Repository: aquasecurity/starboard
Pull request #904 (2022-01-18 10:10:04)

refactor: review and cleanup starboard config package
Signed-off-by: Daniel Pacak <pacak.daniel@gmail.com>

codecov[bot]: # [Codecov](https://codecov.io/gh/aquasecurity/starboard/pull/904?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity) Report
> Merging [#904](https://codecov.io/gh/aquasecurity/starboard/pull/904?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity) (9b8b67c) into [main](https://codecov.io/gh/aquasecurity/starboard/commit/b2a8c0d3b5233c98471cec51c16fb845a7dddd60?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity) (b2a8c0d) will **decrease** coverage by `27.55%`.
> The diff coverage is `n/a`.

[![Impacted file tree graph](https://codecov.io/gh/aquasecurity/starboard/pull/904/graphs/tree.svg?width=650&height=150&src=pr&token=qqTGKAJ0Wb&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity)](https://codecov.io/gh/aquasecurity/starboard/pull/904?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity)

```diff
@@             Coverage Diff             @@
##             main     #904       +/-   ##
===========================================
- Coverage   64.88%   37.33%   -27.56%     
===========================================
  Files          59       13       -46     
  Lines        6679     2073     -4606     
===========================================
- Hits         4334      774     -3560     
+ Misses       1896     1194      -702     
+ Partials      449      105      -344     
```


| [Impacted Files](https://codecov.io/gh/aquasecurity/starboard/pull/904?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity) | Coverage Δ | |
|---|---|---|
| [pkg/operator/controller/vulnerabilityreport.go](https://codecov.io/gh/aquasecurity/starboard/pull/904/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL29wZXJhdG9yL2NvbnRyb2xsZXIvdnVsbmVyYWJpbGl0eXJlcG9ydC5nbw==) | `0.00% <0.00%> (-60.79%)` | :arrow_down: |
| [pkg/operator/controller/ciskubebenchreport.go](https://codecov.io/gh/aquasecurity/starboard/pull/904/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL29wZXJhdG9yL2NvbnRyb2xsZXIvY2lza3ViZWJlbmNocmVwb3J0Lmdv) | `0.00% <0.00%> (-55.70%)` | :arrow_down: |
| [pkg/configauditreport/scanner.go](https://codecov.io/gh/aquasecurity/starboard/pull/904/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL2NvbmZpZ2F1ZGl0cmVwb3J0L3NjYW5uZXIuZ28=) | `0.00% <0.00%> (-55.56%)` | :arrow_down: |
| [pkg/configauditreport/io.go](https://codecov.io/gh/aquasecurity/starboard/pull/904/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL2NvbmZpZ2F1ZGl0cmVwb3J0L2lvLmdv) | `28.57% <0.00%> (-38.10%)` | :arrow_down: |
| [pkg/operator/predicate/predicate.go](https://codecov.io/gh/aquasecurity/starboard/pull/904/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL29wZXJhdG9yL3ByZWRpY2F0ZS9wcmVkaWNhdGUuZ28=) | `58.90% <0.00%> (-28.77%)` | :arrow_down: |
| [pkg/plugin/factory.go](https://codecov.io/gh/aquasecurity/starboard/pull/904/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL3BsdWdpbi9mYWN0b3J5Lmdv) | `54.71% <0.00%> (-26.42%)` | :arrow_down: |
| [pkg/operator/operator.go](https://codecov.io/gh/aquasecurity/starboard/pull/904/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL29wZXJhdG9yL29wZXJhdG9yLmdv) | `33.33% <0.00%> (-19.13%)` | :arrow_down: |
| [pkg/operator/controller/ttl\_report.go](https://codecov.io/gh/aquasecurity/starboard/pull/904/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL29wZXJhdG9yL2NvbnRyb2xsZXIvdHRsX3JlcG9ydC5nbw==) | `0.00% <0.00%> (-16.95%)` | :arrow_down: |
| [pkg/configauditreport/builder.go](https://codecov.io/gh/aquasecurity/starboard/pull/904/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL2NvbmZpZ2F1ZGl0cmVwb3J0L2J1aWxkZXIuZ28=) | `67.93% <0.00%> (-10.87%)` | :arrow_down: |
| [pkg/operator/controller/configauditreport.go](https://codecov.io/gh/aquasecurity/starboard/pull/904/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL29wZXJhdG9yL2NvbnRyb2xsZXIvY29uZmlnYXVkaXRyZXBvcnQuZ28=) | `56.23% <0.00%> (-10.15%)` | :arrow_down: |
| ... and [47 more](https://codecov.io/gh/aquasecurity/starboard/pull/904/diff?src=pr&el=tree-more&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity) | |

------

[Continue to review full report at Codecov](https://codecov.io/gh/aquasecurity/starboard/pull/904?src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity).
> **Legend** - [Click here to learn more](https://docs.codecov.io/docs/codecov-delta?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity)
> `Δ = absolute <relative> (impact)`, `ø = not affected`, `? = missing data`
> Powered by [Codecov](https://codecov.io/gh/aquasecurity/starboard/pull/904?src=pr&el=footer&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity). Last update [b2a8c0d...9b8b67c](https://codecov.io/gh/aquasecurity/starboard/pull/904?src=pr&el=lastupdated&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity). Read the [comment docs](https://docs.codecov.io/docs/pull-request-comments?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity).


