Repository: aquasecurity/starboard
Pull request #931 (2022-01-25 16:02:03)

chore(deps): bump Trivy from v0.20.0 to v0.22.0
Signed-off-by: Daniel Pacak <pacak.daniel@gmail.com>

codecov[bot]: # [Codecov](https://codecov.io/gh/aquasecurity/starboard/pull/931?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity) Report
> Merging [#931](https://codecov.io/gh/aquasecurity/starboard/pull/931?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity) (7a1016e) into [main](https://codecov.io/gh/aquasecurity/starboard/commit/329c812192eae2a7ec6170ac5a4939b50b018763?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity) (329c812) will **decrease** coverage by `18.45%`.
> The diff coverage is `100.00%`.

[![Impacted file tree graph](https://codecov.io/gh/aquasecurity/starboard/pull/931/graphs/tree.svg?width=650&height=150&src=pr&token=qqTGKAJ0Wb&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity)](https://codecov.io/gh/aquasecurity/starboard/pull/931?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity)

```diff
@@             Coverage Diff             @@
##             main     #931       +/-   ##
===========================================
- Coverage   64.72%   46.27%   -18.46%     
===========================================
  Files          59       42       -17     
  Lines        6982     5792     -1190     
===========================================
- Hits         4519     2680     -1839     
- Misses       2003     2948      +945     
+ Partials      460      164      -296     
```


| [Impacted Files](https://codecov.io/gh/aquasecurity/starboard/pull/931?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity) | Coverage Δ | |
|---|---|---|
| [itest/matcher/matcher.go](https://codecov.io/gh/aquasecurity/starboard/pull/931/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-aXRlc3QvbWF0Y2hlci9tYXRjaGVyLmdv) | `74.16% <ø> (ø)` | |
| [pkg/plugin/trivy/plugin.go](https://codecov.io/gh/aquasecurity/starboard/pull/931/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL3BsdWdpbi90cml2eS9wbHVnaW4uZ28=) | `80.20% <100.00%> (-0.58%)` | :arrow_down: |
| [pkg/plugin/factory.go](https://codecov.io/gh/aquasecurity/starboard/pull/931/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL3BsdWdpbi9mYWN0b3J5Lmdv) | `0.00% <0.00%> (-81.14%)` | :arrow_down: |
| [pkg/kubehunter/scanner.go](https://codecov.io/gh/aquasecurity/starboard/pull/931/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL2t1YmVodW50ZXIvc2Nhbm5lci5nbw==) | `0.00% <0.00%> (-74.49%)` | :arrow_down: |
| [pkg/operator/controller/configauditreport.go](https://codecov.io/gh/aquasecurity/starboard/pull/931/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL29wZXJhdG9yL2NvbnRyb2xsZXIvY29uZmlnYXVkaXRyZXBvcnQuZ28=) | `0.00% <0.00%> (-65.51%)` | :arrow_down: |
| [pkg/kube/runnable\_job.go](https://codecov.io/gh/aquasecurity/starboard/pull/931/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL2t1YmUvcnVubmFibGVfam9iLmdv) | `0.00% <0.00%> (-63.73%)` | :arrow_down: |
| [pkg/kubehunter/model.go](https://codecov.io/gh/aquasecurity/starboard/pull/931/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL2t1YmVodW50ZXIvbW9kZWwuZ28=) | `0.00% <0.00%> (-62.86%)` | :arrow_down: |
| [pkg/operator/controller/vulnerabilityreport.go](https://codecov.io/gh/aquasecurity/starboard/pull/931/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL29wZXJhdG9yL2NvbnRyb2xsZXIvdnVsbmVyYWJpbGl0eXJlcG9ydC5nbw==) | `0.00% <0.00%> (-59.69%)` | :arrow_down: |
| [pkg/vulnerabilityreport/scanner.go](https://codecov.io/gh/aquasecurity/starboard/pull/931/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL3Z1bG5lcmFiaWxpdHlyZXBvcnQvc2Nhbm5lci5nbw==) | `0.00% <0.00%> (-59.44%)` | :arrow_down: |
| [pkg/operator/controller/ciskubebenchreport.go](https://codecov.io/gh/aquasecurity/starboard/pull/931/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL29wZXJhdG9yL2NvbnRyb2xsZXIvY2lza3ViZWJlbmNocmVwb3J0Lmdv) | `0.00% <0.00%> (-55.70%)` | :arrow_down: |
| ... and [32 more](https://codecov.io/gh/aquasecurity/starboard/pull/931/diff?src=pr&el=tree-more&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity) | |

