Repository: aquasecurity/starboard (go)

Issue:
Ignore parsing logs of scan jobs have been deleted
In the configauditreports controller we should ignore scan jobs that are cached but had been deleted from etcd so we cannot parse their logs. Currently we return an error, which is causing retry, but retrying does not make much sense in this case.

https://github.com/aquasecurity/starboard/blob/v0.13.0/pkg/operator/controller/configauditreport.go#L406


Pull request description:
Fix: Deletes scan jobs if their pods have been deleted and logs can't be c…
Fixes #873 and for other scan types which are not mentioned in this issue

The problem which is fixed in this PR is the following:

When a scan job creates the pod which handles scans, if this pod has been deleted before starboard parses the pod's logs, these jobs are never deleted which means when the max concurrent job setting is hit, part of this threshold is eaten up by jobs which never get deleted.

Signed-off-by: Joel Whittaker-Smith <jdws.dev@gmail.com>

Patch:
diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index 84075ec..3548749 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -19,8 +19,14 @@ builds:
       - amd64
       - arm
       - arm64
+      - s390x
     goarm:
       - 7
+    ignore:
+      - goos: darwin
+        goarch: s390x
+      - goos: windows
+        goarch: s390x
   - id: starboard-operator
     main: ./cmd/starboard-operator/main.go
     binary: starboard-operator
@@ -30,6 +36,7 @@ builds:
       - amd64
       - arm
       - arm64
+      - s390x
     goarm:
       - 7
   - id: starboard-scanner-aqua
@@ -157,23 +164,65 @@ dockers:
       - "--label=org.label-schema.vcs=https://github.com/aquasecurity/starboard"
       - "--label=org.label-schema.vcs-ref={{ .FullCommit }}"
       - "--platform=linux/arm64"
+  - image_templates:
+      - "docker.io/aquasec/starboard:{{ .Version }}-s390x"
+      - "public.ecr.aws/aquasecurity/starboard:{{ .Version }}-s390x"
+    use: buildx
+    goos: linux
+    dockerfile: build/starboard/Dockerfile
+    goarch: s390x
+    ids:
+      - starboard
+    build_flag_templates:
+      - "--label=org.label-schema.schema-version=1.0"
+      - "--label=org.label-schema.name={{ .ProjectName }}"
+      - "--label=org.label-schema.description=Command line interface for Starboard"
+      - "--label=org.label-schema.vendor=Aqua Security"
+      - "--label=org.label-schema.version={{ .Version }}"
+      - "--label=org.label-schema.build-date={{ .Date }}"
+      - "--label=org.label-schema.vcs=https://github.com/aquasecurity/starboard"
+      - "--label=org.label-schema.vcs-ref={{ .FullCommit }}"
+      - "--platform=linux/s390x"
+  - image_templates:
+      - "docker.io/aquasec/starboard-operator:{{ .Version }}-s390x"
+      - "public.ecr.aws/aquasecurity/starboard-operator:{{ .Version }}-s390x"
+    use: buildx
+    goos: linux
+    dockerfile: build/starboard-operator/Dockerfile
+    goarch: s390x
+    ids:
+      - starboard-operator
+    build_flag_templates:
+      - "--label=org.label-schema.schema-version=1.0"
+      - "--label=org.label-schema.name=starboard-operator"
+      - "--label=org.label-schema.description=Keeps Starboard resources updated"
+      - "--label=org.label-schema.vendor=Aqua Security"
+      - "--label=org.label-schema.version={{ .Version }}"
+      - "--label=org.label-schema.build-date={{ .Date }}"
+      - "--label=org.label-schema.vcs=https://github.com/aquasecurity/starboard"
+      - "--label=org.label-schema.vcs-ref={{ .FullCommit }}"
+      - "--platform=linux/s390x"
 docker_manifests:
   - name_template: 'aquasec/starboard:{{ .Version }}'
     image_templates:
       - 'aquasec/starboard:{{ .Version }}-amd64'
       - 'aquasec/starboard:{{ .Version }}-arm64'
+      - 'aquasec/starboard:{{ .Version }}-s390x'
   - name_template: 'public.ecr.aws/aquasecurity/starboard:{{ .Version }}'
     image_templates:
       - 'public.ecr.aws/aquasecurity/starboard:{{ .Version }}-amd64'
       - 'public.ecr.aws/aquasecurity/starboard:{{ .Version }}-arm64'
+      - 'public.ecr.aws/aquasecurity/starboard:{{ .Version }}-s390x'
   - name_template: 'aquasec/starboard-operator:{{ .Version }}'
     image_templates:
       - 'aquasec/starboard-operator:{{ .Version }}-amd64'
       - 'aquasec/starboard-operator:{{ .Version }}-arm64'
+      - 'aquasec/starboard-operator:{{ .Version }}-s390x'
   - name_template: 'public.ecr.aws/aquasecurity/starboard-operator:{{ .Version }}'
     image_templates:
       - 'public.ecr.aws/aquasecurity/starboard-operator:{{ .Version }}-amd64'
       - 'public.ecr.aws/aquasecurity/starboard-operator:{{ .Version }}-arm64'
+      - 'public.ecr.aws/aquasecurity/starboard-operator:{{ .Version }}-s390x'
   - name_template: 'aquasec/starboard-scanner-aqua:{{ .Version }}'
     image_templates:
       - 'aquasec/starboard-scanner-aqua:{{ .Version }}'
diff --git a/.krew.yaml b/.krew.yaml
index 475a5ac..99a22a3 100644
--- a/.krew.yaml
+++ b/.krew.yaml
@@ -85,3 +85,14 @@ spec:
           - from: LICENSE
             to: .
         bin: starboard.exe
+    - selector:
+        matchLabels:
+          os: linux
+          arch: s390x
+      {{addURIAndSha "https://github.com/aquasecurity/starboard/releases/download/{{ .TagName }}/starboard_linux_s390x.tar.gz" .TagName | indent 6}}
+      files:
+        - from: starboard
+          to: .
+        - from: LICENSE
+          to: .
+      bin: starboard
diff --git a/deploy/helm/values.yaml b/deploy/helm/values.yaml
index aa30338..555b872 100644
--- a/deploy/helm/values.yaml
+++ b/deploy/helm/values.yaml
@@ -92,7 +92,7 @@ trivy:
   createConfig: true
 
   # imageRef the Trivy image reference.
-  imageRef: docker.io/aquasec/trivy:0.22.0
+  imageRef: docker.io/aquasec/trivy:0.23.0
 
   # mode is the Trivy client mode. Either Standalone or ClientServer. Depending
   # on the active mode other settings might be applicable or required.
@@ -372,7 +372,7 @@ conftest:
   createConfig: true
 
   # imageRef the image reference
-  imageRef: docker.io/openpolicyagent/conftest:v0.28.2
+  imageRef: docker.io/openpolicyagent/conftest:v0.30.0
 
   # resources resource requests and limits
   resources:
diff --git a/deploy/static/03-starboard-operator.config.yaml b/deploy/static/03-starboard-operator.config.yaml
index 7f94a09..f1ac19a 100644
--- a/deploy/static/03-starboard-operator.config.yaml
+++ b/deploy/static/03-starboard-operator.config.yaml
@@ -47,7 +47,7 @@ metadata:
     app.kubernetes.io/version: "0.14.1"
     app.kubernetes.io/managed-by: kubectl
 data:
-  trivy.imageRef: "docker.io/aquasec/trivy:0.22.0"
+  trivy.imageRef: "docker.io/aquasec/trivy:0.23.0"
   trivy.mode: "Standalone"
   trivy.severity: "UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL"
   trivy.resources.requests.cpu: 100m
diff --git a/docs/design/design_associating_rego_policies_with_k8s_resources.md b/docs/design/design_associating_rego_policies_with_k8s_resources.md
index cb95892..fbb3db1 100644
--- a/docs/design/design_associating_rego_policies_with_k8s_resources.md
+++ b/docs/design/design_associating_rego_policies_with_k8s_resources.md
@@ -50,7 +50,7 @@ metadata:
   namespace: starboard-operator
   name: starboard-conftest-config
 data:
-  conftest.imageRef: openpolicyagent/conftest:v0.28.2
+  conftest.imageRef: openpolicyagent/conftest:v0.30.0
   conftest.resources.requests.cpu: 50
   conftest.resources.requests.memory: 50M
   conftest.resources.limits.cpu: 300m
@@ -84,7 +84,7 @@ metadata:
     # Introduce a way to version configuration schema.
     starboard.plugin.config.version: "v2"
 data:
-  conftest.imageRef: openpolicyagent/conftest:v0.28.2
+  conftest.imageRef: openpolicyagent/conftest:v0.30.0
   conftest.resources.requests.cpu: 50
   conftest.resources.requests.memory: 50M
   conftest.resources.limits.cpu: 300m
diff --git a/docs/integrations/vulnerability-scanners/trivy.md b/docs/integrations/vulnerability-scanners/trivy.md
index cf4d651..14cd3e7 100644
--- a/docs/integrations/vulnerability-scanners/trivy.md
+++ b/docs/integrations/vulnerability-scanners/trivy.md
@@ -82,7 +82,7 @@ EOF
 
 | CONFIGMAP KEY                      | DEFAULT                            | DESCRIPTION                                                                                                                                                         |
 |------------------------------------|------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| `trivy.imageRef`                   | `docker.io/aquasec/trivy:0.22.0`   | Trivy image reference                                                                                                                                               |
+| `trivy.imageRef`                   | `docker.io/aquasec/trivy:0.23.0`   | Trivy image reference                                                                                                                                               |
 | `trivy.mode`                       | `Standalone`                       | Trivy client mode. Either `Standalone` or `ClientServer`. Depending on the active mode other settings might be applicable or required.                              |
 | `trivy.severity`                   | `UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL` | A comma separated list of severity levels reported by Trivy                                                                                                         |
 | `trivy.ignoreUnfixed`              | N/A                                | Whether to show only fixed vulnerabilities in vulnerabilities reported by Trivy. Set to `"true"` to enable it.                                                      |
diff --git a/pkg/kube/logs.go b/pkg/kube/logs.go
index d2f31a6..67309c5 100644
--- a/pkg/kube/logs.go
+++ b/pkg/kube/logs.go
@@ -2,6 +2,7 @@ package kube
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"io"
 
@@ -11,6 +12,8 @@ import (
 	"k8s.io/client-go/kubernetes"
 )
 
+var podControlledByJobNotFoundErr = errors.New("pod for job not found")
+
 type LogsReader interface {
 	GetLogsByJobAndContainerName(ctx context.Context, job *batchv1.Job, containerName string) (io.ReadCloser, error)
 	GetTerminatedContainersStatusesByJob(ctx context.Context, job *batchv1.Job) (map[string]*corev1.ContainerStateTerminated, error)
@@ -32,7 +35,7 @@ func (r *logsReader) GetLogsByJobAndContainerName(ctx context.Context, job *batc
 		return nil, fmt.Errorf("getting pod controlled by job: %q: %w", job.Namespace+"/"+job.Name, err)
 	}
 	if pod == nil {
-		return nil, fmt.Errorf("getting pod controlled by job: %q: pod not found", job.Namespace+"/"+job.Name)
+		return nil, fmt.Errorf("getting pod controlled by job: %q: %w", job.Namespace+"/"+job.Name, podControlledByJobNotFoundErr)
 	}
 
 	return r.clientset.CoreV1().Pods(pod.Namespace).
@@ -87,3 +90,7 @@ func GetTerminatedContainersStatusesByPod(pod *corev1.Pod) map[string]*corev1.Co
 	}
 	return states
 }
+
+func IsPodControlledByJobNotFound(err error) bool {
+	return errors.Is(err, podControlledByJobNotFoundErr)
+}
diff --git a/pkg/operator/controller/ciskubebenchreport.go b/pkg/operator/controller/ciskubebenchreport.go
index d9d8bac..9783f41 100644
--- a/pkg/operator/controller/ciskubebenchreport.go
+++ b/pkg/operator/controller/ciskubebenchreport.go
@@ -280,6 +280,14 @@ func (r *CISKubeBenchReportReconciler) processCompleteScanJob(ctx context.Contex
 
 	logsStream, err := r.LogsReader.GetLogsByJobAndContainerName(ctx, job, r.Plugin.GetContainerName())
 	if err != nil {
+		if errors.IsNotFound(err) {
+			log.V(1).Info("Cached job must have been deleted")
+			return nil
+		}
+		if kube.IsPodControlledByJobNotFound(err) {
+			log.V(1).Info("Pod must have been deleted")
+			return r.deleteJob(ctx, job)
+		}
 		return fmt.Errorf("getting logs: %w", err)
 	}
 
@@ -321,6 +329,14 @@ func (r *CISKubeBenchReportReconciler) processFailedScanJob(ctx context.Context,
 
 	statuses, err := r.LogsReader.GetTerminatedContainersStatusesByJob(ctx, job)
 	if err != nil {
+		if errors.IsNotFound(err) {
+			log.V(1).Info("Cached job must have been deleted")
+			return nil
+		}
+		if kube.IsPodControlledByJobNotFound(err) {
+			log.V(1).Info("Pod must have been deleted")
+			return r.deleteJob(ctx, job)
+		}
 		return err
 	}
 	for container, status := range statuses {
diff --git a/pkg/operator/controller/configauditreport.go b/pkg/operator/controller/configauditreport.go
index ecb2d15..79f2abc 100644
--- a/pkg/operator/controller/configauditreport.go
+++ b/pkg/operator/controller/configauditreport.go
@@ -409,6 +409,14 @@ func (r *ConfigAuditReportReconciler) processCompleteScanJob(ctx context.Context
 
 	logsStream, err := r.LogsReader.GetLogsByJobAndContainerName(ctx, job, r.Plugin.GetContainerName())
 	if err != nil {
+		if errors.IsNotFound(err) {
+			log.V(1).Info("Cached job must have been deleted")
+			return nil
+		}
+		if kube.IsPodControlledByJobNotFound(err) {
+			log.V(1).Info("Pod must have been deleted")
+			return r.deleteJob(ctx, job)
+		}
 		return fmt.Errorf("getting logs: %w", err)
 	}
 
