feat(trivy-system): add Trivy Operator for continuous in-cluster scanning - #4724
Draft
Tanguille wants to merge 1 commit into
Draft
feat(trivy-system): add Trivy Operator for continuous in-cluster scanning#4724Tanguille wants to merge 1 commit into
Tanguille wants to merge 1 commit into
Conversation
…ning Add Trivy Operator (fully on-prem, Standalone mode) to the trivy-system namespace. It continuously scans workloads for image vulnerabilities, exposed secrets, config misconfigurations, and RBAC, with results stored as native K8s CRs. Metrics are exposed to Prometheus via a ServiceMonitor. No ARMO/external backend, no new SOPS secrets required (chart creates its own RBAC/SA). Chart sourced from oci://ghcr.io/aquasecurity/helm-charts (trivy-operator 0.32.1, the latest tag pullable from that repo). Follow-ups (deliberately deferred): - PrometheusRule for High/Critical findings once live metric names are confirmed. - hadolint + helm-lint CI steps (repo-side, not cluster services).
|
Important Draft PR not reviewedDraft PRs are not automatically reviewed by default.
To automatically review draft PRs, update your CodeRabbit configuration: reviews:
auto_review:
drafts: trueWarning Your free Security trial is over. An organization admin can activate billing to continue. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
@@ (root level) @@
# v1/ServiceAccount/trivy-system/trivy-operator
! + one document added:
+ apiVersion: v1
+ kind: ServiceAccount
+ metadata:
+ name: trivy-operator
+ namespace: trivy-system
+ labels:
+ app.kubernetes.io/instance: trivy-operator
+ app.kubernetes.io/managed-by: Helm
+ app.kubernetes.io/name: trivy-operator
+ helm.toolkit.fluxcd.io/name: trivy-operator
+ helm.toolkit.fluxcd.io/namespace: trivy-system
@@ (root level) @@
# v1/ConfigMap/trivy-system/trivy-operator
! + one document added:
+ apiVersion: v1
+ kind: ConfigMap
+ metadata:
+ name: trivy-operator
+ namespace: trivy-system
+ labels:
+ app.kubernetes.io/instance: trivy-operator
+ app.kubernetes.io/managed-by: Helm
+ app.kubernetes.io/name: trivy-operator
+ helm.toolkit.fluxcd.io/name: trivy-operator
+ helm.toolkit.fluxcd.io/namespace: trivy-system
+ data:
+ compliance.failEntriesLimit: "10"
+ configAuditReports.scanner: Trivy
+ node.collector.imageRef: "ghcr.io/aquasecurity/node-collector:0.3.1"
+ node.collector.nodeSelector: "true"
+ nodeCollector.volumeMounts: "[{\"mountPath\":\"/var/lib/etcd\",\"name\":\"var-lib-etcd\",\"readOnly\":true},{\"mountPath\":\"/var/lib/kubelet\",\"name\":\"var-lib-kubelet\",\"readOnly\":true},{\"mountPath\":\"/var/lib/kube-scheduler\",\"name\":\"var-lib-kube-scheduler\",\"readOnly\":true},{\"mountPath\":\"/var/lib/kube-controller-manager\",\"name\":\"var-lib-kube-controller-manager\",\"readOnly\":true},{\"mountPath\":\"/etc/systemd\",\"name\":\"etc-systemd\",\"readOnly\":true},{\"mountPath\":\"/lib/systemd/\",\"name\":\"lib-systemd\",\"readOnly\":true},{\"mountPath\":\"/etc/kubernetes\",\"name\":\"etc-kubernetes\",\"readOnly\":true},{\"mountPath\":\"/etc/cni/net.d/\",\"name\":\"etc-cni-netd\",\"readOnly\":true}]"
+ nodeCollector.volumes: "[{\"hostPath\":{\"path\":\"/var/lib/etcd\"},\"name\":\"var-lib-etcd\"},{\"hostPath\":{\"path\":\"/var/lib/kubelet\"},\"name\":\"var-lib-kubelet\"},{\"hostPath\":{\"path\":\"/var/lib/kube-scheduler\"},\"name\":\"var-lib-kube-scheduler\"},{\"hostPath\":{\"path\":\"/var/lib/kube-controller-manager\"},\"name\":\"var-lib-kube-controller-manager\"},{\"hostPath\":{\"path\":\"/etc/systemd\"},\"name\":\"etc-systemd\"},{\"hostPath\":{\"path\":\"/lib/systemd\"},\"name\":\"lib-systemd\"},{\"hostPath\":{\"path\":\"/etc/kubernetes\"},\"name\":\"etc-kubernetes\"},{\"hostPath\":{\"path\":\"/etc/cni/net.d/\"},\"name\":\"etc-cni-netd\"}]"
+ policies.bundle.insecure: "false"
+ policies.bundle.oci.ref: "mirror.gcr.io/aquasec/trivy-checks:1"
+ report.recordFailedChecksOnly: "true"
+ scanJob.compressLogs: "true"
+ scanJob.podTemplateContainerSecurityContext: "{\"allowPrivilegeEscalation\":false,\"capabilities\":{\"drop\":[\"ALL\"]},\"privileged\":false,\"readOnlyRootFilesystem\":true}"
+ scanJob.useGCRServiceAccount: "true"
+ vulnerabilityReports.scanJobsInSameNamespace: "false"
+ vulnerabilityReports.scanner: Trivy
@@ (root level) @@
# v1/ConfigMap/trivy-system/trivy-operator-config
! + one document added:
+ apiVersion: v1
+ kind: ConfigMap
+ metadata:
+ name: trivy-operator-config
+ namespace: trivy-system
+ labels:
+ app.kubernetes.io/instance: trivy-operator
+ app.kubernetes.io/managed-by: Helm
+ app.kubernetes.io/name: trivy-operator
+ helm.toolkit.fluxcd.io/name: trivy-operator
+ helm.toolkit.fluxcd.io/namespace: trivy-system
+ data:
+ CONTROLLER_CACHE_SYNC_TIMEOUT: 5m
+ OPERATOR_ACCESS_GLOBAL_SECRETS_SERVICE_ACCOUNTS: "true"
+ OPERATOR_BATCH_DELETE_DELAY: 10s
+ OPERATOR_BATCH_DELETE_LIMIT: "10"
+ OPERATOR_BUILT_IN_TRIVY_SERVER: "false"
+ OPERATOR_CACHE_REPORT_TTL: 120h
+ OPERATOR_CLUSTER_COMPLIANCE_ENABLED: "true"
+ OPERATOR_CLUSTER_SBOM_CACHE_ENABLED: "false"
+ OPERATOR_CONCURRENT_NODE_COLLECTOR_LIMIT: "1"
+ OPERATOR_CONCURRENT_SCAN_JOBS_LIMIT: "10"
+ OPERATOR_CONFIG_AUDIT_SCANNER_ENABLED: "true"
+ OPERATOR_CONFIG_AUDIT_SCANNER_SCAN_ONLY_CURRENT_REVISIONS: "true"
+ OPERATOR_EXPOSED_SECRET_SCANNER_ENABLED: "true"
+ OPERATOR_HEALTH_PROBE_BIND_ADDRESS: ":9090"
+ OPERATOR_INFRA_ASSESSMENT_SCANNER_ENABLED: "true"
+ OPERATOR_LOG_DEV_MODE: "false"
+ OPERATOR_MERGE_RBAC_FINDING_WITH_CONFIG_AUDIT: "false"
+ OPERATOR_METRICS_BIND_ADDRESS: ":8080"
+ OPERATOR_METRICS_CLUSTER_COMPLIANCE_INFO_ENABLED: "false"
+ OPERATOR_METRICS_CONFIG_AUDIT_INFO_ENABLED: "false"
+ OPERATOR_METRICS_EXPOSED_SECRET_INFO_ENABLED: "false"
+ OPERATOR_METRICS_FINDINGS_ENABLED: "true"
+ OPERATOR_METRICS_IMAGE_INFO_ENABLED: "false"
+ OPERATOR_METRICS_INFRA_ASSESSMENT_INFO_ENABLED: "false"
+ OPERATOR_METRICS_RBAC_ASSESSMENT_INFO_ENABLED: "false"
+ OPERATOR_METRICS_VULN_ID_ENABLED: "false"
+ OPERATOR_PPROF_BIND_ADDRESS:
+ OPERATOR_PRIVATE_REGISTRY_SCAN_SECRETS_NAMES: {}
+ OPERATOR_RBAC_ASSESSMENT_SCANNER_ENABLED: "true"
+ OPERATOR_SBOM_GENERATION_ENABLED: "true"
+ OPERATOR_SCAN_JOB_RETRY_AFTER: 30s
+ OPERATOR_SCAN_JOB_TIMEOUT: 5m
+ OPERATOR_SCAN_JOB_TTL:
+ OPERATOR_SCANNER_REPORT_TTL: 24h
+ OPERATOR_SEND_DELETED_REPORTS: "false"
+ OPERATOR_VULNERABILITY_SCANNER_ENABLED: "true"
+ OPERATOR_VULNERABILITY_SCANNER_SCAN_ONLY_CURRENT_REVISIONS: "true"
+ OPERATOR_WEBHOOK_BROADCAST_CUSTOM_HEADERS:
+ OPERATOR_WEBHOOK_BROADCAST_TIMEOUT: 30s
+ OPERATOR_WEBHOOK_BROADCAST_URL:
+ TRIVY_SERVER_HEALTH_CHECK_CACHE_EXPIRATION: 10h
@@ (root level) @@
# v1/ConfigMap/trivy-system/trivy-operator-trivy-config
! + one document added:
+ apiVersion: v1
+ kind: ConfigMap
+ metadata:
+ name: trivy-operator-trivy-config
+ namespace: trivy-system
+ labels:
+ app.kubernetes.io/instance: trivy-operator
+ app.kubernetes.io/managed-by: Helm
+ app.kubernetes.io/name: trivy-operator
+ helm.toolkit.fluxcd.io/name: trivy-operator
+ helm.toolkit.fluxcd.io/namespace: trivy-system
+ data:
+ trivy.additionalVulnerabilityReportFields:
+ trivy.command: image
+ trivy.dbRepository: mirror.gcr.io/aquasec/trivy-db
+ trivy.dbRepositoryInsecure: "false"
+ trivy.filesystemScanCacheDir: /var/trivyoperator/trivy-db
+ trivy.imagePullPolicy: IfNotPresent