------

[Continue to review full report at Codecov](https://codecov.io/gh/aquasecurity/starboard/pull/931?src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity).
> **Legend** - [Click here to learn more](https://docs.codecov.io/docs/codecov-delta?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity)
> `Δ = absolute <relative> (impact)`, `ø = not affected`, `? = missing data`
> Powered by [Codecov](https://codecov.io/gh/aquasecurity/starboard/pull/931?src=pr&el=footer&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity). Last update [329c812...7a1016e](https://codecov.io/gh/aquasecurity/starboard/pull/931?src=pr&el=lastupdated&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity). Read the [comment docs](https://docs.codecov.io/docs/pull-request-comments?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity).


Patch:
diff --git a/deploy/helm/values.yaml b/deploy/helm/values.yaml
index 1fe08fa..aa30338 100644
--- a/deploy/helm/values.yaml
+++ b/deploy/helm/values.yaml
@@ -92,7 +92,7 @@ trivy:
   createConfig: true
 
   # imageRef the Trivy image reference.
-  imageRef: docker.io/aquasec/trivy:0.20.0
+  imageRef: docker.io/aquasec/trivy:0.22.0
 
   # mode is the Trivy client mode. Either Standalone or ClientServer. Depending
   # on the active mode other settings might be applicable or required.
diff --git a/deploy/static/03-starboard-operator.config.yaml b/deploy/static/03-starboard-operator.config.yaml
index 6a01485..2202c1a 100644
--- a/deploy/static/03-starboard-operator.config.yaml
+++ b/deploy/static/03-starboard-operator.config.yaml
@@ -47,7 +47,7 @@ metadata:
     app.kubernetes.io/version: "0.14.0"
     app.kubernetes.io/managed-by: kubectl
 data:
-  trivy.imageRef: "docker.io/aquasec/trivy:0.20.0"
+  trivy.imageRef: "docker.io/aquasec/trivy:0.22.0"
   trivy.mode: "Standalone"
   trivy.severity: "UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL"
   trivy.resources.requests.cpu: 100m
diff --git a/docs/integrations/vulnerability-scanners/trivy.md b/docs/integrations/vulnerability-scanners/trivy.md
index 46332c2..cf4d651 100644
--- a/docs/integrations/vulnerability-scanners/trivy.md
+++ b/docs/integrations/vulnerability-scanners/trivy.md
@@ -80,33 +80,33 @@ EOF
 