@@ -439,6 +447,14 @@ func (r *ConfigAuditReportReconciler) processFailedScanJob(ctx context.Context,
 
 	statuses, err := r.LogsReader.GetTerminatedContainersStatusesByJob(ctx, scanJob)
 	if err != nil {
+		if errors.IsNotFound(err) {
+			log.V(1).Info("Cached job must have been deleted")
+			return nil
+		}
+		if kube.IsPodControlledByJobNotFound(err) {
+			log.V(1).Info("Pod must have been deleted")
+			return r.deleteJob(ctx, scanJob)
+		}
 		return err
 	}
 	for container, status := range statuses {
diff --git a/pkg/operator/controller/vulnerabilityreport.go b/pkg/operator/controller/vulnerabilityreport.go
index ea1d6e1..798d3d7 100644
--- a/pkg/operator/controller/vulnerabilityreport.go
+++ b/pkg/operator/controller/vulnerabilityreport.go
@@ -370,6 +370,14 @@ func (r *VulnerabilityReportReconciler) processCompleteScanJob(ctx context.Conte
 	for containerName, containerImage := range containerImages {
 		logsStream, err := r.LogsReader.GetLogsByJobAndContainerName(ctx, job, containerName)
 		if err != nil {
+			if k8sapierror.IsNotFound(err) {
+				log.V(1).Info("Cached job must have been deleted")
+				return nil
+			}
+			if kube.IsPodControlledByJobNotFound(err) {
+				log.V(1).Info("Pod must have been deleted")
+				return r.deleteJob(ctx, job)
+			}
 			return fmt.Errorf("getting logs for pod %q: %w", job.Namespace+"/"+job.Name, err)
 		}
 		reportData, err := r.Plugin.ParseVulnerabilityReportData(r.PluginContext, containerImage, logsStream)
@@ -411,6 +419,14 @@ func (r *VulnerabilityReportReconciler) processFailedScanJob(ctx context.Context
 
 	statuses, err := r.GetTerminatedContainersStatusesByJob(ctx, scanJob)
 	if err != nil {
+		if k8sapierror.IsNotFound(err) {
+			log.V(1).Info("Cached job must have been deleted")
+			return nil
+		}
+		if kube.IsPodControlledByJobNotFound(err) {
+			log.V(1).Info("Pod must have been deleted")
+			return r.deleteJob(ctx, scanJob)
+		}
 		return err
 	}
 	for container, status := range statuses {
diff --git a/pkg/plugin/trivy/plugin.go b/pkg/plugin/trivy/plugin.go
index c657ffd..f5332b7 100644
--- a/pkg/plugin/trivy/plugin.go
+++ b/pkg/plugin/trivy/plugin.go
@@ -54,7 +54,7 @@ const (
 	keyResourcesLimitsMemory   = "trivy.resources.limits.memory"
 )
 
-// Mode describes mode in which Trivy client operates.
+// Mode in which Trivy client operates.
 type Mode string
 
 const (
@@ -62,11 +62,12 @@ const (
 	ClientServer Mode = "ClientServer"
 )
 
+// Command to scan image or filesystem.
 type Command string
 
 const (
-	FileSystemScan Command = "fs"
-	ImageScan      Command = "image"
+	Filesystem Command = "filesystem"
+	Image      Command = "image"
 )
 
 // Config defines configuration params for this plugin.
@@ -102,16 +103,16 @@ func (c Config) GetCommand() (Command, error) {
 	var value string
 	if value, ok = c.Data[keyTrivyCommand]; !ok {
 		// for backward compatibility, fallback to ImageScan
-		return ImageScan, nil
+		return Image, nil
 	}
 	switch Command(value) {
-	case ImageScan:
-		return ImageScan, nil
-	case FileSystemScan:
-		return FileSystemScan, nil
+	case Image:
+		return Image, nil
+	case Filesystem:
+		return Filesystem, nil
 	}
 	return "", fmt.Errorf("invalid value (%s) of %s; allowed values (%s, %s)",
-		value, keyTrivyCommand, ImageScan, FileSystemScan)
+		value, keyTrivyCommand, Image, Filesystem)
 }
 
 func (c Config) GetServerURL() (string, error) {
@@ -139,15 +140,15 @@ func (c Config) GetInsecureRegistries() map[string]bool {
 	return insecureRegistries
 }
 
-func (c Config) GetNonSslRegistries() map[string]bool {
-	nonSslRegistries := make(map[string]bool)
+func (c Config) GetNonSSLRegistries() map[string]bool {
+	nonSSLRegistries := make(map[string]bool)
 	for key, val := range c.Data {
 		if strings.HasPrefix(key, keyTrivyNonSslRegistryPrefix) {
-			nonSslRegistries[val] = true
+			nonSSLRegistries[val] = true
 		}
 	}
 
-	return nonSslRegistries
+	return nonSSLRegistries
 }
 
 func (c Config) GetMirrors() map[string]string {
@@ -212,11 +213,14 @@ type plugin struct {
 // NewPlugin constructs a new vulnerabilityreport.Plugin, which is using an
 // upstream Trivy container image to scan Kubernetes workloads.
 //
-// This Plugin supports both Standalone and ClientServer modes depending on
-// the settings returned by Config.GetMode.
+// The plugin supports Image and Filesystem commands. The Filesystem command may
+// be used to scan workload images cached on cluster nodes by scheduling
+// scan jobs on a particular node.
 //
-// The ClientServer mode is usually more performant, however it
-// requires a Trivy server accessible at the configurable Config.GetServerURL.
+// The Image command supports both Standalone and ClientServer modes depending
+// on the settings returned by Config.GetMode. The ClientServer mode is usually
+// more performant, however it requires a Trivy server accessible at the
+// configurable Config.GetServerURL.
 func NewPlugin(clock ext.Clock, idGenerator ext.IDGenerator, client client.Client) vulnerabilityreport.Plugin {
 	return &plugin{
 		clock:          clock,
@@ -229,7 +233,7 @@ func NewPlugin(clock ext.Clock, idGenerator ext.IDGenerator, client client.Clien
 func (p *plugin) Init(ctx starboard.PluginContext) error {
 	return ctx.EnsureConfig(starboard.PluginConfig{
 		Data: map[string]string{
-			keyTrivyImageRef: "docker.io/aquasec/trivy:0.22.0",
+			keyTrivyImageRef: "docker.io/aquasec/trivy:0.23.0",
 			keyTrivySeverity: "UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL",
 			keyTrivyMode:     string(Standalone),
 
@@ -258,24 +262,28 @@ func (p *plugin) GetScanJobSpec(ctx starboard.PluginContext, workload client.Obj
 	}
 
 	command, err := config.GetCommand()
-	if command == ImageScan {
+
+	if command == Image {
 		switch mode {
 		case Standalone:
 			return p.getPodSpecForStandaloneMode(ctx, config, spec, credentials)
 		case ClientServer:
 			return p.getPodSpecForClientServerMode(ctx, config, spec, credentials)
 		default:
-			return corev1.PodSpec{}, nil, fmt.Errorf("unrecognized trivy mode: %v", mode)
+			return corev1.PodSpec{}, nil, fmt.Errorf("unrecognized trivy mode %q for command %q", mode, command)
 		}
-	} else {
+	}
+
+	if command == Filesystem {
 		switch mode {
 		case Standalone:
 			return p.getPodSpecForStandaloneFSMode(ctx, config, workload)
 		default:
-			return corev1.PodSpec{}, nil, fmt.Errorf("unrecognized trivy file scan mode: %v", mode)
-
+			return corev1.PodSpec{}, nil, fmt.Errorf("unrecognized trivy mode %q for command %q", mode, command)
 		}
 	}
+
+	return corev1.PodSpec{}, nil, fmt.Errorf("unrecognized trivy command %q", command)
 }
 
 func (p *plugin) newSecretWithAggregateImagePullCredentials(spec corev1.PodSpec, credentials map[string]docker.Auth) *corev1.Secret {
@@ -292,24 +300,24 @@ func (p *plugin) newSecretWithAggregateImagePullCredentials(spec corev1.PodSpec,
 }
 
 const (
-	sharedVolumeName            = "data"
+	tmpVolumeName               = "tmp"
 	ignoreFileVolumeName        = "ignorefile"
 	FsSharedVolumeName          = "starboard"
 	SharedVolumeLocationOfTrivy = "/var/starboard/trivy"
 )
 
