harborのtrivyを削除

[Kentaro1043]

セキュリティスキャンが重いため

[github-actions]

Diff

@@ data.WITH_TRIVY @@
# v1/ConfigMap/harbor/harbor-core
! ± value change
- true
+ false

@@ spec.template.metadata.annotations.checksum/configmap @@
# apps/v1/Deployment/harbor/harbor-core
! ± value change
- e21c3499e10958f5a183a72b8411d24fd86a36ce821af652670c1ef4174577a0
+ 343b227a0cae327426b66706849f0e35e58a6e973c7bb2dbccc4fc82d41ece44

@@ (root level) @@
# v1/Secret/harbor/harbor-trivy
! - one document removed:
- ---
- type: Opaque
- apiVersion: v1
- data: {}
- kind: Secret
- metadata:
-   name: harbor-trivy
-   namespace: harbor
-   labels:
-     app: harbor
-     app.kubernetes.io/instance: harbor
-     app.kubernetes.io/managed-by: Helm
-     app.kubernetes.io/name: harbor
-     app.kubernetes.io/part-of: harbor
-     app.kubernetes.io/version: 2.14.0
-     chart: harbor
-     heritage: Helm
-     release: harbor

@@ (root level) @@
# v1/Service/harbor/harbor-trivy
! - one document removed:
- ---
- apiVersion: v1
- kind: Service
- metadata:
-   name: harbor-trivy
-   namespace: harbor
-   labels:
-     app: harbor
-     app.kubernetes.io/instance: harbor
-     app.kubernetes.io/managed-by: Helm
-     app.kubernetes.io/name: harbor
-     app.kubernetes.io/part-of: harbor
-     app.kubernetes.io/version: 2.14.0
-     chart: harbor
-     heritage: Helm
-     release: harbor
- spec:
-   ports:
-   - name: http-trivy
-     port: 8080
-     protocol: TCP
-   selector:
-     app: harbor
-     component: trivy
-     release: harbor