Patch:
diff --git a/deploy/helm/templates/deployment.yaml b/deploy/helm/templates/deployment.yaml
index a77dca2..d561ef6 100644
--- a/deploy/helm/templates/deployment.yaml
+++ b/deploy/helm/templates/deployment.yaml
@@ -75,12 +75,12 @@ spec:
               value: {{ .Values.operator.kubernetesBenchmarkEnabled | quote }}
             - name: OPERATOR_VULNERABILITY_SCANNER_ENABLED
               value: {{ .Values.operator.vulnerabilityScannerEnabled | quote }}
+            - name: OPERATOR_VULNERABILITY_SCANNER_SCAN_ONLY_CURRENT_REVISIONS
+              value: {{ .Values.operator.vulnerabilityScannerScanOnlyCurrentRevisions | quote }}
             - name: OPERATOR_VULNERABILITY_SCANNER_REPORT_TTL
               value: {{ .Values.operator.vulnerabilityScannerReportTTL | quote }}
             - name: OPERATOR_CONFIG_AUDIT_SCANNER_ENABLED
               value: {{ .Values.operator.configAuditScannerEnabled | quote }}
-            - name: OPERATOR_VULNERABILITY_SCANNER_SCAN_ONLY_CURRENT_REVISIONS
-              value: {{ .Values.operator.vulnerabilityScannerScanOnlyCurrentRevisions | quote }}
             {{- if gt (int .Values.operator.replicas) 1 }}
             - name: OPERATOR_LEADER_ELECTION_ENABLED
               value: "true"
diff --git a/deploy/static/04-starboard-operator.deployment.yaml b/deploy/static/04-starboard-operator.deployment.yaml
index 225a770..88293ca 100644
--- a/deploy/static/04-starboard-operator.deployment.yaml
+++ b/deploy/static/04-starboard-operator.deployment.yaml
@@ -79,12 +79,12 @@ spec:
               value: "true"
             - name: OPERATOR_VULNERABILITY_SCANNER_ENABLED
               value: "true"
+            - name: OPERATOR_VULNERABILITY_SCANNER_SCAN_ONLY_CURRENT_REVISIONS
+              value: "false"
             - name: OPERATOR_VULNERABILITY_SCANNER_REPORT_TTL
               value: ""
             - name: OPERATOR_CONFIG_AUDIT_SCANNER_ENABLED
               value: "true"
-            - name: OPERATOR_VULNERABILITY_SCANNER_SCAN_ONLY_CURRENT_REVISIONS
-              value: "false"
           ports:
             - name: metrics
               containerPort: 8080
diff --git a/pkg/operator/etc/config.go b/pkg/operator/etc/config.go
index 6764618..f41e241 100644
--- a/pkg/operator/etc/config.go
+++ b/pkg/operator/etc/config.go
@@ -10,24 +10,24 @@ import (
 