+ trivy.imageScanCacheDir: /tmp/trivy/.cache
+ trivy.includeDevDeps: "false"
+ trivy.javaDbRepository: mirror.gcr.io/aquasec/trivy-java-db
+ trivy.mode: Standalone
+ trivy.repository: ghcr.io/aquasec/trivy
+ trivy.resources.limits.cpu: 500m
+ trivy.resources.limits.memory: 500M
+ trivy.resources.requests.cpu: 100m
+ trivy.resources.requests.memory: 100M
+ trivy.sbomSources:
+ trivy.severity: "UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL"
+ trivy.skipJavaDBUpdate: "false"
+ trivy.slow: "true"
+ trivy.supportedConfigAuditKinds: "Workload,Service,Role,ClusterRole,NetworkPolicy,Ingress,LimitRange,ResourceQuota"
+ trivy.tag: "0.69.3"
+ trivy.timeout: 5m0s
+ trivy.useBuiltinRegoPolicies: "false"
+ trivy.useEmbeddedRegoPolicies: "true"
@@ (root level) @@
# rbac.authorization.k8s.io/v1/ClusterRole/trivy-operator
! + one document added:
+ apiVersion: rbac.authorization.k8s.io/v1
+ kind: ClusterRole
+ metadata:
+ name: trivy-operator
+ labels:
+ helm.toolkit.fluxcd.io/name: trivy-operator
+ helm.toolkit.fluxcd.io/namespace: trivy-system
+ rules:
+ - resources:
+ - configmaps
+ - limitranges
+ - nodes
+ - pods
+ - replicationcontrollers
+ - resourcequotas
+ - services
+ apiGroups:
+ -
+ verbs:
+ - get
+ - list
+ - watch
+ - resources:
+ - namespaces
+ apiGroups:
+ -
+ verbs:
+ - get
+ - resources:
+ - pods/log
+ apiGroups:
+ -
+ verbs:
+ - get
+ - list
+ - resources:
+ - customresourcedefinitions
+ apiGroups:
+ - apiextensions.k8s.io
+ verbs:
+ - get
+ - list
+ - watch
+ - resources:
+ - daemonsets
+ - deployments
+ - replicasets
+ - statefulsets
+ apiGroups:
+ - apps
+ verbs:
+ - get
+ - list
+ - watch
+ - resources:
+ - deploymentconfigs
+ apiGroups:
+ - apps.openshift.io
+ verbs:
+ - get
+ - list
+ - watch
+ - resources:
+ - clustercompliancedetailreports
+ - clustercompliancereports
+ - clusterconfigauditreports
+ - clusterinfraassessmentreports
+ - clusterrbacassessmentreports
+ - clustersbomreports
+ - clustervulnerabilityreports
+ - configauditreports
+ - exposedsecretreports
+ - infraassessmentreports
+ - rbacassessmentreports
+ - sbomreports
+ - vulnerabilityreports
+ apiGroups:
+ - aquasecurity.github.io
+ verbs:
+ - create
+ - delete
+ - get
+ - list
+ - patch
+ - update
+ - watch
+ - resources:
+ - clustercompliancereports/status
+ apiGroups:
+ - aquasecurity.github.io
+ verbs:
+ - get
+ - patch
+ - update
+ - resources:
+ - cronjobs
+ apiGroups:
+ - batch
+ verbs:
+ - get
+ - list
+ - watch
+ - resources:
+ - jobs
+ apiGroups:
+ - batch
+ verbs:
+ - create
+ - delete
+ - get
+ - list
+ - watch
+ - resources:
+ - ingresses
+ - networkpolicies
+ apiGroups:
+ - networking.k8s.io
+ verbs:
+ - get
+ - list
+ - watch
+ - resources:
+ - clusterrolebindings
+ - clusterroles
+ - rolebindings
+ - roles
+ apiGroups:
+ - rbac.authorization.k8s.io
+ verbs:
+ - get
+ - list
+ - watch
+ - resources:
+ - secrets
+ apiGroups:
+ -
+ verbs:
+ - create
+ - get
+ - update
+ - resources:
+ - serviceaccounts
+ apiGroups:
+ -
+ verbs:
+ - get
+ - resources:
+ - nodes/proxy
+ apiGroups:
+ -
+ verbs:
+ - get
@@ (root level) @@
# rbac.authorization.k8s.io/v1/ClusterRole/aggregate-config-audit-reports-view
! + one document added:
+ apiVersion: rbac.authorization.k8s.io/v1
+ kind: ClusterRole
+ metadata:
+ name: aggregate-config-audit-reports-view
+ labels:
+ app.kubernetes.io/instance: trivy-operator
+ app.kubernetes.io/managed-by: Helm
+ app.kubernetes.io/name: trivy-operator
+ helm.toolkit.fluxcd.io/name: trivy-operator
+ helm.toolkit.fluxcd.io/namespace: trivy-system
+ rbac.authorization.k8s.io/aggregate-to-admin: "true"
+ rbac.authorization.k8s.io/aggregate-to-cluster-reader: "true"
+ rbac.authorization.k8s.io/aggregate-to-edit: "true"
+ rbac.authorization.k8s.io/aggregate-to-view: "true"
+ rules:
+ - resources:
+ - configauditreports
+ apiGroups:
+ - aquasecurity.github.io
+ verbs:
+ - get
+ - list
+ - watch
@@ (root level) @@
# rbac.authorization.k8s.io/v1/ClusterRole/aggregate-exposed-secret-reports-view
! + one document added:
+ apiVersion: rbac.authorization.k8s.io/v1
+ kind: ClusterRole
+ metadata:
+ name: aggregate-exposed-secret-reports-view
+ labels:
+ app.kubernetes.io/instance: trivy-operator
+ app.kubernetes.io/managed-by: Helm
+ app.kubernetes.io/name: trivy-operator
+ helm.toolkit.fluxcd.io/name: trivy-operator
+ helm.toolkit.fluxcd.io/namespace: trivy-system
+ rbac.authorization.k8s.io/aggregate-to-admin: "true"
+ rbac.authorization.k8s.io/aggregate-to-cluster-reader: "true"
+ rbac.authorization.k8s.io/aggregate-to-edit: "true"
+ rbac.authorization.k8s.io/aggregate-to-view: "true"
+ rules:
+ - resources:
+ - exposedsecretreports
+ apiGroups:
+ - aquasecurity.github.io
+ verbs:
+ - get
+ - list
+ - watch
@@ (root level) @@
# rbac.authorization.k8s.io/v1/ClusterRole/aggregate-vulnerability-reports-view
! + one document added:
+ apiVersion: rbac.authorization.k8s.io/v1
+ kind: ClusterRole
+ metadata:
+ name: aggregate-vulnerability-reports-view
+ labels:
+ app.kubernetes.io/instance: trivy-operator
+ app.kubernetes.io/managed-by: Helm
+ app.kubernetes.io/name: trivy-operator
+ helm.toolkit.fluxcd.io/name: trivy-operator
+ helm.toolkit.fluxcd.io/namespace: trivy-system
+ rbac.authorization.k8s.io/aggregate-to-admin: "true"
+ rbac.authorization.k8s.io/aggregate-to-cluster-reader: "true"
+ rbac.authorization.k8s.io/aggregate-to-edit: "true"
+ rbac.authorization.k8s.io/aggregate-to-view: "true"
+ rules:
+ - resources:
+ - vulnerabilityreports
+ apiGroups:
+ - aquasecurity.github.io
+ verbs:
+ - get
+ - list
+ - watch
@@ (root level) @@
# rbac.authorization.k8s.io/v1/ClusterRoleBinding/trivy-operator
! + one document added:
+ apiVersion: rbac.authorization.k8s.io/v1
+ kind: ClusterRoleBinding
+ metadata:
+ name: trivy-operator
+ labels:
+ app.kubernetes.io/instance: trivy-operator
+ app.kubernetes.io/managed-by: Helm
+ app.kubernetes.io/name: trivy-operator
+ helm.toolkit.fluxcd.io/name: trivy-operator
+ helm.toolkit.fluxcd.io/namespace: trivy-system
+ roleRef:
+ name: trivy-operator
+ apiGroup: rbac.authorization.k8s.io
+ kind: ClusterRole
+ subjects:
+ - name: trivy-operator
+ kind: ServiceAccount
+ namespace: trivy-system
@@ (root level) @@
# rbac.authorization.k8s.io/v1/Role/trivy-system/trivy-operator-leader-election
! + one document added:
+ apiVersion: rbac.authorization.k8s.io/v1
+ kind: Role
+ metadata:
+ name: trivy-operator-leader-election
+ namespace: trivy-system
+ labels:
+ app.kubernetes.io/instance: trivy-operator
+ app.kubernetes.io/managed-by: Helm
+ app.kubernetes.io/name: trivy-operator
+ helm.toolkit.fluxcd.io/name: trivy-operator
+ helm.toolkit.fluxcd.io/namespace: trivy-system
+ rules:
+ - resources:
+ - leases
+ apiGroups:
+ - coordination.k8s.io
+ verbs:
+ - create
+ - get
+ - update
+ - resources:
+ - events
+ apiGroups:
+ -
+ verbs:
+ - create
@@ (root level) @@
# rbac.authorization.k8s.io/v1/Role/trivy-system/trivy-operator
! + one document added:
+ apiVersion: rbac.authorization.k8s.io/v1
+ kind: Role
+ metadata:
+ name: trivy-operator
+ namespace: trivy-system
+ labels:
+ app.kubernetes.io/instance: trivy-operator
+ app.kubernetes.io/managed-by: Helm
+ app.kubernetes.io/name: trivy-operator
+ helm.toolkit.fluxcd.io/name: trivy-operator
+ helm.toolkit.fluxcd.io/namespace: trivy-system
+ rules:
+ - resources:
