Repository: aquasecurity/starboard
Pull request #603 (2021-05-25 21:33:25)

refactor: Remove config checkers config from generic starboard ConfigMap
Signed-off-by: Daniel Pacak <pacak.daniel@gmail.com>

codecov[bot]: # [Codecov](https://codecov.io/gh/aquasecurity/starboard/pull/603?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity) Report
> Merging [#603](https://codecov.io/gh/aquasecurity/starboard/pull/603?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity) (ec98f00) into [main](https://codecov.io/gh/aquasecurity/starboard/commit/fd93a8c26eb9f3c9ec23393f98097a99b4df5f09?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity) (fd93a8c) will **decrease** coverage by `25.56%`.
> The diff coverage is `50.00%`.

[![Impacted file tree graph](https://codecov.io/gh/aquasecurity/starboard/pull/603/graphs/tree.svg?width=650&height=150&src=pr&token=qqTGKAJ0Wb&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity)](https://codecov.io/gh/aquasecurity/starboard/pull/603?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity)

```diff
@@             Coverage Diff             @@
##             main     #603       +/-   ##
===========================================
- Coverage   70.95%   45.39%   -25.57%     
===========================================
  Files          57       41       -16     
  Lines        4242     3602      -640     
===========================================
- Hits         3010     1635     -1375     
- Misses        890     1868      +978     
+ Partials      342       99      -243     
```


| [Impacted Files](https://codecov.io/gh/aquasecurity/starboard/pull/603?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity) | Coverage Δ | |
|---|---|---|
| [pkg/configauditreport/scanner.go](https://codecov.io/gh/aquasecurity/starboard/pull/603/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL2NvbmZpZ2F1ZGl0cmVwb3J0L3NjYW5uZXIuZ28=) | `0.00% <0.00%> (-70.77%)` | :arrow_down: |
| [pkg/operator/controller/configauditreport.go](https://codecov.io/gh/aquasecurity/starboard/pull/603/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL29wZXJhdG9yL2NvbnRyb2xsZXIvY29uZmlnYXVkaXRyZXBvcnQuZ28=) | `0.00% <0.00%> (-64.82%)` | :arrow_down: |
| [pkg/plugin/factory.go](https://codecov.io/gh/aquasecurity/starboard/pull/603/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL3BsdWdpbi9mYWN0b3J5Lmdv) | `0.00% <0.00%> (-80.49%)` | :arrow_down: |
| [pkg/starboard/plugin.go](https://codecov.io/gh/aquasecurity/starboard/pull/603/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL3N0YXJib2FyZC9wbHVnaW4uZ28=) | `68.29% <0.00%> (-9.49%)` | :arrow_down: |
| [pkg/plugin/conftest/plugin.go](https://codecov.io/gh/aquasecurity/starboard/pull/603/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL3BsdWdpbi9jb25mdGVzdC9wbHVnaW4uZ28=) | `86.45% <66.66%> (-1.05%)` | :arrow_down: |
| [pkg/plugin/polaris/plugin.go](https://codecov.io/gh/aquasecurity/starboard/pull/603/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL3BsdWdpbi9wb2xhcmlzL3BsdWdpbi5nbw==) | `88.23% <75.00%> (-2.75%)` | :arrow_down: |
| [pkg/starboard/config.go](https://codecov.io/gh/aquasecurity/starboard/pull/603/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL3N0YXJib2FyZC9jb25maWcuZ28=) | `78.49% <100.00%> (+0.83%)` | :arrow_up: |
| [pkg/kubehunter/scanner.go](https://codecov.io/gh/aquasecurity/starboard/pull/603/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL2t1YmVodW50ZXIvc2Nhbm5lci5nbw==) | `0.00% <0.00%> (-80.51%)` | :arrow_down: |
| [pkg/vulnerabilityreport/scanner.go](https://codecov.io/gh/aquasecurity/starboard/pull/603/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL3Z1bG5lcmFiaWxpdHlyZXBvcnQvc2Nhbm5lci5nbw==) | `0.00% <0.00%> (-70.54%)` | :arrow_down: |
| ... and [36 more](https://codecov.io/gh/aquasecurity/starboard/pull/603/diff?src=pr&el=tree-more&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity) | |

------

[Continue to review full report at Codecov](https://codecov.io/gh/aquasecurity/starboard/pull/603?src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity).
> **Legend** - [Click here to learn more](https://docs.codecov.io/docs/codecov-delta?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity)
> `Δ = absolute <relative> (impact)`, `ø = not affected`, `? = missing data`
> Powered by [Codecov](https://codecov.io/gh/aquasecurity/starboard/pull/603?src=pr&el=footer&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity). Last update [fd93a8c...ec98f00](https://codecov.io/gh/aquasecurity/starboard/pull/603?src=pr&el=lastupdated&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity). Read the [comment docs](https://docs.codecov.io/docs/pull-request-comments?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity).


