How to set SbomReport TTL

[srekkas]

I installed trivy-operator with helm chart.
Everything works, but old SbomReports is kept and cause high Kubernetes API latency.

Helm values

serviceMonitor:
    # -- enabled determines whether a serviceMonitor should be deployed
    enabled: true

  nodeCollector:
    excludeNodes: "node-role.kubernetes.io/control-plane=,node-role.kubernetes.io/control-plane=true"

  trivy:
    ignoreUnfixed: false
    storageSize: "2Gi" # Trivy server PVC size
    server:
      # -- resources set trivy-server resource
      resources:
        requests:
          cpu: 10m
          memory: 64Mi
        limits:
          cpu: 200m
          memory: 256Gi

  operator:
    builtInTrivyServer: true
    scannerReportTTL: "12h"
    configAuditScannerEnabled: false
    rbacAssessmentScannerEnabled: false
    infraAssessmentScannerEnabled: false
    clusterComplianceEnabled: false
    metricsVulnIdEnabled: true
    exposedSecretScannerEnabled: false
    metricsExposedSecretInfo: false
    metricsConfigAuditInfo: false
    metricsRbacAssessmentInfo: false
    metricsInfraAssessmentInfo: false
    metricsImageInfo: false
    metricsClusterComplianceInfo: false

SbomReport example

apiVersion: aquasecurity.github.io/v1alpha1
kind: SbomReport
metadata:
  annotations:
    trivy-operator.aquasecurity.github.io/report-ttl: 0s

[afdesk]

@srekkas did you try to set cacheReportTTL?

https://github.com/aquasecurity/trivy-operator/blob/main/deploy/helm/values.yaml#L100

[srekkas]

As i am using helm chart, i think it is set 120h as default. Added to my values file to be sure.