Allow InitContainer to pull vulnerability-db from private registry

[crtvmn]

Hello,

I'm trying to deploy the Trivy Operator in standalone mode with the provided Helm chart in an offline environment with a private registry. Credentials are required to access this registry.

Unfortunately, it is not possible to forward or add env variables (TRIVY_USER and TRIVY_PASSWORD) to allow the Trivy init-container to pull the vulnerability database from my private registry.

Moreover the dbRepositoryPassword and dbRepositoryUsername seem useless.

trivy-operator/deploy/helm/values.yaml

Lines 525 to 529 in 2cd18ea

	dbRepositoryUsername: ~
	# -- The password for dbRepository authentication
	#
	dbRepositoryPassword: ~

Can you confirm that this use case is not possible for the moment? I found this discussion #1341 but no answer and no link to the related issue. Thanks for your help!

Best regards

[github-actions]

This issue is stale because it has been labeled with inactivity.

[Heap0017]

I'm having the same issue. In my opinion it should be possible to provide the credentials for pulling trivy-db and trivy-java-db just like we can do it for trivy-checks.

@crtvmn This is the issue mentioned in the discussion: #1342

[Heap0017]

@crtvmn I just found out that you can in fact use a secret for setting dbRepositoryUsername and dbRepositoryPassword. It just isn't mentioned in the README. #2282