Patch:
diff --git a/deploy/helm/templates/config.yaml b/deploy/helm/templates/config.yaml
index f2cfef4..b265d58 100644
--- a/deploy/helm/templates/config.yaml
+++ b/deploy/helm/templates/config.yaml
@@ -25,12 +25,6 @@ data:
   {{- end }}
   {{- if .Values.operator.configAuditScannerEnabled }}
   configAuditReports.scanner: {{ .Values.operator.configAuditReportsPlugin | quote }}
-  {{- if eq .Values.operator.configAuditReportsPlugin "Polaris" }}
-  polaris.imageRef: "{{ .Values.polaris.imageRef }}"
-  {{- end }}
-  {{- if eq .Values.operator.configAuditReportsPlugin "Conftest" }}
-  conftest.imageRef: {{ .Values.conftest.imageRef | quote }}
-  {{- end }}
   {{- end }}
 {{- if eq .Values.operator.configAuditReportsPlugin "Conftest" }}
 ---
@@ -40,6 +34,8 @@ metadata:
   name: starboard-conftest-config
   labels:
     {{- include "starboard-operator.labels" . | nindent 4 }}
+data:
+  conftest.imageRef: {{ .Values.conftest.imageRef | quote }}
 {{- end }}
 {{- if eq .Values.operator.configAuditReportsPlugin "Polaris" }}
 ---
@@ -50,6 +46,7 @@ metadata:
   labels:
   {{- include "starboard-operator.labels" . | nindent 4 }}
 data:
+  polaris.imageRef: "{{ .Values.polaris.imageRef }}"
   polaris.config.yaml: |
   {{- toYaml .Values.polaris.config | nindent 4 }}
 {{- end }}
diff --git a/deploy/static/05-starboard-operator.config.yaml b/deploy/static/05-starboard-operator.config.yaml
index 3e07e5d..8ba4a50 100644
--- a/deploy/static/05-starboard-operator.config.yaml
+++ b/deploy/static/05-starboard-operator.config.yaml
@@ -11,8 +11,6 @@ data:
   trivy.imageRef: docker.io/aquasec/trivy:0.16.0
   trivy.mode: Standalone
   trivy.serverURL: http://trivy-server.trivy-server:4954
-  polaris.imageRef: quay.io/fairwinds/polaris:3.2
-  conftest.imageRef: openpolicyagent/conftest:v0.25.0
   kube-bench.imageRef: docker.io/aquasec/kube-bench:0.5.0
 ---
 apiVersion: v1
@@ -21,6 +19,7 @@ metadata:
   name: starboard-polaris-config
   namespace: starboard-operator
 data:
+  polaris.imageRef: quay.io/fairwinds/polaris:3.2
   polaris.config.yaml: |
     checks:
       # reliability
diff --git a/pkg/configauditreport/plugin.go b/pkg/configauditreport/plugin.go
index f866cd4..f9d1303 100644
--- a/pkg/configauditreport/plugin.go
+++ b/pkg/configauditreport/plugin.go
@@ -23,7 +23,7 @@ type Plugin interface {
 
 	// ParseConfigAuditReportData is a callback to parse and convert logs of
 	// the container in a pod controlled by the scan job to v1alpha1.ConfigAuditResult.
-	ParseConfigAuditReportData(logsReader io.ReadCloser) (v1alpha1.ConfigAuditResult, error)
+	ParseConfigAuditReportData(ctx starboard.PluginContext, logsReader io.ReadCloser) (v1alpha1.ConfigAuditResult, error)
 
 	// GetContainerName returns the name of the container in a pod created by a scan job
 	// to read logs from.
diff --git a/pkg/configauditreport/scanner.go b/pkg/configauditreport/scanner.go
index 7035ebb..1e12f14 100644
--- a/pkg/configauditreport/scanner.go
+++ b/pkg/configauditreport/scanner.go
@@ -101,7 +101,7 @@ func (s *Scanner) Scan(ctx context.Context, workload kube.Object) (v1alpha1.Conf
 		return v1alpha1.ConfigAuditReport{}, fmt.Errorf("getting logs: %w", err)
 	}
 
