From cd72e6dee1c7e04657801b2ede9e164e36aded0f Mon Sep 17 00:00:00 2001 From: Arunesh Dwivedi Date: Thu, 20 Aug 2026 06:35:04 +0000 Subject: [PATCH] fix: write updated config back to mounted file on configmap reload Kubernetes configmap updates are mounted as files, but the controller only updates its in-memory config. The trivy scanner pod reads the config file directly from the mount, so it sees the stale version. Write the marshaled config back to the file after Update() so that sidecar containers reading the mount see the updated configuration. Signed-off-by: Arunesh Dwivedi --- main.go | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/main.go b/main.go index 0fd4c0c4e8..2788b32b31 100644 --- a/main.go +++ b/main.go @@ -308,6 +308,15 @@ func startConfigWatch(cancel context.CancelFunc, watcher *inotify.Watcher, erase continue } + // Write the updated configuration back to the mounted file so that + // containers (e.g. trivy scanner) reading the config file see the + // updated values instead of the stale file on disk. + if updatedBytes, err := yaml.Marshal(newConfig); err != nil { + setupLog.Error(err, "failed to marshal updated configuration") + } else if err = os.WriteFile(filename, updatedBytes, 0644); err != nil { + setupLog.Error(err, "failed to write updated configuration to file") + } + // read back the new configuration *newConfig, err = eraserOpts.Read() if err != nil {