0         0      0        1
 ```
 
diff --git a/docs/vulnerability-scanning/trivy.md b/docs/vulnerability-scanning/trivy.md
index f666a0e..f7bbc60 100644
--- a/docs/vulnerability-scanning/trivy.md
+++ b/docs/vulnerability-scanning/trivy.md
@@ -82,7 +82,8 @@ EOF
 
 | CONFIGMAP KEY                      | DEFAULT                            | DESCRIPTION                                                                                                                                                         |
 |------------------------------------|------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| `trivy.imageRef`                   | `docker.io/aquasec/trivy:0.24.2`   | Trivy image reference                                                                                                                                               |
+| `trivy.imageRef`                   | `docker.io/aquasec/trivy:0.25.2`   | Trivy image reference                                                                                                                                               |
+| `trivy.dbRepository`               | `ghcr.io/aquasecurity/trivy-db`    | External OCI Registry to download the vulnerability database                                                                                                                                               |
 | `trivy.mode`                       | `Standalone`                       | Trivy client mode. Either `Standalone` or `ClientServer`. Depending on the active mode other settings might be applicable or required.                              |
 | `trivy.severity`                   | `UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL` | A comma separated list of severity levels reported by Trivy                                                                                                         |
 | `trivy.ignoreUnfixed`              | N/A                                | Whether to show only fixed vulnerabilities in vulnerabilities reported by Trivy. Set to `"true"` to enable it.                                                      |
diff --git a/mkdocs.yml b/mkdocs.yml
index ea30235..70e24a1 100644
--- a/mkdocs.yml
+++ b/mkdocs.yml
@@ -99,8 +99,8 @@ extra:
   version:
     provider: mike
   var:
-    prev_git_tag: "v0.15.1"
-    chart_version: 0.10.2
+    prev_git_tag: "v0.15.2"
+    chart_version: 0.10.3
 
 # Requires pip install mkdocs-macros-plugin
 plugins:
diff --git a/pkg/plugin/trivy/plugin.go b/pkg/plugin/trivy/plugin.go
index 1516126..045b064 100644
--- a/pkg/plugin/trivy/plugin.go
+++ b/pkg/plugin/trivy/plugin.go
@@ -43,6 +43,7 @@ const (
 	keyTrivyGitHubToken            = "trivy.githubToken"
 	keyTrivySkipFiles              = "trivy.skipFiles"
 	keyTrivySkipDirs               = "trivy.skipDirs"
+	keyTrivyDBRepository           = "trivy.dbRepository"
 
 	keyTrivyServerURL           = "trivy.serverURL"
 	keyTrivyServerTokenHeader   = "trivy.serverTokenHeader"
@@ -56,6 +57,8 @@ const (
 	keyResourcesLimitsMemory   = "trivy.resources.limits.memory"
 )
 
+const defaultDBRepository = "ghcr.io/aquasecurity/trivy-db"
+
 // Mode in which Trivy client operates.
