build(deps): bump sigstore/cosign-installer from 3.1.0 to 3.1.1 (aqua…

…security#1338)

Bumps [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer) from 3.1.0 to 3.1.1.
- [Release notes](https://github.com/sigstore/cosign-installer/releases)
- [Commits](sigstore/cosign-installer@v3.1.0...v3.1.1)

---
updated-dependencies:
- dependency-name: sigstore/cosign-installer
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

.github/workflows/release-snapshot.yaml

@@ -42,7 +42,7 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-go-
       - name: Install cosign
-        uses: sigstore/cosign-installer@v3.1.0
+        uses: sigstore/cosign-installer@v3.1.1
       - name: Release snapshot
         uses: goreleaser/goreleaser-action@v4
         with:

.github/workflows/release.yaml

@@ -105,7 +105,7 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-go-
       - name: Install cosign
-        uses: sigstore/cosign-installer@v3.1.0
+        uses: sigstore/cosign-installer@v3.1.1
       - name: Login to docker.io registry
         uses: docker/login-action@v2.2.0
         with:

deploy/helm/templates/config.yaml

@@ -93,6 +93,9 @@ metadata:
 data:
   trivy.repository: "{{ required ".Values.trivy.image.registry is required" .Values.trivy.image.registry }}/{{ required ".Values.trivy.image.repository is required" .Values.trivy.image.repository }}"
   trivy.tag: {{ required ".Values.trivy.image.tag is required" .Values.trivy.image.tag | quote }}
+  {{- if .Values.trivy.image.imagePullPolicy }}
+  trivy.imagePullPolicy: {{ .Values.trivy.image.imagePullPolicy | quote }}
+  {{- end }}
   {{- if .Values.trivy.image.imagePullSecret }}
   trivy.imagePullSecret: {{ .Values.trivy.image.imagePullSecret | quote }}
   {{- end }}

deploy/helm/values.yaml

@@ -242,6 +242,8 @@ trivy:
     # -- imagePullSecret is the secret name to be used when pulling trivy image from private registries example : reg-secret
     # It is the user responsibility to create the secret for the private registry in `trivy-operator` namespace
     # imagePullSecret:
+    # -- imagePullPolicy controls when your trivy-image is pulled
+    imagePullPolicy: IfNotPresent
 
   # -- mode is the Trivy client mode. Either Standalone or ClientServer. Depending
   # on the active mode other settings might be applicable or required.

pkg/plugins/trivy/plugin.go

@@ -25,6 +25,7 @@ import (
 	"github.com/aquasecurity/trivy-operator/pkg/trivyoperator"
 	"github.com/aquasecurity/trivy-operator/pkg/vulnerabilityreport"
 	corev1 "k8s.io/api/core/v1"
+	v1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/api/resource"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/utils/pointer"
@@ -50,6 +51,7 @@ const (
 	keyTrivyImageTag        = "trivy.tag"
 	//nolint:gosec
 	keyTrivyImagePullSecret                     = "trivy.imagePullSecret"
+	keyTrivyImagePullPolicy                     = "trivy.imagePullPolicy"
 	keyTrivyMode                                = "trivy.mode"
 	keyTrivyAdditionalVulnerabilityReportFields = "trivy.additionalVulnerabilityReportFields"
 	keyTrivyCommand                             = "trivy.command"
@@ -97,6 +99,7 @@ const (
 
 const (
 	DefaultImageRepository  = "ghcr.io/aquasecurity/trivy"
+	DefaultImagePullPolicy  = "IfNotPresent"
 	DefaultDBRepository     = "ghcr.io/aquasecurity/trivy-db"
 	DefaultJavaDBRepository = "ghcr.io/aquasecurity/trivy-java-db"
 	DefaultSeverity         = "UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL"
@@ -185,6 +188,14 @@ func (c Config) GetImageTag() (string, error) {
 	return tag, nil
 }
 
+func (c Config) GetImagePullPolicy() (string, error) {
+	pullPolicy, err := c.GetRequiredData(keyTrivyImagePullPolicy)
+	if err != nil {
+		return "", err
+	}
+	return pullPolicy, nil
+}
+
 func (c Config) GetImagePullSecret() []corev1.LocalObjectReference {
 	ips, ok := c.Data[keyTrivyImagePullSecret]
 	if !ok {
@@ -553,6 +564,7 @@ func (p *plugin) Init(ctx trivyoperator.PluginContext) error {
 		Data: map[string]string{
 			keyTrivyImageRepository:           DefaultImageRepository,
 			keyTrivyImageTag:                  "0.42.0",
+			keyTrivyImagePullPolicy:           DefaultImagePullPolicy,
 			KeyTrivySeverity:                  DefaultSeverity,
 			keyTrivySlow:                      "true",
 			keyTrivyMode:                      string(Standalone),
@@ -608,6 +620,7 @@ func (p *plugin) GetScanJobSpec(ctx trivyoperator.PluginContext, workload client
 	}
 	// add image pull secret to be used when pulling trivy image fom private registry
 	podSpec.ImagePullSecrets = config.GetImagePullSecret()
+
 	return podSpec, secrets, err
 }
 
@@ -684,6 +697,11 @@ func (p *plugin) getPodSpecForStandaloneMode(ctx trivyoperator.PluginContext, co
 		return corev1.PodSpec{}, nil, err
 	}
 
+	trivyImagePullPolicy, err := config.GetImagePullPolicy()
+	if err != nil {
+		return corev1.PodSpec{}, nil, err
+	}
+
 	trivyConfigName := trivyoperator.GetPluginConfigMapName(Plugin)
 
 	dbRepository, err := config.GetDBRepository()
@@ -851,7 +869,7 @@ func (p *plugin) getPodSpecForStandaloneMode(ctx trivyoperator.PluginContext, co
 		containers = append(containers, corev1.Container{
 			Name:                     c.Name,
 			Image:                    trivyImageRef,
-			ImagePullPolicy:          corev1.PullIfNotPresent,
+			ImagePullPolicy:          v1.PullPolicy(trivyImagePullPolicy),
 			TerminationMessagePolicy: corev1.TerminationMessageFallbackToLogsOnError,
 			Env:                      env,
 			Command:                  cmd,