Exclude volatile ReplicaSet name from Trivy Operator service field

[tallesgois-shipay]

Fixes #16026

Problem

The Trivy Operator handlers (vulnerability_handler.py, checks_handler.py, secrets_handler.py) build Finding.service as namespace/kind/name:

service = f"{resource_namespace}/{resource_kind}/{resource_name}"

For Pods owned by a ReplicaSet, resource_name (from the trivy-operator.resource.name label) is the ReplicaSet's generated name, which changes on every deploy (new hash suffix each rollout).

close_old_findings scopes its query by an exact service match:

if self.service is not None:
    old_findings = old_findings.filter(service=self.service)

Since service changes on every redeploy for these three scan types, close_old_findings can never match findings from a previous deploy generation — old findings are never closed, only ever added to, regardless of close_old_findings=true. In our environment this let one dojo_finding table grow from ~218k to 5.7M+ rows over ~3 months, degrading Postgres enough to cause dashboard timeouts and an availability incident (details in #16026).

This is the same pattern discussed in #11500, where a maintainer confirmed the fix works "as long as you don't include a version number and the value stays the same across reimports" — but there the volatile value came from caller-supplied API input. Here it's built inside DefectDojo's own bundled parsers, so callers (e.g. trivy-dojo-report-operator) have no way to work around it.

Fix

Drop resource_name from the service string in all three handlers, keeping namespace/kind[/container]. This keeps service stable across redeploys of the same workload while still distinguishing different containers/workloads within a namespace. checks_handler.py and secrets_handler.py had byte-identical logic to vulnerability_handler.py and are fixed the same way for consistency, since they share the exact same volatility problem.

Tests

Added test_vulnerabilityreport_service_excludes_volatile_replicaset_name to unittests/tools/test_trivy_operator_parser.py, asserting the fixture's ReplicaSet-generated resource.name ("nginx-deployment-965685897") does not end up in finding.service. No existing test asserted on service format, so nothing else needed updating.

Deployment method

• Kubernetes (Helm)