 type Mode string
 
@@ -211,6 +214,10 @@ func (c Config) setResourceLimit(configKey string, k8sResourceList *corev1.Resou
 	return nil
 }
 
+func (c Config) GetDBRepository() (string, error) {
+	return c.GetRequiredData(keyTrivyDBRepository)
+}
+
 type plugin struct {
 	clock          ext.Clock
 	idGenerator    ext.IDGenerator
@@ -240,10 +247,11 @@ func NewPlugin(clock ext.Clock, idGenerator ext.IDGenerator, client client.Clien
 func (p *plugin) Init(ctx starboard.PluginContext) error {
 	return ctx.EnsureConfig(starboard.PluginConfig{
 		Data: map[string]string{
-			keyTrivyImageRef: "docker.io/aquasec/trivy:0.24.2",
+			keyTrivyImageRef: "docker.io/aquasec/trivy:0.25.2",
 			keyTrivySeverity: "UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL",
 			keyTrivyMode:     string(Standalone),
 			keyTrivyTimeout:  "5m0s",
+			keyTrivyDBRepository: defaultDBRepository,
 
 			keyResourcesRequestsCPU:    "100m",
 			keyResourcesRequestsMemory: "100M",
@@ -342,6 +350,11 @@ func (p *plugin) getPodSpecForStandaloneMode(ctx starboard.PluginContext, config
 
 	trivyConfigName := starboard.GetPluginConfigMapName(Plugin)
 
+	dbRepository, err := config.GetDBRepository()
+	if err != nil {
+		return corev1.PodSpec{}, nil, err
+	}
+
 	requirements, err := config.GetResourceRequirements()
 	if err != nil {
 		return corev1.PodSpec{}, nil, err
@@ -410,6 +423,8 @@ func (p *plugin) getPodSpecForStandaloneMode(ctx starboard.PluginContext, config
 			"/tmp/trivy/.cache",
 			"image",
 			"--download-db-only",
+			"--db-repository",
+			dbRepository,
 		},
 		Resources: requirements,
 		VolumeMounts: []corev1.VolumeMount{
@@ -993,6 +1008,11 @@ func (p *plugin) getPodSpecForStandaloneFSMode(ctx starboard.PluginContext, conf
 
 	trivyConfigName := starboard.GetPluginConfigMapName(Plugin)
 
+	dbRepository, err := config.GetDBRepository()
+	if err != nil {
+		return corev1.PodSpec{}, nil, err
+	}
+
 	requirements, err := config.GetResourceRequirements()
 	if err != nil {
 		return corev1.PodSpec{}, nil, err
@@ -1050,6 +1070,8 @@ func (p *plugin) getPodSpecForStandaloneFSMode(ctx starboard.PluginContext, conf
 			"--download-db-only",
 			"--cache-dir",
 			"/var/starboard/trivy-db",
+			"--db-repository",
+			dbRepository,
 		},
 		Resources:    requirements,
 		VolumeMounts: volumeMounts,


Test patch:
diff --git a/itest/matcher/matcher.go b/itest/matcher/matcher.go
index d045f1a..c5ac8c6 100644
--- a/itest/matcher/matcher.go
+++ b/itest/matcher/matcher.go
@@ -21,7 +21,7 @@ var (
 	trivyScanner = v1alpha1.Scanner{
 		Name:    "Trivy",
 		Vendor:  "Aqua Security",
-		Version: "0.24.2",
+		Version: "0.25.2",
 	}
 	builtInScanner = v1alpha1.Scanner{
 		Name:    "Starboard",
diff --git a/itest/matcher/matcher_test.go b/itest/matcher/matcher_test.go
index 0a48ccc..f163855 100644
--- a/itest/matcher/matcher_test.go
+++ b/itest/matcher/matcher_test.go
@@ -57,7 +57,7 @@ func TestVulnerabilityReportMatcher(t *testing.T) {
 				Scanner: v1alpha1.Scanner{
 					Name:    "Trivy",
 					Vendor:  "Aqua Security",
-					Version: "0.24.2",
+					Version: "0.25.2",
 				},
 				Vulnerabilities: []v1alpha1.Vulnerability{},
 			},
diff --git a/pkg/plugin/trivy/plugin_test.go b/pkg/plugin/trivy/plugin_test.go
index 5fc9c05..6c3c500 100644
--- a/pkg/plugin/trivy/plugin_test.go
+++ b/pkg/plugin/trivy/plugin_test.go
@@ -29,6 +29,8 @@ var (
