use imagePullSecret globally for trivy-operator

[jemag]

I currently have an AKS cluster that already has access to pull from a private ACR registry (cluster service principal has the required permissions). The problem is that trivy-operator does not seem to be able to pull images from that private ACR using that mechanism.

It seems that currently most of the mechanisms described in https://aquasecurity.github.io/trivy-operator/v0.16.1/tutorials/private-registries, involve specifying an imagePullSecret in the workload namespace. Since I have multiple namespace that already have access to this private ACR, I would prefer not defining several, otherwise useless, imagePullSecrets in all of those namespace.

Is there a way to allow trivy-operator to use a specific GLOBAL imagePull secret (in trivy-system namespace) whenever it encounter registry X?
Another option would be to allow Managed Registries through Service Principal instead of workload identity for ACR.

[chen-keinan]

@jemag in the doc you specified the Fourth Option is what you need

[jemag]

I thought that the fourth option would need 1 secret per namespace where applications are pulling images from that private registry.

I am guessing in that case that the trivy operator can instead re-use that single secret for all namespaces that call that private registry?

[chen-keinan]

It not ine secret per namespace , its global secret used for all , you only need to tell him from which namespace to take it