-	result, err := s.plugin.ParseConfigAuditReportData(logsStream)
+	result, err := s.plugin.ParseConfigAuditReportData(s.pluginContext, logsStream)
 	defer func() {
 		_ = logsStream.Close()
 	}()
diff --git a/pkg/operator/controller/configauditreport.go b/pkg/operator/controller/configauditreport.go
index f7768ab..55a761f 100644
--- a/pkg/operator/controller/configauditreport.go
+++ b/pkg/operator/controller/configauditreport.go
@@ -327,7 +327,7 @@ func (r *ConfigAuditReportReconciler) processCompleteScanJob(ctx context.Context
 		return fmt.Errorf("getting logs: %w", err)
 	}
 
-	result, err := r.Plugin.ParseConfigAuditReportData(logsStream)
+	result, err := r.Plugin.ParseConfigAuditReportData(r.PluginContext, logsStream)
 	defer func() {
 		_ = logsStream.Close()
 	}()
diff --git a/pkg/plugin/factory.go b/pkg/plugin/factory.go
index b5e4a34..10dd03a 100644
--- a/pkg/plugin/factory.go
+++ b/pkg/plugin/factory.go
@@ -51,14 +51,12 @@ func (r *Resolver) WithClient(client client.Client) *Resolver {
 	return r
 }
 
-// GetVulnerabilityPlugin is a factory method that instantiates the
-// vulnerabilityreport.Plugin for the specified starboard.ConfigData.
+// GetVulnerabilityPlugin is a factory method that instantiates the vulnerabilityreport.Plugin.
 //
 // Starboard currently supports Trivy scanner in Standalone and ClientServer
 // mode, and Aqua Enterprise scanner.
 //
-// You could add your own scanner by implementing the
-// vulnerabilityreport.Plugin interface.
+// You could add your own scanner by implementing the vulnerabilityreport.Plugin interface.
 func (r *Resolver) GetVulnerabilityPlugin() (vulnerabilityreport.Plugin, starboard.PluginContext, error) {
 	scanner, err := r.config.GetVulnerabilityReportsScanner()
 	if err != nil {
@@ -81,13 +79,11 @@ func (r *Resolver) GetVulnerabilityPlugin() (vulnerabilityreport.Plugin, starboa
 	return nil, nil, fmt.Errorf("unsupported vulnerability scanner plugin: %s", scanner)
 }
 
-// GetConfigAuditPlugin is a factory method that instantiates the
-// configauditreport.Plugin for the specified starboard.ConfigData.
+// GetConfigAuditPlugin is a factory method that instantiates the configauditreport.Plugin.
 //
-// Starboard supports Polaris as the only configuration auditing tool.
+// Starboard supports Polaris and Conftest as configuration auditing tools.
 //
-// You could add your own scanner by implementing the configauditreport.Plugin
-// interface.
+// You could add your own scanner by implementing the configauditreport.Plugin interface.
 func (r *Resolver) GetConfigAuditPlugin() (configauditreport.Plugin, starboard.PluginContext, error) {
 	scanner, err := r.config.GetConfigAuditReportsScanner()
 	if err != nil {
@@ -103,9 +99,9 @@ func (r *Resolver) GetConfigAuditPlugin() (configauditreport.Plugin, starboard.P
 
 	switch scanner {
 	case starboard.Polaris:
-		return polaris.NewPlugin(ext.NewSystemClock(), r.config), pluginContext, nil
+		return polaris.NewPlugin(ext.NewSystemClock()), pluginContext, nil
 	case starboard.Conftest:
-		return conftest.NewPlugin(ext.NewGoogleUUIDGenerator(), ext.NewSystemClock(), r.config), pluginContext, nil
+		return conftest.NewPlugin(ext.NewGoogleUUIDGenerator(), ext.NewSystemClock()), pluginContext, nil
 	}
 	return nil, nil, fmt.Errorf("unsupported configuration audit scanner plugin: %s", scanner)
 }
diff --git a/pkg/plugin/polaris/plugin.go b/pkg/plugin/polaris/plugin.go
index b8ddd67..3fe7767 100644
--- a/pkg/plugin/polaris/plugin.go
+++ b/pkg/plugin/polaris/plugin.go
@@ -22,21 +22,15 @@ const (
 	configVolume         = "config"
 )
 
-type Config interface {
-	GetPolarisImageRef() (string, error)
-}
-
 type plugin struct {
-	clock  ext.Clock
-	config Config
+	clock ext.Clock
 }
 
 // NewPlugin constructs a new configauditreport.Plugin, which is using an
 // official Polaris container image to audit Kubernetes workloads.
-func NewPlugin(clock ext.Clock, config Config) configauditreport.Plugin {
+func NewPlugin(clock ext.Clock) configauditreport.Plugin {
 	return &plugin{
-		clock:  clock,
-		config: config,
+		clock: clock,
 	}
 }
 
@@ -48,8 +42,16 @@ func (p *plugin) GetConfigHash(ctx starboard.PluginContext) (string, error) {
 	return kube.ComputeHash(cm.Data), nil
 }
 
+func (p *plugin) getImageRef(ctx starboard.PluginContext) (string, error) {
+	config, err := ctx.GetConfig()
+	if err != nil {
+		return "", err
+	}
+	return config.GetRequiredData("polaris.imageRef")
+}
+
 func (p *plugin) GetScanJobSpec(ctx starboard.PluginContext, obj client.Object) (corev1.PodSpec, []*corev1.Secret, error) {
-	imageRef, err := p.config.GetPolarisImageRef()
+	imageRef, err := p.getImageRef(ctx)
 	if err != nil {
 		return corev1.PodSpec{}, nil, err
 	}
@@ -117,13 +119,13 @@ func (p *plugin) GetContainerName() string {
 	return polarisContainerName
 }
 
-func (p *plugin) ParseConfigAuditReportData(logsReader io.ReadCloser) (v1alpha1.ConfigAuditResult, error) {
+func (p *plugin) ParseConfigAuditReportData(ctx starboard.PluginContext, logsReader io.ReadCloser) (v1alpha1.ConfigAuditResult, error) {
 	var report Report
 	err := json.NewDecoder(logsReader).Decode(&report)
 	if err != nil {
 		return v1alpha1.ConfigAuditResult{}, err
 	}
-	return p.configAuditResultFrom(report.Results[0])
+	return p.configAuditResultFrom(ctx, report.Results[0])
 }
 
 func (p *plugin) sourceNameFrom(obj client.Object) string {
@@ -141,7 +143,7 @@ func (p *plugin) sourceNameFrom(obj client.Object) string {
 	)
 }
 
-func (p *plugin) configAuditResultFrom(result Result) (v1alpha1.ConfigAuditResult, error) {
+func (p *plugin) configAuditResultFrom(ctx starboard.PluginContext, result Result) (v1alpha1.ConfigAuditResult, error) {
 	var podChecks []v1alpha1.Check
 	containerChecks := make(map[string][]v1alpha1.Check)
 
@@ -170,7 +172,7 @@ func (p *plugin) configAuditResultFrom(result Result) (v1alpha1.ConfigAuditResul
 		containerChecks[cr.Name] = checks
 	}
 
-	imageRef, err := p.config.GetPolarisImageRef()
+	imageRef, err := p.getImageRef(ctx)
 	if err != nil {
 		return v1alpha1.ConfigAuditResult{}, err
 	}
diff --git a/pkg/starboard/config.go b/pkg/starboard/config.go
index 2f0c59c..05617af 100644
--- a/pkg/starboard/config.go
+++ b/pkg/starboard/config.go
@@ -278,23 +278,22 @@ func GetDefaultConfig() ConfigData {
 		"kube-bench.imageRef":  "docker.io/aquasec/kube-bench:0.5.0",
 		"kube-hunter.imageRef": "docker.io/aquasec/kube-hunter:0.4.1",
 		"kube-hunter.quick":    "false",
-
-		"polaris.imageRef": "quay.io/fairwinds/polaris:3.2",
-
-		"conftest.imageRef": "openpolicyagent/conftest:v0.25.0",
 	}
 }
 
 // GetDefaultPolarisConfig returns the default Polaris configuration.
 func GetDefaultPolarisConfig() map[string]string {
 	return map[string]string{
+		"polaris.imageRef":    "quay.io/fairwinds/polaris:3.2",
 		"polaris.config.yaml": polarisConfigYAML,
 	}
 }
 
-// GetDefaultConftestConfig return the defautl Conftest configuration.
+// GetDefaultConftestConfig return the default Conftest configuration.
 func GetDefaultConftestConfig() map[string]string {
-	return map[string]string{}
+	return map[string]string{
+		"conftest.imageRef": "openpolicyagent/conftest:v0.25.0",
+	}
 }
 
 func (c ConfigData) GetScanJobTolerations() ([]corev1.Toleration, error) {
@@ -427,14 +426,6 @@ func (c ConfigData) GetKubeHunterQuick() (bool, error) {
 	return val == "true", nil
 }
 
-func (c ConfigData) GetPolarisImageRef() (string, error) {
-	return c.getRequiredProperty("polaris.imageRef")
-}
-
-func (c ConfigData) GetConftestImageRef() (string, error) {
-	return c.getRequiredProperty("conftest.imageRef")
-}
-
 func (c ConfigData) getRequiredProperty(key string) (string, error) {
 	var ok bool
 	var value string
diff --git a/pkg/starboard/plugin.go b/pkg/starboard/plugin.go
index ced8c9c..2d7abf6 100644
--- a/pkg/starboard/plugin.go
+++ b/pkg/starboard/plugin.go
@@ -17,6 +17,15 @@ type PluginConfig struct {
 	SecretData map[string][]byte
 }
 
+func (c PluginConfig) GetRequiredData(key string) (string, error) {
+	var ok bool
+	var value string
+	if value, ok = c.Data[key]; !ok {
+		return "", fmt.Errorf("property %s not set", key)
+	}
+	return value, nil
+}
+
 // PluginContext is plugin's execution context within the Starboard toolkit.
 // The context is used to grant access to other methods so that this plugin
 // can interact with the toolkit.