 	fixedClock = ext.NewFixedClock(fixedTime)
 )
 
+const defaultDBRepository = "ghcr.io/aquasecurity/trivy-db"
+
 func TestConfig_GetImageRef(t *testing.T) {
 	testCases := []struct {
 		name             string
@@ -196,6 +198,7 @@ func TestConfig_GetResourceRequirements(t *testing.T) {
 			config: trivy.Config{
 				PluginConfig: starboard.PluginConfig{
 					Data: map[string]string{
+						"trivy.dbRepository":              defaultDBRepository,
 						"trivy.resources.requests.cpu":    "800m",
 						"trivy.resources.requests.memory": "200M",
 						"trivy.resources.limits.cpu":      "600m",
@@ -470,10 +473,11 @@ func TestPlugin_Init(t *testing.T) {
 				ResourceVersion: "1",
 			},
 			Data: map[string]string{
-				"trivy.imageRef": "docker.io/aquasec/trivy:0.24.2",
-				"trivy.severity": "UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL",
-				"trivy.mode":     "Standalone",
-				"trivy.timeout":  "5m0s",
+				"trivy.imageRef":     "docker.io/aquasec/trivy:0.25.2",
+				"trivy.severity":     "UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL",
+				"trivy.mode":         "Standalone",
+				"trivy.timeout":      "5m0s",
+				"trivy.dbRepository": defaultDBRepository,
 
 				"trivy.resources.requests.cpu":    "100m",
 				"trivy.resources.requests.memory": "100M",
@@ -496,7 +500,7 @@ func TestPlugin_Init(t *testing.T) {
 					ResourceVersion: "1",
 				},
 				Data: map[string]string{
-					"trivy.imageRef": "docker.io/aquasec/trivy:0.24.2",
+					"trivy.imageRef": "docker.io/aquasec/trivy:0.25.2",
 					"trivy.severity": "UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL",
 					"trivy.mode":     "Standalone",
 				},
@@ -530,7 +534,7 @@ func TestPlugin_Init(t *testing.T) {
 				ResourceVersion: "1",
 			},
 			Data: map[string]string{
-				"trivy.imageRef": "docker.io/aquasec/trivy:0.24.2",
+				"trivy.imageRef": "docker.io/aquasec/trivy:0.25.2",
 				"trivy.severity": "UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL",
 				"trivy.mode":     "Standalone",
 			},
@@ -582,7 +586,7 @@ func TestPlugin_GetScanJobSpec(t *testing.T) {
 			config: map[string]string{
 				"trivy.imageRef": "docker.io/aquasec/trivy:0.14.0",
 				"trivy.mode":     string(trivy.Standalone),
-
+				"trivy.dbRepository":              defaultDBRepository,
 				"trivy.resources.requests.cpu":    "100m",
 				"trivy.resources.requests.memory": "100M",
 				"trivy.resources.limits.cpu":      "500m",
@@ -682,6 +686,7 @@ func TestPlugin_GetScanJobSpec(t *testing.T) {
 							"--cache-dir", "/tmp/trivy/.cache",
 							"image",
 							"--download-db-only",
+							"--db-repository", defaultDBRepository,
 						},
 						Resources: corev1.ResourceRequirements{
 							Requests: corev1.ResourceList{
@@ -834,6 +839,7 @@ func TestPlugin_GetScanJobSpec(t *testing.T) {
 				"trivy.imageRef":                     "docker.io/aquasec/trivy:0.14.0",
 				"trivy.mode":                         string(trivy.Standalone),
 				"trivy.insecureRegistry.pocRegistry": "poc.myregistry.harbor.com.pl",
+				"trivy.dbRepository":                 defaultDBRepository,
 
 				"trivy.resources.requests.cpu":    "100m",
 				"trivy.resources.requests.memory": "100M",
@@ -928,6 +934,7 @@ func TestPlugin_GetScanJobSpec(t *testing.T) {
 							"--cache-dir", "/tmp/trivy/.cache",
 							"image",
 							"--download-db-only",
