Repository: aquasecurity/starboard
Pull request #616 (2021-06-04 14:20:00)

refactor(trivy): Read config from starboard-trivy-config ConfigMap
We started off with all config settings read from the starboard
ConfigMap and the starboard Secret. However, this does not scale
well with a number of plugins and configuration options.

This commit allows Triy plugin to read its settings from
the starboard-trivy-config ConfigMap and the starboard-trivy-config
Secret.

Signed-off-by: Daniel Pacak <pacak.daniel@gmail.com>

codecov[bot]: # [Codecov](https://codecov.io/gh/aquasecurity/starboard/pull/616?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity) Report
> Merging [#616](https://codecov.io/gh/aquasecurity/starboard/pull/616?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity) (4e3cf4e) into [main](https://codecov.io/gh/aquasecurity/starboard/commit/8f97a544cdce5def762a8d9272db37231c92c611?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity) (8f97a54) will **decrease** coverage by `23.51%`.
> The diff coverage is `82.95%`.

[![Impacted file tree graph](https://codecov.io/gh/aquasecurity/starboard/pull/616/graphs/tree.svg?width=650&height=150&src=pr&token=qqTGKAJ0Wb&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity)](https://codecov.io/gh/aquasecurity/starboard/pull/616?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity)

```diff
@@             Coverage Diff             @@
##             main     #616       +/-   ##
===========================================
- Coverage   68.65%   45.14%   -23.52%     
===========================================
  Files          58       41       -17     
  Lines        4387     3591      -796     
===========================================
- Hits         3012     1621     -1391     
- Misses       1034     1871      +837     
+ Partials      341       99      -242     
```


| [Impacted Files](https://codecov.io/gh/aquasecurity/starboard/pull/616?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity) | Coverage Δ | |
|---|---|---|
| [pkg/plugin/aqua/plugin.go](https://codecov.io/gh/aquasecurity/starboard/pull/616/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL3BsdWdpbi9hcXVhL3BsdWdpbi5nbw==) | `0.00% <0.00%> (ø)` | |
| [pkg/plugin/factory.go](https://codecov.io/gh/aquasecurity/starboard/pull/616/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL3BsdWdpbi9mYWN0b3J5Lmdv) | `0.00% <0.00%> (-80.49%)` | :arrow_down: |
| [pkg/starboard/config.go](https://codecov.io/gh/aquasecurity/starboard/pull/616/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL3N0YXJib2FyZC9jb25maWcuZ28=) | `70.07% <ø> (-0.65%)` | :arrow_down: |
| [pkg/starboard/plugin.go](https://codecov.io/gh/aquasecurity/starboard/pull/616/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL3N0YXJib2FyZC9wbHVnaW4uZ28=) | `51.85% <ø> (ø)` | |
| [pkg/plugin/trivy/plugin.go](https://codecov.io/gh/aquasecurity/starboard/pull/616/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL3BsdWdpbi90cml2eS9wbHVnaW4uZ28=) | `82.94% <84.88%> (-2.73%)` | :arrow_down: |
| [pkg/kubehunter/scanner.go](https://codecov.io/gh/aquasecurity/starboard/pull/616/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL2t1YmVodW50ZXIvc2Nhbm5lci5nbw==) | `0.00% <0.00%> (-80.51%)` | :arrow_down: |
| [pkg/configauditreport/scanner.go](https://codecov.io/gh/aquasecurity/starboard/pull/616/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL2NvbmZpZ2F1ZGl0cmVwb3J0L3NjYW5uZXIuZ28=) | `0.00% <0.00%> (-70.77%)` | :arrow_down: |
| [pkg/vulnerabilityreport/scanner.go](https://codecov.io/gh/aquasecurity/starboard/pull/616/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL3Z1bG5lcmFiaWxpdHlyZXBvcnQvc2Nhbm5lci5nbw==) | `0.00% <0.00%> (-70.54%)` | :arrow_down: |
| [pkg/operator/controller/configauditreport.go](https://codecov.io/gh/aquasecurity/starboard/pull/616/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL29wZXJhdG9yL2NvbnRyb2xsZXIvY29uZmlnYXVkaXRyZXBvcnQuZ28=) | `0.00% <0.00%> (-66.67%)` | :arrow_down: |
| ... and [32 more](https://codecov.io/gh/aquasecurity/starboard/pull/616/diff?src=pr&el=tree-more&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity) | |

------

[Continue to review full report at Codecov](https://codecov.io/gh/aquasecurity/starboard/pull/616?src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity).
> **Legend** - [Click here to learn more](https://docs.codecov.io/docs/codecov-delta?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity)
> `Δ = absolute <relative> (impact)`, `ø = not affected`, `? = missing data`
> Powered by [Codecov](https://codecov.io/gh/aquasecurity/starboard/pull/616?src=pr&el=footer&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity). Last update [8f97a54...4e3cf4e](https://codecov.io/gh/aquasecurity/starboard/pull/616?src=pr&el=lastupdated&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity). Read the [comment docs](https://docs.codecov.io/docs/pull-request-comments?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity).

itaysk: I skimmed through it. looks good, but I wasn't sure if you needed to also update the config defaults for the init command use-case?
danielpacak: > I skimmed through it. looks good, but I wasn't sure if you needed to also update the config defaults for the init command use-case?

That's a good point. I've updated the PR to ensure default plugin config when init command is run. Previously I deferred it to scan commands. It was easier in terms of code, but not very intuitive. Now all ConfigMaps are created in the init command.

Patch:
diff --git a/build/mkdocs-material/Dockerfile b/build/mkdocs-material/Dockerfile
index e868812..e2258e2 100644
--- a/build/mkdocs-material/Dockerfile
+++ b/build/mkdocs-material/Dockerfile
@@ -1,4 +1,4 @@
-FROM squidfunk/mkdocs-material
+FROM squidfunk/mkdocs-material:7.0.6
 
 ## If you want to see exactly the same version as is published to GitHub pages
 ## use a private image for insiders, which requires authentication.
diff --git a/deploy/crd/clusterconfigauditreports.crd.yaml b/deploy/crd/clusterconfigauditreports.crd.yaml
new file mode 100644
index 0000000..83321ec
--- /dev/null
+++ b/deploy/crd/clusterconfigauditreports.crd.yaml
@@ -0,0 +1,50 @@
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: clusterconfigauditreports.aquasecurity.github.io
+  labels:
+    app.kubernetes.io/managed-by: starboard
+spec:
+  group: aquasecurity.github.io
+  versions:
+    - name: v1alpha1
+      served: true
+      storage: true
+      additionalPrinterColumns:
+        - jsonPath: .report.scanner.name
+          type: string
+          name: Scanner
+          description: The name of the config audit scanner
+        - jsonPath: .metadata.creationTimestamp
+          type: date
+          name: Age
+          description: The age of the report
+        - jsonPath: .report.summary.dangerCount
+          type: integer
+          name: Danger
+          priority: 1
+          description: The number of checks that failed with Danger status
+        - jsonPath: .report.summary.warningCount
+          type: integer
+          name: Warning
+          priority: 1
+          description: The number of checks that failed with Warning status
+        - jsonPath: .report.summary.passCount
+          type: integer
+          name: Pass
+          priority: 1
+          description: The number of checks that passed
+      schema:
+        openAPIV3Schema:
+          x-kubernetes-preserve-unknown-fields: true
+          type: object
+  scope: Cluster
+  names:
+    singular: clusterconfigauditreport
+    plural: clusterconfigauditreports
+    kind: ClusterConfigAuditReport
+    listKind: ClusterConfigAuditReportList
+    categories:
+      - all
+    shortNames:
+      - clusterconfigaudit
diff --git a/deploy/helm/templates/config.yaml b/deploy/helm/templates/config.yaml
index 5b84558..aa168d3 100644
--- a/deploy/helm/templates/config.yaml
+++ b/deploy/helm/templates/config.yaml
@@ -10,17 +10,6 @@ data:
   scanJob.annotations: {{ .Values.starboard.scanJobAnnotations | quote }}
   {{- if .Values.operator.vulnerabilityScannerEnabled }}
   vulnerabilityReports.scanner: {{ .Values.starboard.vulnerabilityReportsPlugin | quote }}
-  {{- if eq .Values.starboard.vulnerabilityReportsPlugin "Trivy" }}
-  trivy.imageRef: "{{ .Values.trivy.imageRef }}"
-  trivy.mode: "{{ .Values.trivy.mode }}"
-  {{- if eq .Values.trivy.mode "ClientServer" }}
-  trivy.serverURL: "{{ .Values.trivy.serverURL }}"
-  {{- end }}
-  trivy.httpProxy: "{{ .Values.trivy.httpProxy }}"
-  trivy.httpsProxy: "{{ .Values.trivy.httpsProxy }}"
-  trivy.noProxy: "{{ .Values.trivy.noProxy }}"
-  trivy.severity: "{{ .Values.trivy.severity }}"
-  {{- end }}
   {{- end }}
   {{- if .Values.operator.kubernetesBenchmarkEnabled }}
   kube-bench.imageRef: "{{ .Values.kubeBench.imageRef }}"
@@ -28,6 +17,32 @@ data:
   {{- if .Values.operator.configAuditScannerEnabled }}
   configAuditReports.scanner: {{ .Values.starboard.configAuditReportsPlugin | quote }}
   {{- end }}
+{{- if eq .Values.starboard.vulnerabilityReportsPlugin "Trivy" }}
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: starboard-trivy-config
+  labels:
+    {{- include "starboard-operator.labels" . | nindent 4 }}
+data:
+  trivy.imageRef: {{ .Values.trivy.imageRef | quote }}
+  trivy.mode: {{ .Values.trivy.mode | quote }}
+  trivy.httpProxy: "{{ .Values.trivy.httpProxy }}"
+  trivy.httpsProxy: "{{ .Values.trivy.httpsProxy }}"
+  trivy.noProxy: "{{ .Values.trivy.noProxy }}"
+  trivy.severity: "{{ .Values.trivy.severity }}"
+  {{- if eq .Values.trivy.mode "ClientServer" }}
+  trivy.serverURL: "{{ .Values.trivy.serverURL }}"
+  {{- end }}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: starboard-trivy-config
+  labels:
+    {{- include "starboard-operator.labels" . | nindent 4 }}
+{{- end }}
 {{- if eq .Values.starboard.configAuditReportsPlugin "Conftest" }}
 ---
 apiVersion: v1
diff --git a/deploy/static/05-starboard-operator.config.yaml b/deploy/static/05-starboard-operator.config.yaml
index 8ba4a50..10b0020 100644
--- a/deploy/static/05-starboard-operator.config.yaml
+++ b/deploy/static/05-starboard-operator.config.yaml
@@ -7,11 +7,17 @@ metadata:
 data:
   vulnerabilityReports.scanner: Trivy
   configAuditReports.scanner: Polaris
+  kube-bench.imageRef: docker.io/aquasec/kube-bench:0.5.0
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: starboard-trivy-config
+  namespace: starboard-operator
+data:
   trivy.severity: UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL
   trivy.imageRef: docker.io/aquasec/trivy:0.16.0
   trivy.mode: Standalone
-  trivy.serverURL: http://trivy-server.trivy-server:4954
-  kube-bench.imageRef: docker.io/aquasec/kube-bench:0.5.0
 ---
 apiVersion: v1
 kind: ConfigMap
diff --git a/docs/crds.md b/docs/crds.md
index 155e97d..7c36611 100644
--- a/docs/crds.md
+++ b/docs/crds.md
@@ -3,12 +3,13 @@
 This project houses CustomResourceDefinitions (CRDs) related to security and compliance checks along with the code
 generated by Kubernetes [code generators][k8s-code-generator] to write such custom resources in a natural way.
 
-| NAME                                             | SHORTNAMES   | APIGROUP               | NAMESPACED |  KIND               |
-| ------------------------------------------------ | ------------ | ---------------------- | ---------- | ------------------- |
-| [vulnerabilityreports][vulnerabilityreports-crd] | vulns,vuln   | aquasecurity.github.io | true       | [VulnerabilityReport](#vulnerabilityreport) |
-| [configauditreports][configauditreports-crd]     | configaudit  | aquasecurity.github.io | true       | [ConfigAuditReport](#configauditreport)     |
-| [ciskubebenchreports][ciskubebenchreports-crd]   | kubebench    | aquasecurity.github.io | false      | [CISKubeBenchReport](#ciskubebenchreport)   |
-| [kubehunterreports][kubehunterreports-crd]       | kubehunter   | aquasecurity.github.io | false      | [KubeHunterReport](#kubehunterreport)       |
+| NAME                        | SHORTNAMES         | APIGROUP               | NAMESPACED |  KIND |
+| --------------------------- | ------------------ | ---------------------- | ---------- | ----- |
+| [vulnerabilityreports]      | vulns,vuln         | aquasecurity.github.io | true       | [VulnerabilityReport](#vulnerabilityreport) |
+| [configauditreports]        | configaudit        | aquasecurity.github.io | true       | [ConfigAuditReport](#configauditreport)     |
+| [clusterconfigauditreports] | clusterconfigaudit | aquasecurity.github.io | false      | [ClusterConfigAuditReport](#clusterconfigauditreport) |
+| [ciskubebenchreports]       | kubebench          | aquasecurity.github.io | false      | [CISKubeBenchReport](#ciskubebenchreport)   |
+| [kubehunterreports]         | kubehunter         | aquasecurity.github.io | false      | [KubeHunterReport](#kubehunterreport)       |
 
 !!! note
     We are open to suggestions for adding new or changes to the existing CRDs in the case that would enable
@@ -87,12 +88,12 @@ You can find the list of available integrations [here](./integrations/vulnerabil
 
 ## ConfigAuditReport
 
-An instance of the ConfigAuditReport represents checks performed by configuration auditing tools, such as [Polaris][polaris],
-against a Kubernetes workload's configuration. For example, check that a given container image runs as non root user
-or that a container has resource requests and limits set. Currently checks only relate to Kubernetes workloads, but most
-likely we'll extend this model to cater for other Kubernetes objects such as Services, ConfigMaps, etc (see [#300][discussion-300]).
+An instance of the ConfigAuditReport represents checks performed by configuration auditing tools, such as [Polaris]
+and [Conftest], against a Kubernetes object's configuration. For example, check that a given container image runs as
+non-root user or that a container has resource requests and limits set. Checks might relate to Kubernetes workloads
+and other namespaced Kubernetes objects such as Services, ConfigMaps, Roles, and RoleBindings.
 