+ - configmaps
+ apiGroups:
+ -
+ verbs:
+ - create
+ - get
+ - list
+ - watch
+ - resources:
+ - secrets
+ apiGroups:
+ -
+ verbs:
+ - create
+ - get
+ - delete
+ - update
@@ (root level) @@
# rbac.authorization.k8s.io/v1/RoleBinding/trivy-system/trivy-operator-leader-election
! + one document added:
+ apiVersion: rbac.authorization.k8s.io/v1
+ kind: RoleBinding
+ metadata:
+ name: trivy-operator-leader-election
+ namespace: trivy-system
+ labels:
+ app.kubernetes.io/instance: trivy-operator
+ app.kubernetes.io/managed-by: Helm
+ app.kubernetes.io/name: trivy-operator
+ helm.toolkit.fluxcd.io/name: trivy-operator
+ helm.toolkit.fluxcd.io/namespace: trivy-system
+ roleRef:
+ name: trivy-operator-leader-election
+ apiGroup: rbac.authorization.k8s.io
+ kind: Role
+ subjects:
+ - name: trivy-operator
+ kind: ServiceAccount
+ namespace: trivy-system
@@ (root level) @@
# rbac.authorization.k8s.io/v1/RoleBinding/trivy-system/trivy-operator
! + one document added:
+ apiVersion: rbac.authorization.k8s.io/v1
+ kind: RoleBinding
+ metadata:
+ name: trivy-operator
+ namespace: trivy-system
+ labels:
+ app.kubernetes.io/instance: trivy-operator
+ app.kubernetes.io/managed-by: Helm
+ app.kubernetes.io/name: trivy-operator
+ helm.toolkit.fluxcd.io/name: trivy-operator
+ helm.toolkit.fluxcd.io/namespace: trivy-system
+ roleRef:
+ name: trivy-operator
+ apiGroup: rbac.authorization.k8s.io
+ kind: Role
+ subjects:
+ - name: trivy-operator
+ kind: ServiceAccount
+ namespace: trivy-system
@@ (root level) @@
# v1/Service/trivy-system/trivy-operator
! + one document added:
+ apiVersion: v1
+ kind: Service
+ metadata:
+ name: trivy-operator
+ namespace: trivy-system
+ labels:
+ app.kubernetes.io/instance: trivy-operator
+ app.kubernetes.io/managed-by: Helm
+ app.kubernetes.io/name: trivy-operator
+ helm.toolkit.fluxcd.io/name: trivy-operator
+ helm.toolkit.fluxcd.io/namespace: trivy-system
+ spec:
+ type: ClusterIP
+ clusterIP: None
+ selector:
+ app.kubernetes.io/instance: trivy-operator
+ app.kubernetes.io/name: trivy-operator
+ ports:
+ - name: metrics
+ appProtocol: TCP
+ port: 80
+ protocol: TCP
+ targetPort: metrics
@@ (root level) @@
# apps/v1/Deployment/trivy-system/trivy-operator
! + one document added:
+ apiVersion: apps/v1
+ kind: Deployment
+ metadata:
+ name: trivy-operator
+ namespace: trivy-system
+ labels:
+ app.kubernetes.io/instance: trivy-operator
+ app.kubernetes.io/managed-by: Helm
+ app.kubernetes.io/name: trivy-operator
+ helm.toolkit.fluxcd.io/name: trivy-operator
+ helm.toolkit.fluxcd.io/namespace: trivy-system
+ spec:
+ replicas: 1
+ selector:
+ matchLabels:
+ app.kubernetes.io/instance: trivy-operator
+ app.kubernetes.io/name: trivy-operator
+ strategy:
+ type: Recreate
+ template:
+ metadata:
+ labels:
+ app.kubernetes.io/instance: trivy-operator
+ app.kubernetes.io/name: trivy-operator
+ spec:
+ automountServiceAccountToken: true
+ containers:
+ - name: trivy-operator
+ image: "ghcr.io/aquasec/trivy-operator:0.30.1"
+ imagePullPolicy: IfNotPresent
+ env:
+ - name: OPERATOR_NAMESPACE
+ value: trivy-system
+ - name: OPERATOR_TARGET_NAMESPACES
+ value:
+ - name: OPERATOR_EXCLUDE_NAMESPACES
+ value:
+ - name: OPERATOR_TARGET_WORKLOADS
+ value: "pod,replicaset,replicationcontroller,statefulset,daemonset,cronjob,job"
+ - name: OPERATOR_SERVICE_ACCOUNT
+ value: trivy-operator
+ livenessProbe:
+ failureThreshold: 10
+ httpGet:
+ path: /healthz/
+ port: probes
+ initialDelaySeconds: 5
+ periodSeconds: 10
+ successThreshold: 1
+ ports:
+ - name: metrics
+ containerPort: 8080
+ - name: probes
+ containerPort: 9090
+ readinessProbe:
+ failureThreshold: 3
+ httpGet:
+ path: /readyz/
+ port: probes
+ initialDelaySeconds: 5
+ periodSeconds: 10
+ successThreshold: 1
+ resources:
+ limits:
+ memory: 512Mi
+ requests:
+ cpu: 100m
+ memory: 256Mi
+ volumeMounts:
+ - name: cache-policies
+ mountPath: /tmp
+ readOnly: false
+ envFrom:
+ - configMapRef:
+ name: trivy-operator-config
+ securityContext:
+ allowPrivilegeEscalation: false
+ capabilities:
+ drop:
+ - ALL
+ privileged: false
+ readOnlyRootFilesystem: true
+ serviceAccountName: trivy-operator
+ volumes:
+ - name: cache-policies
+ emptyDir: {}
@@ (root level) @@
# aquasecurity.github.io/v1alpha1/ClusterComplianceReport/trivy-system/k8s-cis-1.23
! + one document added:
+ apiVersion: aquasecurity.github.io/v1alpha1
+ kind: ClusterComplianceReport
+ metadata:
+ name: k8s-cis-1.23
+ namespace: trivy-system
+ labels:
+ app.kubernetes.io/instance: trivy-operator
+ app.kubernetes.io/managed-by: kubectl
+ app.kubernetes.io/name: trivy-operator
+ helm.toolkit.fluxcd.io/name: trivy-operator
+ helm.toolkit.fluxcd.io/namespace: trivy-system
+ spec:
+ compliance:
+ version: "1.23"
+ description: "CIS Kubernetes Benchmarks"
+ id: k8s-cis-1.23
+ platform: k8s
+ title: "CIS Kubernetes Benchmarks v1.23"
+ type: cis
+ relatedResources:
+ - "https://www.cisecurity.org/benchmark/kubernetes"
+ controls:
+ - name: "Ensure that the API server pod specification file permissions are set to 600 or more restrictive"
+ checks:
+ - id: AVD-KCV-0048
+ commands:
+ - id: CMD-0001
+ description: "Ensure that the API server pod specification file has permissions of 600 or more restrictive"
+ id: "1.1.1"
+ severity: HIGH
+ - name: "Ensure that the API server pod specification file ownership is set to root:root"
+ checks:
+ - id: AVD-KCV-0049
+ commands:
+ - id: CMD-0002
+ description: "Ensure that the API server pod specification file ownership is set to root:root"
+ id: "1.1.2"
+ severity: HIGH
+ - name: "Ensure that the controller manager pod specification file permissions are set to 600 or more restrictive"
+ checks:
+ - id: AVD-KCV-0050
+ commands:
+ - id: CMD-0003
+ description: "Ensure that the controller manager pod specification file has permissions of 600 or more restrictive"
+ id: "1.1.3"
+ severity: HIGH
+ - name: "Ensure that the controller manager pod specification file ownership is set to root:root"
+ checks:
+ - id: AVD-KCV-0051
+ commands:
+ - id: CMD-0004
+ description: "Ensure that the controller manager pod specification file ownership is set to root:root"
+ id: "1.1.4"
+ severity: HIGH
+ - name: "Ensure that the scheduler pod specification file permissions are set to 600 or more restrictive"
+ checks:
+ - id: AVD-KCV-0052
+ commands:
+ - id: CMD-0005
+ description: "Ensure that the scheduler pod specification file has permissions of 600 or more restrictive"
+ id: "1.1.5"
+ severity: HIGH
+ - name: "Ensure that the scheduler pod specification file ownership is set to root:root"
+ checks:
+ - id: AVD-KCV-0053
+ commands:
+ - id: CMD-0006
+ description: "Ensure that the scheduler pod specification file ownership is set to root:root"
+ id: "1.1.6"
+ severity: HIGH
+ - name: "Ensure that the etcd pod specification file permissions are set to 600 or more restrictive"
+ checks:
+ - id: AVD-KCV-0054
+ commands:
+ - id: CMD-0007
+ description: "Ensure that the etcd pod specification file has permissions of 600 or more restrictive"
+ id: "1.1.7"
+ severity: HIGH
+ - name: "Ensure that the etcd pod specification file ownership is set to root:root"
+ checks:
+ - id: AVD-KCV-0055
+ commands:
+ - id: CMD-0008
+ description: "Ensure that the etcd pod specification file ownership is set to root:root."