+							"--db-repository", defaultDBRepository,
 						},
 						Resources: corev1.ResourceRequirements{
 							Requests: corev1.ResourceList{
@@ -1084,6 +1091,7 @@ func TestPlugin_GetScanJobSpec(t *testing.T) {
 				"trivy.imageRef":                   "docker.io/aquasec/trivy:0.14.0",
 				"trivy.mode":                       string(trivy.Standalone),
 				"trivy.nonSslRegistry.pocRegistry": "poc.myregistry.harbor.com.pl",
+				"trivy.dbRepository":               defaultDBRepository,
 				"trivy.resources.requests.cpu":     "100m",
 				"trivy.resources.requests.memory":  "100M",
 				"trivy.resources.limits.cpu":       "500m",
@@ -1178,6 +1186,7 @@ func TestPlugin_GetScanJobSpec(t *testing.T) {
 							"--cache-dir", "/tmp/trivy/.cache",
 							"image",
 							"--download-db-only",
+							"--db-repository", defaultDBRepository,
 						},
 						Resources: corev1.ResourceRequirements{
 							Requests: corev1.ResourceList{
@@ -1338,6 +1347,7 @@ CVE-2018-14618
 
 # No impact in our settings
 CVE-2019-1543`,
+				"trivy.dbRepository":              defaultDBRepository,
 				"trivy.resources.requests.cpu":    "100m",
 				"trivy.resources.requests.memory": "100M",
 				"trivy.resources.limits.cpu":      "500m",
@@ -1448,6 +1458,7 @@ CVE-2019-1543`,
 							"--cache-dir", "/tmp/trivy/.cache",
 							"image",
 							"--download-db-only",
+							"--db-repository", defaultDBRepository,
 						},
 						Resources: corev1.ResourceRequirements{
 							Requests: corev1.ResourceList{
@@ -1609,6 +1620,7 @@ CVE-2019-1543`,
 				"trivy.imageRef": "docker.io/aquasec/trivy:0.14.0",
 				"trivy.mode":     string(trivy.Standalone),
 
+				"trivy.dbRepository":              defaultDBRepository,
 				"trivy.resources.requests.cpu":    "100m",
 				"trivy.resources.requests.memory": "100M",
 				"trivy.resources.limits.cpu":      "500m",
@@ -1706,6 +1718,7 @@ CVE-2019-1543`,
 							"--cache-dir", "/tmp/trivy/.cache",
 							"image",
 							"--download-db-only",
+							"--db-repository", defaultDBRepository,
 						},
 						Resources: corev1.ResourceRequirements{
 							Requests: corev1.ResourceList{
@@ -1858,6 +1871,7 @@ CVE-2019-1543`,
 				"trivy.imageRef":                  "docker.io/aquasec/trivy:0.14.0",
 				"trivy.mode":                      string(trivy.ClientServer),
 				"trivy.serverURL":                 "http://trivy.trivy:4954",
+				"trivy.dbRepository":              defaultDBRepository,
 				"trivy.resources.requests.cpu":    "100m",
 				"trivy.resources.requests.memory": "100M",
 				"trivy.resources.limits.cpu":      "500m",
@@ -2047,6 +2061,7 @@ CVE-2019-1543`,
 				"trivy.imageRef":                  "docker.io/aquasec/trivy:0.14.0",
 				"trivy.mode":                      string(trivy.ClientServer),
 				"trivy.serverURL":                 "http://trivy.trivy:4954",
+				"trivy.dbRepository":              defaultDBRepository,
 				"trivy.resources.requests.cpu":    "100m",
 				"trivy.resources.requests.memory": "100M",
 				"trivy.resources.limits.cpu":      "500m",
@@ -2237,6 +2252,7 @@ CVE-2019-1543`,
 				"trivy.mode":                      string(trivy.ClientServer),
 				"trivy.serverURL":                 "https://trivy.trivy:4954",
 				"trivy.serverInsecure":            "true",
+				"trivy.dbRepository":              defaultDBRepository,