Test patch:
diff --git a/docs/integrations/config-checkers/conftest.md b/docs/integrations/config-checkers/conftest.md
index 3d641a0..943f0db 100644
--- a/docs/integrations/config-checkers/conftest.md
+++ b/docs/integrations/config-checkers/conftest.md
@@ -58,6 +58,7 @@ As an example, let's create the `starboard-conftest-config` ConfigMap with [file
 
 ```
 kubectl create configmap starboard-conftest-config -n <starboard_namespace> \
+  --from-literal=conftest.imageRef=openpolicyagent/conftest:v0.25.0 \
   --from-file=conftest.policy.kubernetes.rego=kubernetes/lib/kubernetes.rego \
   --from-file=conftest.policy.utils.rego=kubernetes/lib/utils.rego \
   --from-file=conftest.policy.file_system_not_read_only.rego=kubernetes/policies/general/file_system_not_read_only.rego \
diff --git a/itest/starboard-operator/configauditreport/conftest/suite_test.go b/itest/starboard-operator/configauditreport/conftest/suite_test.go
index 27f049b..131b802 100644
--- a/itest/starboard-operator/configauditreport/conftest/suite_test.go
+++ b/itest/starboard-operator/configauditreport/conftest/suite_test.go
@@ -106,6 +106,8 @@ var _ = BeforeSuite(func() {
 			Name:      starboard.GetPluginConfigMapName("Conftest"),
 		},
 		Data: map[string]string{
+			"conftest.imageRef": "docker.io/openpolicyagent/conftest:v0.25.0",
+
 			"conftest.policy.runs_as_root.rego": runAsRootPolicy,
 		},
 	}
diff --git a/itest/starboard/suite_test.go b/itest/starboard/suite_test.go
index 8c6f196..533b75e 100644
--- a/itest/starboard/suite_test.go
+++ b/itest/starboard/suite_test.go
@@ -42,6 +42,7 @@ var (
 			Namespace: "starboard",
 		},
 		Data: map[string]string{
+			"conftest.imageRef": "docker.io/openpolicyagent/conftest:v0.25.0",
 			"conftest.policy.runs_as_root.rego": `
 	package main
     
diff --git a/pkg/configauditreport/builder_test.go b/pkg/configauditreport/builder_test.go
index 4e83f31..3b6b897 100644
--- a/pkg/configauditreport/builder_test.go
+++ b/pkg/configauditreport/builder_test.go
@@ -68,7 +68,7 @@ func (p *testPlugin) GetScanJobSpec(ctx starboard.PluginContext, obj client.Obje
 	return corev1.PodSpec{}, nil, nil
 }
 
-func (p *testPlugin) ParseConfigAuditReportData(logsReader io.ReadCloser) (v1alpha1.ConfigAuditResult, error) {
+func (p *testPlugin) ParseConfigAuditReportData(ctx starboard.PluginContext, logsReader io.ReadCloser) (v1alpha1.ConfigAuditResult, error) {
 	return v1alpha1.ConfigAuditResult{}, nil
 }
 
diff --git a/pkg/plugin/conftest/plugin.go b/pkg/plugin/conftest/plugin.go
index bf43651..25bc47a 100644
--- a/pkg/plugin/conftest/plugin.go
+++ b/pkg/plugin/conftest/plugin.go
@@ -26,23 +26,17 @@ const (
 	defaultCheckCategory  = "Security"
 )
 
-type Config interface {
-	GetConftestImageRef() (string, error)
-}
-
 type plugin struct {
 	idGenerator ext.IDGenerator
 	clock       ext.Clock
-	config      Config
 }
 
 // NewPlugin constructs a new configauditreport.Plugin, which is using
 // the upstream Conftest container image to audit K8s workloads.
-func NewPlugin(idGenerator ext.IDGenerator, clock ext.Clock, config Config) configauditreport.Plugin {
+func NewPlugin(idGenerator ext.IDGenerator, clock ext.Clock) configauditreport.Plugin {
 	return &plugin{
 		idGenerator: idGenerator,
 		clock:       clock,
-		config:      config,
 	}
 }
 
@@ -55,7 +49,7 @@ func (p *plugin) GetConfigHash(ctx starboard.PluginContext) (string, error) {
 }
 
 func (p *plugin) GetScanJobSpec(ctx starboard.PluginContext, obj client.Object) (corev1.PodSpec, []*corev1.Secret, error) {