 // Config defines parameters for running the operator.
 type Config struct {
-	Namespace                                    string        `env:"OPERATOR_NAMESPACE"`
-	TargetNamespaces                             string        `env:"OPERATOR_TARGET_NAMESPACES"`
-	ServiceAccount                               string        `env:"OPERATOR_SERVICE_ACCOUNT" envDefault:"starboard-operator"`
-	LogDevMode                                   bool          `env:"OPERATOR_LOG_DEV_MODE" envDefault:"false"`
-	ScanJobTimeout                               time.Duration `env:"OPERATOR_SCAN_JOB_TIMEOUT" envDefault:"5m"`
-	ConcurrentScanJobsLimit                      int           `env:"OPERATOR_CONCURRENT_SCAN_JOBS_LIMIT" envDefault:"10"`
-	ScanJobRetryAfter                            time.Duration `env:"OPERATOR_SCAN_JOB_RETRY_AFTER" envDefault:"30s"`
-	BatchDeleteLimit                             int           `env:"OPERATOR_BATCH_DELETE_LIMIT" envDefault:"10"`
-	BatchDeleteDelay                             time.Duration `env:"OPERATOR_BATCH_DELETE_DELAY" envDefault:"10s"`
-	MetricsBindAddress                           string        `env:"OPERATOR_METRICS_BIND_ADDRESS" envDefault:":8080"`
-	HealthProbeBindAddress                       string        `env:"OPERATOR_HEALTH_PROBE_BIND_ADDRESS" envDefault:":9090"`
-	CISKubernetesBenchmarkEnabled                bool          `env:"OPERATOR_CIS_KUBERNETES_BENCHMARK_ENABLED" envDefault:"true"`
-	VulnerabilityScannerEnabled                  bool          `env:"OPERATOR_VULNERABILITY_SCANNER_ENABLED" envDefault:"true"`
-	ConfigAuditScannerEnabled                    bool          `env:"OPERATOR_CONFIG_AUDIT_SCANNER_ENABLED" envDefault:"true"`
-	LeaderElectionEnabled                        bool          `env:"OPERATOR_LEADER_ELECTION_ENABLED" envDefault:"false"`
-	LeaderElectionID                             string        `env:"OPERATOR_LEADER_ELECTION_ID" envDefault:"starboard-lock"`
-	VulnerabilityScannerScanOnlyCurrentRevisions bool          `env:"OPERATOR_VULNERABILITY_SCANNER_SCAN_ONLY_CURRENT_REVISIONS" envDefault:"false"`
+	Namespace                                    string         `env:"OPERATOR_NAMESPACE"`
+	TargetNamespaces                             string         `env:"OPERATOR_TARGET_NAMESPACES"`
+	ServiceAccount                               string         `env:"OPERATOR_SERVICE_ACCOUNT" envDefault:"starboard-operator"`
+	LogDevMode                                   bool           `env:"OPERATOR_LOG_DEV_MODE" envDefault:"false"`
+	ScanJobTimeout                               time.Duration  `env:"OPERATOR_SCAN_JOB_TIMEOUT" envDefault:"5m"`
+	ConcurrentScanJobsLimit                      int            `env:"OPERATOR_CONCURRENT_SCAN_JOBS_LIMIT" envDefault:"10"`
+	ScanJobRetryAfter                            time.Duration  `env:"OPERATOR_SCAN_JOB_RETRY_AFTER" envDefault:"30s"`
+	BatchDeleteLimit                             int            `env:"OPERATOR_BATCH_DELETE_LIMIT" envDefault:"10"`
+	BatchDeleteDelay                             time.Duration  `env:"OPERATOR_BATCH_DELETE_DELAY" envDefault:"10s"`
+	MetricsBindAddress                           string         `env:"OPERATOR_METRICS_BIND_ADDRESS" envDefault:":8080"`
+	HealthProbeBindAddress                       string         `env:"OPERATOR_HEALTH_PROBE_BIND_ADDRESS" envDefault:":9090"`
+	CISKubernetesBenchmarkEnabled                bool           `env:"OPERATOR_CIS_KUBERNETES_BENCHMARK_ENABLED" envDefault:"true"`
+	VulnerabilityScannerEnabled                  bool           `env:"OPERATOR_VULNERABILITY_SCANNER_ENABLED" envDefault:"true"`
+	VulnerabilityScannerScanOnlyCurrentRevisions bool           `env:"OPERATOR_VULNERABILITY_SCANNER_SCAN_ONLY_CURRENT_REVISIONS" envDefault:"false"`
 	VulnerabilityScannerReportTTL                *time.Duration `env:"OPERATOR_VULNERABILITY_SCANNER_REPORT_TTL"`
+	ConfigAuditScannerEnabled                    bool           `env:"OPERATOR_CONFIG_AUDIT_SCANNER_ENABLED" envDefault:"true"`
+	LeaderElectionEnabled                        bool           `env:"OPERATOR_LEADER_ELECTION_ENABLED" envDefault:"false"`
+	LeaderElectionID                             string         `env:"OPERATOR_LEADER_ELECTION_ID" envDefault:"starboard-lock"`
 }
 
 // GetOperatorConfig loads Config from environment variables.
diff --git a/pkg/starboard/config.go b/pkg/starboard/config.go
index 95aed88..ca1c51d 100644
--- a/pkg/starboard/config.go
+++ b/pkg/starboard/config.go
@@ -44,7 +44,7 @@ type BuildInfo struct {
 	Executable string
 }
 
-// Scanner represents unique, human readable identifier of a security scanner.
+// Scanner represents unique, human-readable identifier of a security scanner.
 type Scanner string
 
 const (
@@ -57,6 +57,12 @@ const (
 const (
 	keyVulnerabilityReportsScanner = "vulnerabilityReports.scanner"
 	keyConfigAuditReportsScanner   = "configAuditReports.scanner"
+	keyKubeBenchImageRef           = "kube-bench.imageRef"
+	keyKubeHunterImageRef          = "kube-hunter.imageRef"
+	keyKubeHunterQuick             = "kube-hunter.quick"
+	keyScanJobTolerations          = "scanJob.tolerations"
+	keyScanJobAnnotations          = "scanJob.annotations"
+	keyScanJobPodTemplateLabels    = "scanJob.podTemplateLabels"
 )
 
