[LaibaBareera]

Description

This change adds Kubernetes Config Audit support for PersistentVolume and PersistentVolumeClaim resources in Trivy Operator.

Previously, Trivy Operator did not fully process PV/PVC resources as part of config audit scanning. As a result, policies targeting these resource kinds could be evaluated in limited/custom scenarios, but PV/PVC support was not consistently available across the controller flow, default supported kinds, RBAC, and deployment manifests.

This update adds PV/PVC support across the required components:

• Adds PersistentVolume and PersistentVolumeClaim kind handling in the Kubernetes object model.
• Adds spec hash support for PV/PVC resources.
• Adds object resolution support for PV/PVC.
• Treats PersistentVolume as a cluster-scoped resource.
• Treats PersistentVolumeClaim as a namespace-scoped resource.
• Adds PV/PVC to the config audit resource controller.
• Adds PV/PVC handling to the policy config controller so reports are refreshed correctly when policy configuration changes.
• Updates supported config audit kinds to include PV/PVC.
• Updates Helm values and generated RBAC to include PV/PVC.
• Updates documentation/config where supported resource kinds are listed.

Expected Behavior

After this change:

• PersistentVolume resources should be scanned and reported through ClusterConfigAuditReport.
• PersistentVolumeClaim resources should be scanned and reported through ConfigAuditReport.
• Policies targeting PersistentVolume or PersistentVolumeClaim should be evaluated when these resources are created or updated.
• PV/PVC reports should be refreshed correctly when the policy ConfigMap changes.
• Helm/static deployments should include the required RBAC permissions to get/list/watch PV/PVC resources.

Validation

Validation should include creating a custom Rego policy for PersistentVolume or PersistentVolumeClaim, applying a matching resource, and confirming that the relevant Config Audit report is created.

Example expected result for PV:

kubectl get clusterconfigauditreports.aquasecurity.github.io -A

A report similar to the following should be created:

persistentvolume-<pv-name>

with labels such as:

trivy-operator.resource.kind=PersistentVolume
trivy-operator.resource.name=<pv-name>

For PVC:

kubectl get configauditreports.aquasecurity.github.io -A

A report similar to the following should be created:

persistentvolumeclaim-<pvc-name>

with labels such as:

trivy-operator.resource.kind=PersistentVolumeClaim
trivy-operator.resource.namespace=<namespace>

[afdesk]

LGTM!