-	imageRef, err := p.config.GetConftestImageRef()
+	imageRef, err := p.getImageRef(ctx)
 	if err != nil {
 		return corev1.PodSpec{}, nil, fmt.Errorf("getting image reference: %w", err)
 	}
@@ -194,7 +188,7 @@ func (p *plugin) GetContainerName() string {
 	return conftestContainerName
 }
 
-func (p *plugin) ParseConfigAuditReportData(logsReader io.ReadCloser) (v1alpha1.ConfigAuditResult, error) {
+func (p *plugin) ParseConfigAuditReportData(ctx starboard.PluginContext, logsReader io.ReadCloser) (v1alpha1.ConfigAuditResult, error) {
 	var checkResults []CheckResult
 	err := json.NewDecoder(logsReader).Decode(&checkResults)
 
@@ -229,7 +223,7 @@ func (p *plugin) ParseConfigAuditReportData(logsReader io.ReadCloser) (v1alpha1.
 		}
 	}
 
-	imageRef, err := p.config.GetConftestImageRef()
+	imageRef, err := p.getImageRef(ctx)
 	if err != nil {
 		return v1alpha1.ConfigAuditResult{}, err
 	}
@@ -263,3 +257,11 @@ func (p *plugin) getPolicyTitleFromResult(result Result) string {
 	// Fallback to a unique identifier
 	return p.idGenerator.GenerateID()
 }
+
+func (p *plugin) getImageRef(ctx starboard.PluginContext) (string, error) {
+	config, err := ctx.GetConfig()
+	if err != nil {
+		return "", err
+	}
+	return config.GetRequiredData("conftest.imageRef")
+}
diff --git a/pkg/plugin/conftest/plugin_test.go b/pkg/plugin/conftest/plugin_test.go
index 59f4ecc..4b32cdb 100644
--- a/pkg/plugin/conftest/plugin_test.go
+++ b/pkg/plugin/conftest/plugin_test.go
@@ -28,9 +28,6 @@ var (
 func TestPlugin_GetScanJobSpec(t *testing.T) {
 	g := NewGomegaWithT(t)
 	sequence := ext.NewSimpleIDGenerator()
-	config := starboard.ConfigData{
-		"conftest.imageRef": "openpolicyagent/conftest:v0.23.0",
-	}
 	pluginContext := starboard.NewPluginContext().
 		WithName(string(starboard.Conftest)).
 		WithNamespace("starboard-ns").
@@ -41,18 +38,21 @@ func TestPlugin_GetScanJobSpec(t *testing.T) {
 				Namespace: "starboard-ns",
 			},
 			Data: map[string]string{
+				"conftest.imageRef": "openpolicyagent/conftest:v0.23.0",
+
 				"conftest.policy.libkubernetes.rego":      "<REGO>",
 				"conftest.policy.libutil.rego":            "<REGO>",
 				"conftest.policy.access_to_host_pid.rego": "<REGO>",
 				"conftest.policy.cpu_not_limited.rego":    "<REGO>",
-				"foo":                                     "bar",    // This one should be skipped (no conftest.policy. prefix)
 				"conftest.policy.privileged":              "<REGO>", // This one should be skipped (no .rego suffix)
+
+				"foo": "bar", // This one should be skipped (no conftest.policy. prefix)
 			},
 		}).Build()).Get()
 
-	plugin := conftest.NewPlugin(sequence, fixedClock, config)
+	instance := conftest.NewPlugin(sequence, fixedClock)
 
-	jobSpec, secrets, err := plugin.GetScanJobSpec(pluginContext, &corev1.Pod{
+	jobSpec, secrets, err := instance.GetScanJobSpec(pluginContext, &corev1.Pod{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      "nginx",
 			Namespace: "default",
@@ -202,10 +202,7 @@ status: {}
 
 func TestPlugin_ParseConfigAuditReportData(t *testing.T) {
 	g := NewGomegaWithT(t)
-	config := starboard.ConfigData{
-		"conftest.imageRef": "openpolicyagent/conftest:v0.23.0",
-	}
-	plugin := conftest.NewPlugin(ext.NewSimpleIDGenerator(), fixedClock, config)
+	plugin := conftest.NewPlugin(ext.NewSimpleIDGenerator(), fixedClock)
 	logsReader := ioutil.NopCloser(strings.NewReader(`[
   {
     "filename": "/project/workload.yaml",
@@ -273,7 +270,22 @@ func TestPlugin_ParseConfigAuditReportData(t *testing.T) {
   }
 ]`))
 