 // ConfigData holds Starboard configuration settings as a set
@@ -82,16 +88,6 @@ func GetDefaultConfig() ConfigData {
 	}
 }
 
-func (c ConfigData) GetScanJobTolerations() ([]corev1.Toleration, error) {
-	scanJobTolerations := []corev1.Toleration{}
-	if c["scanJob.tolerations"] == "" {
-		return scanJobTolerations, nil
-	}
-	err := json.Unmarshal([]byte(c["scanJob.tolerations"]), &scanJobTolerations)
-
-	return scanJobTolerations, err
-}
-
 func (c ConfigData) GetVulnerabilityReportsScanner() (Scanner, error) {
 	var ok bool
 	var value string
@@ -127,8 +123,18 @@ func (c ConfigData) GetConfigAuditReportsScanner() (Scanner, error) {
 		value, keyConfigAuditReportsScanner, Polaris, Conftest)
 }
 
+func (c ConfigData) GetScanJobTolerations() ([]corev1.Toleration, error) {
+	var scanJobTolerations []corev1.Toleration
+	if c[keyScanJobTolerations] == "" {
+		return scanJobTolerations, nil
+	}
+	err := json.Unmarshal([]byte(c[keyScanJobTolerations]), &scanJobTolerations)
+
+	return scanJobTolerations, err
+}
+
 func (c ConfigData) GetScanJobAnnotations() (map[string]string, error) {
-	scanJobAnnotationsStr, found := c[AnnotationScanJobAnnotations]
+	scanJobAnnotationsStr, found := c[keyScanJobAnnotations]
 	if !found || strings.TrimSpace(scanJobAnnotationsStr) == "" {
 		return map[string]string{}, nil
 	}
@@ -137,7 +143,7 @@ func (c ConfigData) GetScanJobAnnotations() (map[string]string, error) {
 	for _, annotation := range strings.Split(scanJobAnnotationsStr, ",") {
 		sepByEqual := strings.Split(annotation, "=")
 		if len(sepByEqual) != 2 {
-			return map[string]string{}, fmt.Errorf("custom annotations found to be wrongfully provided: %s", scanJobAnnotationsStr)
+			return map[string]string{}, fmt.Errorf("failed parsing incorrectly formatted custom scan job annotations: %s", scanJobAnnotationsStr)
 		}
 		key, value := sepByEqual[0], sepByEqual[1]
 		scanJobAnnotationsMap[key] = value
@@ -147,7 +153,7 @@ func (c ConfigData) GetScanJobAnnotations() (map[string]string, error) {
 }
 
 func (c ConfigData) GetScanJobPodTemplateLabels() (labels.Set, error) {
-	scanJobPodTemplateLabelsStr, found := c[AnnotationScanJobPodTemplateLabels]
+	scanJobPodTemplateLabelsStr, found := c[keyScanJobPodTemplateLabels]
 	if !found || strings.TrimSpace(scanJobPodTemplateLabelsStr) == "" {
 		return labels.Set{}, nil
 	}
@@ -156,7 +162,7 @@ func (c ConfigData) GetScanJobPodTemplateLabels() (labels.Set, error) {
 	for _, annotation := range strings.Split(scanJobPodTemplateLabelsStr, ",") {
 		sepByEqual := strings.Split(annotation, "=")
 		if len(sepByEqual) != 2 {
-			return labels.Set{}, fmt.Errorf("custom template labels found to be wrongfully provided: %s", scanJobPodTemplateLabelsStr)
+			return labels.Set{}, fmt.Errorf("failed parsing incorrectly formatted custom scan pod template labels: %s", scanJobPodTemplateLabelsStr)
 		}
 		key, value := sepByEqual[0], sepByEqual[1]
 		scanJobPodTemplateLabelsMap[key] = value
@@ -166,15 +172,15 @@ func (c ConfigData) GetScanJobPodTemplateLabels() (labels.Set, error) {
 }
 
 func (c ConfigData) GetKubeBenchImageRef() (string, error) {
-	return c.GetRequiredData("kube-bench.imageRef")
+	return c.GetRequiredData(keyKubeBenchImageRef)
 }
 
 func (c ConfigData) GetKubeHunterImageRef() (string, error) {
-	return c.GetRequiredData("kube-hunter.imageRef")
+	return c.GetRequiredData(keyKubeHunterImageRef)
 }
 
 func (c ConfigData) GetKubeHunterQuick() (bool, error) {
-	val, ok := c["kube-hunter.quick"]
+	val, ok := c[keyKubeHunterQuick]
 	if !ok {
 		return false, nil
 	}
diff --git a/pkg/starboard/constants.go b/pkg/starboard/constants.go
index c7c7a1a..bb1bc81 100644
--- a/pkg/starboard/constants.go
+++ b/pkg/starboard/constants.go
@@ -42,7 +42,5 @@ const (
 )
 
 const (
-	AnnotationContainerImages          = "starboard.container-images"
-	AnnotationScanJobAnnotations       = "scanJob.annotations"
-	AnnotationScanJobPodTemplateLabels = "scanJob.podTemplateLabels"
+	AnnotationContainerImages = "starboard.container-images"
 )