+ id: "1.1.8"
+ severity: HIGH
+ - name: "Ensure that the Container Network Interface file permissions are set to 600 or more restrictive"
+ checks:
+ - id: AVD-KCV-0056
+ commands:
+ - id: CMD-0009
+ description: "Ensure that the Container Network Interface files have permissions of 600 or more restrictive"
+ id: "1.1.9"
+ severity: HIGH
+ - name: "Ensure that the Container Network Interface file ownership is set to root:root"
+ checks:
+ - id: AVD-KCV-0057
+ commands:
+ - id: CMD-0010
+ description: "Ensure that the Container Network Interface files have ownership set to root:root"
+ id: "1.1.10"
+ severity: HIGH
+ - name: "Ensure that the etcd data directory permissions are set to 700 or more restrictive"
+ checks:
+ - id: AVD-KCV-0058
+ commands:
+ - id: CMD-0011
+ description: "Ensure that the etcd data directory has permissions of 700 or more restrictive"
+ id: "1.1.11"
+ severity: HIGH
+ - name: "Ensure that the etcd data directory ownership is set to etcd:etcd"
+ checks:
+ - id: AVD-KCV-0059
+ commands:
+ - id: CMD-0012
+ description: "Ensure that the etcd data directory ownership is set to etcd:etcd"
+ id: "1.1.12"
+ severity: LOW
+ - name: "Ensure that the admin.conf file permissions are set to 600"
+ checks:
+ - id: AVD-KCV-0060
+ commands:
+ - id: CMD-0013
+ description: "Ensure that the admin.conf file has permissions of 600"
+ id: "1.1.13"
+ severity: CRITICAL
+ - name: "Ensure that the admin.conf file ownership is set to root:root"
+ checks:
+ - id: AVD-KCV-0061
+ commands:
+ - id: CMD-0014
+ description: "Ensure that the admin.conf file ownership is set to root:root"
+ id: "1.1.14"
+ severity: CRITICAL
+ - name: "Ensure that the scheduler.conf file permissions are set to 600 or more restrictive"
+ checks:
+ - id: AVD-KCV-0062
+ commands:
+ - id: CMD-0015
+ description: "Ensure that the scheduler.conf file has permissions of 600 or more restrictive"
+ id: "1.1.15"
+ severity: HIGH
+ - name: "Ensure that the scheduler.conf file ownership is set to root:root"
+ checks:
+ - id: AVD-KCV-0063
+ commands:
+ - id: CMD-0016
+ description: "Ensure that the scheduler.conf file ownership is set to root:root"
+ id: "1.1.16"
+ severity: HIGH
+ - name: "Ensure that the controller-manager.conf file permissions are set to 600 or more restrictive"
+ checks:
+ - id: AVD-KCV-0064
+ commands:
+ - id: CMD-0017
+ description: "Ensure that the controller-manager.conf file has permissions of 600 or more restrictive"
+ id: "1.1.17"
+ severity: HIGH
+ - name: "Ensure that the controller-manager.conf file ownership is set to root:root"
+ checks:
+ - id: AVD-KCV-0065
+ commands:
+ - id: CMD-0018
+ description: "Ensure that the controller-manager.conf file ownership is set to root:root."
+ id: "1.1.18"
+ severity: HIGH
+ - name: "Ensure that the Kubernetes PKI directory and file ownership is set to root:root"
+ checks:
+ - id: AVD-KCV-0066
+ commands:
+ - id: CMD-0019
+ description: "Ensure that the Kubernetes PKI directory and file ownership is set to root:root"
+ id: "1.1.19"
+ severity: CRITICAL
+ - name: "Ensure that the Kubernetes PKI certificate file permissions are set to 600 or more restrictive"
+ checks:
+ - id: AVD-KCV-0068
+ commands:
+ - id: CMD-0020
+ description: "Ensure that Kubernetes PKI certificate files have permissions of 600 or more restrictive"
+ id: "1.1.20"
+ severity: CRITICAL
+ - name: "Ensure that the Kubernetes PKI key file permissions are set to 600"
+ checks:
+ - id: AVD-KCV-0067
+ commands:
+ - id: CMD-0021
+ description: "Ensure that Kubernetes PKI key files have permissions of 600"
+ id: "1.1.21"
+ severity: CRITICAL
+ - name: "Ensure that the --anonymous-auth argument is set to false"
+ checks:
+ - id: AVD-KCV-0001
+ description: "Disable anonymous requests to the API server"
+ id: "1.2.1"
+ severity: MEDIUM
+ - name: "Ensure that the --token-auth-file parameter is not set"
+ checks:
+ - id: AVD-KCV-0002
+ description: "Do not use token based authentication"
+ id: "1.2.2"
+ severity: LOW
+ - name: "Ensure that the --DenyServiceExternalIPs is not set"
+ checks:
+ - id: AVD-KCV-0003
+ description: "This admission controller rejects all net-new usage of the Service field externalIPs"
+ id: "1.2.3"
+ severity: LOW
+ - name: "Ensure that the --kubelet-https argument is set to true"
+ checks:
+ - id: AVD-KCV-0004
+ description: "Use https for kubelet connections"
+ id: "1.2.4"
+ severity: LOW
+ - name: "Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate"
+ checks:
+ - id: AVD-KCV-0005
+ description: "Enable certificate based kubelet authentication"
+ id: "1.2.5"
+ severity: HIGH
+ - name: "Ensure that the --kubelet-certificate-authority argument is set as appropriate"
+ checks:
+ - id: AVD-KCV-0006
+ description: "Verify kubelets certificate before establishing connection"
+ id: "1.2.6"
+ severity: HIGH
+ - name: "Ensure that the --authorization-mode argument is not set to AlwaysAllow"
+ checks:
+ - id: AVD-KCV-0007
+ description: "Do not always authorize all requests"
+ id: "1.2.7"
+ severity: LOW
+ - name: "Ensure that the --authorization-mode argument includes Node"
+ checks:
+ - id: AVD-KCV-0008
+ description: "Restrict kubelet nodes to reading only objects associated with them"
+ id: "1.2.8"
+ severity: HIGH
+ - name: "Ensure that the --authorization-mode argument includes RBAC"
+ checks:
+ - id: AVD-KCV-0009
+ description: "Turn on Role Based Access Control"
+ id: "1.2.9"
+ severity: HIGH
+ - name: "Ensure that the admission control plugin EventRateLimit is set"
+ checks:
+ - id: AVD-KCV-0010
+ description: "Limit the rate at which the API server accepts requests"
+ id: "1.2.10"
+ severity: HIGH
+ - name: "Ensure that the admission control plugin AlwaysAdmit is not set"
+ checks:
+ - id: AVD-KCV-0011
+ description: "Do not allow all requests"
+ id: "1.2.11"
+ severity: LOW
+ - name: "Ensure that the admission control plugin AlwaysPullImages is set"
+ checks:
+ - id: AVD-KCV-0012
+ description: "Always pull images"
+ id: "1.2.12"
+ severity: MEDIUM
+ - name: "Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used"
+ checks:
+ - id: AVD-KCV-0013
+ description: "The SecurityContextDeny admission controller can be used to deny pods which make use of some SecurityContext fields which could allow for privilege escalation in the cluster. This should be used where PodSecurityPolicy is not in place within the cluster"
+ id: "1.2.13"
+ severity: MEDIUM
+ - name: "Ensure that the admission control plugin ServiceAccount is set"
+ checks:
+ - id: AVD-KCV-0014
+ description: "Automate service accounts management"
+ id: "1.2.14"
+ severity: LOW
+ - name: "Ensure that the admission control plugin NamespaceLifecycle is set"
+ checks:
+ - id: AVD-KCV-0015
+ description: "Reject creating objects in a namespace that is undergoing termination"
+ id: "1.2.15"
+ severity: LOW
+ - name: "Ensure that the admission control plugin NodeRestriction is set"
+ checks:
+ - id: AVD-KCV-0016
+ description: "Limit the Node and Pod objects that a kubelet could modify"
+ id: "1.2.16"
+ severity: LOW
+ - name: "Ensure that the --secure-port argument is not set to 0"
+ checks:
+ - id: AVD-KCV-0017
+ description: "Do not disable the secure port"
+ id: "1.2.17"
+ severity: HIGH
+ - name: "Ensure that the --profiling argument is set to false"
+ checks:
+ - id: AVD-KCV-0018
+ description: "Disable profiling, if not needed"
+ id: "1.2.18"
+ severity: LOW
+ - name: "Ensure that the --audit-log-path argument is set"
+ checks:
+ - id: AVD-KCV-0019
+ description: "Enable auditing on the Kubernetes API Server and set the desired audit log path."