 ## Settings
 
-| CONFIGMAP KEY                     | DEFAULT                            | DESCRIPTION |
-| --------------------------------- | ---------------------------------- | ----------- |
-| `trivy.imageRef`                  | `docker.io/aquasec/trivy:0.20.0`   | Trivy image reference |
-| `trivy.mode`                      | `Standalone`                       | Trivy client mode. Either `Standalone` or `ClientServer`. Depending on the active mode other settings might be applicable or required. |
-| `trivy.severity`                  | `UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL` | A comma separated list of severity levels reported by Trivy |
-| `trivy.ignoreUnfixed`             | N/A                                | Whether to show only fixed vulnerabilities in vulnerabilities reported by Trivy. Set to `"true"` to enable it. |
-| `trivy.skipFiles`                 | N/A                                | A comma separated list of file paths for Trivy to skip traversal. |
-| `trivy.skipDirs`                  | N/A                                | A comma separated list of directories for Trivy to skip traversal. |
-| `trivy.ignoreFile`                | N/A                                | It specifies the `.trivyignore` file which contains a list of vulnerability IDs to be ignored from vulnerabilities reported by Trivy. |
-| `trivy.serverURL`                 | N/A                                | The endpoint URL of the Trivy server. Required in `ClientServer` mode. |
-| `trivy.serverTokenHeader`         | `Trivy-Token`                      | The name of the HTTP header to send the authentication token to Trivy server. Only application in `ClientServer` mode when `trivy.serverToken` is specified. |
-| `trivy.insecureRegistry.<id>`     | N/A                                | The registry to which insecure connections are allowed. There can be multiple registries with different registry `<id>`. |
-| `trivy.nonSslRegistry.<id>`       | N/A                                | A registry without SSL. There can be multiple registries with different registry `<id>`. |
-| `trivy.registry.mirror.<registry>`| N/A                                | Mirror for the registry `<registry>`, e.g. `trivy.registry.mirror.index.docker.io: mirror.io` would use `mirror.io` to get images originated from `index.docker.io` |
-| `trivy.httpProxy`                 | N/A                                | The HTTP proxy used by Trivy to download the vulnerabilities database from GitHub. |
-| `trivy.httpsProxy`                | N/A                                | The HTTPS proxy used by Trivy to download the vulnerabilities database from GitHub. |
-| `trivy.noProxy`                   | N/A                                | A comma separated list of IPs and domain names that are not subject to proxy settings. |
-| `trivy.resources.requests.cpu`    | `100m`                             | The minimum amount of CPU required to run Trivy scanner pod. |
-| `trivy.resources.requests.memory` | `100M`                             | The minimum amount of memory required to run Trivy scanner pod. |
-| `trivy.resources.limits.cpu`      | `500m`                             | The maximum amount of CPU allowed to run Trivy scanner pod. |
-| `trivy.resources.limits.memory`   | `500M`                             | The maximum amount of memory allowed to run Trivy scanner pod. |
-
-| SECRET KEY                  | DESCRIPTION |
-| --------------------------- | ----------- |
+| CONFIGMAP KEY                      | DEFAULT                            | DESCRIPTION                                                                                                                                                         |
+|------------------------------------|------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| `trivy.imageRef`                   | `docker.io/aquasec/trivy:0.22.0`   | Trivy image reference                                                                                                                                               |
+| `trivy.mode`                       | `Standalone`                       | Trivy client mode. Either `Standalone` or `ClientServer`. Depending on the active mode other settings might be applicable or required.                              |
+| `trivy.severity`                   | `UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL` | A comma separated list of severity levels reported by Trivy                                                                                                         |
+| `trivy.ignoreUnfixed`              | N/A                                | Whether to show only fixed vulnerabilities in vulnerabilities reported by Trivy. Set to `"true"` to enable it.                                                      |