Test patch:
diff --git a/pkg/starboard/config_test.go b/pkg/starboard/config_test.go
index de5f941..29cd3d6 100644
--- a/pkg/starboard/config_test.go
+++ b/pkg/starboard/config_test.go
@@ -15,37 +15,271 @@ import (
 	"k8s.io/client-go/kubernetes/fake"
 )
 
-func TestGetVersionFromImageRef(t *testing.T) {
+func TestConfigData_GetVulnerabilityReportsScanner(t *testing.T) {
 	testCases := []struct {
-		imageRef        string
-		expectedVersion string
+		name            string
+		configData      starboard.ConfigData
+		expectedError   string
+		expectedScanner starboard.Scanner
 	}{
 		{
-			imageRef:        "docker.io/aquasec/trivy:0.9.1",
-			expectedVersion: "0.9.1",
+			name: "Should return Trivy",
+			configData: starboard.ConfigData{
+				"vulnerabilityReports.scanner": "Trivy",
+			},
+			expectedScanner: starboard.Trivy,
 		},
 		{
-			imageRef:        "docker.io/aquasec/trivy@sha256:5020dac24a63ef4f24452a0c63ebbfe93a5309e40f6353d1ee8221d2184ee954",
-			expectedVersion: "sha256:5020dac24a63ef4f24452a0c63ebbfe93a5309e40f6353d1ee8221d2184ee954",
+			name: "Should return Aqua",
+			configData: starboard.ConfigData{
+				"vulnerabilityReports.scanner": "Aqua",
+			},
+			expectedScanner: starboard.Aqua,
 		},
 		{
-			imageRef:        "aquasec/trivy:0.9.1",
-			expectedVersion: "0.9.1",
+			name:          "Should return error when value is not set",
+			configData:    starboard.ConfigData{},
+			expectedError: "property vulnerabilityReports.scanner not set",
 		},
 		{
-			imageRef:        "aquasec/trivy:latest",
-			expectedVersion: "latest",
+			name: "Should return error when value is not allowed",
+			configData: starboard.ConfigData{
+				"vulnerabilityReports.scanner": "Clair",
+			},
+			expectedError: "invalid value (Clair) of vulnerabilityReports.scanner; allowed values (Trivy, Aqua)",
 		},
+	}
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			scanner, err := tc.configData.GetVulnerabilityReportsScanner()
+			if tc.expectedError != "" {
+				require.EqualError(t, err, tc.expectedError)
+			} else {
+				require.NoError(t, err)
+				assert.Equal(t, tc.expectedScanner, scanner)
+			}
+		})
+	}
+}
+
+func TestConfigData_GetConfigAuditReportsScanner(t *testing.T) {
+	testCases := []struct {
+		name            string
+		configData      starboard.ConfigData
+		expectedError   string
+		expectedScanner starboard.Scanner
+	}{
 		{
-			imageRef:        "aquasec/trivy",
-			expectedVersion: "latest",
+			name: "Should return Polaris",
+			configData: starboard.ConfigData{
+				"configAuditReports.scanner": "Polaris",
+			},
+			expectedScanner: starboard.Polaris,
+		},
+		{
+			name: "Should return Conftest",
+			configData: starboard.ConfigData{
+				"configAuditReports.scanner": "Conftest",
+			},
+			expectedScanner: starboard.Conftest,
+		},
+		{
+			name:          "Should return error when value is not set",
+			configData:    starboard.ConfigData{},
+			expectedError: "property configAuditReports.scanner not set",
+		},
+		{
+			name: "Should return error when value is not allowed",
+			configData: starboard.ConfigData{
+				"configAuditReports.scanner": "KubeScan",
+			},
+			expectedError: "invalid value (KubeScan) of configAuditReports.scanner; allowed values (Polaris, Conftest)",
+		},
+	}
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			scanner, err := tc.configData.GetConfigAuditReportsScanner()
+			if tc.expectedError != "" {
+				require.EqualError(t, err, tc.expectedError)
+			} else {
+				require.NoError(t, err)
+				assert.Equal(t, tc.expectedScanner, scanner)
+			}
+		})
+	}
+}
+
+func TestConfigData_GetScanJobTolerations(t *testing.T) {
+	testCases := []struct {
+		name        string
+		config      starboard.ConfigData
+		expected    []corev1.Toleration
+		expectError string
+	}{
+		{
+			name:     "no scanJob.tolerations in ConfigData",
+			config:   starboard.ConfigData{},
+			expected: []corev1.Toleration(nil),
+		},
+		{
+			name:        "scanJob.tolerations value is not json",
+			config:      starboard.ConfigData{"scanJob.tolerations": `lolwut`},
+			expected:    []corev1.Toleration(nil),
+			expectError: "invalid character 'l' looking for beginning of value",
+		},
+		{
+			name:     "empty JSON array",
+			config:   starboard.ConfigData{"scanJob.tolerations": `[]`},
+			expected: []corev1.Toleration{},
+		},
+		{
+			name: "one valid toleration",
+			config: starboard.ConfigData{
+				"scanJob.tolerations": `[{"key":"key1","operator":"Equal","value":"value1","effect":"NoSchedule"}]`},
+			expected: []corev1.Toleration{{
+				Key:      "key1",
+				Operator: "Equal",
+				Value:    "value1",
+				Effect:   "NoSchedule",
+			}},
+		},
+		{
+			name: "multiple valid tolerations",
+			config: starboard.ConfigData{
+				"scanJob.tolerations": `[{"key":"key1","operator":"Equal","value":"value1","effect":"NoSchedule"},
+					  {"key":"key2","operator":"Equal","value":"value2","effect":"NoSchedule"}]`},
+			expected: []corev1.Toleration{
+				{
+					Key:      "key1",
+					Operator: "Equal",
+					Value:    "value1",
+					Effect:   "NoSchedule",
+				},
+				{
+					Key:      "key2",
+					Operator: "Equal",
+					Value:    "value2",
+					Effect:   "NoSchedule",
+				},
+			},
 		},
 	}
 