-	data, err := plugin.ParseConfigAuditReportData(logsReader)
+	pluginContext := starboard.NewPluginContext().
+		WithName(string(starboard.Conftest)).
+		WithNamespace("starboard-ns").
+		WithServiceAccountName("starboard-sa").
+		WithClient(fake.NewClientBuilder().WithObjects(&corev1.ConfigMap{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:      "starboard-conftest-config",
+				Namespace: "starboard-ns",
+			},
+			Data: map[string]string{
+				"conftest.imageRef": "openpolicyagent/conftest:v0.25.0",
+			},
+		}).Build()).
+		Get()
+
+	data, err := plugin.ParseConfigAuditReportData(pluginContext, logsReader)
 
 	// When Conftest plugin is used with https://github.com/aquasecurity/appshield
 	// Rego scripts the Check.ID is not unique. For example, for a Pod with multiple
@@ -289,7 +301,7 @@ func TestPlugin_ParseConfigAuditReportData(t *testing.T) {
 		"Scanner": Equal(v1alpha1.Scanner{
 			Name:    "Conftest",
 			Vendor:  "Open Policy Agent",
-			Version: "v0.23.0",
+			Version: "v0.25.0",
 		}),
 		"Summary": Equal(v1alpha1.ConfigAuditSummary{
 			DangerCount:  6,
@@ -379,7 +391,7 @@ func TestPlugin_GetConfigHash(t *testing.T) {
 			"foo":   "baz",
 		})
 
-		plugin := conftest.NewPlugin(ext.NewSimpleIDGenerator(), fixedClock, starboard.ConfigData{})
+		plugin := conftest.NewPlugin(ext.NewSimpleIDGenerator(), fixedClock)
 		hash1, err := plugin.GetConfigHash(pluginContext1)
 		g.Expect(err).ToNot(HaveOccurred())
 
@@ -400,7 +412,7 @@ func TestPlugin_GetConfigHash(t *testing.T) {
 			"foo":   "bar",
 		})
 
-		plugin := conftest.NewPlugin(ext.NewSimpleIDGenerator(), fixedClock, starboard.ConfigData{})
+		plugin := conftest.NewPlugin(ext.NewSimpleIDGenerator(), fixedClock)
 		hash1, err := plugin.GetConfigHash(pluginContext1)
 		g.Expect(err).ToNot(HaveOccurred())
 
@@ -413,6 +425,6 @@ func TestPlugin_GetConfigHash(t *testing.T) {
 func TestPlugin_GetContainerName(t *testing.T) {
 	g := NewGomegaWithT(t)
 
-	plugin := conftest.NewPlugin(ext.NewSimpleIDGenerator(), fixedClock, starboard.ConfigData{})
+	plugin := conftest.NewPlugin(ext.NewSimpleIDGenerator(), fixedClock)
 	g.Expect(plugin.GetContainerName()).To(Equal("conftest"))
 }
diff --git a/pkg/plugin/polaris/plugin_test.go b/pkg/plugin/polaris/plugin_test.go
index 9f50c3d..07eb78c 100644
--- a/pkg/plugin/polaris/plugin_test.go
+++ b/pkg/plugin/polaris/plugin_test.go
@@ -28,14 +28,14 @@ func TestPlugin_GetScanJobSpec(t *testing.T) {
 	testCases := []struct {
 		name string
 
-		config starboard.ConfigData
+		config map[string]string
 		obj    client.Object
 
 		expectedJobSpec corev1.PodSpec
 	}{
 		{
 			name: "Should return job spec for Deployment",
-			config: starboard.ConfigData{
+			config: map[string]string{
 				"polaris.imageRef": "quay.io/fairwinds/polaris:3.2",
 			},
 			obj: &appsv1.Deployment{
@@ -49,7 +49,7 @@ func TestPlugin_GetScanJobSpec(t *testing.T) {
 				},
 			},
 			expectedJobSpec: corev1.PodSpec{
-				ServiceAccountName:           starboard.ServiceAccountName,
+				ServiceAccountName:           "starboard-sa",
 				AutomountServiceAccountToken: pointer.BoolPtr(true),
 				RestartPolicy:                corev1.RestartPolicyNever,
 				Affinity:                     starboard.LinuxNodeAffinity(),
@@ -113,11 +113,18 @@ func TestPlugin_GetScanJobSpec(t *testing.T) {
 
 			pluginContext := starboard.NewPluginContext().
 				WithName(string(starboard.Polaris)).
-				WithNamespace(starboard.NamespaceName).
-				WithServiceAccountName(starboard.ServiceAccountName).
-				Get()
