fix(k8s): disable parallel traversal with fs cache for k8s images

[afdesk]

Description

This PR disables parallel traversal of Kubernetes artifacts when the fs cache is enabled.

Since the fs cache relies on bbolt as its underlying database, any parallel traversal inevitably becomes bottlenecked by database access. As a result, concurrency provides no real performance benefit in this context.

To reflect this change, integration tests have been updated. Instead of only verifying the presence of vulnerabilities and misconfigurations, the tests now validate exact results, ensuring stronger guarantees and more reliable regression detection.

Before:

$ trivy k8s --report=summary --scanners=vuln -q --include-namespaces kube-system
2025-09-22T11:42:05+06:00       ERROR   Error during vulnerabilities or misconfiguration scan   err="scan error: unable to initialize a scan service: unable to initialize an image scan service: unable to initialize fs cache: cache may be in use by another process: timeout"
2025-09-22T11:42:05+06:00       ERROR   Error during vulnerabilities or misconfiguration scan   err="scan error: unable to initialize a scan service: unable to initialize an image scan service: unable to initialize fs cache: cache may be in use by another process: timeout"
2025-09-22T11:42:05+06:00       ERROR   Error during vulnerabilities or misconfiguration scan   err="scan error: unable to initialize a scan service: unable to initialize an image scan service: unable to initialize fs cache: cache may be in use by another process: timeout"
2025-09-22T11:42:05+06:00       ERROR   Error during vulnerabilities or misconfiguration scan   err="scan error: unable to initialize a scan service: unable to initialize an image scan service: unable to initialize fs cache: cache may be in use by another process: timeout"

Summary Report for minikube


Workload Assessment
┌───────────┬──────────┬───────────────────┐
│ Namespace │ Resource │  Vulnerabilities  │
│           │          ├───┬───┬───┬───┬───┤
│           │          │ C │ H │ M │ L │ U │
└───────────┴──────────┴───┴───┴───┴───┴───┘
Severities: C=CRITICAL H=HIGH M=MEDIUM L=LOW U=UNKNOWN


Infra Assessment
┌─────────────┬─────────────────────────────────────────┬──────────────────────┐
│  Namespace  │                Resource                 │   Vulnerabilities    │
│             │                                         ├───┬────┬────┬────┬───┤
│             │                                         │ C │ H  │ M  │ L  │ U │
├─────────────┼─────────────────────────────────────────┼───┼────┼────┼────┼───┤
│ kube-system │ ControlPlaneComponents/k8s.io/apiserver │   │    │    │ 1  │   │
│ kube-system │ Pod/storage-provisioner                 │ 5 │ 56 │ 42 │ 1  │   │
│ kube-system │ DaemonSet/kube-proxy                    │   │ 1  │ 1  │ 16 │   │
└─────────────┴─────────────────────────────────────────┴───┴────┴────┴────┴───┘
Severities: C=CRITICAL H=HIGH M=MEDIUM L=LOW U=UNKNOWN

After:

./trivy k8s --report=summary --scanners=vuln -q --include-namespaces kube-system

Summary Report for minikube


Workload Assessment
┌───────────┬──────────┬───────────────────┐
│ Namespace │ Resource │  Vulnerabilities  │
│           │          ├───┬───┬───┬───┬───┤
│           │          │ C │ H │ M │ L │ U │
└───────────┴──────────┴───┴───┴───┴───┴───┘
Severities: C=CRITICAL H=HIGH M=MEDIUM L=LOW U=UNKNOWN


Infra Assessment
┌─────────────┬─────────────────────────────────────────┬──────────────────────┐
│  Namespace  │                Resource                 │   Vulnerabilities    │
│             │                                         ├───┬────┬────┬────┬───┤
│             │                                         │ C │ H  │ M  │ L  │ U │
├─────────────┼─────────────────────────────────────────┼───┼────┼────┼────┼───┤
│ kube-system │ DaemonSet/kube-proxy                    │   │ 1  │ 1  │ 16 │   │
│ kube-system │ ControlPlaneComponents/k8s.io/apiserver │   │    │    │ 1  │   │
│ kube-system │ Deployment/coredns                      │   │ 4  │ 10 │    │   │
│ kube-system │ Pod/etcd-minikube                       │   │ 7  │ 13 │    │   │
│ kube-system │ Pod/storage-provisioner                 │ 5 │ 55 │ 43 │ 1  │   │
└─────────────┴─────────────────────────────────────────┴───┴────┴────┴────┴───┘
Severities: C=CRITICAL H=HIGH M=MEDIUM L=LOW U=UNKNOWN

Related issues

• Close bug(k8s): unable to initialize fs cache #9503

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).

[knqyf263]

I have another idea for simplifying this implementation. What if merging #9504 and including this PR in v0.67.1?

[afdesk]

I have another idea for simplifying this implementation. What if merging #9504 and including this PR in v0.67.1?

we discussed this PR with @DmitriyLewen, and there is a good idea.
so I hope to follow up it today

#9504 is using in memory cache, actually, it's not a good way for k8s clusters with thouthands similar images...

[DmitriyLewen]

LGTM