 	for _, tc := range testCases {
-		t.Run(tc.imageRef, func(t *testing.T) {
-			version, _ := starboard.GetVersionFromImageRef(tc.imageRef)
-			assert.Equal(t, tc.expectedVersion, version)
+		t.Run(tc.name, func(t *testing.T) {
+			got, err := tc.config.GetScanJobTolerations()
+			if tc.expectError != "" {
+				assert.Error(t, err, "unexpected end of JSON input", tc.name)
+			} else {
+				assert.NoError(t, err, tc.name)
+			}
+			assert.Equal(t, tc.expected, got, tc.name)
+		})
+	}
+}
+
+func TestConfigData_GetScanJobAnnotations(t *testing.T) {
+	testCases := []struct {
+		name        string
+		config      starboard.ConfigData
+		expected    map[string]string
+		expectError string
+	}{
+		{
+			name: "scan job annotations can be fetched successfully",
+			config: starboard.ConfigData{
+				"scanJob.annotations": "a.b=c.d/e,foo=bar",
+			},
+			expected: map[string]string{
+				"foo": "bar",
+				"a.b": "c.d/e",
+			},
+		},
+		{
+			name:     "gracefully deal with unprovided annotations",
+			config:   starboard.ConfigData{},
+			expected: map[string]string{},
+		},
+		{
+			name: "raise an error on being provided with annotations in wrong format",
+			config: starboard.ConfigData{
+				"scanJob.annotations": "foo",
+			},
+			expected:    map[string]string{},
+			expectError: "failed parsing incorrectly formatted custom scan job annotations: foo",
+		},
+		{
+			name: "raise an error on being provided with annotations in wrong format",
+			config: starboard.ConfigData{
+				"scanJob.annotations": "foo=bar,a=b=c",
+			},
+			expected:    map[string]string{},
+			expectError: "failed parsing incorrectly formatted custom scan job annotations: foo=bar,a=b=c",
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			scanJobAnnotations, err := tc.config.GetScanJobAnnotations()
+			if tc.expectError != "" {
+				assert.EqualError(t, err, tc.expectError, tc.name)
+			} else {
+				assert.NoError(t, err, tc.name)
+				assert.Equal(t, tc.expected, scanJobAnnotations, tc.name)
+			}
+		})
+	}
+}
+
+func TestConfigData_GetScanJobPodTemplateLabels(t *testing.T) {
+	testCases := []struct {
+		name        string
+		config      starboard.ConfigData
+		expected    labels.Set
+		expectError string
+	}{
+		{
+			name: "scan job template labels can be fetched successfully",
+			config: starboard.ConfigData{
+				"scanJob.podTemplateLabels": "a.b=c.d/e,foo=bar",
+			},
+			expected: labels.Set{
+				"foo": "bar",
+				"a.b": "c.d/e",
+			},
+		},
+		{
+			name:     "gracefully deal with unprovided annotations",
+			config:   starboard.ConfigData{},
+			expected: labels.Set{},
+		},
+		{
+			name: "raise an error on being provided with annotations in wrong format",
+			config: starboard.ConfigData{
+				"scanJob.podTemplateLabels": "foo",
+			},
+			expected:    labels.Set{},
+			expectError: "failed parsing incorrectly formatted custom scan pod template labels: foo",
+		},
+		{
+			name: "raise an error on being provided with template labels in wrong format",
+			config: starboard.ConfigData{
+				"scanJob.podTemplateLabels": "foo=bar,a=b=c",
+			},
+			expected:    labels.Set{},
+			expectError: "failed parsing incorrectly formatted custom scan pod template labels: foo=bar,a=b=c",
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			scanJobPodTemplateLabels, err := tc.config.GetScanJobPodTemplateLabels()
+			if tc.expectError != "" {
+				assert.EqualError(t, err, tc.expectError, tc.name)
+			} else {
+				assert.NoError(t, err, tc.name)
+				assert.Equal(t, tc.expected, scanJobPodTemplateLabels, tc.name)
+			}
 		})
 	}
 }
@@ -164,49 +398,37 @@ func TestConfigData_GetKubeHunterQuick(t *testing.T) {
 	}
 }
 