-			plugin := polaris.NewPlugin(fixedClock, tc.config)
-			jobSpec, secrets, err := plugin.GetScanJobSpec(pluginContext, tc.obj)
+				WithNamespace("starboard-ns").
+				WithServiceAccountName("starboard-sa").
+				WithClient(fake.NewClientBuilder().WithObjects(&corev1.ConfigMap{
+					ObjectMeta: metav1.ObjectMeta{
+						Name:      "starboard-polaris-config",
+						Namespace: "starboard-ns",
+					},
+					Data: tc.config,
+				}).Build()).Get()
+
+			instance := polaris.NewPlugin(fixedClock)
+			jobSpec, secrets, err := instance.GetScanJobSpec(pluginContext, tc.obj)
 
 			g.Expect(err).ToNot(gomega.HaveOccurred())
 			g.Expect(secrets).To(gomega.BeNil())
@@ -129,7 +136,7 @@ func TestPlugin_GetScanJobSpec(t *testing.T) {
 
 func TestPlugin_GetContainerName(t *testing.T) {
 	g := gomega.NewGomegaWithT(t)
-	plugin := polaris.NewPlugin(fixedClock, starboard.ConfigData{})
+	plugin := polaris.NewPlugin(fixedClock)
 	g.Expect(plugin.GetContainerName()).To(gomega.Equal("polaris"))
 }
 
@@ -141,11 +148,23 @@ func TestPlugin_ParseConfigAuditReportData(t *testing.T) {
 		_ = testReport.Close()
 	}()
 
-	config := starboard.ConfigData{
-		"polaris.imageRef": "quay.io/fairwinds/polaris:3.2",
-	}
-	plugin := polaris.NewPlugin(fixedClock, config)
-	result, err := plugin.ParseConfigAuditReportData(testReport)
+	pluginContext := starboard.NewPluginContext().
+		WithName(string(starboard.Polaris)).
+		WithNamespace("starboard-ns").
+		WithServiceAccountName("starboard-sa").
+		WithClient(fake.NewClientBuilder().WithObjects(&corev1.ConfigMap{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:      "starboard-polaris-config",
+				Namespace: "starboard-ns",
+			},
+			Data: map[string]string{
+				"polaris.imageRef": "quay.io/fairwinds/polaris:3.2",
+			},
+		}).Build()).
+		Get()
+
+	plugin := polaris.NewPlugin(fixedClock)
+	result, err := plugin.ParseConfigAuditReportData(pluginContext, testReport)
 	g.Expect(err).ToNot(gomega.HaveOccurred())
 	g.Expect(result.UpdateTimestamp).To(gomega.Equal(metav1.NewTime(fixedTime)))
 	g.Expect(result.Scanner).To(gomega.Equal(v1alpha1.Scanner{
@@ -217,7 +236,7 @@ func TestPlugin_GetConfigHash(t *testing.T) {
 			"foo":   "baz",
 		})
 
-		plugin := polaris.NewPlugin(fixedClock, starboard.ConfigData{})
+		plugin := polaris.NewPlugin(fixedClock)
 		hash1, err := plugin.GetConfigHash(pluginContext1)
 		g.Expect(err).ToNot(gomega.HaveOccurred())
 
@@ -238,7 +257,7 @@ func TestPlugin_GetConfigHash(t *testing.T) {
 			"foo":   "bar",
 		})
 
-		plugin := polaris.NewPlugin(fixedClock, starboard.ConfigData{})
+		plugin := polaris.NewPlugin(fixedClock)
 		hash1, err := plugin.GetConfigHash(pluginContext1)
 		g.Expect(err).ToNot(gomega.HaveOccurred())
 
diff --git a/pkg/starboard/config_test.go b/pkg/starboard/config_test.go
index 07c5f8f..8c4e11e 100644
--- a/pkg/starboard/config_test.go
+++ b/pkg/starboard/config_test.go
@@ -517,7 +517,9 @@ func TestConfigManager_EnsureDefault(t *testing.T) {
 		pluginConfig, err := clientset.CoreV1().ConfigMaps(namespace).
 			Get(context.TODO(), starboard.GetPluginConfigMapName(string(starboard.Conftest)), metav1.GetOptions{})
 		g.Expect(err).ToNot(gomega.HaveOccurred())
-		g.Expect(pluginConfig.Data).To(gomega.BeEmpty())
+		g.Expect(pluginConfig.Data).To(gomega.Equal(map[string]string{
+			"conftest.imageRef": "openpolicyagent/conftest:v0.25.0",
+		}))
 
 		_, err = clientset.CoreV1().ConfigMaps(namespace).
 			Get(context.TODO(), starboard.GetPluginConfigMapName(string(starboard.Polaris)), metav1.GetOptions{})