+ id: "1.2.19"
+ severity: LOW
+ - name: "Ensure that the --audit-log-maxage argument is set to 30 or as appropriate"
+ checks:
+ - id: AVD-KCV-0020
+ description: "Retain the logs for at least 30 days or as appropriate"
+ id: "1.2.20"
+ severity: LOW
+ - name: "Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate"
+ checks:
+ - id: AVD-KCV-0021
+ description: "Retain 10 or an appropriate number of old log file"
+ id: "1.2.21"
+ severity: LOW
+ - name: "Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate"
+ checks:
+ - id: AVD-KCV-0022
+ description: "Rotate log files on reaching 100 MB or as appropriate"
+ id: "1.2.22"
+ severity: LOW
+ - name: "Ensure that the --service-account-lookup argument is set to true"
+ checks:
+ - id: AVD-KCV-0024
+ description: "Validate service account before validating token"
+ id: "1.2.24"
+ severity: LOW
+ - name: "Ensure that the --service-account-key-file argument is set as appropriate"
+ checks:
+ - id: AVD-KCV-0025
+ description: "Explicitly set a service account public key file for service accounts on the apiserver"
+ id: "1.2.25"
+ severity: LOW
+ - name: "Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate"
+ checks:
+ - id: AVD-KCV-0026
+ description: "etcd should be configured to make use of TLS encryption for client connections"
+ id: "1.2.26"
+ severity: LOW
+ - name: "Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate"
+ checks:
+ - id: AVD-KCV-0027
+ description: "Setup TLS connection on the API server"
+ id: "1.2.27"
+ severity: MEDIUM
+ - name: "Ensure that the --client-ca-file argument is set appropriate"
+ checks:
+ - id: AVD-KCV-0028
+ description: "Setup TLS connection on the API server"
+ id: "1.2.28"
+ severity: LOW
+ - name: "Ensure that the --etcd-cafile argument is set as appropriate"
+ checks:
+ - id: AVD-KCV-0029
+ description: "etcd should be configured to make use of TLS encryption for client connections."
+ id: "1.2.29"
+ severity: LOW
+ - name: "Ensure that the --encryption-provider-config argument is set as appropriate"
+ checks:
+ - id: AVD-KCV-0030
+ description: "Encrypt etcd key-value store"
+ id: "1.2.30"
+ severity: LOW
+ - name: "Ensure that the --terminated-pod-gc-threshold argument is set as appropriate"
+ checks:
+ - id: AVD-KCV-0033
+ description: "Activate garbage collector on pod termination, as appropriate"
+ id: "1.3.1"
+ severity: MEDIUM
+ - name: "Ensure that the --use-service-account-credentials argument is set to true"
+ checks:
+ - id: AVD-KCV-0035
+ description: "Use individual service account credentials for each controller"
+ id: "1.3.3"
+ severity: MEDIUM
+ - name: "Ensure that the --service-account-private-key-file argument is set as appropriate"
+ checks:
+ - id: AVD-KCV-0036
+ description: "Explicitly set a service account private key file for service accounts on the controller manager"
+ id: "1.3.4"
+ severity: MEDIUM
+ - name: "Ensure that the --root-ca-file argument is set as appropriate"
+ checks:
+ - id: AVD-KCV-0037
+ description: "Allow pods to verify the API servers serving certificate before establishing connections"
+ id: "1.3.5"
+ severity: MEDIUM
+ - name: "Ensure that the RotateKubeletServerCertificate argument is set to true"
+ checks:
+ - id: AVD-KCV-0038
+ description: "Enable kubelet server certificate rotation on controller-manager"
+ id: "1.3.6"
+ severity: MEDIUM
+ - name: "Ensure that the --bind-address argument is set to 127.0.0.1"
+ checks:
+ - id: AVD-KCV-0039
+ description: "Do not bind the scheduler service to non-loopback insecure addresses"
+ id: "1.3.7"
+ severity: LOW
+ - name: "Ensure that the --profiling argument is set to false"
+ checks:
+ - id: AVD-KCV-0034
+ description: "Disable profiling, if not needed"
+ id: "1.4.1"
+ severity: MEDIUM
+ - name: "Ensure that the --bind-address argument is set to 127.0.0.1"
+ checks:
+ - id: AVD-KCV-0041
+ description: "Do not bind the scheduler service to non-loopback insecure addresses"
+ id: "1.4.2"
+ severity: CRITICAL
+ - name: "Ensure that the --cert-file and --key-file arguments are set as appropriate"
+ checks:
+ - id: AVD-KCV-0042
+ description: "Configure TLS encryption for the etcd service"
+ id: "2.1"
+ severity: MEDIUM
+ - name: "Ensure that the --client-cert-auth argument is set to true"
+ checks:
+ - id: AVD-KCV-0043
+ description: "Enable client authentication on etcd service"
+ id: "2.2"
+ severity: CRITICAL
+ - name: "Ensure that the --auto-tls argument is not set to true"
+ checks:
+ - id: AVD-KCV-0044
+ description: "Do not use self-signed certificates for TLS"
+ id: "2.3"
+ severity: CRITICAL
+ - name: "Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate"
+ checks:
+ - id: AVD-KCV-0045
+ description: "etcd should be configured to make use of TLS encryption for peer connections."
+ id: "2.4"
+ severity: CRITICAL
+ - name: "Ensure that the --peer-client-cert-auth argument is set to true"
+ checks:
+ - id: AVD-KCV-0046
+ description: "etcd should be configured for peer authentication"
+ id: "2.5"
+ severity: CRITICAL
+ - name: "Ensure that the --peer-auto-tls argument is not set to true"
+ checks:
+ - id: AVD-KCV-0047
+ description: "Do not use self-signed certificates for TLS"
+ id: "2.6"
+ severity: HIGH
+ - name: "Client certificate authentication should not be used for users (Manual)"
+ description: "Kubernetes provides the option to use client certificates for user authentication. However as there is no way to revoke these certificates when a user leaves an organization or loses their credential, they are not suitable for this purpose"
+ id: "3.1.1"
+ severity: HIGH
+ - name: "Ensure that a minimal audit policy is created (Manual)"
+ description: "Kubernetes can audit the details of requests made to the API server. The --audit- policy-file flag must be set for this logging to be enabled."
+ id: "3.2.1"
+ severity: HIGH
+ - name: "Ensure that the audit policy covers key security concerns (Manual)"
+ description: "Ensure that the audit policy created for the cluster covers key security concerns"
+ id: "3.2.2"
+ severity: HIGH
+ - name: "Ensure that the kubelet service file permissions are set to 600 or more restrictive"
+ checks:
+ - id: AVD-KCV-0069
+ commands:
+ - id: CMD-0022
+ description: "Ensure that the kubelet service file has permissions of 600 or more restrictive."
