Update .gitignore to include .tmp files, remove Trivy namespace from kustomization.yaml, and add Trivy dashboard application to app-of-apps kustomization. Delete obsolete Trivy namespace and values files to streamline deployment configuration.

clusters/noble/apps/trivy/values.yaml

@@ -0,0 +1,33 @@
+# Trivy Operator — in-cluster image vulnerability + config reports (Aqua trivy-operator Helm chart).
+# Deploy via Argo CD: **noble-trivy-operator** (`clusters/noble/bootstrap/argocd/app-of-apps/trivy-operator-application.yaml`).
+#
+# Web UI (separate chart; OAuth via Traefik ForwardAuth → oauth2-proxy / Authentik): sync **noble-trivy-dashboard**
+# after the operator — values in **dashboard-values.yaml** (host **trivy.apps.noble.lab.pcenicni.dev**).
+#
+# Manual Helm (if not using Argo):
+#   helm repo add aqua https://aquasecurity.github.io/helm-charts/ && helm repo update
+#   kubectl apply -f clusters/noble/bootstrap/trivy/namespace.yaml
+#   helm upgrade --install trivy-operator aqua/trivy-operator -n trivy-system \
+#     --version 0.32.1 -f clusters/noble/bootstrap/trivy/values.yaml --wait --timeout 15m
+#
+# Inspect: kubectl get vulnerabilityreports,configauditreports -A
+# Docs: https://aquasecurity.github.io/trivy-operator/
+
+# Skip platform/system namespaces (mirrors Kyverno excludes; reduces scan load).
+excludeNamespaces: "argocd,cert-manager,headlamp,kyverno,local-path-storage,logging,longhorn-system,loki,metallb-system,monitoring,newt,traefik,trivy-system,velero,kube-node-lease,kube-public,kube-system"
+
+operator:
+  scanJobsConcurrentLimit: 5
+  # SBOM / cluster compliance add CPU and CR volume; keep vulnerability + config audit.
+  sbomGenerationEnabled: false
+  clusterSbomCacheEnabled: false
+  clusterComplianceEnabled: false
+
+trivyOperator:
+  # Run scan Jobs on every node (Talos / mixed taints).
+  scanJobTolerations:
+    - operator: Exists
+
+serviceMonitor:
+  enabled: true
+  namespace: monitoring