 // In the Standalone mode there is the init container responsible for
-// downloading the latest Trivy DB file from GitHub and storing it to the empty
-// volume shared with main containers. In other words, the init container runs
-// the following Trivy command:
+// downloading the latest Trivy DB file from GitHub and storing it to the
+// emptyDir volume shared with main containers. In other words, the init
+// container runs the following Trivy command:
 //
-//     trivy --cache-dir /var/lib/trivy image --download-db-only
+//     trivy --cache-dir /tmp/trivy/.cache image --download-db-only
 //
 // The number of main containers correspond to the number of containers
 // defined for the scanned workload. Each container runs the Trivy image scan
 // command and skips the database download:
 //
-//     trivy --cache-dir /var/lib/trivy image --skip-update \
+//     trivy --cache-dir /tmp/trivy/.cache image --skip-update \
 //       --format json <container image>
 func (p *plugin) getPodSpecForStandaloneMode(ctx starboard.PluginContext, config Config, spec corev1.PodSpec, credentials map[string]docker.Auth) (corev1.PodSpec, []*corev1.Secret, error) {
 	var secret *corev1.Secret
@@ -392,15 +400,15 @@ func (p *plugin) getPodSpecForStandaloneMode(ctx starboard.PluginContext, config
 		},
 		Args: []string{
 			"--cache-dir",
-			"/var/lib/trivy",
+			"/tmp/trivy/.cache",
 			"image",
 			"--download-db-only",
 		},
 		Resources: requirements,
 		VolumeMounts: []corev1.VolumeMount{
 			{
-				Name:      sharedVolumeName,
-				MountPath: "/var/lib/trivy",
+				Name:      tmpVolumeName,
+				MountPath: "/tmp",
 				ReadOnly:  false,
 			},
 		},
@@ -410,14 +418,14 @@ func (p *plugin) getPodSpecForStandaloneMode(ctx starboard.PluginContext, config
 
 	volumeMounts := []corev1.VolumeMount{
 		{
-			Name:      sharedVolumeName,
+			Name:      tmpVolumeName,
 			ReadOnly:  false,
-			MountPath: "/var/lib/trivy",
+			MountPath: "/tmp",
 		},
 	}
 	volumes := []corev1.Volume{
 		{
-			Name: sharedVolumeName,
+			Name: tmpVolumeName,
 			VolumeSource: corev1.VolumeSource{
 				EmptyDir: &corev1.EmptyDirVolumeSource{
 					Medium: corev1.StorageMediumDefault,
@@ -446,7 +454,7 @@ func (p *plugin) getPodSpecForStandaloneMode(ctx starboard.PluginContext, config
 
 		volumeMounts = append(volumeMounts, corev1.VolumeMount{
 			Name:      ignoreFileVolumeName,
-			MountPath: "/tmp/trivy/.trivyignore",
+			MountPath: "/etc/trivy/.trivyignore",
 			SubPath:   ".trivyignore",
 		})
 	}
@@ -543,7 +551,7 @@ func (p *plugin) getPodSpecForStandaloneMode(ctx starboard.PluginContext, config
 		if config.IgnoreFileExists() {
 			env = append(env, corev1.EnvVar{
 				Name:  "TRIVY_IGNOREFILE",
-				Value: "/tmp/trivy/.trivyignore",
+				Value: "/etc/trivy/.trivyignore",
 			})
 		}
 
@@ -579,7 +587,7 @@ func (p *plugin) getPodSpecForStandaloneMode(ctx starboard.PluginContext, config
 			return corev1.PodSpec{}, nil, err
 		}
 
-		env, err = p.appendTrivyNonSslEnv(config, c.Image, env)
+		env, err = p.appendTrivyNonSSLEnv(config, c.Image, env)
 		if err != nil {
 			return corev1.PodSpec{}, nil, err
 		}
@@ -605,7 +613,7 @@ func (p *plugin) getPodSpecForStandaloneMode(ctx starboard.PluginContext, config
 			},
 			Args: []string{
 				"--cache-dir",
-				"/var/lib/trivy",
+				"/tmp/trivy/.cache",
 				"--quiet",
 				"image",
 				"--skip-update",
@@ -638,13 +646,13 @@ func (p *plugin) getPodSpecForStandaloneMode(ctx starboard.PluginContext, config
 	}, secrets, nil
 }
 
-// In the ClientServer mode the number of containers of the pod
-// created by the scan job equals the number of containers defined for the
-// scanned workload. Each container runs Trivy image scan command and refers
-// to Trivy server URL returned by Config.GetServerURL:
+// In the ClientServer mode the number of containers of the pod created by the
+// scan job equals the number of containers defined for the scanned workload.
+// Each container runs Trivy image scan command and refers to Trivy server URL
+// returned by Config.GetServerURL:
 //
 //     trivy client --remote <server URL> \
-//       --format json <container image ref>
+//       --format json <container image>
 func (p *plugin) getPodSpecForClientServerMode(ctx starboard.PluginContext, config Config, spec corev1.PodSpec, credentials map[string]docker.Auth) (corev1.PodSpec, []*corev1.Secret, error) {
 	var secret *corev1.Secret
 	var secrets []*corev1.Secret
@@ -827,7 +835,7 @@ func (p *plugin) getPodSpecForClientServerMode(ctx starboard.PluginContext, conf
 			return corev1.PodSpec{}, nil, err
 		}
 
-		env, err = p.appendTrivyNonSslEnv(config, container.Image, env)
+		env, err = p.appendTrivyNonSSLEnv(config, container.Image, env)
 		if err != nil {
 			return corev1.PodSpec{}, nil, err
 		}
@@ -855,14 +863,14 @@ func (p *plugin) getPodSpecForClientServerMode(ctx starboard.PluginContext, conf
 			volumeMounts = []corev1.VolumeMount{
 				{
 					Name:      ignoreFileVolumeName,
-					MountPath: "/tmp/trivy/.trivyignore",
+					MountPath: "/etc/trivy/.trivyignore",
 					SubPath:   ".trivyignore",
 				},
 			}
 
 			env = append(env, corev1.EnvVar{
 				Name:  "TRIVY_IGNOREFILE",
-				Value: "/tmp/trivy/.trivyignore",
+				Value: "/etc/trivy/.trivyignore",
 			})
 		}
 
@@ -1131,14 +1139,14 @@ func (p *plugin) appendTrivyInsecureEnv(config Config, image string, env []corev
 	return env, nil
 }
 
-func (p *plugin) appendTrivyNonSslEnv(config Config, image string, env []corev1.EnvVar) ([]corev1.EnvVar, error) {
+func (p *plugin) appendTrivyNonSSLEnv(config Config, image string, env []corev1.EnvVar) ([]corev1.EnvVar, error) {
 	ref, err := name.ParseReference(image)
 	if err != nil {
 		return nil, err
 	}
 
