chore(chart-deps): update trivy-operator to version 0.35.0

[svcAPLBot]

This PR updates the dependency trivy-operator to version 0.35.0.

[Copilot]

Pull request overview

Updates the vendored trivy-operator Helm chart and surrounding metadata to align with upstream chart version 0.35.0 (AppVersion 0.33.0), including refreshed defaults and RBAC needed for expanded config audit coverage.

Changes:

• Bump Trivy Operator chart version to 0.35.0 (AppVersion 0.33.0) and update dependency pin.
• Update default Trivy image tag to 0.73.0 and expand supportedConfigAuditKinds to include PV/PVC.
• Extend RBAC resource access to persistentvolumes / persistentvolumeclaims and refresh compliance spec labels.

Reviewed changes

Copilot reviewed 11 out of 12 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
charts/trivy-operator/values.yaml	Updates Trivy image tag and expands supported config-audit kinds.
charts/trivy-operator/templates/specs/rke2-cis-1.24.yaml	Updates compliance spec label version.
charts/trivy-operator/templates/specs/k8s-pss-restricted-0.1.yaml	Updates compliance spec label version.
charts/trivy-operator/templates/specs/k8s-pss-baseline-0.1.yaml	Updates compliance spec label version.
charts/trivy-operator/templates/specs/k8s-nsa-1.0.yaml	Updates compliance spec label version.
charts/trivy-operator/templates/specs/k8s-cis-1.23.yaml	Updates compliance spec label version.
charts/trivy-operator/templates/specs/eks-cis-1.4.yaml	Updates compliance spec label version.
charts/trivy-operator/README.md	Refreshes chart Version/AppVersion badges and values table defaults.
charts/trivy-operator/generated/role.yaml	Adds PV/PVC to ClusterRole resources to support expanded auditing.
charts/trivy-operator/Chart.yaml	Bumps chart version and appVersion.
charts/dependencies.yaml	Updates the trivy-operator dependency version pin.
apps.yaml	Updates Trivy Operator appVersion metadata.

Suppressed comments (1)

apps.yaml:215

• The Trivy entry’s documentation link is still pinned to v0.16.4, which no longer matches the updated appVersion: 0.33.0. This makes it easy for users to land on the wrong docs/version when following links from App Platform metadata.

    appVersion: 0.33.0
    repo: https://github.com/aquasecurity/trivy-operator
    maintainers: Aqua Security
    relatedLinks:
      - https://aquasecurity.github.io/trivy-operator/v0.16.4/

[Copilot]

Pull request overview

Copilot reviewed 11 out of 12 changed files in this pull request and generated no new comments.

[svcAPLBot]

Comparison of Helm chart templating output:

# otomi-api/templates/core-config.yaml

@@ data.core.yaml @@
! ± value change in multiline text (one insert, one deletion)
  adminApps:
  - deps:
    - prometheus
    name: alertmanager
  
  [470 lines unchanged)]
  
      about: Trivy Operator continuously scans your Kubernetes cluster for security
        issues, and generates security reports as Kubernetes Custom Resources. It does
        it by watching Kubernetes for state changes and automatically triggering scans
        in response to changes.
-     appVersion: 0.30.1
+     appVersion: 0.33.0
      chartName: trivy-operator
      dependencies: Prometheus, Grafana
      integration: App Platform installs and configures Trivy Operator to scan all resources
        deployed by a team and makes results visible in a Grafana dashboard.
  
  [115 lines unchanged)]
  
    path: /explore?orgId=1&left=%7B"datasource":"loki","queries":%5B%7B"refId":"A","expr":"","queryType":"range","datasource":%7B"type":"loki","uid":"loki"%7D%7D%5D,"range":%7B"from":"now-1h","to":"now"%7D%7D
    useHost: grafana
  - name: tekton
    ownHost: true

# otomi-api/templates/deployment.yaml

# rabbitmq-cluster-operator/templates/messaging-topology-operator/validating-webhook-configuration.yaml

# trivy-operator/templates/configmaps/operator.yaml

# trivy-operator/templates/configmaps/trivy-operator-config.yaml

# trivy-operator/templates/configmaps/trivy.yaml

@@ data.trivy.tag @@
! ± value change
- 0.69.3
+ 0.73.0

@@ data.trivy.supportedConfigAuditKinds @@
! ± value change
- Workload,Service,Role,ClusterRole,NetworkPolicy,Ingress,LimitRange,ResourceQuota
+ Workload,Service,Role,ClusterRole,NetworkPolicy,Ingress,LimitRange,ResourceQuota,PersistentVolume,PersistentVolumeClaim

# trivy-operator/templates/deployment.yaml

@@ spec.template.spec.containers.trivy-operator.image @@
! ± value change
- mirror.gcr.io/aquasec/trivy-operator:0.30.1
+ mirror.gcr.io/aquasec/trivy-operator:0.33.0

# trivy-operator/templates/monitor/service.yaml

# trivy-operator/templates/monitor/servicemonitor.yaml

# trivy-operator/templates/rbac/clusterrole.yaml

@@ rules @@
! - one list entry removed:
- - resources:
-   - configmaps
-   - limitranges
-   - nodes
-   - pods
-   - replicationcontrollers
-   - resourcequotas
-   - services
-   apiGroups:
-   - 
-   verbs:
-   - get
-   - list
-   - watch
! + one list entry added:
+ - resources:
+   - configmaps
+   - limitranges
+   - nodes
+   - persistentvolumeclaims
+   - persistentvolumes
+   - pods
+   - replicationcontrollers
+   - resourcequotas
+   - services
+   apiGroups:
+   - 
+   verbs:
+   - get
+   - list
+   - watch

# trivy-operator/templates/rbac/clusterrolebinding.yaml

# trivy-operator/templates/rbac/leader-election-role.yaml

# trivy-operator/templates/rbac/leader-election-rolebinding.yaml

# trivy-operator/templates/rbac/role.yaml

# trivy-operator/templates/rbac/rolebinding.yaml

# trivy-operator/templates/rbac/view-configauditreports-clusterrole.yaml

# trivy-operator/templates/rbac/view-exposedsecretreports-clusterrole.yaml

# trivy-operator/templates/rbac/view-vulnerabilityreports-clusterrole.yaml

# trivy-operator/templates/secrets/operator.yaml

# trivy-operator/templates/secrets/trivy.yaml

# trivy-operator/templates/serviceaccount.yaml

# trivy-operator/templates/specs/k8s-cis-1.23.yaml

# trivy-operator/templates/specs/k8s-nsa-1.0.yaml

# trivy-operator/templates/specs/k8s-pss-baseline-0.1.yaml

# trivy-operator/templates/specs/k8s-pss-restricted-0.1.yaml

# values-repo.yaml