+ id: "4.1.1"
+ severity: HIGH
+ - name: "Ensure that the kubelet service file ownership is set to root:root"
+ checks:
+ - id: AVD-KCV-0070
+ commands:
+ - id: CMD-0023
+ description: "Ensure that the kubelet service file ownership is set to root:root"
+ id: "4.1.2"
+ severity: HIGH
+ - name: "If proxy kubeconfig file exists ensure permissions are set to 600 or more restrictive"
+ checks:
+ - id: AVD-KCV-0071
+ commands:
+ - id: CMD-0024
+ description: "If kube-proxy is running, and if it is using a file-based kubeconfig file, ensure that the proxy kubeconfig file has permissions of 600 or more restrictive"
+ id: "4.1.3"
+ severity: HIGH
+ - name: "If proxy kubeconfig file exists ensure ownership is set to root:root"
+ checks:
+ - id: AVD-KCV-0072
+ commands:
+ - id: CMD-0025
+ description: "If kube-proxy is running, ensure that the file ownership of its kubeconfig file is set to root:root"
+ id: "4.1.4"
+ severity: HIGH
+ - name: "Ensure that the --kubeconfig kubelet.conf file permissions are set to 600 or more restrictive"
+ checks:
+ - id: AVD-KCV-0073
+ commands:
+ - id: CMD-0026
+ description: "Ensure that the kubelet.conf file has permissions of 600 or more restrictive"
+ id: "4.1.5"
+ severity: HIGH
+ - name: "Ensure that the --kubeconfig kubelet.conf file ownership is set to root:root"
+ checks:
+ - id: AVD-KCV-0074
+ commands:
+ - id: CMD-0027
+ description: "Ensure that the kubelet.conf file ownership is set to root:root"
+ id: "4.1.6"
+ severity: HIGH
+ - name: "Ensure that the certificate authorities file permissions are set to 600 or more restrictive"
+ checks:
+ - id: AVD-KCV-0075
+ commands:
+ - id: CMD-0028
+ description: "Ensure that the certificate authorities file has permissions of 600 or more restrictive"
+ id: "4.1.7"
+ severity: CRITICAL
+ - name: "Ensure that the client certificate authorities file ownership is set to root:root"
+ checks:
+ - id: AVD-KCV-0076
+ commands:
+ - id: CMD-0029
+ description: "Ensure that the certificate authorities file ownership is set to root:root"
+ id: "4.1.8"
+ severity: CRITICAL
+ - name: "If the kubelet config.yaml configuration file is being used validate permissions set to 600 or more restrictive"
+ checks:
+ - id: AVD-KCV-0077
+ commands:
+ - id: CMD-0030
+ description: "Ensure that if the kubelet refers to a configuration file with the --config argument, that file has permissions of 600 or more restrictive"
+ id: "4.1.9"
+ severity: HIGH
+ - name: "If the kubelet config.yaml configuration file is being used validate file ownership is set to root:root"
+ checks:
+ - id: AVD-KCV-0078
+ commands:
+ - id: CMD-0031
+ description: "Ensure that if the kubelet refers to a configuration file with the --config argument, that file is owned by root:root"
+ id: "4.1.10"
+ severity: HIGH
+ - name: "Ensure that the --anonymous-auth argument is set to false"
+ checks:
+ - id: AVD-KCV-0079
+ commands:
+ - id: CMD-0032
+ description: "Disable anonymous requests to the Kubelet server"
+ id: "4.2.1"
+ severity: CRITICAL
+ - name: "Ensure that the --authorization-mode argument is not set to AlwaysAllow"
+ checks:
+ - id: AVD-KCV-0080
+ commands:
+ - id: CMD-0033
+ description: "Do not allow all requests. Enable explicit authorization"
+ id: "4.2.2"
+ severity: CRITICAL
+ - name: "Ensure that the --client-ca-file argument is set as appropriate"
+ checks:
+ - id: AVD-KCV-0081
+ commands:
+ - id: CMD-0034
+ description: "Enable Kubelet authentication using certificates"
+ id: "4.2.3"
+ severity: CRITICAL
+ - name: "Verify that the --read-only-port argument is set to 0"
+ checks:
+ - id: AVD-KCV-0082
+ commands:
+ - id: CMD-0035
+ description: "Disable the read-only port"
+ id: "4.2.4"
+ severity: HIGH
+ - name: "Ensure that the --streaming-connection-idle-timeout argument is not set to 0"
+ checks:
+ - id: AVD-KCV-0085
+ commands:
+ - id: CMD-0036
+ description: "Do not disable timeouts on streaming connections"
+ id: "4.2.5"
+ severity: HIGH
+ - name: "Ensure that the --protect-kernel-defaults argument is set to true"
+ checks:
+ - id: AVD-KCV-0083
+ commands:
+ - id: CMD-0037
+ description: "Protect tuned kernel parameters from overriding kubelet default kernel parameter values"
+ id: "4.2.6"
+ severity: HIGH
+ - name: "Ensure that the --make-iptables-util-chains argument is set to true"
+ checks:
+ - id: AVD-KCV-0084
+ commands:
+ - id: CMD-0038
+ description: "Allow Kubelet to manage iptables"
+ id: "4.2.7"
+ severity: HIGH
+ - name: "Ensure that the --hostname-override argument is not set"
+ checks:
+ - id: AVD-KCV-0086
+ commands:
+ - id: CMD-0039
+ description: "Do not override node hostnames"
+ id: "4.2.8"
+ severity: HIGH
+ - name: "Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture"
+ checks:
+ - id: AVD-KCV-0087
+ commands:
+ - id: CMD-0040
+ description: "Security relevant information should be captured. The --event-qps flag on the Kubelet can be used to limit the rate at which events are gathered"
+ id: "4.2.9"
+ severity: HIGH
+ - name: "Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate"
+ checks:
+ - id: AVD-KCV-0088
+ - id: AVD-KCV-0089
+ commands:
+ - id: CMD-0041
+ - id: CMD-0042
+ description: "Setup TLS connection on the Kubelets"
+ id: "4.2.10"
+ severity: CRITICAL
+ - name: "Ensure that the --rotate-certificates argument is not set to false"
+ checks:
+ - id: AVD-KCV-0090
+ commands:
+ - id: CMD-0043
+ description: "Enable kubelet client certificate rotation"
+ id: "4.2.11"
+ severity: CRITICAL
+ - name: "Verify that the RotateKubeletServerCertificate argument is set to true"
+ checks:
+ - id: AVD-KCV-0091
+ commands:
+ - id: CMD-0044
+ description: "Enable kubelet server certificate rotation"
+ id: "4.2.12"
+ severity: CRITICAL
+ - name: "Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers"
+ checks:
+ - id: AVD-KCV-0092
+ commands:
+ - id: CMD-0045
+ description: "Ensure that the Kubelet is configured to only use strong cryptographic ciphers"
+ id: "4.2.13"
+ severity: CRITICAL
+ - name: "Ensure that the cluster-admin role is only used where required"
+ checks:
+ - id: AVD-KSV-0111
+ description: "The RBAC role cluster-admin provides wide-ranging powers over the environment and should be used only where and when needed"
+ id: "5.1.1"
+ severity: HIGH
+ - name: "Minimize access to secrets"
+ checks:
+ - id: AVD-KSV-0041
+ description: "The Kubernetes API stores secrets, which may be service account tokens for the Kubernetes API or credentials used by workloads in the cluster"
+ id: "5.1.2"
+ severity: HIGH
+ - name: "Minimize wildcard use in Roles and ClusterRoles"
+ checks:
+ - id: AVD-KSV-0044
+ - id: AVD-KSV-0045
+ - id: AVD-KSV-0046
+ description: "Kubernetes Roles and ClusterRoles provide access to resources based on sets of objects and actions that can be taken on those objects. It is possible to set either of these to be the wildcard \"*\" which matches all items"
+ id: "5.1.3"
+ severity: HIGH
+ - name: "Ensure that Service Account Tokens are only mounted where necessary"
+ checks:
+ - id: AVD-KSV-0036
+ description: "Service accounts tokens should not be mounted in pods except where the workload running in the pod explicitly needs to communicate with the API server"
+ id: "5.1.6"
+ severity: HIGH
+ - name: "Limit use of the Bind, Impersonate and Escalate permissions in the Kubernetes cluster"
+ checks:
+ - id: AVD-KSV-0043
+ description: "Cluster roles and roles with the impersonate, bind or escalate permissions should not be granted unless strictly required"
+ id: "5.1.8"
+ severity: HIGH
+ - name: "Minimize the admission of privileged containers"
+ checks:
+ - id: AVD-KSV-0017
+ description: "Do not generally permit containers to be run with the securityContext.privileged flag set to true"
+ id: "5.2.2"
+ severity: HIGH
+ - name: "Minimize the admission of containers wishing to share the host process ID namespace"
+ checks:
+ - id: AVD-KSV-0010
+ description: "Do not generally permit containers to be run with the hostPID flag set to true."
+ id: "5.2.3"
+ severity: HIGH
+ - name: "Minimize the admission of containers wishing to share the host IPC namespace"
+ checks:
+ - id: AVD-KSV-0008
+ description: "Do not generally permit containers to be run with the hostIPC flag set to true"
+ id: "5.2.4"
+ severity: HIGH
+ - name: "Minimize the admission of containers wishing to share the host network namespace"
+ checks:
+ - id: AVD-KSV-0009
+ description: "Do not generally permit containers to be run with the hostNetwork flag set to true"
+ id: "5.2.5"
+ severity: HIGH
+ - name: "Minimize the admission of containers with allowPrivilegeEscalation"
+ checks:
+ - id: AVD-KSV-0001
+ description: "Do not generally permit containers to be run with the allowPrivilegeEscalation flag set to true"