-	nonSslRegistries := config.GetNonSslRegistries()
-	if nonSslRegistries[ref.Context().RegistryStr()] {
+	nonSSLRegistries := config.GetNonSSLRegistries()
+	if nonSSLRegistries[ref.Context().RegistryStr()] {
 		env = append(env, corev1.EnvVar{
 			Name:  "TRIVY_NON_SSL",
 			Value: "true",


Test patch:
diff --git a/docs/integrations/config-checkers/conftest.md b/docs/integrations/config-checkers/conftest.md
index 1561a8e..6099315 100644
--- a/docs/integrations/config-checkers/conftest.md
+++ b/docs/integrations/config-checkers/conftest.md
@@ -64,7 +64,7 @@ STARBOARD_NAMESPACE=<starboard_namespace>
 ```
 ```
 kubectl create configmap starboard-conftest-config --namespace $STARBOARD_NAMESPACE \
-  --from-literal=conftest.imageRef=openpolicyagent/conftest:v0.28.2 \
+  --from-literal=conftest.imageRef=openpolicyagent/conftest:v0.30.0 \
   --from-file=conftest.library.kubernetes.rego=kubernetes/lib/kubernetes.rego \
   --from-file=conftest.library.utils.rego=kubernetes/lib/utils.rego \
   --from-file=conftest.policy.file_system_not_read_only.rego=kubernetes/policies/general/file_system_not_read_only.rego \
@@ -160,15 +160,15 @@ report:
 
 ## Settings
 
-| CONFIGMAP KEY                        | DEFAULT                                      | DESCRIPTION |
-| ------------------------------------ | -------------------------------------------- | ----------- |
-| `conftest.imageRef`                  | `docker.io/openpolicyagent/conftest:v0.28.2` | Conftest image reference |
-| `conftest.resources.requests.cpu`    | `50m`                                        | The minimum amount of CPU required to run Conftest scanner pod. |
-| `conftest.resources.requests.memory` | `50M`                                        | The minimum amount of memory required to run Conftest scanner pod. |
-| `conftest.resources.limits.cpu`      | `300m`                                       | The maximum amount of CPU allowed to run Conftest scanner pod. |
-| `conftest.resources.limits.memory`   | `300M`                                       | The maximum amount of memory allowed to run Conftest scanner pod. |
-| `conftest.library.<name>.rego`       | N/A                                          | Rego library with helper functions |
-| `conftest.policy.<name>.rego`        | N/A                                          | Rego policy with the specified name |
+| CONFIGMAP KEY                        | DEFAULT                                      | DESCRIPTION                                                                                                                                                                               |
+|--------------------------------------|----------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| `conftest.imageRef`                  | `docker.io/openpolicyagent/conftest:v0.30.0` | Conftest image reference                                                                                                                                                                  |
+| `conftest.resources.requests.cpu`    | `50m`                                        | The minimum amount of CPU required to run Conftest scanner pod.                                                                                                                           |
+| `conftest.resources.requests.memory` | `50M`                                        | The minimum amount of memory required to run Conftest scanner pod.                                                                                                                        |
+| `conftest.resources.limits.cpu`      | `300m`                                       | The maximum amount of CPU allowed to run Conftest scanner pod.                                                                                                                            |
+| `conftest.resources.limits.memory`   | `300M`                                       | The maximum amount of memory allowed to run Conftest scanner pod.                                                                                                                         |
+| `conftest.library.<name>.rego`       | N/A                                          | Rego library with helper functions                                                                                                                                                        |
+| `conftest.policy.<name>.rego`        | N/A                                          | Rego policy with the specified name                                                                                                                                                       |
 | `conftest.policy.<name>.kinds`       | N/A                                          | A comma-separated list of Kubernetes kinds applicable to the policy with a given name. You can use `Workload` or `*` as special kinds to represent any Kubernetes workload or any object. |
 
 [Open Policy Agent]: https://www.openpolicyagent.org
diff --git a/itest/matcher/matcher.go b/itest/matcher/matcher.go
index 8ef8c4e..f6e558b 100644
--- a/itest/matcher/matcher.go
+++ b/itest/matcher/matcher.go
@@ -22,7 +22,7 @@ var (
 	trivyScanner = v1alpha1.Scanner{
 		Name:    "Trivy",
 		Vendor:  "Aqua Security",
-		Version: "0.22.0",
+		Version: "0.23.0",
 	}
 	polarisScanner = v1alpha1.Scanner{
 		Name:    "Polaris",
@@ -32,7 +32,7 @@ var (
 	conftestScanner = v1alpha1.Scanner{
 		Name:    "Conftest",
 		Vendor:  "Open Policy Agent",
-		Version: "v0.28.2",
+		Version: "v0.30.0",
 	}
 )
 
diff --git a/itest/matcher/matcher_test.go b/itest/matcher/matcher_test.go
index 1fb48ad..cfa33ce 100644
--- a/itest/matcher/matcher_test.go
+++ b/itest/matcher/matcher_test.go
@@ -58,7 +58,7 @@ func TestVulnerabilityReportMatcher(t *testing.T) {
 				Scanner: v1alpha1.Scanner{
 					Name:    "Trivy",
 					Vendor:  "Aqua Security",
-					Version: "0.22.0",
+					Version: "0.23.0",
 				},
 				Vulnerabilities: []v1alpha1.Vulnerability{},
 			},
diff --git a/itest/starboard-operator/configauditreport/conftest/suite_test.go b/itest/starboard-operator/configauditreport/conftest/suite_test.go
index 42b54cd..c5b8905 100644
--- a/itest/starboard-operator/configauditreport/conftest/suite_test.go
+++ b/itest/starboard-operator/configauditreport/conftest/suite_test.go
@@ -99,7 +99,7 @@ var _ = BeforeSuite(func() {
 		},
 		Data: map[string]string{
 			"configAuditReports.scanner": "Conftest",
-			"conftest.imageRef":          "docker.io/openpolicyagent/conftest:v0.28.2",
+			"conftest.imageRef":          "docker.io/openpolicyagent/conftest:v0.30.0",
 		},
 	}
 	err = kubeClient.Create(context.Background(), starboardCM)
@@ -111,7 +111,7 @@ var _ = BeforeSuite(func() {
 			Name:      starboard.GetPluginConfigMapName("Conftest"),
 		},
 		Data: map[string]string{
-			"conftest.imageRef": "docker.io/openpolicyagent/conftest:v0.28.2",
+			"conftest.imageRef": "docker.io/openpolicyagent/conftest:v0.30.0",
 