-Each report owned by the underlying Kubernetes workload and is stored in the same namespace, following the
+Each report is owned by the underlying Kubernetes object and is stored in the same namespace, following the
 `<workload-kind>-<workload-name>` naming convention.
 
 ```yaml
@@ -163,6 +164,11 @@ schema can be integrated with Starboard.
     to perform scans and vary in output formats for a relatively common goal, which is inspecting deployment descriptors
     for known configuration pitfalls.
 
+## ClusterConfigAuditReport
+
+ClusterConfigAuditReport is equivalent to ConfigAuditReport for cluster-scoped objects such as ClusterRoles,
+ClusterRoleBindings, and CustomResourceDefinitions.
+
 ## CISKubeBenchReport
 
 The CISKubeBenchReport is a cluster scoped resource owned by a Kubernetes node, which represents the latest result
@@ -287,13 +293,15 @@ report:
 
 [k8s-code-generator]: https://github.com/kubernetes/code-generator
 
-[vulnerabilityreports-crd]: https://raw.githubusercontent.com/aquasecurity/starboard/{{ var.tag }}/deploy/crd/vulnerabilityreports.crd.yaml
-[ciskubebenchreports-crd]: https://raw.githubusercontent.com/aquasecurity/starboard/{{ var.tag }}/deploy/crd/ciskubebenchreports.crd.yaml
-[kubehunterreports-crd]: https://raw.githubusercontent.com/aquasecurity/starboard/{{ var.tag }}/deploy/crd/kubehunterreports.crd.yaml
-[configauditreports-crd]: https://raw.githubusercontent.com/aquasecurity/starboard/{{ var.tag }}/deploy/crd/configauditreports.crd.yaml
+[vulnerabilityreports]: https://raw.githubusercontent.com/aquasecurity/starboard/{{ var.tag }}/deploy/crd/vulnerabilityreports.crd.yaml
+[ciskubebenchreports]: https://raw.githubusercontent.com/aquasecurity/starboard/{{ var.tag }}/deploy/crd/ciskubebenchreports.crd.yaml
+[kubehunterreports]: https://raw.githubusercontent.com/aquasecurity/starboard/{{ var.tag }}/deploy/crd/kubehunterreports.crd.yaml
+[configauditreports]: https://raw.githubusercontent.com/aquasecurity/starboard/{{ var.tag }}/deploy/crd/configauditreports.crd.yaml
+[clusterconfigauditreports]: https://raw.githubusercontent.com/aquasecurity/starboard/{{ var.tag }}/deploy/crd/clusterconfigauditreports.crd.yaml
 
 [issue-288]: https://github.com/aquasecurity/starboard/issues/288
 [discussion-300]: https://github.com/aquasecurity/starboard/discussions/300
-[polaris]: https://github.com/FairwindsOps/polaris
+[Polaris]: ./integrations/config-checkers/polaris.md
+[Conftest]: ./integrations/config-checkers/conftest.md
 [kube-bench]: https://github.com/aquasecurity/kube-bench
 [kube-hunter]: https://github.com/aquasecurity/kube-hunter
diff --git a/pkg/apis/aquasecurity/v1alpha1/config_audit_types.go b/pkg/apis/aquasecurity/v1alpha1/config_audit_types.go
index a84655d..56d8d5c 100644
--- a/pkg/apis/aquasecurity/v1alpha1/config_audit_types.go
+++ b/pkg/apis/aquasecurity/v1alpha1/config_audit_types.go
@@ -43,6 +43,29 @@ type ConfigAuditReportList struct {
 	Items []ConfigAuditReport `json:"items"`
 }
 
+// +genclient
+// +genclient:nonNamespaced
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// ClusterConfigAuditReport is a specification for the ClusterConfigAuditReport resource.
+type ClusterConfigAuditReport struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	Report ConfigAuditResult `json:"report"`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// ClusterConfigAuditReportList is a list of ClusterConfigAuditReport resources.
+type ClusterConfigAuditReportList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata"`
+
+	Items []ClusterConfigAuditReport `json:"items"`
+}
+
+// TODO Rename to ConfigAuditReportData
 type ConfigAuditResult struct {
 	UpdateTimestamp metav1.Time        `json:"updateTimestamp"`
 	Scanner         Scanner            `json:"scanner"`
diff --git a/pkg/apis/aquasecurity/v1alpha1/register.go b/pkg/apis/aquasecurity/v1alpha1/register.go
index 879b09a..34d5ed3 100644
--- a/pkg/apis/aquasecurity/v1alpha1/register.go
+++ b/pkg/apis/aquasecurity/v1alpha1/register.go
@@ -39,6 +39,8 @@ func addKnownTypes(scheme *runtime.Scheme) error {
 		&KubeHunterReportList{},
 		&ConfigAuditReport{},
 		&ConfigAuditReportList{},
+		&ClusterConfigAuditReport{},
+		&ClusterConfigAuditReportList{},
 	)
 	meta.AddToGroupVersion(scheme, SchemeGroupVersion)
 	return nil
diff --git a/pkg/apis/aquasecurity/v1alpha1/zz_generated.deepcopy.go b/pkg/apis/aquasecurity/v1alpha1/zz_generated.deepcopy.go
index 0031c90..6ad5261 100644
--- a/pkg/apis/aquasecurity/v1alpha1/zz_generated.deepcopy.go
+++ b/pkg/apis/aquasecurity/v1alpha1/zz_generated.deepcopy.go
@@ -202,6 +202,66 @@ func (in *Check) DeepCopy() *Check {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ClusterConfigAuditReport) DeepCopyInto(out *ClusterConfigAuditReport) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.Report.DeepCopyInto(&out.Report)
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClusterConfigAuditReport.
+func (in *ClusterConfigAuditReport) DeepCopy() *ClusterConfigAuditReport {
+	if in == nil {
+		return nil
+	}
+	out := new(ClusterConfigAuditReport)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *ClusterConfigAuditReport) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ClusterConfigAuditReportList) DeepCopyInto(out *ClusterConfigAuditReportList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]ClusterConfigAuditReport, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClusterConfigAuditReportList.
+func (in *ClusterConfigAuditReportList) DeepCopy() *ClusterConfigAuditReportList {
+	if in == nil {
+		return nil
+	}
+	out := new(ClusterConfigAuditReportList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *ClusterConfigAuditReportList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *ConfigAuditReport) DeepCopyInto(out *ConfigAuditReport) {
 	*out = *in
diff --git a/pkg/cmd/cleanup.go b/pkg/cmd/cleanup.go
index 2136ece..6471dca 100644
--- a/pkg/cmd/cleanup.go
+++ b/pkg/cmd/cleanup.go
@@ -8,9 +8,10 @@ import (
 	apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/client/clientset/clientset/typed/apiextensions/v1"
 	"k8s.io/cli-runtime/pkg/genericclioptions"
 	"k8s.io/client-go/kubernetes"
+	"sigs.k8s.io/controller-runtime/pkg/client"
 )
 
-func NewCleanupCmd(cf *genericclioptions.ConfigFlags) *cobra.Command {
+func NewCleanupCmd(buildInfo starboard.BuildInfo, cf *genericclioptions.ConfigFlags) *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "cleanup",
 		Short: "Delete Kubernetes resources created by Starboard",
@@ -27,8 +28,13 @@ func NewCleanupCmd(cf *genericclioptions.ConfigFlags) *cobra.Command {
 			if err != nil {
 				return err
 			}
+			scheme := starboard.NewScheme()
+			kubeClient, err := client.New(kubeConfig, client.Options{Scheme: scheme})
+			if err != nil {
+				return err
+			}
 			configManager := starboard.NewConfigManager(kubeClientset, starboard.NamespaceName)
-			installer := NewInstaller(kubeClientset, apiExtensionsClientset, configManager)
+			installer := NewInstaller(buildInfo, kubeClientset, apiExtensionsClientset, kubeClient, configManager)
 			return installer.Uninstall(context.Background())
 		},
 	}
diff --git a/pkg/cmd/init.go b/pkg/cmd/init.go
index 4a10dba..7be0d29 100644
--- a/pkg/cmd/init.go
+++ b/pkg/cmd/init.go
@@ -8,9 +8,10 @@ import (
 	apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/client/clientset/clientset/typed/apiextensions/v1"
 	"k8s.io/cli-runtime/pkg/genericclioptions"
 	"k8s.io/client-go/kubernetes"
+	"sigs.k8s.io/controller-runtime/pkg/client"
 )
 
-func NewInitCmd(cf *genericclioptions.ConfigFlags) *cobra.Command {
+func NewInitCmd(buildInfo starboard.BuildInfo, cf *genericclioptions.ConfigFlags) *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "init",
 		Short: "Create Kubernetes resources used by Starboard",
@@ -49,8 +50,13 @@ the "cleanup" command.`,
 			if err != nil {
 				return err
 			}
+			scheme := starboard.NewScheme()
+			kubeClient, err := client.New(kubeConfig, client.Options{Scheme: scheme})
+			if err != nil {
+				return err
+			}
 			configManager := starboard.NewConfigManager(kubeClientset, starboard.NamespaceName)
-			installer := NewInstaller(kubeClientset, apiExtensionsClientset, configManager)
+			installer := NewInstaller(buildInfo, kubeClientset, apiExtensionsClientset, kubeClient, configManager)
 			return installer.Install(context.Background())
 		},
 	}
diff --git a/pkg/cmd/installer.go b/pkg/cmd/installer.go
index f946208..5762f03 100644
--- a/pkg/cmd/installer.go
+++ b/pkg/cmd/installer.go
@@ -7,6 +7,7 @@ import (
 
 	embedded "github.com/aquasecurity/starboard"
 	"github.com/aquasecurity/starboard/pkg/apis/aquasecurity/v1alpha1"
+	"github.com/aquasecurity/starboard/pkg/plugin"
 	"github.com/aquasecurity/starboard/pkg/starboard"
 	corev1 "k8s.io/api/core/v1"
 	rbacv1 "k8s.io/api/rbac/v1"
@@ -18,6 +19,7 @@ import (
 	"k8s.io/client-go/kubernetes"
 	"k8s.io/klog"
 	"k8s.io/utils/pointer"
+	"sigs.k8s.io/controller-runtime/pkg/client"
 )
 
 const (
@@ -119,6 +121,8 @@ var (
 )
 
 type Installer struct {
+	buildInfo     starboard.BuildInfo
+	client        client.Client
 	clientset     kubernetes.Interface
 	clientsetext  extapi.ApiextensionsV1Interface
 	configManager starboard.ConfigManager
@@ -126,14 +130,19 @@ type Installer struct {
 
 // NewInstaller constructs an Installer with the given starboard.ConfigManager and kubernetes.Interface.
 func NewInstaller(
+	buildInfo starboard.BuildInfo,
+	// TODO Get rid of kubernetes.Interface and ApiextensionsV1Interface and use just client.Client
 	clientset kubernetes.Interface,
 	clientsetext extapi.ApiextensionsV1Interface,
+	client client.Client,
 	configManager starboard.ConfigManager,
 ) *Installer {
 	return &Installer{
-		configManager: configManager,
+		buildInfo:     buildInfo,
 		clientset:     clientset,
 		clientsetext:  clientsetext,
+		client:        client,
+		configManager: configManager,
 	}
 }
 
@@ -185,6 +194,37 @@ func (m *Installer) Install(ctx context.Context) error {
 		return err
 	}
 
+	config, err := m.configManager.Read(ctx)
+	if err != nil {
+		return err
+	}
+
+	pluginResolver := plugin.NewResolver().
+		WithBuildInfo(m.buildInfo).
+		WithNamespace(starboard.NamespaceName).
+		WithServiceAccountName(starboard.ServiceAccountName).
+		WithConfig(config).
+		WithClient(m.client)
+
+	vulnerabilityPlugin, pluginContext, err := pluginResolver.GetVulnerabilityPlugin()
+	if err != nil {
+		return err
+	}
+
+	err = vulnerabilityPlugin.Init(pluginContext)
+	if err != nil {
+		return fmt.Errorf("initializing %s plugin: %w", pluginContext.GetName(), err)
+	}
+
+	configAuditPlugin, pluginContext, err := pluginResolver.GetConfigAuditPlugin()
+	if err != nil {
+		return err
+	}
+	err = configAuditPlugin.Init(pluginContext)
+	if err != nil {
+		return fmt.Errorf("initializing %s plugin: %w", pluginContext.GetName(), err)
+	}
+
 	return m.initRBAC(ctx)
 }
 
diff --git a/pkg/cmd/root.go b/pkg/cmd/root.go
index 10158f0..8c7d0bf 100644
--- a/pkg/cmd/root.go
+++ b/pkg/cmd/root.go
@@ -52,10 +52,10 @@ func NewRootCmd(buildInfo starboard.BuildInfo, args []string, outWriter io.Write
 	cf = genericclioptions.NewConfigFlags(true)
 
 	rootCmd.AddCommand(NewVersionCmd(buildInfo, outWriter))
-	rootCmd.AddCommand(NewInitCmd(cf))
+	rootCmd.AddCommand(NewInitCmd(buildInfo, cf))
 	rootCmd.AddCommand(NewScanCmd(buildInfo, cf))
 	rootCmd.AddCommand(NewGetCmd(buildInfo, cf, outWriter))
-	rootCmd.AddCommand(NewCleanupCmd(cf))
+	rootCmd.AddCommand(NewCleanupCmd(buildInfo, cf))
 	rootCmd.AddCommand(NewConfigCmd(cf, outWriter))
 
 	SetGlobalFlags(cf, rootCmd)
diff --git a/pkg/cmd/scan_configauditreports.go b/pkg/cmd/scan_configauditreports.go
index 1c719a4..d3c3d86 100644
--- a/pkg/cmd/scan_configauditreports.go
+++ b/pkg/cmd/scan_configauditreports.go
@@ -2,7 +2,6 @@ package cmd
 
 import (
 	"context"
-	"fmt"
 
 	"github.com/aquasecurity/starboard/pkg/configauditreport"
 	"github.com/aquasecurity/starboard/pkg/plugin"
@@ -73,10 +72,6 @@ func ScanConfigAuditReports(buildInfo starboard.BuildInfo, cf *genericclioptions
 		if err != nil {
 			return err
 		}
-		err = plugin.Init(pluginContext)
-		if err != nil {
-			return fmt.Errorf("initializing %s plugin: %w", pluginContext.GetName(), err)
-		}
 		scanner := configauditreport.NewScanner(kubeClientset, kubeClient, plugin, pluginContext, config, opts)
 		report, err := scanner.Scan(ctx, workload)
 		if err != nil {
diff --git a/pkg/generated/clientset/versioned/typed/aquasecurity/v1alpha1/aquasecurity_client.go b/pkg/generated/clientset/versioned/typed/aquasecurity/v1alpha1/aquasecurity_client.go
index d5077e3..7a5f0ae 100644
--- a/pkg/generated/clientset/versioned/typed/aquasecurity/v1alpha1/aquasecurity_client.go
+++ b/pkg/generated/clientset/versioned/typed/aquasecurity/v1alpha1/aquasecurity_client.go
@@ -11,6 +11,7 @@ import (
 type AquasecurityV1alpha1Interface interface {
 	RESTClient() rest.Interface
 	CISKubeBenchReportsGetter
+	ClusterConfigAuditReportsGetter
 	ConfigAuditReportsGetter
 	KubeHunterReportsGetter
 	VulnerabilityReportsGetter
@@ -25,6 +26,10 @@ func (c *AquasecurityV1alpha1Client) CISKubeBenchReports() CISKubeBenchReportInt
 	return newCISKubeBenchReports(c)
 }
 
+func (c *AquasecurityV1alpha1Client) ClusterConfigAuditReports() ClusterConfigAuditReportInterface {
+	return newClusterConfigAuditReports(c)
+}
+
 func (c *AquasecurityV1alpha1Client) ConfigAuditReports(namespace string) ConfigAuditReportInterface {
 	return newConfigAuditReports(c, namespace)
 }
diff --git a/pkg/generated/clientset/versioned/typed/aquasecurity/v1alpha1/clusterconfigauditreport.go b/pkg/generated/clientset/versioned/typed/aquasecurity/v1alpha1/clusterconfigauditreport.go
new file mode 100644
index 0000000..08a4047
--- /dev/null
+++ b/pkg/generated/clientset/versioned/typed/aquasecurity/v1alpha1/clusterconfigauditreport.go
@@ -0,0 +1,152 @@
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	"context"
+	"time"
+
+	v1alpha1 "github.com/aquasecurity/starboard/pkg/apis/aquasecurity/v1alpha1"
+	scheme "github.com/aquasecurity/starboard/pkg/generated/clientset/versioned/scheme"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	watch "k8s.io/apimachinery/pkg/watch"
+	rest "k8s.io/client-go/rest"
+)
+
+// ClusterConfigAuditReportsGetter has a method to return a ClusterConfigAuditReportInterface.
+// A group's client should implement this interface.
+type ClusterConfigAuditReportsGetter interface {
+	ClusterConfigAuditReports() ClusterConfigAuditReportInterface
+}
+
+// ClusterConfigAuditReportInterface has methods to work with ClusterConfigAuditReport resources.
+type ClusterConfigAuditReportInterface interface {
+	Create(ctx context.Context, clusterConfigAuditReport *v1alpha1.ClusterConfigAuditReport, opts v1.CreateOptions) (*v1alpha1.ClusterConfigAuditReport, error)
+	Update(ctx context.Context, clusterConfigAuditReport *v1alpha1.ClusterConfigAuditReport, opts v1.UpdateOptions) (*v1alpha1.ClusterConfigAuditReport, error)
+	Delete(ctx context.Context, name string, opts v1.DeleteOptions) error
+	DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error
+	Get(ctx context.Context, name string, opts v1.GetOptions) (*v1alpha1.ClusterConfigAuditReport, error)
+	List(ctx context.Context, opts v1.ListOptions) (*v1alpha1.ClusterConfigAuditReportList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.ClusterConfigAuditReport, err error)
+	ClusterConfigAuditReportExpansion
+}
+
+// clusterConfigAuditReports implements ClusterConfigAuditReportInterface
+type clusterConfigAuditReports struct {
+	client rest.Interface
+}
+
+// newClusterConfigAuditReports returns a ClusterConfigAuditReports
+func newClusterConfigAuditReports(c *AquasecurityV1alpha1Client) *clusterConfigAuditReports {
+	return &clusterConfigAuditReports{
+		client: c.RESTClient(),
+	}
+}
+
+// Get takes name of the clusterConfigAuditReport, and returns the corresponding clusterConfigAuditReport object, and an error if there is any.
+func (c *clusterConfigAuditReports) Get(ctx context.Context, name string, options v1.GetOptions) (result *v1alpha1.ClusterConfigAuditReport, err error) {
+	result = &v1alpha1.ClusterConfigAuditReport{}
+	err = c.client.Get().
+		Resource("clusterconfigauditreports").
+		Name(name).
+		VersionedParams(&options, scheme.ParameterCodec).
+		Do(ctx).
+		Into(result)
+	return
+}
+
+// List takes label and field selectors, and returns the list of ClusterConfigAuditReports that match those selectors.
+func (c *clusterConfigAuditReports) List(ctx context.Context, opts v1.ListOptions) (result *v1alpha1.ClusterConfigAuditReportList, err error) {
+	var timeout time.Duration
+	if opts.TimeoutSeconds != nil {
+		timeout = time.Duration(*opts.TimeoutSeconds) * time.Second
+	}
+	result = &v1alpha1.ClusterConfigAuditReportList{}
+	err = c.client.Get().
+		Resource("clusterconfigauditreports").
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Timeout(timeout).
+		Do(ctx).
+		Into(result)
+	return
+}
+
+// Watch returns a watch.Interface that watches the requested clusterConfigAuditReports.
+func (c *clusterConfigAuditReports) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
+	var timeout time.Duration
+	if opts.TimeoutSeconds != nil {
+		timeout = time.Duration(*opts.TimeoutSeconds) * time.Second
+	}
+	opts.Watch = true
+	return c.client.Get().
+		Resource("clusterconfigauditreports").
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Timeout(timeout).
+		Watch(ctx)
+}
+
+// Create takes the representation of a clusterConfigAuditReport and creates it.  Returns the server's representation of the clusterConfigAuditReport, and an error, if there is any.
+func (c *clusterConfigAuditReports) Create(ctx context.Context, clusterConfigAuditReport *v1alpha1.ClusterConfigAuditReport, opts v1.CreateOptions) (result *v1alpha1.ClusterConfigAuditReport, err error) {
+	result = &v1alpha1.ClusterConfigAuditReport{}
+	err = c.client.Post().
+		Resource("clusterconfigauditreports").
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Body(clusterConfigAuditReport).
+		Do(ctx).
+		Into(result)
+	return
+}
+
+// Update takes the representation of a clusterConfigAuditReport and updates it. Returns the server's representation of the clusterConfigAuditReport, and an error, if there is any.
+func (c *clusterConfigAuditReports) Update(ctx context.Context, clusterConfigAuditReport *v1alpha1.ClusterConfigAuditReport, opts v1.UpdateOptions) (result *v1alpha1.ClusterConfigAuditReport, err error) {
+	result = &v1alpha1.ClusterConfigAuditReport{}
+	err = c.client.Put().
+		Resource("clusterconfigauditreports").
+		Name(clusterConfigAuditReport.Name).
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Body(clusterConfigAuditReport).
+		Do(ctx).
+		Into(result)
+	return
+}
+
+// Delete takes name of the clusterConfigAuditReport and deletes it. Returns an error if one occurs.
+func (c *clusterConfigAuditReports) Delete(ctx context.Context, name string, opts v1.DeleteOptions) error {
+	return c.client.Delete().
+		Resource("clusterconfigauditreports").
+		Name(name).
+		Body(&opts).
+		Do(ctx).
+		Error()
+}
+
+// DeleteCollection deletes a collection of objects.
+func (c *clusterConfigAuditReports) DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error {
+	var timeout time.Duration
+	if listOpts.TimeoutSeconds != nil {
+		timeout = time.Duration(*listOpts.TimeoutSeconds) * time.Second
+	}
+	return c.client.Delete().
+		Resource("clusterconfigauditreports").
+		VersionedParams(&listOpts, scheme.ParameterCodec).
+		Timeout(timeout).
+		Body(&opts).
+		Do(ctx).
+		Error()
+}
+
+// Patch applies the patch and returns the patched clusterConfigAuditReport.
+func (c *clusterConfigAuditReports) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.ClusterConfigAuditReport, err error) {
+	result = &v1alpha1.ClusterConfigAuditReport{}
+	err = c.client.Patch(pt).
+		Resource("clusterconfigauditreports").
+		Name(name).
+		SubResource(subresources...).
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Body(data).
+		Do(ctx).
+		Into(result)
+	return
+}
diff --git a/pkg/generated/clientset/versioned/typed/aquasecurity/v1alpha1/fake/fake_aquasecurity_client.go b/pkg/generated/clientset/versioned/typed/aquasecurity/v1alpha1/fake/fake_aquasecurity_client.go
index 6f83af2..bf22e7f 100644
--- a/pkg/generated/clientset/versioned/typed/aquasecurity/v1alpha1/fake/fake_aquasecurity_client.go
+++ b/pkg/generated/clientset/versioned/typed/aquasecurity/v1alpha1/fake/fake_aquasecurity_client.go
@@ -16,6 +16,10 @@ func (c *FakeAquasecurityV1alpha1) CISKubeBenchReports() v1alpha1.CISKubeBenchRe
 	return &FakeCISKubeBenchReports{c}
 }
 
+func (c *FakeAquasecurityV1alpha1) ClusterConfigAuditReports() v1alpha1.ClusterConfigAuditReportInterface {
+	return &FakeClusterConfigAuditReports{c}
+}
+
 func (c *FakeAquasecurityV1alpha1) ConfigAuditReports(namespace string) v1alpha1.ConfigAuditReportInterface {
 	return &FakeConfigAuditReports{c, namespace}
 }
diff --git a/pkg/generated/clientset/versioned/typed/aquasecurity/v1alpha1/fake/fake_clusterconfigauditreport.go b/pkg/generated/clientset/versioned/typed/aquasecurity/v1alpha1/fake/fake_clusterconfigauditreport.go
new file mode 100644
index 0000000..97711ea
--- /dev/null
+++ b/pkg/generated/clientset/versioned/typed/aquasecurity/v1alpha1/fake/fake_clusterconfigauditreport.go
@@ -0,0 +1,106 @@
+// Code generated by client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	"context"
+
+	v1alpha1 "github.com/aquasecurity/starboard/pkg/apis/aquasecurity/v1alpha1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	labels "k8s.io/apimachinery/pkg/labels"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	types "k8s.io/apimachinery/pkg/types"
+	watch "k8s.io/apimachinery/pkg/watch"
+	testing "k8s.io/client-go/testing"
+)
+
+// FakeClusterConfigAuditReports implements ClusterConfigAuditReportInterface
+type FakeClusterConfigAuditReports struct {
+	Fake *FakeAquasecurityV1alpha1
+}
+
+var clusterconfigauditreportsResource = schema.GroupVersionResource{Group: "aquasecurity.github.io", Version: "v1alpha1", Resource: "clusterconfigauditreports"}
+
+var clusterconfigauditreportsKind = schema.GroupVersionKind{Group: "aquasecurity.github.io", Version: "v1alpha1", Kind: "ClusterConfigAuditReport"}
+
+// Get takes name of the clusterConfigAuditReport, and returns the corresponding clusterConfigAuditReport object, and an error if there is any.
+func (c *FakeClusterConfigAuditReports) Get(ctx context.Context, name string, options v1.GetOptions) (result *v1alpha1.ClusterConfigAuditReport, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewRootGetAction(clusterconfigauditreportsResource, name), &v1alpha1.ClusterConfigAuditReport{})
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha1.ClusterConfigAuditReport), err
+}
+
+// List takes label and field selectors, and returns the list of ClusterConfigAuditReports that match those selectors.
+func (c *FakeClusterConfigAuditReports) List(ctx context.Context, opts v1.ListOptions) (result *v1alpha1.ClusterConfigAuditReportList, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewRootListAction(clusterconfigauditreportsResource, clusterconfigauditreportsKind, opts), &v1alpha1.ClusterConfigAuditReportList{})
+	if obj == nil {
+		return nil, err
+	}
+
+	label, _, _ := testing.ExtractFromListOptions(opts)
+	if label == nil {
+		label = labels.Everything()
+	}
+	list := &v1alpha1.ClusterConfigAuditReportList{ListMeta: obj.(*v1alpha1.ClusterConfigAuditReportList).ListMeta}
+	for _, item := range obj.(*v1alpha1.ClusterConfigAuditReportList).Items {
+		if label.Matches(labels.Set(item.Labels)) {
+			list.Items = append(list.Items, item)
+		}
+	}
+	return list, err
+}
+
+// Watch returns a watch.Interface that watches the requested clusterConfigAuditReports.
+func (c *FakeClusterConfigAuditReports) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
+	return c.Fake.
+		InvokesWatch(testing.NewRootWatchAction(clusterconfigauditreportsResource, opts))
+}
+
+// Create takes the representation of a clusterConfigAuditReport and creates it.  Returns the server's representation of the clusterConfigAuditReport, and an error, if there is any.
+func (c *FakeClusterConfigAuditReports) Create(ctx context.Context, clusterConfigAuditReport *v1alpha1.ClusterConfigAuditReport, opts v1.CreateOptions) (result *v1alpha1.ClusterConfigAuditReport, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewRootCreateAction(clusterconfigauditreportsResource, clusterConfigAuditReport), &v1alpha1.ClusterConfigAuditReport{})
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha1.ClusterConfigAuditReport), err
+}
+
+// Update takes the representation of a clusterConfigAuditReport and updates it. Returns the server's representation of the clusterConfigAuditReport, and an error, if there is any.
+func (c *FakeClusterConfigAuditReports) Update(ctx context.Context, clusterConfigAuditReport *v1alpha1.ClusterConfigAuditReport, opts v1.UpdateOptions) (result *v1alpha1.ClusterConfigAuditReport, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewRootUpdateAction(clusterconfigauditreportsResource, clusterConfigAuditReport), &v1alpha1.ClusterConfigAuditReport{})
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha1.ClusterConfigAuditReport), err
+}
+
+// Delete takes name of the clusterConfigAuditReport and deletes it. Returns an error if one occurs.
+func (c *FakeClusterConfigAuditReports) Delete(ctx context.Context, name string, opts v1.DeleteOptions) error {
+	_, err := c.Fake.
+		Invokes(testing.NewRootDeleteAction(clusterconfigauditreportsResource, name), &v1alpha1.ClusterConfigAuditReport{})
+	return err
+}
+
+// DeleteCollection deletes a collection of objects.
+func (c *FakeClusterConfigAuditReports) DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error {
+	action := testing.NewRootDeleteCollectionAction(clusterconfigauditreportsResource, listOpts)
+
+	_, err := c.Fake.Invokes(action, &v1alpha1.ClusterConfigAuditReportList{})
+	return err
+}
+
+// Patch applies the patch and returns the patched clusterConfigAuditReport.
+func (c *FakeClusterConfigAuditReports) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.ClusterConfigAuditReport, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewRootPatchSubresourceAction(clusterconfigauditreportsResource, name, pt, data, subresources...), &v1alpha1.ClusterConfigAuditReport{})
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha1.ClusterConfigAuditReport), err
+}
diff --git a/pkg/generated/clientset/versioned/typed/aquasecurity/v1alpha1/generated_expansion.go b/pkg/generated/clientset/versioned/typed/aquasecurity/v1alpha1/generated_expansion.go
index 1b64a29..e0b674c 100644
--- a/pkg/generated/clientset/versioned/typed/aquasecurity/v1alpha1/generated_expansion.go
+++ b/pkg/generated/clientset/versioned/typed/aquasecurity/v1alpha1/generated_expansion.go
@@ -4,6 +4,8 @@ package v1alpha1
 
 type CISKubeBenchReportExpansion interface{}
 
+type ClusterConfigAuditReportExpansion interface{}
+
 type ConfigAuditReportExpansion interface{}
 
 type KubeHunterReportExpansion interface{}
diff --git a/pkg/generated/informers/externalversions/aquasecurity/v1alpha1/clusterconfigauditreport.go b/pkg/generated/informers/externalversions/aquasecurity/v1alpha1/clusterconfigauditreport.go
new file mode 100644
index 0000000..7d8c35f
--- /dev/null
+++ b/pkg/generated/informers/externalversions/aquasecurity/v1alpha1/clusterconfigauditreport.go
@@ -0,0 +1,73 @@
+// Code generated by informer-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	"context"
+	time "time"
+
+	aquasecurityv1alpha1 "github.com/aquasecurity/starboard/pkg/apis/aquasecurity/v1alpha1"
+	versioned "github.com/aquasecurity/starboard/pkg/generated/clientset/versioned"
+	internalinterfaces "github.com/aquasecurity/starboard/pkg/generated/informers/externalversions/internalinterfaces"