@@ (root level) @@
# apps/v1/StatefulSet/harbor/harbor-trivy
! - one document removed:
- ---
- apiVersion: apps/v1
- kind: StatefulSet
- metadata:
-   name: harbor-trivy
-   namespace: harbor
-   labels:
-     app: harbor
-     app.kubernetes.io/component: trivy
-     app.kubernetes.io/instance: harbor
-     app.kubernetes.io/managed-by: Helm
-     app.kubernetes.io/name: harbor
-     app.kubernetes.io/part-of: harbor
-     app.kubernetes.io/version: 2.14.0
-     chart: harbor
-     component: trivy
-     heritage: Helm
-     release: harbor
- spec:
-   replicas: 1
-   selector:
-     matchLabels:
-       app: harbor
-       component: trivy
-       release: harbor
-   serviceName: harbor-trivy
-   template:
-     metadata:
-       annotations:
-         checksum/secret: 7fed78c063b47fa17033c6700702ca8ca1ef373f5e15b7af1df8133fbdad0bff
-       labels:
-         app: harbor
-         app.kubernetes.io/component: trivy
-         app.kubernetes.io/instance: harbor
-         app.kubernetes.io/managed-by: Helm
-         app.kubernetes.io/name: harbor
-         app.kubernetes.io/part-of: harbor
-         app.kubernetes.io/version: 2.14.0
-         chart: harbor
-         component: trivy
-         heritage: Helm
-         release: harbor
-     spec:
-       automountServiceAccountToken: false
-       containers:
-       - name: trivy
-         image: "goharbor/trivy-adapter-photon:v2.14.0"
-         imagePullPolicy: Always
-         livenessProbe:
-           failureThreshold: 10
-           httpGet:
-             path: /probe/healthy
-             port: api-server
-             scheme: HTTP
-           initialDelaySeconds: 5
-           periodSeconds: 10
-           successThreshold: 1
-         ports:
-         - name: api-server
-           containerPort: 8080
-         readinessProbe:
-           failureThreshold: 3
-           httpGet:
-             path: /probe/ready
-             port: api-server
-             scheme: HTTP
-           initialDelaySeconds: 5
-           periodSeconds: 10
-           successThreshold: 1
-         resources:
-           limits:
-             cpu: 1
-             memory: 500Mi
-           requests:
-             cpu: 10m
-             memory: 20Mi
-         volumeMounts:
-         - name: data
-           mountPath: /home/scanner/.cache
-           readOnly: false
-           subPath: null
-         securityContext:
-           allowPrivilegeEscalation: false
-           capabilities:
-             drop:
-             - ALL
-           privileged: false
-           runAsNonRoot: true
-           seccompProfile:
-             type: RuntimeDefault
-         env:
-         - name: HTTP_PROXY
-           value: 
-         - name: HTTPS_PROXY
-           value: 
-         - name: NO_PROXY
-           value: "harbor-core,harbor-jobservice,harbor-database,harbor-registry,harbor-portal,harbor-trivy,harbor-exporter,127.0.0.1,localhost,.local,.internal"
-         - name: SCANNER_LOG_LEVEL
-           value: info
-         - name: SCANNER_TRIVY_CACHE_DIR
-           value: /home/scanner/.cache/trivy
-         - name: SCANNER_TRIVY_REPORTS_DIR
-           value: /home/scanner/.cache/reports
-         - name: SCANNER_TRIVY_DEBUG_MODE
-           value: "false"
-         - name: SCANNER_TRIVY_VULN_TYPE
-           value: "os,library"
-         - name: SCANNER_TRIVY_TIMEOUT
-           value: 5m0s
-         - name: SCANNER_TRIVY_GITHUB_TOKEN
-           valueFrom:
-             secretKeyRef:
-               name: harbor-trivy
-               key: gitHubToken
-         - name: SCANNER_TRIVY_SEVERITY
-           value: "UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL"
-         - name: SCANNER_TRIVY_IGNORE_UNFIXED
-           value: "false"
-         - name: SCANNER_TRIVY_SKIP_UPDATE
-           value: "false"
-         - name: SCANNER_TRIVY_SKIP_JAVA_DB_UPDATE
-           value: "false"
-         - name: SCANNER_TRIVY_DB_REPOSITORY
-           value: "mirror.gcr.io/aquasec/trivy-db,ghcr.io/aquasecurity/trivy-db"
-         - name: SCANNER_TRIVY_JAVA_DB_REPOSITORY
-           value: "mirror.gcr.io/aquasec/trivy-java-db,ghcr.io/aquasecurity/trivy-java-db"
-         - name: SCANNER_TRIVY_OFFLINE_SCAN
-           value: "false"
-         - name: SCANNER_TRIVY_SECURITY_CHECKS
-           value: vuln
-         - name: SCANNER_TRIVY_INSECURE
-           value: "false"
-         - name: SCANNER_API_SERVER_ADDR
-           value: ":8080"
-         - name: SCANNER_REDIS_URL
-           valueFrom:
-             secretKeyRef:
-               name: harbor-trivy
-               key: redisURL
-         - name: SCANNER_STORE_REDIS_URL
-           valueFrom:
-             secretKeyRef:
-               name: harbor-trivy
-               key: redisURL
-         - name: SCANNER_JOB_QUEUE_REDIS_URL
-           valueFrom:
-             secretKeyRef:
-               name: harbor-trivy
-               key: redisURL
-       nodeSelector:
-         kubernetes.io/hostname: c1-203.tokyotech.org
-       securityContext:
-         fsGroup: 10000
-         runAsUser: 10000
-   volumeClaimTemplates:
-   - apiVersion: v1
-     kind: PersistentVolumeClaim
-     metadata:
-       name: data
-       annotations: null
-       labels:
-         app: harbor
-         chart: harbor
-         heritage: Helm
-         release: harbor
-     spec:
-       resources:
-         requests:
-           storage: 5Gi
-       accessModes:
-       - ReadWriteOnce