 			"conftest.policy.runs_as_root.rego":              runAsRootPolicy,
 			"conftest.policy.runs_as_root.kinds":             "Workload",
diff --git a/itest/starboard-operator/suite_test.go b/itest/starboard-operator/suite_test.go
index 61bd4fc..01634de 100644
--- a/itest/starboard-operator/suite_test.go
+++ b/itest/starboard-operator/suite_test.go
@@ -66,9 +66,8 @@ var _ = BeforeSuite(func() {
 		AssertTimeout:         3 * time.Minute,
 		PrimaryNamespace:      corev1.NamespaceDefault,
 		PrimaryWorkloadPrefix: "wordpress",
-
-		Client: kubeClient,
-		Helper: helper.NewHelper(kubeClient),
+		Client:                kubeClient,
+		Helper:                helper.NewHelper(kubeClient),
 	}
 
 	startCtx, stopFunc = context.WithCancel(context.Background())
diff --git a/itest/starboard/suite_test.go b/itest/starboard/suite_test.go
index e326eec..7b6d5aa 100644
--- a/itest/starboard/suite_test.go
+++ b/itest/starboard/suite_test.go
@@ -47,7 +47,7 @@ var (
 			Namespace: "starboard",
 		},
 		Data: map[string]string{
-			"conftest.imageRef":                  "docker.io/openpolicyagent/conftest:v0.28.2",
+			"conftest.imageRef":                  "docker.io/openpolicyagent/conftest:v0.30.0",
 			"conftest.policy.runs_as_root.kinds": "Workload",
 			"conftest.policy.runs_as_root.rego": `
 	package main
diff --git a/pkg/plugin/conftest/plugin.go b/pkg/plugin/conftest/plugin.go
index 42bf1c2..848ed21 100644
--- a/pkg/plugin/conftest/plugin.go
+++ b/pkg/plugin/conftest/plugin.go
@@ -221,7 +221,7 @@ func (p *plugin) IsApplicable(ctx starboard.PluginContext, obj client.Object) (b
 func (p *plugin) Init(ctx starboard.PluginContext) error {
 	return ctx.EnsureConfig(starboard.PluginConfig{
 		Data: map[string]string{
-			keyImageRef:                "openpolicyagent/conftest:v0.28.2",
+			keyImageRef:                "openpolicyagent/conftest:v0.30.0",
 			keyResourcesRequestsCPU:    "50m",
 			keyResourcesRequestsMemory: "50M",
 			keyResourcesLimitsCPU:      "300m",
diff --git a/pkg/plugin/conftest/plugin_test.go b/pkg/plugin/conftest/plugin_test.go
index 1eba29a..a4c7832 100644
--- a/pkg/plugin/conftest/plugin_test.go
+++ b/pkg/plugin/conftest/plugin_test.go
@@ -178,7 +178,7 @@ func TestPlugin_IsApplicable(t *testing.T) {
 		{
 			name: "Should return false if there are no policies",
 			configData: map[string]string{
-				"conftest.imageRef": "openpolicyagent/conftest:v0.28.2",
+				"conftest.imageRef": "openpolicyagent/conftest:v0.30.0",
 			},
 			obj: &corev1.Pod{
 				TypeMeta: metav1.TypeMeta{
@@ -191,7 +191,7 @@ func TestPlugin_IsApplicable(t *testing.T) {
 		{
 			name: "Should return true if there is at least one policy",
 			configData: map[string]string{
-				"conftest.imageRef":                "openpolicyagent/conftest:v0.28.2",
+				"conftest.imageRef":                "openpolicyagent/conftest:v0.30.0",
 				"conftest.policy.kubernetes.kinds": "Pod",
 				"conftest.policy.kubernetes.rego": `package main
 
@@ -285,7 +285,7 @@ func TestPlugin_Init(t *testing.T) {
 				ResourceVersion: "1",
 			},
 			Data: map[string]string{
-				"conftest.imageRef":                  "openpolicyagent/conftest:v0.28.2",
+				"conftest.imageRef":                  "openpolicyagent/conftest:v0.30.0",
 				"conftest.resources.requests.cpu":    "50m",
 				"conftest.resources.requests.memory": "50M",
 				"conftest.resources.limits.cpu":      "300m",
@@ -305,7 +305,7 @@ func TestPlugin_Init(t *testing.T) {
 					ResourceVersion: "0",
 				},
 				Data: map[string]string{
-					"conftest.imageRef": "openpolicyagent/conftest:v0.28.2",
+					"conftest.imageRef": "openpolicyagent/conftest:v0.30.0",
 				},
 			}).Build()
 
@@ -337,7 +337,7 @@ func TestPlugin_Init(t *testing.T) {
 				ResourceVersion: "0",
 			},
 			Data: map[string]string{
-				"conftest.imageRef": "openpolicyagent/conftest:v0.28.2",
+				"conftest.imageRef": "openpolicyagent/conftest:v0.30.0",
 			},
 		}))
 	})
@@ -607,7 +607,7 @@ func TestPlugin_ParseConfigAuditReportData(t *testing.T) {
 				Namespace: "starboard-ns",
 			},
 			Data: map[string]string{
-				"conftest.imageRef": "openpolicyagent/conftest:v0.28.2",
+				"conftest.imageRef": "openpolicyagent/conftest:v0.30.0",
 			},
 		}).Build()).
 		Get()
@@ -628,7 +628,7 @@ func TestPlugin_ParseConfigAuditReportData(t *testing.T) {
 		"Scanner": Equal(v1alpha1.Scanner{
 			Name:    "Conftest",
 			Vendor:  "Open Policy Agent",
-			Version: "v0.28.2",
+			Version: "v0.30.0",
 		}),
 		"Summary": Equal(v1alpha1.ConfigAuditSummary{
 			DangerCount:  6,
diff --git a/pkg/plugin/trivy/plugin_test.go b/pkg/plugin/trivy/plugin_test.go
index 93b17c5..6f6ae60 100644
--- a/pkg/plugin/trivy/plugin_test.go
+++ b/pkg/plugin/trivy/plugin_test.go
@@ -132,23 +132,23 @@ func TestConfig_GetCommand(t *testing.T) {
 					"trivy.command": "image",
 				},
 			}},
-			expectedCommand: trivy.ImageScan,
+			expectedCommand: trivy.Image,
 		},
 		{
 			name: "Should return image when value is not set",
 			configData: trivy.Config{PluginConfig: starboard.PluginConfig{
 				Data: map[string]string{},
 			}},
-			expectedCommand: trivy.ImageScan,
+			expectedCommand: trivy.Image,
 		},
 		{
-			name: "Should return fs",
+			name: "Should return filesystem",
 			configData: trivy.Config{PluginConfig: starboard.PluginConfig{
 				Data: map[string]string{
-					"trivy.command": "fs",
+					"trivy.command": "filesystem",
 				},
 			}},
-			expectedCommand: trivy.FileSystemScan,
+			expectedCommand: trivy.Filesystem,
 		},
 		{
 			name: "Should return error when value is not allowed",
@@ -157,7 +157,7 @@ func TestConfig_GetCommand(t *testing.T) {
 					"trivy.command": "ls",
 				},
 			}},
-			expectedError: "invalid value (ls) of trivy.command; allowed values (image, fs)",
+			expectedError: "invalid value (ls) of trivy.command; allowed values (image, filesystem)",
 		},
 	}
 	for _, tc := range testCases {
@@ -362,7 +362,7 @@ func TestConfig_GetInsecureRegistries(t *testing.T) {
 	}
 }
 
-func TestConfig_GetNonSslRegistries(t *testing.T) {
+func TestConfig_GetNonSSLRegistries(t *testing.T) {
 	testCases := []struct {
 		name           string
 		configData     trivy.Config
@@ -395,7 +395,7 @@ func TestConfig_GetNonSslRegistries(t *testing.T) {
 
 	for _, tc := range testCases {
 		t.Run(tc.name, func(t *testing.T) {
-			nonSslRegistries := tc.configData.GetNonSslRegistries()
+			nonSslRegistries := tc.configData.GetNonSSLRegistries()
 			assert.Equal(t, tc.expectedOutput, nonSslRegistries)
 		})
 	}
@@ -470,7 +470,7 @@ func TestPlugin_Init(t *testing.T) {
 				ResourceVersion: "1",
 			},
 			Data: map[string]string{
-				"trivy.imageRef": "docker.io/aquasec/trivy:0.22.0",
+				"trivy.imageRef": "docker.io/aquasec/trivy:0.23.0",
 				"trivy.severity": "UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL",
 				"trivy.mode":     "Standalone",
 