+	v1alpha1 "github.com/aquasecurity/starboard/pkg/generated/listers/aquasecurity/v1alpha1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	cache "k8s.io/client-go/tools/cache"
+)
+
+// ClusterConfigAuditReportInformer provides access to a shared informer and lister for
+// ClusterConfigAuditReports.
+type ClusterConfigAuditReportInformer interface {
+	Informer() cache.SharedIndexInformer
+	Lister() v1alpha1.ClusterConfigAuditReportLister
+}
+
+type clusterConfigAuditReportInformer struct {
+	factory          internalinterfaces.SharedInformerFactory
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+}
+
+// NewClusterConfigAuditReportInformer constructs a new informer for ClusterConfigAuditReport type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewClusterConfigAuditReportInformer(client versioned.Interface, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
+	return NewFilteredClusterConfigAuditReportInformer(client, resyncPeriod, indexers, nil)
+}
+
+// NewFilteredClusterConfigAuditReportInformer constructs a new informer for ClusterConfigAuditReport type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewFilteredClusterConfigAuditReportInformer(client versioned.Interface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
+	return cache.NewSharedIndexInformer(
+		&cache.ListWatch{
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.AquasecurityV1alpha1().ClusterConfigAuditReports().List(context.TODO(), options)
+			},
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.AquasecurityV1alpha1().ClusterConfigAuditReports().Watch(context.TODO(), options)
+			},
+		},
+		&aquasecurityv1alpha1.ClusterConfigAuditReport{},
+		resyncPeriod,
+		indexers,
+	)
+}
+
+func (f *clusterConfigAuditReportInformer) defaultInformer(client versioned.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
+	return NewFilteredClusterConfigAuditReportInformer(client, resyncPeriod, cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, f.tweakListOptions)
+}
+
+func (f *clusterConfigAuditReportInformer) Informer() cache.SharedIndexInformer {
+	return f.factory.InformerFor(&aquasecurityv1alpha1.ClusterConfigAuditReport{}, f.defaultInformer)
+}
+
+func (f *clusterConfigAuditReportInformer) Lister() v1alpha1.ClusterConfigAuditReportLister {
+	return v1alpha1.NewClusterConfigAuditReportLister(f.Informer().GetIndexer())
+}
diff --git a/pkg/generated/informers/externalversions/aquasecurity/v1alpha1/interface.go b/pkg/generated/informers/externalversions/aquasecurity/v1alpha1/interface.go
index b77c1cf..c7fe6e3 100644
--- a/pkg/generated/informers/externalversions/aquasecurity/v1alpha1/interface.go
+++ b/pkg/generated/informers/externalversions/aquasecurity/v1alpha1/interface.go
@@ -10,6 +10,8 @@ import (
 type Interface interface {
 	// CISKubeBenchReports returns a CISKubeBenchReportInformer.
 	CISKubeBenchReports() CISKubeBenchReportInformer
+	// ClusterConfigAuditReports returns a ClusterConfigAuditReportInformer.
+	ClusterConfigAuditReports() ClusterConfigAuditReportInformer
 	// ConfigAuditReports returns a ConfigAuditReportInformer.
 	ConfigAuditReports() ConfigAuditReportInformer
 	// KubeHunterReports returns a KubeHunterReportInformer.
@@ -34,6 +36,11 @@ func (v *version) CISKubeBenchReports() CISKubeBenchReportInformer {
 	return &cISKubeBenchReportInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
 
+// ClusterConfigAuditReports returns a ClusterConfigAuditReportInformer.
+func (v *version) ClusterConfigAuditReports() ClusterConfigAuditReportInformer {
+	return &clusterConfigAuditReportInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
+}
+
 // ConfigAuditReports returns a ConfigAuditReportInformer.
 func (v *version) ConfigAuditReports() ConfigAuditReportInformer {
 	return &configAuditReportInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
diff --git a/pkg/generated/informers/externalversions/generic.go b/pkg/generated/informers/externalversions/generic.go
index 5e0bf0e..9f76ef3 100644
--- a/pkg/generated/informers/externalversions/generic.go
+++ b/pkg/generated/informers/externalversions/generic.go
@@ -39,6 +39,8 @@ func (f *sharedInformerFactory) ForResource(resource schema.GroupVersionResource
 	// Group=aquasecurity.github.io, Version=v1alpha1
 	case v1alpha1.SchemeGroupVersion.WithResource("ciskubebenchreports"):
 		return &genericInformer{resource: resource.GroupResource(), informer: f.Aquasecurity().V1alpha1().CISKubeBenchReports().Informer()}, nil
+	case v1alpha1.SchemeGroupVersion.WithResource("clusterconfigauditreports"):
+		return &genericInformer{resource: resource.GroupResource(), informer: f.Aquasecurity().V1alpha1().ClusterConfigAuditReports().Informer()}, nil
 	case v1alpha1.SchemeGroupVersion.WithResource("configauditreports"):
 		return &genericInformer{resource: resource.GroupResource(), informer: f.Aquasecurity().V1alpha1().ConfigAuditReports().Informer()}, nil
 	case v1alpha1.SchemeGroupVersion.WithResource("kubehunterreports"):
diff --git a/pkg/generated/listers/aquasecurity/v1alpha1/clusterconfigauditreport.go b/pkg/generated/listers/aquasecurity/v1alpha1/clusterconfigauditreport.go
new file mode 100644
index 0000000..c0cbcad
--- /dev/null
+++ b/pkg/generated/listers/aquasecurity/v1alpha1/clusterconfigauditreport.go
@@ -0,0 +1,52 @@
+// Code generated by lister-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	v1alpha1 "github.com/aquasecurity/starboard/pkg/apis/aquasecurity/v1alpha1"
+	"k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/labels"
+	"k8s.io/client-go/tools/cache"
+)
+
+// ClusterConfigAuditReportLister helps list ClusterConfigAuditReports.
+// All objects returned here must be treated as read-only.
+type ClusterConfigAuditReportLister interface {
+	// List lists all ClusterConfigAuditReports in the indexer.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*v1alpha1.ClusterConfigAuditReport, err error)
+	// Get retrieves the ClusterConfigAuditReport from the index for a given name.
+	// Objects returned here must be treated as read-only.
+	Get(name string) (*v1alpha1.ClusterConfigAuditReport, error)
+	ClusterConfigAuditReportListerExpansion
+}
+
+// clusterConfigAuditReportLister implements the ClusterConfigAuditReportLister interface.
+type clusterConfigAuditReportLister struct {
+	indexer cache.Indexer
+}
+
+// NewClusterConfigAuditReportLister returns a new ClusterConfigAuditReportLister.
+func NewClusterConfigAuditReportLister(indexer cache.Indexer) ClusterConfigAuditReportLister {
+	return &clusterConfigAuditReportLister{indexer: indexer}
+}
+
+// List lists all ClusterConfigAuditReports in the indexer.
+func (s *clusterConfigAuditReportLister) List(selector labels.Selector) (ret []*v1alpha1.ClusterConfigAuditReport, err error) {
+	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
+		ret = append(ret, m.(*v1alpha1.ClusterConfigAuditReport))
+	})
+	return ret, err
+}
+
+// Get retrieves the ClusterConfigAuditReport from the index for a given name.
+func (s *clusterConfigAuditReportLister) Get(name string) (*v1alpha1.ClusterConfigAuditReport, error) {
+	obj, exists, err := s.indexer.GetByKey(name)
+	if err != nil {
+		return nil, err
+	}
+	if !exists {
+		return nil, errors.NewNotFound(v1alpha1.Resource("clusterconfigauditreport"), name)
+	}
+	return obj.(*v1alpha1.ClusterConfigAuditReport), nil
+}
diff --git a/pkg/generated/listers/aquasecurity/v1alpha1/expansion_generated.go b/pkg/generated/listers/aquasecurity/v1alpha1/expansion_generated.go
index 99a2eeb..26a7abb 100644
--- a/pkg/generated/listers/aquasecurity/v1alpha1/expansion_generated.go
+++ b/pkg/generated/listers/aquasecurity/v1alpha1/expansion_generated.go
@@ -6,6 +6,10 @@ package v1alpha1
 // CISKubeBenchReportLister.
 type CISKubeBenchReportListerExpansion interface{}
 
+// ClusterConfigAuditReportListerExpansion allows custom methods to be added to
+// ClusterConfigAuditReportLister.
+type ClusterConfigAuditReportListerExpansion interface{}
+
 // ConfigAuditReportListerExpansion allows custom methods to be added to
 // ConfigAuditReportLister.
 type ConfigAuditReportListerExpansion interface{}
diff --git a/pkg/operator/operator.go b/pkg/operator/operator.go
index b911ccc..2c6ba58 100644
--- a/pkg/operator/operator.go
+++ b/pkg/operator/operator.go
@@ -140,6 +140,11 @@ func Start(ctx context.Context, buildInfo starboard.BuildInfo, operatorConfig et
 			return err
 		}
 
+		err = plugin.Init(pluginContext)
+		if err != nil {
+			return fmt.Errorf("initializing %s plugin: %w", pluginContext.GetName(), err)
+		}
+
 		if err = (&controller.VulnerabilityReportReconciler{
 			Logger:         ctrl.Log.WithName("reconciler").WithName("vulnerabilityreport"),
 			Config:         operatorConfig,
diff --git a/pkg/plugin/aqua/plugin.go b/pkg/plugin/aqua/plugin.go
index 83e4658..6b418bb 100644
--- a/pkg/plugin/aqua/plugin.go
+++ b/pkg/plugin/aqua/plugin.go
@@ -32,6 +32,11 @@ func NewPlugin(
 	}
 }
 
+func (s *plugin) Init(_ starboard.PluginContext) error {
+	// Do nothing
+	return nil
+}
+
 func (s *plugin) GetScanJobSpec(ctx starboard.PluginContext, spec corev1.PodSpec, _ map[string]docker.Auth) (corev1.PodSpec, []*corev1.Secret, error) {
 	initContainerName := s.idGenerator.GenerateID()
 
diff --git a/pkg/plugin/factory.go b/pkg/plugin/factory.go
index 252d436..f8b14c7 100644
--- a/pkg/plugin/factory.go
+++ b/pkg/plugin/factory.go
@@ -72,7 +72,7 @@ func (r *Resolver) GetVulnerabilityPlugin() (vulnerabilityreport.Plugin, starboa
 
 	switch scanner {
 	case starboard.Trivy:
-		return trivy.NewPlugin(ext.NewSystemClock(), ext.NewGoogleUUIDGenerator(), r.config), pluginContext, nil
+		return trivy.NewPlugin(ext.NewSystemClock(), ext.NewGoogleUUIDGenerator()), pluginContext, nil
 	case starboard.Aqua:
 		return aqua.NewPlugin(ext.NewGoogleUUIDGenerator(), r.buildInfo), pluginContext, nil
 	}
diff --git a/pkg/plugin/trivy/plugin.go b/pkg/plugin/trivy/plugin.go
index e54c430..bc8f005 100644
--- a/pkg/plugin/trivy/plugin.go
+++ b/pkg/plugin/trivy/plugin.go
@@ -32,15 +32,34 @@ var (
 	}
 )
 
+const (
+	// Plugin the name of this plugin.
+	Plugin = "Trivy"
+)
+
 type plugin struct {
 	clock       ext.Clock
 	idGenerator ext.IDGenerator
-	config      Config
 }
 
 const (
-	keyTrivyMode      = "trivy.mode"
-	keyTrivyServerURL = "trivy.serverURL"
+	keyTrivyImageRef               = "trivy.imageRef"
+	keyTrivyMode                   = "trivy.mode"
+	keyTrivySeverity               = "trivy.severity"
+	keyTrivyIgnoreUnfixed          = "trivy.ignoreUnfixed"
+	keyTrivyIgnoreFile             = "trivy.ignoreFile"
+	keyTrivyInsecureRegistryPrefix = "trivy.insecureRegistry."
+	keyTrivyHTTPProxy              = "trivy.httpProxy"
+	keyTrivyHTTPSProxy             = "trivy.httpsProxy"
+	keyTrivyNoProxy                = "trivy.noProxy"
+	keyTrivyGitHubToken            = "trivy.githubToken"
+	keyTrivySkipFiles              = "trivy.skipFiles"
+	keyTrivySkipDirs               = "trivy.skipDirs"
+
+	keyTrivyServerURL           = "trivy.serverURL"
+	keyTrivyServerTokenHeader   = "trivy.serverTokenHeader"
+	keyTrivyServerToken         = "trivy.serverToken"
+	keyTrivyServerCustomHeaders = "trivy.serverCustomHeaders"
 )
 
 // Mode describes mode in which Trivy client operates.
@@ -53,17 +72,17 @@ const (
 
 // Config defines configuration params for the Trivy vulnerabilityreport.Plugin.
 type Config struct {
-	starboard.ConfigData
+	starboard.PluginConfig
 }
 
 func (c Config) GetImageRef() (string, error) {
-	return c.GetRequiredData("trivy.imageRef")
+	return c.GetRequiredData(keyTrivyImageRef)
 }
 
 func (c Config) GetMode() (Mode, error) {
 	var ok bool
 	var value string
-	if value, ok = c.ConfigData[keyTrivyMode]; !ok {
+	if value, ok = c.Data[keyTrivyMode]; !ok {
 		return "", fmt.Errorf("property %s not set", keyTrivyMode)
 	}
 
@@ -79,18 +98,18 @@ func (c Config) GetMode() (Mode, error) {
 }
 
 func (c Config) GetServerURL() (string, error) {
-	return c.ConfigData.GetRequiredData(keyTrivyServerURL)
+	return c.GetRequiredData(keyTrivyServerURL)
 }
 
 func (c Config) IgnoreFileExists() bool {
-	_, ok := c.ConfigData["trivy.ignoreFile"]
+	_, ok := c.Data[keyTrivyIgnoreFile]
 	return ok
 }
 
 func (c Config) GetInsecureRegistries() map[string]bool {
 	insecureRegistries := make(map[string]bool)
-	for key, val := range c.ConfigData {
-		if strings.HasPrefix(key, "trivy.insecureRegistry.") {
+	for key, val := range c.Data {
+		if strings.HasPrefix(key, keyTrivyInsecureRegistryPrefix) {
 			insecureRegistries[val] = true
 		}
 	}
@@ -99,31 +118,46 @@ func (c Config) GetInsecureRegistries() map[string]bool {
 }
 
 // NewPlugin constructs a new vulnerabilityreport.Plugin, which is using an
-// official Trivy container image to scan Kubernetes workloads.
+// upstream Trivy container image to scan Kubernetes workloads.
 //
-// This Plugin supports both starboard.Standalone and starboard.ClientServer
-// client modes depending on the active mode returned by Config.GetTrivyMode.
+// This Plugin supports both Standalone and ClientServer modes depending on
+// the settings returned by Config.GetMode.
 //
-// The starboard.ClientServer mode is usually more performant, however it
-// requires a Trivy server accessible at the configurable URL.
-func NewPlugin(clock ext.Clock, idGenerator ext.IDGenerator, config starboard.ConfigData) vulnerabilityreport.Plugin {
+// The ClientServer mode is usually more performant, however it
+// requires a Trivy server accessible at the configurable Config.GetServerURL.
+func NewPlugin(clock ext.Clock, idGenerator ext.IDGenerator) vulnerabilityreport.Plugin {
 	return &plugin{
 		clock:       clock,
 		idGenerator: idGenerator,
-		config:      Config{ConfigData: config},
 	}
 }
 
-func (s *plugin) GetScanJobSpec(_ starboard.PluginContext, spec corev1.PodSpec, credentials map[string]docker.Auth) (corev1.PodSpec, []*corev1.Secret, error) {
-	mode, err := s.config.GetMode()
+// Init ensures the default Config required by this plugin.
+func (s *plugin) Init(ctx starboard.PluginContext) error {
+	return ctx.EnsureConfig(starboard.PluginConfig{