+ id: "5.2.6"
+ severity: HIGH
+ - name: "Minimize the admission of root containers"
+ checks:
+ - id: AVD-KSV-0012
+ description: "Do not generally permit containers to be run as the root user"
+ id: "5.2.7"
+ severity: MEDIUM
+ - name: "Minimize the admission of containers with the NET_RAW capability"
+ checks:
+ - id: AVD-KSV-0022
+ description: "Do not generally permit containers with the potentially dangerous NET_RAW capability"
+ id: "5.2.8"
+ severity: MEDIUM
+ - name: "Minimize the admission of containers with added capabilities"
+ checks:
+ - id: AVD-KSV-0004
+ description: "Do not generally permit containers with capabilities assigned beyond the default set"
+ id: "5.2.9"
+ severity: LOW
+ - name: "Minimize the admission of containers with capabilities assigned"
+ checks:
+ - id: AVD-KSV-0003
+ description: "Do not generally permit containers with capabilities"
+ id: "5.2.10"
+ severity: LOW
+ - name: "Minimize the admission of containers with capabilities assigned"
+ checks:
+ - id: AVD-KSV-0103
+ description: "Do not generally permit containers with capabilities"
+ id: "5.2.11"
+ severity: MEDIUM
+ - name: "Minimize the admission of HostPath volumes"
+ checks:
+ - id: AVD-KSV-0023
+ description: "Do not generally admit containers which make use of hostPath volumes"
+ id: "5.2.12"
+ severity: MEDIUM
+ - name: "Minimize the admission of containers which use HostPorts"
+ checks:
+ - id: AVD-KSV-0024
+ description: "Do not generally permit containers which require the use of HostPorts"
+ id: "5.2.13"
+ severity: MEDIUM
+ - name: "Ensure that the CNI in use supports Network Policies (Manual)"
+ description: "There are a variety of CNI plugins available for Kubernetes. If the CNI in use does not support Network Policies it may not be possible to effectively restrict traffic in the cluster"
+ id: "5.3.1"
+ severity: MEDIUM
+ - name: "Ensure that all Namespaces have Network Policies defined"
+ checks:
+ - id: AVD-KSV-0038
+ description: "Use network policies to isolate traffic in your cluster network"
+ id: "5.3.2"
+ severity: MEDIUM
+ - name: "Prefer using secrets as files over secrets as environment variables (Manual)"
+ description: "Kubernetes supports mounting secrets as data volumes or as environment variables. Minimize the use of environment variable secrets"
+ id: "5.4.1"
+ severity: MEDIUM
+ - name: "Consider external secret storage (Manual)"
+ description: "Consider the use of an external secrets storage and management system, instead of using Kubernetes Secrets directly, if you have more complex secret management needs"
+ id: "5.4.2"
+ severity: MEDIUM
+ - name: "Configure Image Provenance using ImagePolicyWebhook admission controller (Manual)"
+ description: "Configure Image Provenance for your deployment"
+ id: "5.5.1"
+ severity: MEDIUM
+ - name: "Create administrative boundaries between resources using namespaces (Manual)"
+ description: "Use namespaces to isolate your Kubernetes objects"
+ id: "5.7.1"
+ severity: MEDIUM
+ - name: "Ensure that the seccomp profile is set to docker/default in your pod definitions"
+ checks:
+ - id: AVD-KSV-0104
+ description: "Enable docker/default seccomp profile in your pod definitions"
+ id: "5.7.2"
+ severity: MEDIUM
+ - name: "Apply Security Context to Your Pods and Containers"
+ checks:
+ - id: AVD-KSV-0021
+ - id: AVD-KSV-0020
+ - id: AVD-KSV-0005
+ - id: AVD-KSV-0025
+ - id: AVD-KSV-0104
+ - id: AVD-KSV-0030
+ description: "Apply Security Context to Your Pods and Containers"
+ id: "5.7.3"
+ severity: HIGH
+ - name: "The default namespace should not be used"
+ checks:
+ - id: AVD-KSV-0110
+ description: "Kubernetes provides a default namespace, where objects are placed if no namespace is specified for them"
+ id: "5.7.4"
+ severity: MEDIUM
+ cron: "0 */6 * * *"
+ reportType: summary
@@ (root level) @@
# aquasecurity.github.io/v1alpha1/ClusterComplianceReport/trivy-system/k8s-nsa-1.0
! + one document added:
+ apiVersion: aquasecurity.github.io/v1alpha1
+ kind: ClusterComplianceReport
+ metadata:
+ name: k8s-nsa-1.0
+ namespace: trivy-system
+ labels:
+ app.kubernetes.io/instance: trivy-operator
+ app.kubernetes.io/managed-by: kubectl
+ app.kubernetes.io/name: trivy-operator
+ helm.toolkit.fluxcd.io/name: trivy-operator
+ helm.toolkit.fluxcd.io/namespace: trivy-system
+ spec:
+ compliance:
+ version: "1.0"
+ description: "National Security Agency - Kubernetes Hardening Guidance"
+ id: k8s-nsa-1.0
+ platform: k8s
+ title: "National Security Agency - Kubernetes Hardening Guidance v1.0"
+ type: nsa
+ relatedResources:
+ - "https://www.nsa.gov/Press-Room/News-Highlights/Article/Article/2716980/nsa-cisa-release-kubernetes-hardening-guidance/"
+ controls:
+ - name: "Non-root containers"
+ checks:
+ - id: AVD-KSV-0012
+ description: "Check that container is not running as root"
+ id: "1.0"
+ severity: MEDIUM
+ - name: "Immutable container file systems"
+ checks:
+ - id: AVD-KSV-0014
+ description: "Check that container root file system is immutable"
+ id: "1.1"
+ severity: LOW
+ - name: "Preventing privileged containers"
+ checks:
+ - id: AVD-KSV-0017
+ description: "Controls whether Pods can run privileged containers"
+ id: "1.2"
+ severity: HIGH
+ - name: "Share containers process namespaces"
+ checks:
+ - id: AVD-KSV-0008
+ description: "Controls whether containers can share process namespaces"
+ id: "1.3"
+ severity: HIGH
+ - name: "Share host process namespaces"
+ checks:
+ - id: AVD-KSV-0009
+ description: "Controls whether share host process namespaces"
+ id: "1.4"
+ severity: HIGH
+ - name: "Use the host network"
+ checks:
+ - id: AVD-KSV-0010
+ description: "Controls whether containers can use the host network"
+ id: "1.5"
+ severity: HIGH
+ - name: "Run with root privileges or with root group membership"
+ checks:
+ - id: AVD-KSV-0029
+ description: "Controls whether container applications can run with root privileges or with root group membership"
+ id: "1.6"
+ severity: LOW
+ - name: "Restricts escalation to root privileges"
+ checks:
+ - id: AVD-KSV-0001
+ description: "Control check restrictions escalation to root privileges"
+ id: "1.7"
+ severity: MEDIUM
+ - name: "Sets the SELinux context of the container"
+ checks:
+ - id: AVD-KSV-0002
+ description: "Control checks if pod sets the SELinux context of the container"
+ id: "1.8"
+ severity: MEDIUM
+ - name: "Restrict a container's access to resources with AppArmor"
+ checks:
+ - id: AVD-KSV-0030
+ description: "Control checks the restriction of containers access to resources with AppArmor"
+ id: "1.9"
+ severity: MEDIUM
+ - name: "Sets the seccomp profile used to sandbox containers."
+ checks:
+ - id: AVD-KSV-0030
+ description: "Control checks the sets the seccomp profile used to sandbox containers"
+ id: "1.10"
+ severity: LOW
+ - name: "Protecting Pod service account tokens"
+ checks:
+ - id: AVD-KSV-0036
+ description: "Control check whether disable secret token been mount ,automountServiceAccountToken: false"
+ id: "1.11"
+ severity: MEDIUM
+ - name: "Namespace kube-system should not be used by users"
+ checks:
+ - id: AVD-KSV-0037
+ defaultStatus: FAIL
+ description: "Control check whether Namespace kube-system is not be used by users"
+ id: "1.12"
+ severity: MEDIUM
+ - name: "Pod and/or namespace Selectors usage"
+ checks:
+ - id: AVD-KSV-0038
+ defaultStatus: FAIL
+ description: "Control check validate the pod and/or namespace Selectors usage"
+ id: "2.0"
+ severity: MEDIUM
+ - name: "Use CNI plugin that supports NetworkPolicy API (Manual)"
+ defaultStatus: FAIL
+ description: "Control check whether check cni plugin installed"
+ id: "3.0"
+ severity: CRITICAL
+ - name: "Use ResourceQuota policies to limit resources"
+ checks:
+ - id: AVD-KSV-0040
+ defaultStatus: FAIL
+ description: "Control check the use of ResourceQuota policy to limit aggregate resource usage within namespace"
+ id: "4.0"
+ severity: MEDIUM
+ - name: "Use LimitRange policies to limit resources"
+ checks:
+ - id: AVD-KSV-0039
+ defaultStatus: FAIL
+ description: "Control check the use of LimitRange policy limit resource usage for namespaces or nodes"
+ id: "4.1"
+ severity: MEDIUM
+ - name: "Control plan disable insecure port (Manual)"
+ defaultStatus: FAIL
+ description: "Control check whether control plan disable insecure port"
+ id: "5.0"
+ severity: CRITICAL
+ - name: "Encrypt etcd communication"
+ checks:
+ - id: AVD-KCV-0030
+ description: "Control check whether etcd communication is encrypted"
+ id: "5.1"
+ severity: CRITICAL
+ - name: "Ensure kube config file permission (Manual)"
+ defaultStatus: FAIL
+ description: "Control check whether kube config file permissions"
+ id: "6.0"
+ severity: CRITICAL
+ - name: "Check that encryption resource has been set"
+ checks:
+ - id: AVD-KCV-0029
+ description: "Control checks whether encryption resource has been set"
+ id: "6.1"
+ severity: CRITICAL
+ - name: "Check encryption provider"
+ checks:
+ - id: AVD-KCV-0004
+ description: "Control checks whether encryption provider has been set"
+ id: "6.2"
+ severity: CRITICAL
+ - name: "Make sure anonymous-auth is unset"
+ checks:
+ - id: AVD-KCV-0001
+ description: "Control checks whether anonymous-auth is unset"
+ id: "7.0"
+ severity: CRITICAL
+ - name: "Make sure -authorization-mode=RBAC"
+ checks:
+ - id: AVD-KCV-0008
+ description: "Control check whether RBAC permission is in use"
+ id: "7.1"
+ severity: CRITICAL
+ - name: "Audit policy is configure (Manual)"
+ defaultStatus: FAIL
+ description: "Control check whether audit policy is configure"
+ id: "8.0"
+ severity: HIGH
+ - name: "Audit log path is configure"
+ checks:
+ - id: AVD-KCV-0019
+ description: "Control check whether audit log path is configure"
+ id: "8.1"
+ severity: MEDIUM
+ - name: "Audit log aging"
+ checks:
+ - id: AVD-KCV-0020
+ description: "Control check whether audit log aging is configure"
+ id: "8.2"
+ severity: MEDIUM
+ cron: "0 */6 * * *"
+ reportType: summary
@@ (root level) @@
# aquasecurity.github.io/v1alpha1/ClusterComplianceReport/trivy-system/k8s-pss-baseline-0.1
! + one document added:
+ apiVersion: aquasecurity.github.io/v1alpha1
+ kind: ClusterComplianceReport
+ metadata:
+ name: k8s-pss-baseline-0.1
+ namespace: trivy-system
+ labels:
+ app.kubernetes.io/instance: trivy-operator
+ app.kubernetes.io/managed-by: kubectl
+ app.kubernetes.io/name: trivy-operator
+ helm.toolkit.fluxcd.io/name: trivy-operator
+ helm.toolkit.fluxcd.io/namespace: trivy-system
+ spec:
+ compliance:
+ version: "0.1"
+ description: "Kubernetes Pod Security Standards - Baseline"
+ id: k8s-pss-baseline-0.1
+ platform: eks
+ title: "Kubernetes Pod Security Standards - Baseline"
+ type: pss-baseline
+ relatedResources:
+ -This message was truncated. Download full message |
@@ (root level) @@
# kustomize.toolkit.fluxcd.io/v1/Kustomization/trivy-system/trivy-operator
! + one document added:
+ apiVersion: kustomize.toolkit.fluxcd.io/v1
+ kind: Kustomization
+ metadata:
+ name: trivy-operator
+ namespace: trivy-system
+ labels:
+ kustomize.toolkit.fluxcd.io/name: cluster-apps
+ kustomize.toolkit.fluxcd.io/namespace: flux-system
+ spec:
+ decryption:
+ provider: sops
+ secretRef:
+ name: sops-age
+ deletionPolicy: WaitForTermination
+ interval: 1h
+ patches:
+ - patch: |
+ apiVersion: helm.toolkit.fluxcd.io/v2
+ kind: HelmRelease
+ metadata:
+ name: _
+ spec:
+ driftDetection:
+ mode: enabled
+ install:
+ crds: CreateReplace
+ rollback:
+ cleanupOnFail: true
+ upgrade:
+ cleanupOnFail: true
+ crds: CreateReplace
+ strategy:
+ name: RemediateOnFailure
+ remediation:
+ remediateLastFailure: true
+ retries: 2
+ target:
+ kind: HelmRelease
+ group: helm.toolkit.fluxcd.io
+ path: ./kubernetes/apps/trivy-system/trivy-operator/app
+ postBuild:
+ substituteFrom:
+ - name: cluster-settings
+ kind: ConfigMap
+ optional: false
+ - name: cluster-secrets
+ kind: Secret
+ optional: false
+ prune: true
+ retryInterval: 2m
+ sourceRef:
+ name: flux-system
+ kind: GitRepository
+ namespace: flux-system
+ targetNamespace: trivy-system
+ timeout: 5m
+ wait: true
@@ (root level) @@
# v1/ConfigMap/trivy-system/cluster-settings
! + one document added:
+ apiVersion: v1
+ kind: ConfigMap
+ metadata:
+ name: cluster-settings
+ namespace: trivy-system
+ labels:
+ kustomize.toolkit.fluxcd.io/name: cluster-apps
+ kustomize.toolkit.fluxcd.io/namespace: flux-system
+ data:
+ AVR_IP: "192.168.0.106"
+ BACKUP_NFS_PATH: /mnt/TanguilleServer/VolsyncKopia
+ CENTAURI_CARBON_IP: "192.168.0.95"
+ CLUSTER_NODE_1_IP: "192.168.0.11"
+ CLUSTER_NODE_2_IP: "192.168.0.12"
+ CLUSTER_NODE_3_IP: "192.168.0.13"
+ COREDNS_IP: "10.43.0.10"
+ ENVOY_EXTERNAL_IP: "192.168.0.6"
+ ENVOY_GATUS_PROBE_IP: "192.168.0.9"
+ ENVOY_INTERNAL_IP: "192.168.0.4"
+ ENVOY_INTERNAL_TLS_IP: "192.168.0.7"
+ HOME_ASSISTANT_IP: "192.168.0.16"
+ IPMI_IP: "192.168.0.45"
+ K8S_GATEWAY_IP: "192.168.0.3"
+ LAN_CIDR: 192.168.0.0/24
+ MEDIA_NFS_PATH: /mnt/BIGHDDZ1/Media
+ MONEROD_IP: "192.168.0.8"
+ OPENCODE_VM_IP: "192.168.0.181"
+ OPNSENSE_IP: "192.168.0.1"
+ P2POOL_IP: "192.168.0.5"
+ POD_CIDR: 10.42.0.0/16
+ TIMEZONE: Europe/Brussels
+ TRUENAS_IP: "192.168.0.27"
@@ (root level) @@
# v1/Namespace/trivy-system
! + one document added:
+ apiVersion: v1
+ kind: Namespace
+ metadata:
+ name: trivy-system
+ annotations:
+ kustomize.toolkit.fluxcd.io/prune: disabled
+ labels:
+ kustomize.toolkit.fluxcd.io/name: cluster-apps
+ kustomize.toolkit.fluxcd.io/namespace: flux-system
+ pod-security.kubernetes.io/audit: baseline
+ pod-security.kubernetes.io/enforce: baseline
+ pod-security.kubernetes.io/warn: baseline
@@ (root level) @@
# source.toolkit.fluxcd.io/v1/OCIRepository/trivy-system/app-template
! + one document added:
+ apiVersion: source.toolkit.fluxcd.io/v1
+ kind: OCIRepository
+ metadata:
+ name: app-template
+ namespace: trivy-system
+ labels:
+ kustomize.toolkit.fluxcd.io/name: cluster-apps
+ kustomize.toolkit.fluxcd.io/namespace: flux-system
+ spec:
+ url: "oci://ghcr.io/bjw-s-labs/helm/app-template"
+ interval: 1h
+ layerSelector:
+ mediaType: application/vnd.cncf.helm.chart.content.v1.tar+gzip
+ operation: copy
+ ref:
+ tag: "5.1.0"
@@ (root level) @@
# helm.toolkit.fluxcd.io/v2/HelmRelease/trivy-system/trivy-operator
! + one document added:
+ apiVersion: helm.toolkit.fluxcd.io/v2
+ kind: HelmRelease
+ metadata:
+ name: trivy-operator
+ namespace: trivy-system
+ labels:
+ kustomize.toolkit.fluxcd.io/name: trivy-operator
+ kustomize.toolkit.fluxcd.io/namespace: trivy-system
+ spec:
+ chartRef:
+ name: trivy-operator
+ kind: OCIRepository
+ driftDetection:
+ mode: enabled
+ install:
+ crds: CreateReplace
+ interval: 1h
+ rollback:
+ cleanupOnFail: true
+ upgrade:
+ cleanupOnFail: true
+ crds: CreateReplace
+ remediation:
+ remediateLastFailure: true
+ retries: 2
+ strategy:
+ name: RemediateOnFailure
+ values:
+ resources:
+ limits:
+ memory: 512Mi
+ requests:
+ cpu: 100m
+ memory: 256Mi
+ fullnameOverride: trivy-operator
+ image:
+ registry: ghcr.io
+ repository: aquasec/trivy-operator
+ operator:
+ replicas: 1
+ serviceMonitor:
+ enabled: true
+ trivy:
+ image:
+ registry: ghcr.io
+ repository: aquasec/trivy
+ severity: "UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL"
+ slow: true
@@ (root level) @@
# source.toolkit.fluxcd.io/v1/OCIRepository/trivy-system/trivy-operator
! + one document added:
+ apiVersion: source.toolkit.fluxcd.io/v1
+ kind: OCIRepository
+ metadata:
+ name: trivy-operator
+ namespace: trivy-system
+ labels:
+ kustomize.toolkit.fluxcd.io/name: trivy-operator
+ kustomize.toolkit.fluxcd.io/namespace: trivy-system
+ spec:
+ url: "oci://ghcr.io/aquasecurity/helm-charts/trivy-operator"
+ interval: 1h
+ layerSelector:
+ mediaType: application/vnd.cncf.helm.chart.content.v1.tar+gzip
+ operation: copy
+ ref:
+ tag: "0.32.1"
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds Trivy Operator as an on‑prem, always‑on security scanner in a new
trivy‑systemnamespace — the one item in the original lint‑tool list that is genuinely a cluster service worth deploying (vs the others which are repo‑side CI linters).It continuously scans workloads for image CVEs, exposed secrets, config misconfigurations, and RBAC, storing results as native K8s CRs, and exposes metrics to Prometheus via a ServiceMonitor. Fully self‑hosted — no vendor/ARMO cloud, no new SOPS secrets (the chart creates its own RBAC/ServiceAccount).
Why Trivy, not the 6 as listed
.github/workflows/gitleaks.yaml).lefthook.toml) +.mise.toml.markdownlint.json(oxfmt defers.mdto it)kubescape‑operator, whose backend runs in ARMO SaaS (needs an ARMO account, ships data out) — poor fit for a private, security‑first homelabTrivy is the on‑prem, continuous, no‑vendor equivalent of the cluster‑side scan the list was pointing at.
Details
trivy-operator0.32.1fromoci://ghcr.io/aquasecurity/helm-charts/trivy-operator(latest tag pullable from that OCI repo; plain tag — Renovate pins the digest).Standalonemode (in‑cluster scanner jobs,slow: truefor homelab footprint), severity all levels.trivy‑systemuses the standardbaselinePSA component (nopsa‑privileged).Validation
kustomize buildonkubernetes/apps/trivy-system/and.../app/— all pass.✓ All kustomize builds passed,✓ shellcheck passed; 0 new warnings from these files (73 pre‑existing warnings on other files are untouched).values.yamlinspected against the pulled0.32.1chart (value keys: top‑leveloperator/image/trivy/serviceMonitor/resources;mode: Standalonedefault;rbac.create/serviceAccount.createdefaulttrue).Not in this PR (deliberate)
/metricsfrom the deployed operator.