@@ -495,7 +495,7 @@ func TestPlugin_Init(t *testing.T) {
 					ResourceVersion: "1",
 				},
 				Data: map[string]string{
-					"trivy.imageRef": "docker.io/aquasec/trivy:0.22.0",
+					"trivy.imageRef": "docker.io/aquasec/trivy:0.23.0",
 					"trivy.severity": "UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL",
 					"trivy.mode":     "Standalone",
 				},
@@ -529,7 +529,7 @@ func TestPlugin_Init(t *testing.T) {
 				ResourceVersion: "1",
 			},
 			Data: map[string]string{
-				"trivy.imageRef": "docker.io/aquasec/trivy:0.22.0",
+				"trivy.imageRef": "docker.io/aquasec/trivy:0.23.0",
 				"trivy.severity": "UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL",
 				"trivy.mode":     "Standalone",
 			},
@@ -539,6 +539,21 @@ func TestPlugin_Init(t *testing.T) {
 
 func TestPlugin_GetScanJobSpec(t *testing.T) {
 
+	tmpVolume := corev1.Volume{
+		Name: "tmp",
+		VolumeSource: corev1.VolumeSource{
+			EmptyDir: &corev1.EmptyDirVolumeSource{
+				Medium: corev1.StorageMediumDefault,
+			},
+		},
+	}
+
+	tmpVolumeMount := corev1.VolumeMount{
+		Name:      "tmp",
+		MountPath: "/tmp",
+		ReadOnly:  false,
+	}
+
 	testCases := []struct {
 		name string
 
