helm-release.yaml

apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: trivy-operator
  namespace: trivy-operator
  labels:
    helm.toolkit.fluxcd.io/crds: enabled
    helm.toolkit.fluxcd.io/helm-test: enabled
    helm.toolkit.fluxcd.io/remediation: enabled
spec:
  interval: 10m
  chart:
    spec:
      chart: trivy-operator
      version: 0.25.0
      sourceRef:
        kind: HelmRepository
        name: trivy-operator
  # https://github.com/aquasecurity/trivy-operator/blob/main/deploy/helm/values.yaml
  values:
    nodeCollector:
      volumeMounts:
        - name: var-lib-etcd
          mountPath: /var/lib/etcd
          readOnly: true
        - name: var-lib-kubelet
          mountPath: /var/lib/kubelet
          readOnly: true
        - name: var-lib-kube-scheduler
          mountPath: /var/lib/kube-scheduler
          readOnly: true
        - name: var-lib-kube-controller-manager
          mountPath: /var/lib/kube-controller-manager
          readOnly: true
      volumes:
        - name: var-lib-etcd
          hostPath:
            path: /var/lib/etcd
        - name: var-lib-kubelet
          hostPath:
            path: /var/lib/kubelet
        - name: var-lib-kube-scheduler
          hostPath:
            path: /var/lib/kube-scheduler
        - name: var-lib-kube-controller-manager
          hostPath:
            path: /var/lib/kube-controller-manager