+		Data: map[string]string{
+			keyTrivyImageRef: "docker.io/aquasec/trivy:0.16.0",
+			keyTrivySeverity: "UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL",
+			keyTrivyMode:     string(Standalone),
+		},
+	})
+}
+
+func (s *plugin) GetScanJobSpec(ctx starboard.PluginContext, spec corev1.PodSpec, credentials map[string]docker.Auth) (corev1.PodSpec, []*corev1.Secret, error) {
+	config, err := s.newConfigFrom(ctx)
+	if err != nil {
+		return corev1.PodSpec{}, nil, err
+	}
+
+	mode, err := config.GetMode()
 	if err != nil {
 		return corev1.PodSpec{}, nil, err
 	}
 	switch mode {
 	case Standalone:
-		return s.getPodSpecForStandaloneMode(spec, credentials)
+		return s.getPodSpecForStandaloneMode(config, spec, credentials)
 	case ClientServer:
-		return s.getPodSpecForClientServerMode(spec, credentials)
+		return s.getPodSpecForClientServerMode(config, spec, credentials)
 	default:
 		return corev1.PodSpec{}, nil, fmt.Errorf("unrecognized trivy mode: %v", mode)
 	}
@@ -135,6 +169,7 @@ func (s *plugin) newSecretWithAggregateImagePullCredentials(spec corev1.PodSpec,
 
 	return &corev1.Secret{
 		ObjectMeta: metav1.ObjectMeta{
+			// TODO Use deterministic names for secrets that hold image pull credentials, e.g. scan-vulnerabilityreport-<workload hash>-registry-creds
 			Name: s.idGenerator.GenerateID(),
 		},
 		Data: secretData,
@@ -146,7 +181,7 @@ const (
 	ignoreFileVolumeName = "ignorefile"
 )
 
-// In the starboard.Standalone mode there is the init container responsible for
+// In the Standalone mode there is the init container responsible for
 // downloading the latest Trivy DB file from GitHub and storing it to the empty
 // volume shared with main containers. In other words, the init container runs
 // the following Trivy command:
@@ -159,7 +194,7 @@ const (
 //
 //     trivy --skip-update --cache-dir /var/lib/trivy \
 //       --format json <container image>
-func (s *plugin) getPodSpecForStandaloneMode(spec corev1.PodSpec, credentials map[string]docker.Auth) (corev1.PodSpec, []*corev1.Secret, error) {
+func (s *plugin) getPodSpecForStandaloneMode(config Config, spec corev1.PodSpec, credentials map[string]docker.Auth) (corev1.PodSpec, []*corev1.Secret, error) {
 	var secret *corev1.Secret
 	var secrets []*corev1.Secret
 
@@ -168,11 +203,13 @@ func (s *plugin) getPodSpecForStandaloneMode(spec corev1.PodSpec, credentials ma
 		secrets = append(secrets, secret)
 	}
 
-	trivyImageRef, err := s.config.GetImageRef()
+	trivyImageRef, err := config.GetImageRef()
 	if err != nil {
 		return corev1.PodSpec{}, nil, err
 	}
 
+	trivyConfigName := starboard.GetPluginConfigMapName(Plugin)
+
 	initContainer := corev1.Container{
 		Name:                     s.idGenerator.GenerateID(),
 		Image:                    trivyImageRef,
@@ -184,9 +221,9 @@ func (s *plugin) getPodSpecForStandaloneMode(spec corev1.PodSpec, credentials ma
 				ValueFrom: &corev1.EnvVarSource{
 					ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
 						LocalObjectReference: corev1.LocalObjectReference{
-							Name: starboard.ConfigMapName,
+							Name: trivyConfigName,
 						},
-						Key:      "trivy.httpProxy",
+						Key:      keyTrivyHTTPProxy,
 						Optional: pointer.BoolPtr(true),
 					},
 				},
@@ -196,9 +233,9 @@ func (s *plugin) getPodSpecForStandaloneMode(spec corev1.PodSpec, credentials ma
 				ValueFrom: &corev1.EnvVarSource{
 					ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
 						LocalObjectReference: corev1.LocalObjectReference{
-							Name: starboard.ConfigMapName,
+							Name: trivyConfigName,
 						},
-						Key:      "trivy.httpsProxy",
+						Key:      keyTrivyHTTPSProxy,
 						Optional: pointer.BoolPtr(true),
 					},
 				},
@@ -208,9 +245,9 @@ func (s *plugin) getPodSpecForStandaloneMode(spec corev1.PodSpec, credentials ma
 				ValueFrom: &corev1.EnvVarSource{
 					ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
 						LocalObjectReference: corev1.LocalObjectReference{
-							Name: starboard.ConfigMapName,
+							Name: trivyConfigName,
 						},
-						Key:      "trivy.noProxy",
+						Key:      keyTrivyNoProxy,
 						Optional: pointer.BoolPtr(true),
 					},
 				},
@@ -220,9 +257,9 @@ func (s *plugin) getPodSpecForStandaloneMode(spec corev1.PodSpec, credentials ma
 				ValueFrom: &corev1.EnvVarSource{
 					SecretKeyRef: &corev1.SecretKeySelector{
 						LocalObjectReference: corev1.LocalObjectReference{
-							Name: starboard.SecretName,
+							Name: trivyConfigName,
 						},
-						Key:      "trivy.githubToken",
+						Key:      keyTrivyGitHubToken,
 						Optional: pointer.BoolPtr(true),
 					},
 				},
@@ -266,17 +303,17 @@ func (s *plugin) getPodSpecForStandaloneMode(spec corev1.PodSpec, credentials ma
 		},
 	}
 
-	if s.config.IgnoreFileExists() {
+	if config.IgnoreFileExists() {
 		volumes = append(volumes, corev1.Volume{
 			Name: ignoreFileVolumeName,
 			VolumeSource: corev1.VolumeSource{
 				ConfigMap: &corev1.ConfigMapVolumeSource{
 					LocalObjectReference: corev1.LocalObjectReference{
-						Name: starboard.ConfigMapName,
+						Name: trivyConfigName,
 					},
 					Items: []corev1.KeyToPath{
 						{
-							Key:  "trivy.ignoreFile",
+							Key:  keyTrivyIgnoreFile,
 							Path: ".trivyignore",
 						},
 					},
@@ -299,9 +336,9 @@ func (s *plugin) getPodSpecForStandaloneMode(spec corev1.PodSpec, credentials ma
 				ValueFrom: &corev1.EnvVarSource{
 					ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
 						LocalObjectReference: corev1.LocalObjectReference{
-							Name: starboard.ConfigMapName,
+							Name: trivyConfigName,
 						},
-						Key:      "trivy.severity",
+						Key:      keyTrivySeverity,
 						Optional: pointer.BoolPtr(true),
 					},
 				},
@@ -311,9 +348,9 @@ func (s *plugin) getPodSpecForStandaloneMode(spec corev1.PodSpec, credentials ma
 				ValueFrom: &corev1.EnvVarSource{
 					ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
 						LocalObjectReference: corev1.LocalObjectReference{
-							Name: starboard.ConfigMapName,
+							Name: trivyConfigName,
 						},
-						Key:      "trivy.ignoreUnfixed",
+						Key:      keyTrivyIgnoreUnfixed,
 						Optional: pointer.BoolPtr(true),
 					},
 				},
@@ -323,9 +360,9 @@ func (s *plugin) getPodSpecForStandaloneMode(spec corev1.PodSpec, credentials ma
 				ValueFrom: &corev1.EnvVarSource{
 					ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
 						LocalObjectReference: corev1.LocalObjectReference{
-							Name: starboard.ConfigMapName,
+							Name: trivyConfigName,
 						},
-						Key:      "trivy.skipFiles",
+						Key:      keyTrivySkipFiles,
 						Optional: pointer.BoolPtr(true),
 					},
 				},
@@ -335,9 +372,9 @@ func (s *plugin) getPodSpecForStandaloneMode(spec corev1.PodSpec, credentials ma
 				ValueFrom: &corev1.EnvVarSource{
 					ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
 						LocalObjectReference: corev1.LocalObjectReference{
-							Name: starboard.ConfigMapName,
+							Name: trivyConfigName,
 						},
-						Key:      "trivy.skipDirs",
+						Key:      keyTrivySkipDirs,
 						Optional: pointer.BoolPtr(true),
 					},
 				},
@@ -347,9 +384,9 @@ func (s *plugin) getPodSpecForStandaloneMode(spec corev1.PodSpec, credentials ma
 				ValueFrom: &corev1.EnvVarSource{
 					ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
 						LocalObjectReference: corev1.LocalObjectReference{
-							Name: starboard.ConfigMapName,
+							Name: trivyConfigName,
 						},
-						Key:      "trivy.httpProxy",
+						Key:      keyTrivyHTTPProxy,
 						Optional: pointer.BoolPtr(true),
 					},
 				},
@@ -359,9 +396,9 @@ func (s *plugin) getPodSpecForStandaloneMode(spec corev1.PodSpec, credentials ma
 				ValueFrom: &corev1.EnvVarSource{
 					ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
 						LocalObjectReference: corev1.LocalObjectReference{
-							Name: starboard.ConfigMapName,
+							Name: trivyConfigName,
 						},
-						Key:      "trivy.httpsProxy",
+						Key:      keyTrivyHTTPSProxy,
 						Optional: pointer.BoolPtr(true),
 					},
 				},
@@ -371,16 +408,16 @@ func (s *plugin) getPodSpecForStandaloneMode(spec corev1.PodSpec, credentials ma
 				ValueFrom: &corev1.EnvVarSource{
 					ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
 						LocalObjectReference: corev1.LocalObjectReference{
-							Name: starboard.ConfigMapName,
+							Name: trivyConfigName,
 						},
-						Key:      "trivy.noProxy",
+						Key:      keyTrivyNoProxy,
 						Optional: pointer.BoolPtr(true),
 					},
 				},
 			},
 		}
 
-		if s.config.IgnoreFileExists() {
+		if config.IgnoreFileExists() {
 			env = append(env, corev1.EnvVar{
 				Name:  "TRIVY_IGNOREFILE",
 				Value: "/tmp/trivy/.trivyignore",
@@ -414,7 +451,7 @@ func (s *plugin) getPodSpecForStandaloneMode(spec corev1.PodSpec, credentials ma
 			})
 		}
 
-		env, err = s.appendTrivyInsecureEnv(c.Image, env)
+		env, err = s.appendTrivyInsecureEnv(config, c.Image, env)
 		if err != nil {
 			return corev1.PodSpec{}, nil, err
 		}
@@ -461,25 +498,25 @@ func (s *plugin) getPodSpecForStandaloneMode(spec corev1.PodSpec, credentials ma
 	}, secrets, nil
 }
 
-// In the starboard.ClientServer mode the number of containers of the pod
+// In the ClientServer mode the number of containers of the pod
 // created by the scan job equals the number of containers defined for the
 // scanned workload. Each container runs Trivy image scan command and refers
-// to Trivy server URL returned by Config.GetTrivyServerURL:
+// to Trivy server URL returned by Config.GetServerURL:
 //
 //     trivy client --remote <server URL> \
 //       --format json <container image ref>
-func (s *plugin) getPodSpecForClientServerMode(spec corev1.PodSpec, credentials map[string]docker.Auth) (corev1.PodSpec, []*corev1.Secret, error) {
+func (s *plugin) getPodSpecForClientServerMode(config Config, spec corev1.PodSpec, credentials map[string]docker.Auth) (corev1.PodSpec, []*corev1.Secret, error) {
 	var secret *corev1.Secret
 	var secrets []*corev1.Secret
 	var volumeMounts []corev1.VolumeMount
 	var volumes []corev1.Volume
 
-	trivyImageRef, err := s.config.GetImageRef()
+	trivyImageRef, err := config.GetImageRef()
 	if err != nil {
 		return corev1.PodSpec{}, nil, err
 	}
 
-	trivyServerURL, err := s.config.GetServerURL()
+	trivyServerURL, err := config.GetServerURL()
 	if err != nil {
 		return corev1.PodSpec{}, nil, err
 	}
@@ -491,6 +528,8 @@ func (s *plugin) getPodSpecForClientServerMode(spec corev1.PodSpec, credentials
 
 	var containers []corev1.Container
 
+	trivyConfigName := starboard.GetPluginConfigMapName(Plugin)
+
 	for _, container := range spec.Containers {
 
 		env := []corev1.EnvVar{
@@ -499,9 +538,9 @@ func (s *plugin) getPodSpecForClientServerMode(spec corev1.PodSpec, credentials
 				ValueFrom: &corev1.EnvVarSource{
 					ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
 						LocalObjectReference: corev1.LocalObjectReference{
-							Name: starboard.ConfigMapName,
+							Name: trivyConfigName,
 						},
-						Key:      "trivy.httpProxy",
+						Key:      keyTrivyHTTPProxy,
 						Optional: pointer.BoolPtr(true),
 					},
 				},
@@ -511,9 +550,9 @@ func (s *plugin) getPodSpecForClientServerMode(spec corev1.PodSpec, credentials
 				ValueFrom: &corev1.EnvVarSource{
 					ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
 						LocalObjectReference: corev1.LocalObjectReference{
-							Name: starboard.ConfigMapName,
+							Name: trivyConfigName,
 						},
-						Key:      "trivy.httpsProxy",
+						Key:      keyTrivyHTTPSProxy,
 						Optional: pointer.BoolPtr(true),
 					},
 				},
@@ -523,9 +562,9 @@ func (s *plugin) getPodSpecForClientServerMode(spec corev1.PodSpec, credentials
 				ValueFrom: &corev1.EnvVarSource{
 					ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
 						LocalObjectReference: corev1.LocalObjectReference{
-							Name: starboard.ConfigMapName,
+							Name: trivyConfigName,
 						},
-						Key:      "trivy.noProxy",
+						Key:      keyTrivyNoProxy,
 						Optional: pointer.BoolPtr(true),
 					},
 				},
@@ -535,9 +574,9 @@ func (s *plugin) getPodSpecForClientServerMode(spec corev1.PodSpec, credentials
 				ValueFrom: &corev1.EnvVarSource{
 					ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
 						LocalObjectReference: corev1.LocalObjectReference{
-							Name: starboard.ConfigMapName,
+							Name: trivyConfigName,
 						},
-						Key:      "trivy.severity",
+						Key:      keyTrivySeverity,
 						Optional: pointer.BoolPtr(true),
 					},
 				},
@@ -547,9 +586,9 @@ func (s *plugin) getPodSpecForClientServerMode(spec corev1.PodSpec, credentials
 				ValueFrom: &corev1.EnvVarSource{
 					ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
 						LocalObjectReference: corev1.LocalObjectReference{
-							Name: starboard.ConfigMapName,
+							Name: trivyConfigName,
 						},
-						Key:      "trivy.ignoreUnfixed",
+						Key:      keyTrivyIgnoreUnfixed,
 						Optional: pointer.BoolPtr(true),
 					},
 				},
@@ -559,9 +598,9 @@ func (s *plugin) getPodSpecForClientServerMode(spec corev1.PodSpec, credentials
 				ValueFrom: &corev1.EnvVarSource{
 					ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
 						LocalObjectReference: corev1.LocalObjectReference{
-							Name: starboard.ConfigMapName,
+							Name: trivyConfigName,
 						},
-						Key:      "trivy.skipFiles",
+						Key:      keyTrivySkipFiles,
 						Optional: pointer.BoolPtr(true),
 					},
 				},
@@ -571,9 +610,9 @@ func (s *plugin) getPodSpecForClientServerMode(spec corev1.PodSpec, credentials
 				ValueFrom: &corev1.EnvVarSource{
 					ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
 						LocalObjectReference: corev1.LocalObjectReference{
-							Name: starboard.ConfigMapName,
+							Name: trivyConfigName,
 						},
-						Key:      "trivy.skipDirs",
+						Key:      keyTrivySkipDirs,
 						Optional: pointer.BoolPtr(true),
 					},
 				},