 				"trivy.resources.requests.cpu":    "100m",
 				"trivy.resources.requests.memory": "100M",
 				"trivy.resources.limits.cpu":      "500m",
@@ -2431,6 +2447,7 @@ CVE-2019-1543`,
 				"trivy.mode":                       string(trivy.ClientServer),
 				"trivy.serverURL":                  "http://trivy.trivy:4954",
 				"trivy.nonSslRegistry.pocRegistry": "poc.myregistry.harbor.com.pl",
+				"trivy.dbRepository":               defaultDBRepository,
 				"trivy.resources.requests.cpu":     "100m",
 				"trivy.resources.requests.memory":  "100M",
 				"trivy.resources.limits.cpu":       "500m",
@@ -2629,6 +2646,7 @@ CVE-2018-14618
 
 # No impact in our settings
 CVE-2019-1543`,
+				"trivy.dbRepository":              defaultDBRepository,
 				"trivy.resources.requests.cpu":    "100m",
 				"trivy.resources.requests.memory": "100M",
 				"trivy.resources.limits.cpu":      "500m",
@@ -2844,9 +2862,10 @@ CVE-2019-1543`,
 		{
 			name: "Trivy fs scan command in Standalone mode",
 			config: map[string]string{
-				"trivy.imageRef":                  "docker.io/aquasec/trivy:0.24.2",
+				"trivy.imageRef":                  "docker.io/aquasec/trivy:0.25.2",
 				"trivy.mode":                      string(trivy.Standalone),
 				"trivy.command":                   string(trivy.Filesystem),
+				"trivy.dbRepository":              defaultDBRepository,
 				"trivy.resources.requests.cpu":    "100m",
 				"trivy.resources.requests.memory": "100M",
 				"trivy.resources.limits.cpu":      "500m",
@@ -2888,7 +2907,7 @@ CVE-2019-1543`,
 				InitContainers: []corev1.Container{
 					{
 						Name:                     "00000000-0000-0000-0000-000000000001",
-						Image:                    "docker.io/aquasec/trivy:0.24.2",
+						Image:                    "docker.io/aquasec/trivy:0.25.2",
 						ImagePullPolicy:          corev1.PullIfNotPresent,
 						TerminationMessagePolicy: corev1.TerminationMessageFallbackToLogsOnError,
 						Command: []string{
@@ -2917,7 +2936,7 @@ CVE-2019-1543`,
 					},
 					{
 						Name:                     "00000000-0000-0000-0000-000000000002",
-						Image:                    "docker.io/aquasec/trivy:0.24.2",
+						Image:                    "docker.io/aquasec/trivy:0.25.2",
 						ImagePullPolicy:          corev1.PullIfNotPresent,
 						TerminationMessagePolicy: corev1.TerminationMessageFallbackToLogsOnError,
 						Env: []corev1.EnvVar{
@@ -2978,6 +2997,7 @@ CVE-2019-1543`,
 							"--download-db-only",
 							"--cache-dir",
 							"/var/starboard/trivy-db",
+							"--db-repository", defaultDBRepository,
 						},
 						Resources: corev1.ResourceRequirements{
 							Requests: corev1.ResourceList{
@@ -3162,6 +3182,7 @@ CVE-2019-1543`,
 			"trivy.imageRef":                  "docker.io/aquasec/trivy:0.22.0",
 			"trivy.mode":                      string(trivy.Standalone),
 			"trivy.command":                   string(trivy.Filesystem),
+			"trivy.dbRepository":              defaultDBRepository,
 			"trivy.resources.requests.cpu":    "100m",
 			"trivy.resources.requests.memory": "100M",
 			"trivy.resources.limits.cpu":      "500m",
@@ -3294,6 +3315,7 @@ CVE-2019-1543`,
 						"--download-db-only",
 						"--cache-dir",
 						"/var/starboard/trivy-db",
+						"--db-repository", defaultDBRepository,
 					},
 					Resources: corev1.ResourceRequirements{
 						Requests: corev1.ResourceList{