Harbor Scanner Cache Refresh on Updated Vulnerability Database

Harbor Scanner Cache Refresh on Updated Vulnerability Database

When the underlying vulnerability scanner (e.g., Trivy) updates its CVE database, Harbor may continue to serve scan results from its internal cache, leading to stale or incomplete vulnerability information. The goal is to understand how to trigger a cache refresh or override the cached data so that subsequent scans reflect the latest vulnerability data while respecting Harbor’s configuration constraints.

Key constraints include:

• Harbor stores scan results in PostgreSQL and does not automatically invalidate the cache when the scanner’s database changes.
• The UI and API provide a force=true query parameter for new scans, but this feature is only available in Harbor 2.2 and later.
• Clearing scan data via the API removes audit history, which may conflict with compliance requirements.
• Enabling scan_overwrite=true in Harbor’s scanner configuration replaces cached results automatically on subsequent scans.

Given these constraints, the following questions arise:

1. What is the recommended sequence of API calls to force a fresh scan after the scanner’s database has been updated, without disrupting audit trails?
2. How does Harbor’s scan_overwrite flag interact with the force=true parameter when both are enabled?
3. In a compliance‑heavy environment, what best practices exist for clearing or overwriting cached scan results while preserving necessary audit information?