What is it the difference between ClusterSbomReport and SbmReport CRD

[AstritCepele]

What is it the difference between ClusterSbomReport and SbmReport CRD?

To me, it looks like SbmReport CRD is deprecated and not used.

[AnaisUrlichs]

Hmm, I was not aware that the two different reports exist -- thank you for pointing it out. I just saved both ClusterSbomReport and SbomReport for the trivy-operator into separate files and then compared them:

❯ diff test-two.yaml test.yaml
2c2
< kind: SbomReport
---
> kind: ClusterSbomReport
4c4,6
<   creationTimestamp: "2023-12-12T10:34:11Z"
---
>   annotations:
>     trivy-operator.aquasecurity.github.io/report-ttl: 120h0m0s
>   creationTimestamp: "2023-12-12T10:03:24Z"
7,22c9,12
<     resource-spec-hash: 7dfcd5f8c9
<     trivy-operator.container.name: trivy-operator
<     trivy-operator.resource.kind: ReplicaSet
<     trivy-operator.resource.name: trivy-operator-7c5f6cf4d4
<     trivy-operator.resource.namespace: trivy-system
<   name: replicaset-trivy-operator-7c5f6cf4d4-trivy-operator
<   namespace: trivy-system
<   ownerReferences:
<   - apiVersion: apps/v1
<     blockOwnerDeletion: false
<     controller: true
<     kind: ReplicaSet
<     name: trivy-operator-7c5f6cf4d4
<     uid: b5eb1aa6-55da-44ee-8ec5-5614136c0da3
<   resourceVersion: "3039"
<   uid: 57fac1d9-15dd-4013-9393-2ac9a457c11b
---
>     resource-image-id: 6696869d49
>   name: 6696869d49
>   resourceVersion: "1080"
>   uid: 969554e3-bb91-4b83-9744-b06fcd8fc44d

Doesn't seem to be much of a difference in the actual scan/report. @chen-keinan is the ClusterSbomReport still needed? tbh in K9s, the both reports are presented differently and the ClusterSbomReport shows more details:

[chen-keinan]

Yes, the clustersbomreport is used as cache to speed images scan