-func TestConfigData_GetVulnerabilityReportsScanner(t *testing.T) {
+func TestGetVersionFromImageRef(t *testing.T) {
 	testCases := []struct {
-		name            string
-		configData      starboard.ConfigData
-		expectedError   string
-		expectedScanner starboard.Scanner
+		imageRef        string
+		expectedVersion string
 	}{
 		{
-			name: "Should return Trivy",
-			configData: starboard.ConfigData{
-				"vulnerabilityReports.scanner": "Trivy",
-			},
-			expectedScanner: starboard.Trivy,
+			imageRef:        "docker.io/aquasec/trivy:0.9.1",
+			expectedVersion: "0.9.1",
 		},
 		{
-			name: "Should return Aqua",
-			configData: starboard.ConfigData{
-				"vulnerabilityReports.scanner": "Aqua",
-			},
-			expectedScanner: starboard.Aqua,
+			imageRef:        "docker.io/aquasec/trivy@sha256:5020dac24a63ef4f24452a0c63ebbfe93a5309e40f6353d1ee8221d2184ee954",
+			expectedVersion: "sha256:5020dac24a63ef4f24452a0c63ebbfe93a5309e40f6353d1ee8221d2184ee954",
 		},
 		{
-			name:          "Should return error when value is not set",
-			configData:    starboard.ConfigData{},
-			expectedError: "property vulnerabilityReports.scanner not set",
+			imageRef:        "aquasec/trivy:0.9.1",
+			expectedVersion: "0.9.1",
 		},
 		{
-			name: "Should return error when value is not allowed",
-			configData: starboard.ConfigData{
-				"vulnerabilityReports.scanner": "Clair",
-			},
-			expectedError: "invalid value (Clair) of vulnerabilityReports.scanner; allowed values (Trivy, Aqua)",
+			imageRef:        "aquasec/trivy:latest",
+			expectedVersion: "latest",
+		},
+		{
+			imageRef:        "aquasec/trivy",
+			expectedVersion: "latest",
 		},
 	}
+
 	for _, tc := range testCases {
-		t.Run(tc.name, func(t *testing.T) {
-			scanner, err := tc.configData.GetVulnerabilityReportsScanner()
-			if tc.expectedError != "" {
-				require.EqualError(t, err, tc.expectedError)
-			} else {
-				require.NoError(t, err)
-				assert.Equal(t, tc.expectedScanner, scanner)
-			}
+		t.Run(tc.imageRef, func(t *testing.T) {
+			version, _ := starboard.GetVersionFromImageRef(tc.imageRef)
+			assert.Equal(t, tc.expectedVersion, version)
 		})
 	}
 }
@@ -373,178 +595,3 @@ func TestConfigManager_Delete(t *testing.T) {
 		assert.True(t, errors.IsNotFound(err))
 	})
 }
-
-func TestGetScanJobTolerations(t *testing.T) {
-	testCases := []struct {
-		name        string
-		config      starboard.ConfigData
-		expected    []corev1.Toleration
-		expectError string
-	}{
-		{
-			name:     "no scanJob.tolerations in ConfigData",
-			config:   starboard.ConfigData{},
-			expected: []corev1.Toleration{},
-		},
-		{
-			name:        "scanJob.tolerations value is not json",
-			config:      starboard.ConfigData{"scanJob.tolerations": `lolwut`},
-			expected:    []corev1.Toleration{},
-			expectError: "invalid character 'l' looking for beginning of value",
-		},
-		{
-			name:     "empty JSON array",
-			config:   starboard.ConfigData{"scanJob.tolerations": `[]`},
-			expected: []corev1.Toleration{},
-		},
-		{
-			name: "one valid toleration",
-			config: starboard.ConfigData{
-				"scanJob.tolerations": `[{"key":"key1","operator":"Equal","value":"value1","effect":"NoSchedule"}]`},
-			expected: []corev1.Toleration{{
-				Key:      "key1",
-				Operator: "Equal",
-				Value:    "value1",
-				Effect:   "NoSchedule",
-			}},
-		},
-		{
-			name: "multiple valid tolerations",
-			config: starboard.ConfigData{
-				"scanJob.tolerations": `[{"key":"key1","operator":"Equal","value":"value1","effect":"NoSchedule"},
-					  {"key":"key2","operator":"Equal","value":"value2","effect":"NoSchedule"}]`},
-			expected: []corev1.Toleration{
-				{
