diff --git a/charts/zora/Chart.yaml b/charts/zora/Chart.yaml index 54ed77c..14337f2 100644 --- a/charts/zora/Chart.yaml +++ b/charts/zora/Chart.yaml @@ -17,7 +17,7 @@ name: zora description: A multi-plugin solution that reports misconfigurations and vulnerabilities by scanning your cluster at scheduled times. icon: https://zora-docs.undistro.io/v0.7/assets/logo.svg type: application -version: 0.10.1 -appVersion: "v0.10.1" +version: 0.10.2-rc1 +appVersion: "v0.10.2-rc1" sources: - https://github.com/undistro/zora diff --git a/charts/zora/README.md b/charts/zora/README.md index 774df5a..583929c 100644 --- a/charts/zora/README.md +++ b/charts/zora/README.md @@ -123,6 +123,7 @@ The following table lists the configurable parameters of the Zora chart and thei | scan.plugins.trivy.envFrom | list | `[]` | List of sources to populate environment variables in trivy container. | | scan.plugins.trivy.timeout | string | `"10m"` | Trivy timeout | | scan.plugins.trivy.insecure | bool | `false` | Allow insecure server connections for Trivy | +| scan.plugins.trivy.fsGroup | int | `nil` | Trivy fsGroup. Should be greater than 0. | | scan.plugins.trivy.persistence.enabled | bool | `true` | Specifies whether Trivy vulnerabilities database should be persisted between the scans, using PersistentVolumeClaim | | scan.plugins.trivy.persistence.accessMode | string | `"ReadWriteOnce"` | [Persistence access mode](https://kubernetes.io/docs/concepts/storage/persistent-volumes/#access-modes) | | scan.plugins.trivy.persistence.storageClass | string | `""` | [Persistence storage class](https://kubernetes.io/docs/concepts/storage/storage-classes/). Set to empty for default storage class | diff --git a/charts/zora/templates/operator/deployment.yaml b/charts/zora/templates/operator/deployment.yaml index 46c0ea6..8f45362 100644 --- a/charts/zora/templates/operator/deployment.yaml +++ b/charts/zora/templates/operator/deployment.yaml @@ -105,6 +105,7 @@ spec: - --cronjob-clusterrolebinding-name=zora-plugins-rolebinding - --cronjob-serviceaccount-name=zora-plugins - --trivy-db-pvc={{- if .Values.scan.plugins.trivy.persistence.enabled }}trivy-db-volume{{- end }} + - --trivy-fs-group={{- if .Values.scan.plugins.trivy.fsGroup }}{{ .Values.scan.plugins.trivy.fsGroup }}{{- else }}0{{- end}} {{- if .Values.scan.plugins.annotations}} - --cronjob-serviceaccount-annotations={{ $first := true }}{{- range $key, $value := .Values.scan.plugins.annotations }}{{if not $first}},{{else}}{{$first = false}}{{end}}{{ $key }}={{$value}}{{- end }} {{- end }} diff --git a/charts/zora/templates/plugins/trivy-job.yaml b/charts/zora/templates/plugins/trivy-job.yaml index 093556c..8e18650 100644 --- a/charts/zora/templates/plugins/trivy-job.yaml +++ b/charts/zora/templates/plugins/trivy-job.yaml @@ -25,6 +25,10 @@ spec: - name: trivy-db persistentVolumeClaim: claimName: trivy-db-volume + {{- if .Values.scan.plugins.trivy.fsGroup }} + securityContext: + fsGroup: {{ .Values.scan.plugins.trivy.fsGroup }} + {{- end }} containers: - name: trivy-download-db image: "{{ .Values.scan.plugins.trivy.image.repository }}:{{ .Values.scan.plugins.trivy.image.tag }}" diff --git a/charts/zora/values.yaml b/charts/zora/values.yaml index dec1926..6a5cf90 100644 --- a/charts/zora/values.yaml +++ b/charts/zora/values.yaml @@ -241,6 +241,9 @@ scan: # -- Allow insecure server connections for Trivy insecure: false + # -- (int) Trivy fsGroup. Should be greater than 0. + fsGroup: null + persistence: # -- Specifies whether Trivy vulnerabilities database should be persisted between the scans, using PersistentVolumeClaim enabled: true