+| `trivy.skipFiles`                  | N/A                                | A comma separated list of file paths for Trivy to skip traversal.                                                                                                   |
+| `trivy.skipDirs`                   | N/A                                | A comma separated list of directories for Trivy to skip traversal.                                                                                                  |
+| `trivy.ignoreFile`                 | N/A                                | It specifies the `.trivyignore` file which contains a list of vulnerability IDs to be ignored from vulnerabilities reported by Trivy.                               |
+| `trivy.serverURL`                  | N/A                                | The endpoint URL of the Trivy server. Required in `ClientServer` mode.                                                                                              |
+| `trivy.serverTokenHeader`          | `Trivy-Token`                      | The name of the HTTP header to send the authentication token to Trivy server. Only application in `ClientServer` mode when `trivy.serverToken` is specified.        |
+| `trivy.insecureRegistry.<id>`      | N/A                                | The registry to which insecure connections are allowed. There can be multiple registries with different registry `<id>`.                                            |
+| `trivy.nonSslRegistry.<id>`        | N/A                                | A registry without SSL. There can be multiple registries with different registry `<id>`.                                                                            |
+| `trivy.registry.mirror.<registry>` | N/A                                | Mirror for the registry `<registry>`, e.g. `trivy.registry.mirror.index.docker.io: mirror.io` would use `mirror.io` to get images originated from `index.docker.io` |
+| `trivy.httpProxy`                  | N/A                                | The HTTP proxy used by Trivy to download the vulnerabilities database from GitHub.                                                                                  |
+| `trivy.httpsProxy`                 | N/A                                | The HTTPS proxy used by Trivy to download the vulnerabilities database from GitHub.                                                                                 |
+| `trivy.noProxy`                    | N/A                                | A comma separated list of IPs and domain names that are not subject to proxy settings.                                                                              |
+| `trivy.resources.requests.cpu`     | `100m`                             | The minimum amount of CPU required to run Trivy scanner pod.                                                                                                        |
+| `trivy.resources.requests.memory`  | `100M`                             | The minimum amount of memory required to run Trivy scanner pod.                                                                                                     |
+| `trivy.resources.limits.cpu`       | `500m`                             | The maximum amount of CPU allowed to run Trivy scanner pod.                                                                                                         |
+| `trivy.resources.limits.memory`    | `500M`                             | The maximum amount of memory allowed to run Trivy scanner pod.                                                                                                      |
+
+| SECRET KEY                  | DESCRIPTION                                                                                                                       |
+|-----------------------------|-----------------------------------------------------------------------------------------------------------------------------------|
 | `trivy.githubToken`         | The GitHub access token used by Trivy to download the vulnerabilities database from GitHub. Only applicable in `Standalone` mode. |
-| `trivy.serverToken`         | The token to authenticate Trivy client with Trivy server. Only applicable in `ClientServer` mode. |
-| `trivy.serverCustomHeaders` | A comma separated list of custom HTTP headers sent by Trivy client to Trivy server. Only applicable in `ClientServer` mode. |
+| `trivy.serverToken`         | The token to authenticate Trivy client with Trivy server. Only applicable in `ClientServer` mode.                                 |
+| `trivy.serverCustomHeaders` | A comma separated list of custom HTTP headers sent by Trivy client to Trivy server. Only applicable in `ClientServer` mode.       |
 