-					Key:      "key1",
-					Operator: "Equal",
-					Value:    "value1",
-					Effect:   "NoSchedule",
-				},
-				{
-					Key:      "key2",
-					Operator: "Equal",
-					Value:    "value2",
-					Effect:   "NoSchedule",
-				},
-			},
-		},
-	}
-
-	for _, tc := range testCases {
-		t.Run(tc.name, func(t *testing.T) {
-			got, err := tc.config.GetScanJobTolerations()
-			if tc.expectError != "" {
-				assert.Error(t, err, "unexpected end of JSON input", tc.name)
-			} else {
-				assert.NoError(t, err, tc.name)
-			}
-			assert.Equal(t, tc.expected, got, tc.name)
-		})
-	}
-}
-
-func TestGetScanJobAnnotations(t *testing.T) {
-	testCases := []struct {
-		name        string
-		config      starboard.ConfigData
-		expected    map[string]string
-		expectError string
-	}{
-		{
-			name: "scan job annotations can be fetched successfully",
-			config: starboard.ConfigData{
-				"scanJob.annotations": "a.b=c.d/e,foo=bar",
-			},
-			expected: map[string]string{
-				"foo": "bar",
-				"a.b": "c.d/e",
-			},
-		},
-		{
-			name:     "gracefully deal with unprovided annotations",
-			config:   starboard.ConfigData{},
-			expected: map[string]string{},
-		},
-		{
-			name: "raise an error on being provided with annotations in wrong format",
-			config: starboard.ConfigData{
-				"scanJob.annotations": "foo",
-			},
-			expected:    map[string]string{},
-			expectError: "custom annotations found to be wrongfully provided: foo",
-		},
-		{
-			name: "raise an error on being provided with annotations in wrong format",
-			config: starboard.ConfigData{
-				"scanJob.annotations": "foo=bar,a=b=c",
-			},
-			expected:    map[string]string{},
-			expectError: "custom annotations found to be wrongfully provided: foo=bar,a=b=c",
-		},
-	}
-
-	for _, tc := range testCases {
-		t.Run(tc.name, func(t *testing.T) {
-			scanJobAnnotations, err := tc.config.GetScanJobAnnotations()
-			if tc.expectError != "" {
-				assert.Error(t, err, tc.expectError, tc.name)
-			} else {
-				assert.NoError(t, err, tc.name)
-			}
-			assert.Equal(t, tc.expected, scanJobAnnotations, tc.name)
-		})
-	}
-}
-
-func TestGetScanJobPodTemplateLabels(t *testing.T) {
-	testCases := []struct {
-		name        string
-		config      starboard.ConfigData
-		expected    labels.Set
-		expectError string
-	}{
-		{
-			name: "scan job template labels can be fetched successfully",
-			config: starboard.ConfigData{
-				"scanJob.podTemplateLabels": "a.b=c.d/e,foo=bar",
-			},
-			expected: labels.Set{
-				"foo": "bar",
-				"a.b": "c.d/e",
-			},
-		},
-		{
-			name:     "gracefully deal with unprovided annotations",
-			config:   starboard.ConfigData{},
-			expected: labels.Set{},
-		},
-		{
-			name: "raise an error on being provided with annotations in wrong format",
-			config: starboard.ConfigData{
-				"scanJob.podTemplateLabels": "foo",
-			},
-			expected:    labels.Set{},
-			expectError: "custom template labels found to be wrongfully provided: foo",
-		},
-		{
-			name: "raise an error on being provided with template labels in wrong format",
-			config: starboard.ConfigData{
-				"scanJob.podTemplateLabels": "foo=bar,a=b=c",
-			},
-			expected:    labels.Set{},
-			expectError: "custom template labels found to be wrongfully provided: foo=bar,a=b=c",
-		},
-	}
-
-	for _, tc := range testCases {
-		t.Run(tc.name, func(t *testing.T) {
-			scanJobPodTemplateLabels, err := tc.config.GetScanJobPodTemplateLabels()
-			if tc.expectError != "" {
-				assert.Error(t, err, tc.expectError, tc.name)
-			} else {
-				assert.NoError(t, err, tc.name)
-			}
-			assert.Equal(t, tc.expected, scanJobPodTemplateLabels, tc.name)
-		})
-	}
-}