@@ -583,9 +622,9 @@ func (s *plugin) getPodSpecForClientServerMode(spec corev1.PodSpec, credentials
 				ValueFrom: &corev1.EnvVarSource{
 					ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
 						LocalObjectReference: corev1.LocalObjectReference{
-							Name: starboard.SecretName,
+							Name: trivyConfigName,
 						},
-						Key:      "trivy.serverTokenHeader",
+						Key:      keyTrivyServerTokenHeader,
 						Optional: pointer.BoolPtr(true),
 					},
 				},
@@ -595,9 +634,9 @@ func (s *plugin) getPodSpecForClientServerMode(spec corev1.PodSpec, credentials
 				ValueFrom: &corev1.EnvVarSource{
 					SecretKeyRef: &corev1.SecretKeySelector{
 						LocalObjectReference: corev1.LocalObjectReference{
-							Name: starboard.SecretName,
+							Name: trivyConfigName,
 						},
-						Key:      "trivy.serverToken",
+						Key:      keyTrivyServerToken,
 						Optional: pointer.BoolPtr(true),
 					},
 				},
@@ -607,9 +646,9 @@ func (s *plugin) getPodSpecForClientServerMode(spec corev1.PodSpec, credentials
 				ValueFrom: &corev1.EnvVarSource{
 					SecretKeyRef: &corev1.SecretKeySelector{
 						LocalObjectReference: corev1.LocalObjectReference{
-							Name: starboard.SecretName,
+							Name: trivyConfigName,
 						},
-						Key:      "trivy.serverCustomHeaders",
+						Key:      keyTrivyServerCustomHeaders,
 						Optional: pointer.BoolPtr(true),
 					},
 				},
@@ -643,23 +682,23 @@ func (s *plugin) getPodSpecForClientServerMode(spec corev1.PodSpec, credentials
 			})
 		}
 
-		env, err = s.appendTrivyInsecureEnv(container.Image, env)
+		env, err = s.appendTrivyInsecureEnv(config, container.Image, env)
 		if err != nil {
 			return corev1.PodSpec{}, nil, err
 		}
 
-		if s.config.IgnoreFileExists() {
+		if config.IgnoreFileExists() {
 			volumes = []corev1.Volume{
 				{
 					Name: ignoreFileVolumeName,
 					VolumeSource: corev1.VolumeSource{
 						ConfigMap: &corev1.ConfigMapVolumeSource{
 							LocalObjectReference: corev1.LocalObjectReference{
-								Name: starboard.ConfigMapName,
+								Name: trivyConfigName,
 							},
 							Items: []corev1.KeyToPath{
 								{
-									Key:  "trivy.ignoreFile",
+									Key:  keyTrivyIgnoreFile,
 									Path: ".trivyignore",
 								},
 							},
@@ -713,13 +752,13 @@ func (s *plugin) getPodSpecForClientServerMode(spec corev1.PodSpec, credentials
 	}, secrets, nil
 }
 
-func (s *plugin) appendTrivyInsecureEnv(image string, env []corev1.EnvVar) ([]corev1.EnvVar, error) {
+func (s *plugin) appendTrivyInsecureEnv(config Config, image string, env []corev1.EnvVar) ([]corev1.EnvVar, error) {
 	ref, err := name.ParseReference(image)
 	if err != nil {
 		return nil, err
 	}
 
-	insecureRegistries := s.config.GetInsecureRegistries()
+	insecureRegistries := config.GetInsecureRegistries()
 	if insecureRegistries[ref.Context().RegistryStr()] {
 		env = append(env, corev1.EnvVar{
 			Name:  "TRIVY_INSECURE",
@@ -730,9 +769,14 @@ func (s *plugin) appendTrivyInsecureEnv(image string, env []corev1.EnvVar) ([]co
 	return env, nil
 }
 
-func (s *plugin) ParseVulnerabilityReportData(_ starboard.PluginContext, imageRef string, logsReader io.ReadCloser) (v1alpha1.VulnerabilityScanResult, error) {
+func (s *plugin) ParseVulnerabilityReportData(ctx starboard.PluginContext, imageRef string, logsReader io.ReadCloser) (v1alpha1.VulnerabilityScanResult, error) {
+	config, err := s.newConfigFrom(ctx)
+	if err != nil {
+		return v1alpha1.VulnerabilityScanResult{}, err
+	}
+
 	var reports []ScanReport
-	err := json.NewDecoder(logsReader).Decode(&reports)
+	err = json.NewDecoder(logsReader).Decode(&reports)
 	if err != nil {
 		return v1alpha1.VulnerabilityScanResult{}, err
 	}
@@ -759,7 +803,7 @@ func (s *plugin) ParseVulnerabilityReportData(_ starboard.PluginContext, imageRe
 		return v1alpha1.VulnerabilityScanResult{}, err
 	}
 
-	trivyImageRef, err := s.config.GetImageRef()
+	trivyImageRef, err := config.GetImageRef()
 	if err != nil {
 		return v1alpha1.VulnerabilityScanResult{}, err
 	}
@@ -783,7 +827,16 @@ func (s *plugin) ParseVulnerabilityReportData(_ starboard.PluginContext, imageRe
 	}, nil
 }
 
-func (s *plugin) toSummary(vulnerabilities []v1alpha1.Vulnerability) (vs v1alpha1.VulnerabilitySummary) {
+func (s *plugin) newConfigFrom(ctx starboard.PluginContext) (Config, error) {
+	pluginConfig, err := ctx.GetConfig()
+	if err != nil {
+		return Config{}, err
+	}
+	return Config{PluginConfig: pluginConfig}, nil
+}
+
+func (s *plugin) toSummary(vulnerabilities []v1alpha1.Vulnerability) v1alpha1.VulnerabilitySummary {
+	var vs v1alpha1.VulnerabilitySummary
 	for _, v := range vulnerabilities {
 		switch v.Severity {
 		case v1alpha1.SeverityCritical:
@@ -798,11 +851,11 @@ func (s *plugin) toSummary(vulnerabilities []v1alpha1.Vulnerability) (vs v1alpha
 			vs.UnknownCount++
 		}
 	}
-	return
+	return vs
 }
 
 // TODO check if it works if both tag and digest are specified
-func (s *plugin) parseImageRef(imageRef string) (v1alpha1.Registry, v1alpha1.Artifact, error) {
+func (p *plugin) parseImageRef(imageRef string) (v1alpha1.Registry, v1alpha1.Artifact, error) {
 	ref, err := name.ParseReference(imageRef)
 	if err != nil {
 		return v1alpha1.Registry{}, v1alpha1.Artifact{}, err
diff --git a/pkg/starboard/config.go b/pkg/starboard/config.go
index fdd6f50..90b426d 100644
--- a/pkg/starboard/config.go
+++ b/pkg/starboard/config.go
@@ -72,10 +72,6 @@ func GetDefaultConfig() ConfigData {
 		keyVulnerabilityReportsScanner: string(Trivy),
 		keyConfigAuditReportsScanner:   string(Polaris),
 
-		"trivy.severity": "UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL",
-		"trivy.imageRef": "docker.io/aquasec/trivy:0.16.0",
-		"trivy.mode":     "Standalone",
-
 		"kube-bench.imageRef":  "docker.io/aquasec/kube-bench:0.5.0",
 		"kube-hunter.imageRef": "docker.io/aquasec/kube-hunter:0.4.1",
 		"kube-hunter.quick":    "false",
diff --git a/pkg/starboard/plugin.go b/pkg/starboard/plugin.go
index 7f88b7d..eae8d75 100644
--- a/pkg/starboard/plugin.go
+++ b/pkg/starboard/plugin.go
@@ -3,9 +3,10 @@ package starboard
 import (
 	"context"
 	"fmt"
+	"strings"
+
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/labels"
-	"strings"
 
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/api/errors"
@@ -48,6 +49,7 @@ type PluginContext interface {
 
 // GetPluginConfigMapName returns the name of a ConfigMap used to configure a plugin
 // with the given name.
+// TODO Rename to GetPluginConfigObjectName as this method is used to determine the name of ConfigMaps and Secrets.
 func GetPluginConfigMapName(pluginName string) string {
 	return "starboard-" + strings.ToLower(pluginName) + "-config"
 }
diff --git a/pkg/vulnerabilityreport/plugin.go b/pkg/vulnerabilityreport/plugin.go
index 39068e8..1fa7027 100644
--- a/pkg/vulnerabilityreport/plugin.go
+++ b/pkg/vulnerabilityreport/plugin.go
@@ -13,6 +13,10 @@ import (
 // scanners.
 type Plugin interface {
 
+	// Init is a callback to initialize this plugin, e.g. ensure the default
+	// configuration.
+	Init(ctx starboard.PluginContext) error
+
 	// GetScanJobSpec describes the pod that will be created by Starboard when
 	// it schedules a Kubernetes job to scan the workload with the specified
 	// descriptor.


Test patch:
diff --git a/pkg/plugin/trivy/plugin_test.go b/pkg/plugin/trivy/plugin_test.go
index eb0bb33..91516a8 100644
--- a/pkg/plugin/trivy/plugin_test.go
+++ b/pkg/plugin/trivy/plugin_test.go
@@ -17,6 +17,7 @@ import (
 	"k8s.io/apimachinery/pkg/api/resource"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/utils/pointer"
+	"sigs.k8s.io/controller-runtime/pkg/client/fake"
 )
 
 var (
@@ -33,13 +34,15 @@ func TestConfig_GetImageRef(t *testing.T) {
 	}{
 		{
 			name:          "Should return error",
-			configData:    trivy.Config{starboard.ConfigData{}},
+			configData:    trivy.Config{PluginConfig: starboard.PluginConfig{}},
 			expectedError: "property trivy.imageRef not set",
 		},
 		{
 			name: "Should return image reference from config data",
-			configData: trivy.Config{starboard.ConfigData{
-				"trivy.imageRef": "gcr.io/aquasecurity/trivy:0.8.0",
+			configData: trivy.Config{PluginConfig: starboard.PluginConfig{
+				Data: map[string]string{
+					"trivy.imageRef": "gcr.io/aquasecurity/trivy:0.8.0",
+				},
 			}},
 			expectedImageRef: "gcr.io/aquasecurity/trivy:0.8.0",
 		},
@@ -67,27 +70,33 @@ func TestConfig_GetMode(t *testing.T) {
 	}{
 		{
 			name: "Should return Standalone",
-			configData: trivy.Config{starboard.ConfigData{
-				"trivy.mode": "Standalone",
+			configData: trivy.Config{PluginConfig: starboard.PluginConfig{
+				Data: map[string]string{
+					"trivy.mode": "Standalone",
+				},
 			}},
 			expectedMode: trivy.Standalone,
 		},
 		{
 			name: "Should return ClientServer",
-			configData: trivy.Config{starboard.ConfigData{
-				"trivy.mode": "ClientServer",
+			configData: trivy.Config{PluginConfig: starboard.PluginConfig{
+				Data: map[string]string{
+					"trivy.mode": "ClientServer",
+				},
 			}},
 			expectedMode: trivy.ClientServer,
 		},
 		{
 			name:          "Should return error when value is not set",
-			configData:    trivy.Config{starboard.ConfigData{}},
+			configData:    trivy.Config{PluginConfig: starboard.PluginConfig{}},
 			expectedError: "property trivy.mode not set",
 		},
 		{
 			name: "Should return error when value is not allowed",
-			configData: trivy.Config{starboard.ConfigData{
-				"trivy.mode": "P2P",
+			configData: trivy.Config{PluginConfig: starboard.PluginConfig{
+				Data: map[string]string{
+					"trivy.mode": "P2P",
+				},
 			}},
 			expectedError: "invalid value (P2P) of trivy.mode; allowed values (Standalone, ClientServer)",
 		},
@@ -113,20 +122,24 @@ func TestConfig_IgnoreFileExists(t *testing.T) {
 	}{
 		{
 			name: "Should return false",
-			configData: trivy.Config{starboard.ConfigData{
-				"foo": "bar",
+			configData: trivy.Config{PluginConfig: starboard.PluginConfig{
+				Data: map[string]string{
+					"foo": "bar",
+				},
 			}},
 			expectedOutput: false,
 		},
 		{
 			name: "Should return true",
-			configData: trivy.Config{starboard.ConfigData{
-				"foo": "bar",
-				"trivy.ignoreFile": `# Accept the risk
+			configData: trivy.Config{PluginConfig: starboard.PluginConfig{
+				Data: map[string]string{
+					"foo": "bar",
+					"trivy.ignoreFile": `# Accept the risk
 CVE-2018-14618
 
 # No impact in our settings
 CVE-2019-1543`,
+				},
 			}},
 			expectedOutput: true,
 		},
@@ -148,17 +161,21 @@ func TestConfig_GetInsecureRegistries(t *testing.T) {
 	}{
 		{
 			name: "Should return nil map when there is no key with trivy.insecureRegistry. prefix",
-			configData: trivy.Config{starboard.ConfigData{
-				"foo": "bar",
+			configData: trivy.Config{PluginConfig: starboard.PluginConfig{
+				Data: map[string]string{
+					"foo": "bar",
+				},
 			}},
 			expectedOutput: make(map[string]bool),
 		},
 		{
 			name: "Should return insecure registries in map",
-			configData: trivy.Config{starboard.ConfigData{
-				"foo":                                "bar",
-				"trivy.insecureRegistry.pocRegistry": "poc.myregistry.harbor.com.pl",
-				"trivy.insecureRegistry.qaRegistry":  "qa.registry.aquasec.com",
+			configData: trivy.Config{PluginConfig: starboard.PluginConfig{
+				Data: map[string]string{
+					"foo":                                "bar",
+					"trivy.insecureRegistry.pocRegistry": "poc.myregistry.harbor.com.pl",
+					"trivy.insecureRegistry.qaRegistry":  "qa.registry.aquasec.com",
+				},
 			}},
 			expectedOutput: map[string]bool{
 				"poc.myregistry.harbor.com.pl": true,
@@ -180,7 +197,7 @@ func TestScanner_GetScanJobSpec(t *testing.T) {
 	testCases := []struct {
 		name string
 
-		config       starboard.ConfigData
+		config       map[string]string
 		workloadSpec corev1.PodSpec
 
 		expectedSecrets []corev1.Secret
@@ -188,7 +205,7 @@ func TestScanner_GetScanJobSpec(t *testing.T) {
 	}{
 		{
 			name: "Standalone mode without insecure registry",
-			config: starboard.ConfigData{
+			config: map[string]string{
 				"trivy.imageRef": "docker.io/aquasec/trivy:0.14.0",
 				"trivy.mode":     string(trivy.Standalone),
 			},
@@ -226,7 +243,7 @@ func TestScanner_GetScanJobSpec(t *testing.T) {
 								ValueFrom: &corev1.EnvVarSource{
 									ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
 										LocalObjectReference: corev1.LocalObjectReference{
-											Name: starboard.ConfigMapName,
+											Name: "starboard-trivy-config",
 										},
 										Key:      "trivy.httpProxy",
 										Optional: pointer.BoolPtr(true),
@@ -238,7 +255,7 @@ func TestScanner_GetScanJobSpec(t *testing.T) {
 								ValueFrom: &corev1.EnvVarSource{
 									ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
 										LocalObjectReference: corev1.LocalObjectReference{
-											Name: starboard.ConfigMapName,
+											Name: "starboard-trivy-config",
 										},
 										Key:      "trivy.httpsProxy",
 										Optional: pointer.BoolPtr(true),
@@ -250,7 +267,7 @@ func TestScanner_GetScanJobSpec(t *testing.T) {
 								ValueFrom: &corev1.EnvVarSource{
 									ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
 										LocalObjectReference: corev1.LocalObjectReference{
-											Name: starboard.ConfigMapName,
+											Name: "starboard-trivy-config",
 										},
 										Key:      "trivy.noProxy",
 										Optional: pointer.BoolPtr(true),
@@ -263,7 +280,7 @@ func TestScanner_GetScanJobSpec(t *testing.T) {
 								ValueFrom: &corev1.EnvVarSource{
 									SecretKeyRef: &corev1.SecretKeySelector{
 										LocalObjectReference: corev1.LocalObjectReference{
-											Name: starboard.SecretName,
+											Name: "starboard-trivy-config",
 										},
 										Key:      "trivy.githubToken",
 										Optional: pointer.BoolPtr(true),
@@ -309,7 +326,7 @@ func TestScanner_GetScanJobSpec(t *testing.T) {
 								ValueFrom: &corev1.EnvVarSource{
 									ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
