Skip to content

Ignore trivy CRD objects by default #24969

@hronecviktor

Description

@hronecviktor

Is your feature request related to a problem?

Deploying trivy alongside argocd can result in non-trivial increase in RAM usage for application-controller pods.
This can incur extra costs or stability issues (application-controller pod has no default resources specified).
Case of this being an issue: https://cloud-native.slack.com/archives/C01TSERG0KZ/p1760521753256809

Related helm chart

argo-cd

Describe the solution you'd like

Include trivy CRDs into defaults for configs.cm."resource.exclusions":

              - apiGroups:
                - aquasecurity.github.io
                kinds:
                - ClusterComplianceReport
                - ClusterConfigAuditReport
                - ClusterInfraAssessmentReport
                - ClusterRbacAssessmentReport
                - ClusterSbomReport
                - ClusterVulnerabilityReport
                - ConfigAuditReport
                - ExposedSecretReport
                - InfraAssessmentReport
                - RbacAssessmentReport
                - SbomReport
                - VulnerabilityReport

These objects are created and managed by Trivy operator and I don't see a reason why argo should watch them.

Describe alternatives you've considered

No response

Additional context

No response

Metadata

Metadata

Assignees

No one assigned

    Labels

    enhancementNew feature or request

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions