Helm chart issues with persistent volumes about harbor-scanner-trivy HOT 4 CLOSED

Hi @svanschie . Thank you for trying out Trivy adapter and opening the issue.
Just for my understanding, you mentioned .cache directory that's not writable. Are you referring to /home/scanner/.cache directory? I believe this one should be writable by uid 1000 as its home directory.

from harbor-scanner-trivy.

Hi @danielpacak, yes I meant the /home/scanner/.cache directory. For me this wasn't writable by uid 1000 by default. By setting the fsGroup=1000 on pod level, this resolved the issue. I'm not sure, but perhaps this depends on the storage driver used for persistent storage, we are using Portworx. Most Helm charts seem to use fsGroup by default when using persistent volumes.

Perhaps it would be better to make the securityContext (both on pod and container level) fully configurable through the values file and setting the currently used values as defaults there. What do you think?

from harbor-scanner-trivy.

Hi @danielpacak, yes I meant the /home/scanner/.cache directory. For me this wasn't writable by uid 1000 by default. By setting the fsGroup=1000 on pod level, this resolved the issue. I'm not sure, but perhaps this depends on the storage driver used for persistent storage, we are using Portworx. Most Helm charts seem to use fsGroup by default when using persistent volumes.

Perhaps it would be better to make the securityContext (both on pod and container level) fully configurable through the values file and setting the currently used values as defaults there. What do you think?

Got your point. Let's set fsGroup to resolve your main issue in the first run. And I'm okey with making securityContext configurable with Helm values.

from harbor-scanner-trivy.

Resolved by #70

from harbor-scanner-trivy.