failed to create cache dir

[Kaktor]

Hi guys, can you help me - we use trivy in our air-gapped on-prem environment.
trivy-operator throws following error:

{"level":"error","ts":"2023-06-12T13:22:01Z","logger":"reconciler.scan job","msg":"Scan job container","job":"trivy-operator/scan-vulnerabilityreport-5d5c467c56","container":"main","status.reason":"Error","status.message":"2023-06-12T13:21:58.949Z\t\u001b[31mFATAL\u001b[0m\tinit error: cache error: unable to initialize the cache: unable to initialize fs cache: failed to create cache dir: mkdir /var/trivyoperator/trivy-db/fanal: permission denied\n","stacktrace":"github.com/aquasecurity/trivy-operator/pkg/vulnerabilityreport/controller.(*ScanJobController).processFailedScanJob\n\t/home/runner/work/trivy-operator/trivy-operator/pkg/vulnerabilityreport/controller/scanjob.go:265\ngithub.com/aquasecurity/trivy-operator/pkg/vulnerabilityreport/controller.(*ScanJobController).reconcileJobs.func1\n\t/home/runner/work/trivy-operator/trivy-operator/pkg/vulnerabilityreport/controller/scanjob.go:79\nsigs.k8s.io/controller-runtime/pkg/reconcile.Func.Reconcile\n\t/home/runner/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.15.0/pkg/reconcile/reconcile.go:103\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/home/runner/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.15.0/pkg/internal/controller/controller.go:118\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/home/runner/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.15.0/pkg/internal/controller/controller.go:314\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/home/runner/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.15.0/pkg/internal/controller/controller.go:265\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/home/runner/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.15.0/pkg/internal/controller/controller.go:226"}

i found a similar error message here but i cant find any value for adding additional parameters in the trivy-operator chart (0.14.0).
Can you tell me, how to fix it or how can i set the "--cache-dir"?

[chen-keinan]

@Kaktor are you using filesystem scanning mode ?
see code a volumeMountsis created

[Kaktor]

yes we are using command: filesystem - with following values

trivy-operator:
  mode: ClientServer
  ignoreUnfixed: "true"
  serverToken: "*******"
  serverURL: "http://trivy.trivy:4954"
  targetNamespaces: ""
  image:
    registry: xxxx
    pullSecrets:
    - name: xxxx
  serviceMonitor:
    enabled: false
  operator:
    vulnerabilityScannerScanOnlyCurrentRevisions: false
    configAuditScannerEnabled: false
  trivy:
    image:
      registry: xxxx
      imagePullSecret: xxxx
    dbRegistry: xxxx
    javaDbRegistry: xxxx
    command: filesystem

[chen-keinan]

is scanJobPodTemplateContainerSecurityContext.runAsUser=0 is set ?
and builtInTrivyServer = true ?

[chen-keinan]

@Kaktor converting this discussion to issue #1300, so it can be properly investigate.