@@ -587,14 +602,7 @@ func TestPlugin_GetScanJobSpec(t *testing.T) {
 				ServiceAccountName:           "starboard-sa",
 				AutomountServiceAccountToken: pointer.BoolPtr(false),
 				Volumes: []corev1.Volume{
-					{
-						Name: "data",
-						VolumeSource: corev1.VolumeSource{
-							EmptyDir: &corev1.EmptyDirVolumeSource{
-								Medium: corev1.StorageMediumDefault,
-							},
-						},
-					},
+					tmpVolume,
 				},
 				InitContainers: []corev1.Container{
 					{
@@ -657,7 +665,7 @@ func TestPlugin_GetScanJobSpec(t *testing.T) {
 							"trivy",
 						},
 						Args: []string{
-							"--cache-dir", "/var/lib/trivy",
+							"--cache-dir", "/tmp/trivy/.cache",
 							"image",
 							"--download-db-only",
 						},
@@ -672,11 +680,7 @@ func TestPlugin_GetScanJobSpec(t *testing.T) {
 							},
 						},
 						VolumeMounts: []corev1.VolumeMount{
-							{
-								Name:      "data",
-								MountPath: "/var/lib/trivy",
-								ReadOnly:  false,
-							},
+							tmpVolumeMount,
 						},
 					},
 				},
@@ -776,7 +780,7 @@ func TestPlugin_GetScanJobSpec(t *testing.T) {
 							"trivy",
 						},
 						Args: []string{
-							"--cache-dir", "/var/lib/trivy",
+							"--cache-dir", "/tmp/trivy/.cache",
 							"--quiet",
 							"image",
 							"--skip-update",
@@ -794,11 +798,7 @@ func TestPlugin_GetScanJobSpec(t *testing.T) {
 							},
 						},
 						VolumeMounts: []corev1.VolumeMount{
-							{
-								Name:      "data",
-								ReadOnly:  false,
-								MountPath: "/var/lib/trivy",
-							},
+							tmpVolumeMount,
 						},
 						SecurityContext: &corev1.SecurityContext{
 							Privileged:               pointer.BoolPtr(false),
@@ -848,14 +848,7 @@ func TestPlugin_GetScanJobSpec(t *testing.T) {
 				ServiceAccountName:           "starboard-sa",
 				AutomountServiceAccountToken: pointer.BoolPtr(false),
 				Volumes: []corev1.Volume{
-					{
-						Name: "data",
-						VolumeSource: corev1.VolumeSource{
-							EmptyDir: &corev1.EmptyDirVolumeSource{
-								Medium: corev1.StorageMediumDefault,
-							},
-						},
-					},
+					tmpVolume,
 				},
 				InitContainers: []corev1.Container{
 					{
@@ -917,7 +910,7 @@ func TestPlugin_GetScanJobSpec(t *testing.T) {
 							"trivy",
 						},
 						Args: []string{
-							"--cache-dir", "/var/lib/trivy",
+							"--cache-dir", "/tmp/trivy/.cache",
 							"image",
 							"--download-db-only",
 						},
@@ -932,11 +925,7 @@ func TestPlugin_GetScanJobSpec(t *testing.T) {
 							},
 						},
 						VolumeMounts: []corev1.VolumeMount{
-							{
-								Name:      "data",
-								MountPath: "/var/lib/trivy",
-								ReadOnly:  false,
-							},
+							tmpVolumeMount,
 						},
 					},
 				},
@@ -1040,7 +1029,7 @@ func TestPlugin_GetScanJobSpec(t *testing.T) {
 							"trivy",
 						},
 						Args: []string{
-							"--cache-dir", "/var/lib/trivy",
+							"--cache-dir", "/tmp/trivy/.cache",
 							"--quiet",
 							"image",
 							"--skip-update",
@@ -1058,11 +1047,7 @@ func TestPlugin_GetScanJobSpec(t *testing.T) {
 							},
 						},
 						VolumeMounts: []corev1.VolumeMount{
-							{
-								Name:      "data",
-								ReadOnly:  false,
-								MountPath: "/var/lib/trivy",
-							},
+							tmpVolumeMount,
 						},
 						SecurityContext: &corev1.SecurityContext{
 							Privileged:               pointer.BoolPtr(false),
@@ -1112,14 +1097,7 @@ func TestPlugin_GetScanJobSpec(t *testing.T) {
 				ServiceAccountName:           "starboard-sa",
 				AutomountServiceAccountToken: pointer.BoolPtr(false),
 				Volumes: []corev1.Volume{
-					{
-						Name: "data",
-						VolumeSource: corev1.VolumeSource{
-							EmptyDir: &corev1.EmptyDirVolumeSource{
-								Medium: corev1.StorageMediumDefault,
-							},
-						},
-					},
+					tmpVolume,
 				},
 				InitContainers: []corev1.Container{
 					{
@@ -1181,7 +1159,7 @@ func TestPlugin_GetScanJobSpec(t *testing.T) {
 							"trivy",
 						},
 						Args: []string{
-							"--cache-dir", "/var/lib/trivy",
+							"--cache-dir", "/tmp/trivy/.cache",
 							"image",
 							"--download-db-only",
 						},
@@ -1196,11 +1174,7 @@ func TestPlugin_GetScanJobSpec(t *testing.T) {
 							},
 						},
 						VolumeMounts: []corev1.VolumeMount{
-							{
-								Name:      "data",
-								MountPath: "/var/lib/trivy",
-								ReadOnly:  false,
-							},
+							tmpVolumeMount,
 						},
 					},
 				},
@@ -1304,7 +1278,7 @@ func TestPlugin_GetScanJobSpec(t *testing.T) {
 							"trivy",
 						},
 						Args: []string{
-							"--cache-dir", "/var/lib/trivy",
+							"--cache-dir", "/tmp/trivy/.cache",
 							"--quiet",
 							"image",
 							"--skip-update",
@@ -1322,11 +1296,7 @@ func TestPlugin_GetScanJobSpec(t *testing.T) {
 							},
 						},
 						VolumeMounts: []corev1.VolumeMount{
-							{
-								Name:      "data",
-								ReadOnly:  false,
-								MountPath: "/var/lib/trivy",
-							},
+							tmpVolumeMount,
 						},
 						SecurityContext: &corev1.SecurityContext{
 							Privileged:               pointer.BoolPtr(false),
@@ -1380,14 +1350,7 @@ CVE-2019-1543`,
 				ServiceAccountName:           "starboard-sa",
 				AutomountServiceAccountToken: pointer.BoolPtr(false),
 				Volumes: []corev1.Volume{
-					{
-						Name: "data",
-						VolumeSource: corev1.VolumeSource{
-							EmptyDir: &corev1.EmptyDirVolumeSource{
-								Medium: corev1.StorageMediumDefault,
-							},
-						},
-					},
+					tmpVolume,
 					{
 						Name: "ignorefile",
 						VolumeSource: corev1.VolumeSource{
@@ -1448,7 +1411,6 @@ CVE-2019-1543`,
 									},
 								},
 							},
-
 							{
 								Name: "GITHUB_TOKEN",
 								ValueFrom: &corev1.EnvVarSource{
@@ -1466,7 +1428,7 @@ CVE-2019-1543`,
 							"trivy",
 						},
 						Args: []string{
-							"--cache-dir", "/var/lib/trivy",
+							"--cache-dir", "/tmp/trivy/.cache",
 							"image",
 							"--download-db-only",
 						},
@@ -1481,11 +1443,7 @@ CVE-2019-1543`,
 							},
 						},
 						VolumeMounts: []corev1.VolumeMount{
-							{
-								Name:      "data",
-								MountPath: "/var/lib/trivy",
-								ReadOnly:  false,
-							},
+							tmpVolumeMount,
 						},
 					},
 				},
@@ -1582,14 +1540,14 @@ CVE-2019-1543`,
 							},
 							{
 								Name:  "TRIVY_IGNOREFILE",
-								Value: "/tmp/trivy/.trivyignore",
+								Value: "/etc/trivy/.trivyignore",
 							},
 						},
 						Command: []string{
 							"trivy",
 						},
 						Args: []string{
-							"--cache-dir", "/var/lib/trivy",
+							"--cache-dir", "/tmp/trivy/.cache",
 							"--quiet",
 							"image",
 							"--skip-update",
@@ -1607,14 +1565,10 @@ CVE-2019-1543`,
 							},
 						},
 						VolumeMounts: []corev1.VolumeMount{
-							{
-								Name:      "data",
-								ReadOnly:  false,
-								MountPath: "/var/lib/trivy",
-							},
+							tmpVolumeMount,
 							{
 								Name:      "ignorefile",
-								MountPath: "/tmp/trivy/.trivyignore",
+								MountPath: "/etc/trivy/.trivyignore",
 								SubPath:   ".trivyignore",
 							},
 						},
@@ -1668,14 +1622,7 @@ CVE-2019-1543`,
 				ServiceAccountName:           "starboard-sa",
 				AutomountServiceAccountToken: pointer.BoolPtr(false),
 				Volumes: []corev1.Volume{
-					{
-						Name: "data",
-						VolumeSource: corev1.VolumeSource{
-							EmptyDir: &corev1.EmptyDirVolumeSource{
-								Medium: corev1.StorageMediumDefault,
-							},
-						},
-					},
+					tmpVolume,
 				},
 				InitContainers: []corev1.Container{
 					{
@@ -1738,7 +1685,7 @@ CVE-2019-1543`,
 							"trivy",
 						},
 						Args: []string{
-							"--cache-dir", "/var/lib/trivy",
+							"--cache-dir", "/tmp/trivy/.cache",
 							"image",
 							"--download-db-only",
 						},
@@ -1753,11 +1700,7 @@ CVE-2019-1543`,
 							},
 						},
 						VolumeMounts: []corev1.VolumeMount{
-							{
-								Name:      "data",
-								MountPath: "/var/lib/trivy",
-								ReadOnly:  false,
-							},
+							tmpVolumeMount,
 						},
 					},
 				},
@@ -1857,7 +1800,7 @@ CVE-2019-1543`,
 							"trivy",
 						},
 						Args: []string{
-							"--cache-dir", "/var/lib/trivy",
+							"--cache-dir", "/tmp/trivy/.cache",
 							"--quiet",
 							"image",
 							"--skip-update",
@@ -1875,11 +1818,7 @@ CVE-2019-1543`,
 							},
 						},
 						VolumeMounts: []corev1.VolumeMount{
-							{
-								Name:      "data",
-								ReadOnly:  false,
-								MountPath: "/var/lib/trivy",
-							},
+							tmpVolumeMount,
 						},
 						SecurityContext: &corev1.SecurityContext{
 							Privileged:               pointer.BoolPtr(false),
@@ -2654,7 +2593,7 @@ CVE-2019-1543`,
 							},
 							{
 								Name:  "TRIVY_IGNOREFILE",
-								Value: "/tmp/trivy/.trivyignore",
+								Value: "/etc/trivy/.trivyignore",
 							},
 						},
 						Command: []string{
@@ -2682,7 +2621,7 @@ CVE-2019-1543`,
 						VolumeMounts: []corev1.VolumeMount{
 							{
 								Name:      "ignorefile",
-								MountPath: "/tmp/trivy/.trivyignore",
+								MountPath: "/etc/trivy/.trivyignore",
 								SubPath:   ".trivyignore",
 							},
 						},
@@ -2693,9 +2632,9 @@ CVE-2019-1543`,
 		{
 			name: "Trivy fs scan command in Standalone mode",
 			config: map[string]string{
-				"trivy.imageRef":                  "docker.io/aquasec/trivy:0.22.0",
+				"trivy.imageRef":                  "docker.io/aquasec/trivy:0.23.0",
 				"trivy.mode":                      string(trivy.Standalone),
-				"trivy.command":                   string(trivy.FileSystemScan),
+				"trivy.command":                   string(trivy.Filesystem),
 				"trivy.resources.requests.cpu":    "100m",
 				"trivy.resources.requests.memory": "100M",
 				"trivy.resources.limits.cpu":      "500m",
@@ -2737,7 +2676,7 @@ CVE-2019-1543`,
 				InitContainers: []corev1.Container{
 					{
 						Name:                     "00000000-0000-0000-0000-000000000001",
-						Image:                    "docker.io/aquasec/trivy:0.22.0",
+						Image:                    "docker.io/aquasec/trivy:0.23.0",
 						ImagePullPolicy:          corev1.PullIfNotPresent,
 						TerminationMessagePolicy: corev1.TerminationMessageFallbackToLogsOnError,
 						Command: []string{
@@ -2766,7 +2705,7 @@ CVE-2019-1543`,
 					},
 					{
 						Name:                     "00000000-0000-0000-0000-000000000002",
-						Image:                    "docker.io/aquasec/trivy:0.22.0",
+						Image:                    "docker.io/aquasec/trivy:0.23.0",
 						ImagePullPolicy:          corev1.PullIfNotPresent,
 						TerminationMessagePolicy: corev1.TerminationMessageFallbackToLogsOnError,
 						Env: []corev1.EnvVar{