 [trivy-standalone]: https://aquasecurity.github.io/trivy/latest/modes/standalone/
 [emptyDir-volume]: https://kubernetes.io/docs/concepts/storage/volumes/#emptydir
diff --git a/pkg/plugin/trivy/plugin.go b/pkg/plugin/trivy/plugin.go
index 911c02d..c657ffd 100644
--- a/pkg/plugin/trivy/plugin.go
+++ b/pkg/plugin/trivy/plugin.go
@@ -229,7 +229,7 @@ func NewPlugin(clock ext.Clock, idGenerator ext.IDGenerator, client client.Clien
 func (p *plugin) Init(ctx starboard.PluginContext) error {
 	return ctx.EnsureConfig(starboard.PluginConfig{
 		Data: map[string]string{
-			keyTrivyImageRef: "docker.io/aquasec/trivy:0.20.0",
+			keyTrivyImageRef: "docker.io/aquasec/trivy:0.22.0",
 			keyTrivySeverity: "UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL",
 			keyTrivyMode:     string(Standalone),
 


Test patch:
diff --git a/itest/matcher/matcher.go b/itest/matcher/matcher.go
index 0401bf9..eef08df 100644
--- a/itest/matcher/matcher.go
+++ b/itest/matcher/matcher.go
@@ -21,7 +21,7 @@ var (
 	trivyScanner = v1alpha1.Scanner{
 		Name:    "Trivy",
 		Vendor:  "Aqua Security",
-		Version: "0.20.0",
+		Version: "0.22.0",
 	}
 	polarisScanner = v1alpha1.Scanner{
 		Name:    "Polaris",
diff --git a/itest/matcher/matcher_test.go b/itest/matcher/matcher_test.go
index d4d13aa..2618d04 100644
--- a/itest/matcher/matcher_test.go
+++ b/itest/matcher/matcher_test.go
@@ -57,7 +57,7 @@ func TestVulnerabilityReportMatcher(t *testing.T) {
 				Scanner: v1alpha1.Scanner{
 					Name:    "Trivy",
 					Vendor:  "Aqua Security",
-					Version: "0.20.0",
+					Version: "0.22.0",
 				},
 				Vulnerabilities: []v1alpha1.Vulnerability{},
 			},
diff --git a/pkg/plugin/trivy/plugin_test.go b/pkg/plugin/trivy/plugin_test.go
index 6de3142..93b17c5 100644
--- a/pkg/plugin/trivy/plugin_test.go
+++ b/pkg/plugin/trivy/plugin_test.go
@@ -470,7 +470,7 @@ func TestPlugin_Init(t *testing.T) {
 				ResourceVersion: "1",
 			},
 			Data: map[string]string{
-				"trivy.imageRef": "docker.io/aquasec/trivy:0.20.0",
+				"trivy.imageRef": "docker.io/aquasec/trivy:0.22.0",
 				"trivy.severity": "UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL",
 				"trivy.mode":     "Standalone",
 
@@ -495,7 +495,7 @@ func TestPlugin_Init(t *testing.T) {
 					ResourceVersion: "1",
 				},
 				Data: map[string]string{
-					"trivy.imageRef": "docker.io/aquasec/trivy:0.20.0",
+					"trivy.imageRef": "docker.io/aquasec/trivy:0.22.0",
 					"trivy.severity": "UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL",
 					"trivy.mode":     "Standalone",
 				},
@@ -529,7 +529,7 @@ func TestPlugin_Init(t *testing.T) {
 				ResourceVersion: "1",
 			},
 			Data: map[string]string{
-				"trivy.imageRef": "docker.io/aquasec/trivy:0.20.0",
+				"trivy.imageRef": "docker.io/aquasec/trivy:0.22.0",
 				"trivy.severity": "UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL",
 				"trivy.mode":     "Standalone",
 			},
@@ -2693,7 +2693,7 @@ CVE-2019-1543`,
 		{
 			name: "Trivy fs scan command in Standalone mode",
 			config: map[string]string{
-				"trivy.imageRef":                  "docker.io/aquasec/trivy:0.20.0",
+				"trivy.imageRef":                  "docker.io/aquasec/trivy:0.22.0",
 				"trivy.mode":                      string(trivy.Standalone),
 				"trivy.command":                   string(trivy.FileSystemScan),
 				"trivy.resources.requests.cpu":    "100m",
@@ -2737,7 +2737,7 @@ CVE-2019-1543`,
 				InitContainers: []corev1.Container{
 					{
 						Name:                     "00000000-0000-0000-0000-000000000001",
-						Image:                    "docker.io/aquasec/trivy:0.20.0",
+						Image:                    "docker.io/aquasec/trivy:0.22.0",
 						ImagePullPolicy:          corev1.PullIfNotPresent,
 						TerminationMessagePolicy: corev1.TerminationMessageFallbackToLogsOnError,
 						Command: []string{
@@ -2766,7 +2766,7 @@ CVE-2019-1543`,
 					},
 					{
 						Name:                     "00000000-0000-0000-0000-000000000002",
-						Image:                    "docker.io/aquasec/trivy:0.20.0",
+						Image:                    "docker.io/aquasec/trivy:0.22.0",
 						ImagePullPolicy:          corev1.PullIfNotPresent,
 						TerminationMessagePolicy: corev1.TerminationMessageFallbackToLogsOnError,
 						Env: []corev1.EnvVar{