 										LocalObjectReference: corev1.LocalObjectReference{
-											Name: starboard.ConfigMapName,
+											Name: "starboard-trivy-config",
 										},
 										Key:      "trivy.severity",
 										Optional: pointer.BoolPtr(true),
@@ -321,7 +338,7 @@ func TestScanner_GetScanJobSpec(t *testing.T) {
 								ValueFrom: &corev1.EnvVarSource{
 									ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
 										LocalObjectReference: corev1.LocalObjectReference{
-											Name: starboard.ConfigMapName,
+											Name: "starboard-trivy-config",
 										},
 										Key:      "trivy.ignoreUnfixed",
 										Optional: pointer.BoolPtr(true),
@@ -333,7 +350,7 @@ func TestScanner_GetScanJobSpec(t *testing.T) {
 								ValueFrom: &corev1.EnvVarSource{
 									ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
 										LocalObjectReference: corev1.LocalObjectReference{
-											Name: starboard.ConfigMapName,
+											Name: "starboard-trivy-config",
 										},
 										Key:      "trivy.skipFiles",
 										Optional: pointer.BoolPtr(true),
@@ -345,7 +362,7 @@ func TestScanner_GetScanJobSpec(t *testing.T) {
 								ValueFrom: &corev1.EnvVarSource{
 									ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
 										LocalObjectReference: corev1.LocalObjectReference{
-											Name: starboard.ConfigMapName,
+											Name: "starboard-trivy-config",
 										},
 										Key:      "trivy.skipDirs",
 										Optional: pointer.BoolPtr(true),
@@ -357,7 +374,7 @@ func TestScanner_GetScanJobSpec(t *testing.T) {
 								ValueFrom: &corev1.EnvVarSource{
 									ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
 										LocalObjectReference: corev1.LocalObjectReference{
-											Name: starboard.ConfigMapName,
+											Name: "starboard-trivy-config",
 										},
 										Key:      "trivy.httpProxy",
 										Optional: pointer.BoolPtr(true),
@@ -369,7 +386,7 @@ func TestScanner_GetScanJobSpec(t *testing.T) {
 								ValueFrom: &corev1.EnvVarSource{
 									ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
 										LocalObjectReference: corev1.LocalObjectReference{
-											Name: starboard.ConfigMapName,
+											Name: "starboard-trivy-config",
 										},
 										Key:      "trivy.httpsProxy",
 										Optional: pointer.BoolPtr(true),
@@ -381,7 +398,7 @@ func TestScanner_GetScanJobSpec(t *testing.T) {
 								ValueFrom: &corev1.EnvVarSource{
 									ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
 										LocalObjectReference: corev1.LocalObjectReference{
-											Name: starboard.ConfigMapName,
+											Name: "starboard-trivy-config",
 										},
 										Key:      "trivy.noProxy",
 										Optional: pointer.BoolPtr(true),
@@ -431,7 +448,7 @@ func TestScanner_GetScanJobSpec(t *testing.T) {
 		},
 		{
 			name: "Standalone mode with insecure registry",
-			config: starboard.ConfigData{
+			config: map[string]string{
 				"trivy.imageRef":                     "docker.io/aquasec/trivy:0.14.0",
 				"trivy.mode":                         string(trivy.Standalone),
 				"trivy.insecureRegistry.pocRegistry": "poc.myregistry.harbor.com.pl",
@@ -470,7 +487,7 @@ func TestScanner_GetScanJobSpec(t *testing.T) {
 								ValueFrom: &corev1.EnvVarSource{
 									ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
 										LocalObjectReference: corev1.LocalObjectReference{
-											Name: starboard.ConfigMapName,
+											Name: "starboard-trivy-config",
 										},
 										Key:      "trivy.httpProxy",
 										Optional: pointer.BoolPtr(true),
@@ -482,7 +499,7 @@ func TestScanner_GetScanJobSpec(t *testing.T) {
 								ValueFrom: &corev1.EnvVarSource{
 									ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
 										LocalObjectReference: corev1.LocalObjectReference{
-											Name: starboard.ConfigMapName,
+											Name: "starboard-trivy-config",
 										},
 										Key:      "trivy.httpsProxy",
 										Optional: pointer.BoolPtr(true),
@@ -494,7 +511,7 @@ func TestScanner_GetScanJobSpec(t *testing.T) {
 								ValueFrom: &corev1.EnvVarSource{
 									ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
 										LocalObjectReference: corev1.LocalObjectReference{
-											Name: starboard.ConfigMapName,
+											Name: "starboard-trivy-config",
 										},
 										Key:      "trivy.noProxy",
 										Optional: pointer.BoolPtr(true),
@@ -506,7 +523,7 @@ func TestScanner_GetScanJobSpec(t *testing.T) {
 								ValueFrom: &corev1.EnvVarSource{
 									SecretKeyRef: &corev1.SecretKeySelector{
 										LocalObjectReference: corev1.LocalObjectReference{
-											Name: starboard.SecretName,
+											Name: "starboard-trivy-config",
 										},
 										Key:      "trivy.githubToken",
 										Optional: pointer.BoolPtr(true),
@@ -552,7 +569,7 @@ func TestScanner_GetScanJobSpec(t *testing.T) {
 								ValueFrom: &corev1.EnvVarSource{
 									ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
 										LocalObjectReference: corev1.LocalObjectReference{
-											Name: starboard.ConfigMapName,
+											Name: "starboard-trivy-config",
 										},
 										Key:      "trivy.severity",
 										Optional: pointer.BoolPtr(true),
@@ -564,7 +581,7 @@ func TestScanner_GetScanJobSpec(t *testing.T) {
 								ValueFrom: &corev1.EnvVarSource{
 									ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
 										LocalObjectReference: corev1.LocalObjectReference{
-											Name: starboard.ConfigMapName,
+											Name: "starboard-trivy-config",
 										},
 										Key:      "trivy.ignoreUnfixed",
 										Optional: pointer.BoolPtr(true),
@@ -576,7 +593,7 @@ func TestScanner_GetScanJobSpec(t *testing.T) {
 								ValueFrom: &corev1.EnvVarSource{
 									ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
 										LocalObjectReference: corev1.LocalObjectReference{
-											Name: starboard.ConfigMapName,
+											Name: "starboard-trivy-config",
 										},
 										Key:      "trivy.skipFiles",
 										Optional: pointer.BoolPtr(true),
@@ -588,7 +605,7 @@ func TestScanner_GetScanJobSpec(t *testing.T) {
 								ValueFrom: &corev1.EnvVarSource{
 									ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
 										LocalObjectReference: corev1.LocalObjectReference{
-											Name: starboard.ConfigMapName,
+											Name: "starboard-trivy-config",
 										},
 										Key:      "trivy.skipDirs",
 										Optional: pointer.BoolPtr(true),
@@ -600,7 +617,7 @@ func TestScanner_GetScanJobSpec(t *testing.T) {
 								ValueFrom: &corev1.EnvVarSource{
 									ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
 										LocalObjectReference: corev1.LocalObjectReference{
-											Name: starboard.ConfigMapName,
+											Name: "starboard-trivy-config",
 										},
 										Key:      "trivy.httpProxy",
 										Optional: pointer.BoolPtr(true),
@@ -612,7 +629,7 @@ func TestScanner_GetScanJobSpec(t *testing.T) {
 								ValueFrom: &corev1.EnvVarSource{
 									ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
 										LocalObjectReference: corev1.LocalObjectReference{
-											Name: starboard.ConfigMapName,
+											Name: "starboard-trivy-config",
 										},
 										Key:      "trivy.httpsProxy",
 										Optional: pointer.BoolPtr(true),
@@ -624,7 +641,7 @@ func TestScanner_GetScanJobSpec(t *testing.T) {
 								ValueFrom: &corev1.EnvVarSource{
 									ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
 										LocalObjectReference: corev1.LocalObjectReference{
-											Name: starboard.ConfigMapName,
+											Name: "starboard-trivy-config",
 										},
 										Key:      "trivy.noProxy",
 										Optional: pointer.BoolPtr(true),
@@ -678,7 +695,7 @@ func TestScanner_GetScanJobSpec(t *testing.T) {
 		},
 		{
 			name: "Standalone mode with trivyignore file",
-			config: starboard.ConfigData{
+			config: map[string]string{
 				"trivy.imageRef": "docker.io/aquasec/trivy:0.14.0",
 				"trivy.mode":     string(trivy.Standalone),
 				"trivy.ignoreFile": `# Accept the risk
@@ -713,7 +730,7 @@ CVE-2019-1543`,
 						VolumeSource: corev1.VolumeSource{
 							ConfigMap: &corev1.ConfigMapVolumeSource{
 								LocalObjectReference: corev1.LocalObjectReference{
-									Name: starboard.ConfigMapName,
+									Name: "starboard-trivy-config",
 								},
 								Items: []corev1.KeyToPath{
 									{
@@ -737,7 +754,7 @@ CVE-2019-1543`,
 								ValueFrom: &corev1.EnvVarSource{
 									ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
 										LocalObjectReference: corev1.LocalObjectReference{
-											Name: starboard.ConfigMapName,
+											Name: "starboard-trivy-config",
 										},
 										Key:      "trivy.httpProxy",
 										Optional: pointer.BoolPtr(true),
@@ -749,7 +766,7 @@ CVE-2019-1543`,
 								ValueFrom: &corev1.EnvVarSource{
 									ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
 										LocalObjectReference: corev1.LocalObjectReference{
-											Name: starboard.ConfigMapName,
+											Name: "starboard-trivy-config",
 										},
 										Key:      "trivy.httpsProxy",
 										Optional: pointer.BoolPtr(true),
@@ -761,7 +778,7 @@ CVE-2019-1543`,
 								ValueFrom: &corev1.EnvVarSource{
 									ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
 										LocalObjectReference: corev1.LocalObjectReference{
-											Name: starboard.ConfigMapName,
+											Name: "starboard-trivy-config",
 										},
 										Key:      "trivy.noProxy",
 										Optional: pointer.BoolPtr(true),
@@ -774,7 +791,7 @@ CVE-2019-1543`,
 								ValueFrom: &corev1.EnvVarSource{
 									SecretKeyRef: &corev1.SecretKeySelector{
 										LocalObjectReference: corev1.LocalObjectReference{
-											Name: starboard.SecretName,
+											Name: "starboard-trivy-config",
 										},
 										Key:      "trivy.githubToken",
 										Optional: pointer.BoolPtr(true),
@@ -820,7 +837,7 @@ CVE-2019-1543`,
 								ValueFrom: &corev1.EnvVarSource{
 									ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
 										LocalObjectReference: corev1.LocalObjectReference{
-											Name: starboard.ConfigMapName,
+											Name: "starboard-trivy-config",
 										},
 										Key:      "trivy.severity",
 										Optional: pointer.BoolPtr(true),
@@ -832,7 +849,7 @@ CVE-2019-1543`,
 								ValueFrom: &corev1.EnvVarSource{
 									ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
 										LocalObjectReference: corev1.LocalObjectReference{
-											Name: starboard.ConfigMapName,
+											Name: "starboard-trivy-config",
 										},
 										Key:      "trivy.ignoreUnfixed",
 										Optional: pointer.BoolPtr(true),
@@ -844,7 +861,7 @@ CVE-2019-1543`,
 								ValueFrom: &corev1.EnvVarSource{
 									ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
 										LocalObjectReference: corev1.LocalObjectReference{
-											Name: starboard.ConfigMapName,
+											Name: "starboard-trivy-config",
 										},
 										Key:      "trivy.skipFiles",
 										Optional: pointer.BoolPtr(true),
@@ -856,7 +873,7 @@ CVE-2019-1543`,
 								ValueFrom: &corev1.EnvVarSource{
 									ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
 										LocalObjectReference: corev1.LocalObjectReference{
-											Name: starboard.ConfigMapName,
+											Name: "starboard-trivy-config",
 										},
 										Key:      "trivy.skipDirs",
 										Optional: pointer.BoolPtr(true),
@@ -868,7 +885,7 @@ CVE-2019-1543`,
 								ValueFrom: &corev1.EnvVarSource{
 									ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
 										LocalObjectReference: corev1.LocalObjectReference{
-											Name: starboard.ConfigMapName,
+											Name: "starboard-trivy-config",
 										},
 										Key:      "trivy.httpProxy",
 										Optional: pointer.BoolPtr(true),
@@ -880,7 +897,7 @@ CVE-2019-1543`,
 								ValueFrom: &corev1.EnvVarSource{
 									ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
 										LocalObjectReference: corev1.LocalObjectReference{
-											Name: starboard.ConfigMapName,
+											Name: "starboard-trivy-config",
 										},
 										Key:      "trivy.httpsProxy",
 										Optional: pointer.BoolPtr(true),
@@ -892,7 +909,7 @@ CVE-2019-1543`,
 								ValueFrom: &corev1.EnvVarSource{
 									ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
 										LocalObjectReference: corev1.LocalObjectReference{
-											Name: starboard.ConfigMapName,
+											Name: "starboard-trivy-config",
 										},
 										Key:      "trivy.noProxy",
 										Optional: pointer.BoolPtr(true),
@@ -951,7 +968,7 @@ CVE-2019-1543`,
 		},
 		{
 			name: "ClientServer mode without insecure registry",
-			config: starboard.ConfigData{
+			config: map[string]string{
 				"trivy.imageRef":  "docker.io/aquasec/trivy:0.14.0",
 				"trivy.mode":      string(trivy.ClientServer),
 				"trivy.serverURL": "http://trivy.trivy:4954",
@@ -979,7 +996,7 @@ CVE-2019-1543`,
 								ValueFrom: &corev1.EnvVarSource{
 									ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
 										LocalObjectReference: corev1.LocalObjectReference{
-											Name: starboard.ConfigMapName,
+											Name: "starboard-trivy-config",
 										},
 										Key:      "trivy.httpProxy",
 										Optional: pointer.BoolPtr(true),
@@ -991,7 +1008,7 @@ CVE-2019-1543`,
 								ValueFrom: &corev1.EnvVarSource{
 									ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
 										LocalObjectReference: corev1.LocalObjectReference{
-											Name: starboard.ConfigMapName,
+											Name: "starboard-trivy-config",
 										},
 										Key:      "trivy.httpsProxy",
 										Optional: pointer.BoolPtr(true),
@@ -1003,7 +1020,7 @@ CVE-2019-1543`,
 								ValueFrom: &corev1.EnvVarSource{
 									ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
 										LocalObjectReference: corev1.LocalObjectReference{
-											Name: starboard.ConfigMapName,
+											Name: "starboard-trivy-config",
 										},
 										Key:      "trivy.noProxy",
 										Optional: pointer.BoolPtr(true),
@@ -1015,7 +1032,7 @@ CVE-2019-1543`,
 								ValueFrom: &corev1.EnvVarSource{
 									ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
 										LocalObjectReference: corev1.LocalObjectReference{
-											Name: starboard.ConfigMapName,
+											Name: "starboard-trivy-config",
 										},
 										Key:      "trivy.severity",
 										Optional: pointer.BoolPtr(true),
@@ -1027,7 +1044,7 @@ CVE-2019-1543`,
 								ValueFrom: &corev1.EnvVarSource{
 									ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
 										LocalObjectReference: corev1.LocalObjectReference{
-											Name: starboard.ConfigMapName,
+											Name: "starboard-trivy-config",
 										},
 										Key:      "trivy.ignoreUnfixed",
 										Optional: pointer.BoolPtr(true),
@@ -1039,7 +1056,7 @@ CVE-2019-1543`,
 								ValueFrom: &corev1.EnvVarSource{
 									ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
 										LocalObjectReference: corev1.LocalObjectReference{
-											Name: starboard.ConfigMapName,
+											Name: "starboard-trivy-config",
 										},
 										Key:      "trivy.skipFiles",
 										Optional: pointer.BoolPtr(true),
@@ -1051,7 +1068,7 @@ CVE-2019-1543`,
 								ValueFrom: &corev1.EnvVarSource{
 									ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
 										LocalObjectReference: corev1.LocalObjectReference{
-											Name: starboard.ConfigMapName,
+											Name: "starboard-trivy-config",
 										},
 										Key:      "trivy.skipDirs",
 										Optional: pointer.BoolPtr(true),
@@ -1063,7 +1080,7 @@ CVE-2019-1543`,
 								ValueFrom: &corev1.EnvVarSource{
 									ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
 										LocalObjectReference: corev1.LocalObjectReference{
-											Name: starboard.SecretName,
+											Name: "starboard-trivy-config",
 										},
 										Key:      "trivy.serverTokenHeader",
 										Optional: pointer.BoolPtr(true),
@@ -1075,7 +1092,7 @@ CVE-2019-1543`,
 								ValueFrom: &corev1.EnvVarSource{
 									SecretKeyRef: &corev1.SecretKeySelector{
 										LocalObjectReference: corev1.LocalObjectReference{
-											Name: starboard.SecretName,
+											Name: "starboard-trivy-config",
 										},
 										Key:      "trivy.serverToken",
 										Optional: pointer.BoolPtr(true),
@@ -1087,7 +1104,7 @@ CVE-2019-1543`,
 								ValueFrom: &corev1.EnvVarSource{
 									SecretKeyRef: &corev1.SecretKeySelector{
 										LocalObjectReference: corev1.LocalObjectReference{
-											Name: starboard.SecretName,
+											Name: "starboard-trivy-config",
 										},
 										Key:      "trivy.serverCustomHeaders",
 										Optional: pointer.BoolPtr(true),
@@ -1123,7 +1140,7 @@ CVE-2019-1543`,
 		},
 		{
 			name: "ClientServer mode with insecure registry",
-			config: starboard.ConfigData{
+			config: map[string]string{
 				"trivy.imageRef":                     "docker.io/aquasec/trivy:0.14.0",
 				"trivy.mode":                         string(trivy.ClientServer),
 				"trivy.serverURL":                    "http://trivy.trivy:4954",
@@ -1152,7 +1169,7 @@ CVE-2019-1543`,
 								ValueFrom: &corev1.EnvVarSource{
 									ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
 										LocalObjectReference: corev1.LocalObjectReference{
-											Name: starboard.ConfigMapName,
+											Name: "starboard-trivy-config",
 										},
 										Key:      "trivy.httpProxy",
 										Optional: pointer.BoolPtr(true),
@@ -1164,7 +1181,7 @@ CVE-2019-1543`,
 								ValueFrom: &corev1.EnvVarSource{
 									ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
 										LocalObjectReference: corev1.LocalObjectReference{
-											Name: starboard.ConfigMapName,
+											Name: "starboard-trivy-config",
 										},
 										Key:      "trivy.httpsProxy",
 										Optional: pointer.BoolPtr(true),
@@ -1176,7 +1193,7 @@ CVE-2019-1543`,
 								ValueFrom: &corev1.EnvVarSource{
 									ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
 										LocalObjectReference: corev1.LocalObjectReference{
-											Name: starboard.ConfigMapName,
+											Name: "starboard-trivy-config",
 										},
 										Key:      "trivy.noProxy",
 										Optional: pointer.BoolPtr(true),
@@ -1188,7 +1205,7 @@ CVE-2019-1543`,
 								ValueFrom: &corev1.EnvVarSource{
 									ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
 										LocalObjectReference: corev1.LocalObjectReference{
-											Name: starboard.ConfigMapName,
+											Name: "starboard-trivy-config",
 										},
 										Key:      "trivy.severity",
 										Optional: pointer.BoolPtr(true),
@@ -1200,7 +1217,7 @@ CVE-2019-1543`,
 								ValueFrom: &corev1.EnvVarSource{
 									ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
 										LocalObjectReference: corev1.LocalObjectReference{
-											Name: starboard.ConfigMapName,
+											Name: "starboard-trivy-config",
 										},
 										Key:      "trivy.ignoreUnfixed",
 										Optional: pointer.BoolPtr(true),
@@ -1212,7 +1229,7 @@ CVE-2019-1543`,
 								ValueFrom: &corev1.EnvVarSource{
 									ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
 										LocalObjectReference: corev1.LocalObjectReference{
-											Name: starboard.ConfigMapName,
+											Name: "starboard-trivy-config",
 										},
 										Key:      "trivy.skipFiles",
 										Optional: pointer.BoolPtr(true),
@@ -1224,7 +1241,7 @@ CVE-2019-1543`,
 								ValueFrom: &corev1.EnvVarSource{
 									ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
 										LocalObjectReference: corev1.LocalObjectReference{
-											Name: starboard.ConfigMapName,
+											Name: "starboard-trivy-config",
 										},
 										Key:      "trivy.skipDirs",
 										Optional: pointer.BoolPtr(true),
@@ -1236,7 +1253,7 @@ CVE-2019-1543`,
 								ValueFrom: &corev1.EnvVarSource{
 									ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
 										LocalObjectReference: corev1.LocalObjectReference{
-											Name: starboard.SecretName,
+											Name: "starboard-trivy-config",
 										},
 										Key:      "trivy.serverTokenHeader",
 										Optional: pointer.BoolPtr(true),
@@ -1248,7 +1265,7 @@ CVE-2019-1543`,
 								ValueFrom: &corev1.EnvVarSource{
 									SecretKeyRef: &corev1.SecretKeySelector{
 										LocalObjectReference: corev1.LocalObjectReference{
-											Name: starboard.SecretName,
+											Name: "starboard-trivy-config",
 										},
 										Key:      "trivy.serverToken",
 										Optional: pointer.BoolPtr(true),
@@ -1260,7 +1277,7 @@ CVE-2019-1543`,
 								ValueFrom: &corev1.EnvVarSource{
 									SecretKeyRef: &corev1.SecretKeySelector{
 										LocalObjectReference: corev1.LocalObjectReference{
-											Name: starboard.SecretName,
+											Name: "starboard-trivy-config",
 										},
 										Key:      "trivy.serverCustomHeaders",
 										Optional: pointer.BoolPtr(true),
@@ -1300,7 +1317,7 @@ CVE-2019-1543`,
 		},
 		{
 			name: "ClientServer mode with trivyignore file",
-			config: starboard.ConfigData{
+			config: map[string]string{
 				"trivy.imageRef":  "docker.io/aquasec/trivy:0.14.0",
 				"trivy.mode":      string(trivy.ClientServer),
 				"trivy.serverURL": "http://trivy.trivy:4954",
@@ -1327,7 +1344,7 @@ CVE-2019-1543`,
 						VolumeSource: corev1.VolumeSource{
 							ConfigMap: &corev1.ConfigMapVolumeSource{
 								LocalObjectReference: corev1.LocalObjectReference{
-									Name: starboard.ConfigMapName,
+									Name: "starboard-trivy-config",
 								},
 								Items: []corev1.KeyToPath{
 									{
@@ -1351,7 +1368,7 @@ CVE-2019-1543`,
 								ValueFrom: &corev1.EnvVarSource{
 									ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
 										LocalObjectReference: corev1.LocalObjectReference{
-											Name: starboard.ConfigMapName,
+											Name: "starboard-trivy-config",
 										},
 										Key:      "trivy.httpProxy",
 										Optional: pointer.BoolPtr(true),
@@ -1363,7 +1380,7 @@ CVE-2019-1543`,
 								ValueFrom: &corev1.EnvVarSource{
 									ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
 										LocalObjectReference: corev1.LocalObjectReference{
-											Name: starboard.ConfigMapName,
+											Name: "starboard-trivy-config",
 										},
 										Key:      "trivy.httpsProxy",
 										Optional: pointer.BoolPtr(true),
@@ -1375,7 +1392,7 @@ CVE-2019-1543`,
 								ValueFrom: &corev1.EnvVarSource{
 									ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
 										LocalObjectReference: corev1.LocalObjectReference{
-											Name: starboard.ConfigMapName,
+											Name: "starboard-trivy-config",
 										},
 										Key:      "trivy.noProxy",
 										Optional: pointer.BoolPtr(true),
@@ -1387,7 +1404,7 @@ CVE-2019-1543`,
 								ValueFrom: &corev1.EnvVarSource{
 									ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
 										LocalObjectReference: corev1.LocalObjectReference{
-											Name: starboard.ConfigMapName,
+											Name: "starboard-trivy-config",
 										},
 										Key:      "trivy.severity",
 										Optional: pointer.BoolPtr(true),
@@ -1399,7 +1416,7 @@ CVE-2019-1543`,
 								ValueFrom: &corev1.EnvVarSource{
 									ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
 										LocalObjectReference: corev1.LocalObjectReference{
-											Name: starboard.ConfigMapName,
+											Name: "starboard-trivy-config",
 										},
 										Key:      "trivy.ignoreUnfixed",
 										Optional: pointer.BoolPtr(true),
@@ -1411,7 +1428,7 @@ CVE-2019-1543`,
 								ValueFrom: &corev1.EnvVarSource{
 									ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
 										LocalObjectReference: corev1.LocalObjectReference{
-											Name: starboard.ConfigMapName,
+											Name: "starboard-trivy-config",
 										},
 										Key:      "trivy.skipFiles",
 										Optional: pointer.BoolPtr(true),
@@ -1423,7 +1440,7 @@ CVE-2019-1543`,
 								ValueFrom: &corev1.EnvVarSource{
 									ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
 										LocalObjectReference: corev1.LocalObjectReference{
-											Name: starboard.ConfigMapName,
+											Name: "starboard-trivy-config",
 										},
 										Key:      "trivy.skipDirs",
 										Optional: pointer.BoolPtr(true),
@@ -1435,7 +1452,7 @@ CVE-2019-1543`,
 								ValueFrom: &corev1.EnvVarSource{
 									ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
 										LocalObjectReference: corev1.LocalObjectReference{
-											Name: starboard.SecretName,
+											Name: "starboard-trivy-config",
 										},
 										Key:      "trivy.serverTokenHeader",
 										Optional: pointer.BoolPtr(true),
@@ -1447,7 +1464,7 @@ CVE-2019-1543`,
 								ValueFrom: &corev1.EnvVarSource{
 									SecretKeyRef: &corev1.SecretKeySelector{
 										LocalObjectReference: corev1.LocalObjectReference{
-											Name: starboard.SecretName,
+											Name: "starboard-trivy-config",
 										},
 										Key:      "trivy.serverToken",
 										Optional: pointer.BoolPtr(true),
@@ -1459,7 +1476,7 @@ CVE-2019-1543`,
 								ValueFrom: &corev1.EnvVarSource{
 									SecretKeyRef: &corev1.SecretKeySelector{
 										LocalObjectReference: corev1.LocalObjectReference{
-											Name: starboard.SecretName,
+											Name: "starboard-trivy-config",
 										},
 										Key:      "trivy.serverCustomHeaders",
 										Optional: pointer.BoolPtr(true),
@@ -1509,11 +1526,20 @@ CVE-2019-1543`,
 	for _, tc := range testCases {
 		t.Run(tc.name, func(t *testing.T) {
 			pluginContext := starboard.NewPluginContext().
-				WithName(string(starboard.Trivy)).
+				WithName("Trivy").
 				WithNamespace("starboard-ns").
 				WithServiceAccountName("starboard-sa").
+				WithClient(fake.NewClientBuilder().WithObjects(
+					&corev1.ConfigMap{
+						ObjectMeta: metav1.ObjectMeta{
+							Name:      "starboard-trivy-config",
+							Namespace: "starboard-ns",
+						},
+						Data: tc.config,
+					},
+				).Build()).
 				Get()
-			instance := trivy.NewPlugin(fixedClock, ext.NewSimpleIDGenerator(), tc.config)
+			instance := trivy.NewPlugin(fixedClock, ext.NewSimpleIDGenerator())
 			jobSpec, secrets, err := instance.GetScanJobSpec(pluginContext, tc.workloadSpec, nil)
 			require.NoError(t, err)
 			assert.Empty(t, secrets)
@@ -1603,8 +1629,14 @@ var (
 )
 
 func TestScanner_ParseVulnerabilityReportData(t *testing.T) {
-	config := starboard.ConfigData{
-		"trivy.imageRef": "aquasec/trivy:0.9.1",
+	config := &corev1.ConfigMap{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "starboard-trivy-config",
+			Namespace: "starboard-ns",
+		},
+		Data: map[string]string{
+			"trivy.imageRef": "aquasec/trivy:0.9.1",
+		},
 	}
 
 	testCases := []struct {
@@ -1661,8 +1693,13 @@ func TestScanner_ParseVulnerabilityReportData(t *testing.T) {
 
 	for _, tc := range testCases {
 		t.Run(tc.name, func(t *testing.T) {
-			ctx := starboard.NewPluginContext().Get()
-			instance := trivy.NewPlugin(fixedClock, ext.NewSimpleIDGenerator(), config)
+			ctx := starboard.NewPluginContext().
+				WithName("Trivy").
+				WithNamespace("starboard-ns").
+				WithServiceAccountName("starboard-sa").
+				WithClient(fake.NewClientBuilder().WithObjects(config).Build()).
+				Get()
+			instance := trivy.NewPlugin(fixedClock, ext.NewSimpleIDGenerator())
 			report, err := instance.ParseVulnerabilityReportData(ctx, tc.imageRef, io.NopCloser(strings.NewReader(tc.input)))
 			switch {
 			case tc.expectedError == nil: