Kubernetes-native security toolkit. (Documentation)

Reason for the Fork

We're running AKS with Azure CNI Powered by Cilium. Without the fork we exhaust the cilium identity buffer because of the cardinality of trivy job/pod labels. At the moment it's not possible to configure which labels should be used by cilium as it would be possible with a self managed CNI. See cilium doc We created an issue for AKS without the expectation to be solve it in the near feature. See github issue

As a workaround we changed the label assignment to the by default ignored "annotation.*". Additionaly Azure CNI Powered by Cilium does not exclude the controller-uid label so that we had to change the job<->pod default behavior using "manualSelector: true" in the job definition.

Introduction

The Trivy Operator leverages Trivy to continuously scan your Kubernetes cluster for security issues. The scans are summarised in security reports as Kubernetes Custom Resource Definitions, which become accessible through the Kubernetes API. The Operator does this by watching Kubernetes for state changes and automatically triggering security scans in response. For example, a vulnerability scan is initiated when a new Pod is created. This way, users can find and view the risks that relate to different resources in a Kubernetes-native way.

In-cluster Security Scans

The Trivy Operator automatically generates and updates security reports. These reports are generated in response to new workload and other changes on a Kubernetes cluster, generating the following reports:

• Vulnerability Scans: Automated vulnerability scanning for Kubernetes workloads, control-plane and node components (api-server, controller-manager, kubelet and etc)
• ConfigAudit Scans: Automated configuration audits for Kubernetes resources with predefined rules or custom Open Policy Agent (OPA) policies.
• Exposed Secret Scans: Automated secret scans which find and detail the location of exposed Secrets within your cluster.
• RBAC scans: Role Based Access Control scans provide detailed information on the access rights of the different resources installed.
• K8s core component infra assessment scan Kubernetes infra core components (etcd,apiserver,scheduler,controller-manager and etc) setting and configuration.
• k8s outdated api validation - a configaudit check will validate if the resource api has been deprecated and planned for removal
• Compliance reports
  • NSA, CISA Kubernetes Hardening Guidance v1.1 cybersecurity technical report is produced.
  • CIS Kubernetes Benchmark v1.23 cybersecurity technical report is produced.
  • Kubernetes pss-baseline, Pod Security Standards
  • Kubernetes pss-restricted, Pod Security Standards
• SBOM (Software Bill of Materials genertations) for Kubernetes workloads.

Please star ⭐ the repo if you want us to continue developing and improving trivy-operator! 😀

Usage

The official Documentation provides detailed installation, configuration, troubleshooting, and quick start guides.

You can install the Trivy-operator Operator with Static YAML Manifests and follow the Getting Started guide to see how vulnerability and configuration audit reports are generated automatically.

Quick Start

The Trivy Operator can be installed easily through the Helm Chart. The Helm Chart can be downloaded by one of the two options:

Option 1: Install from traditional helm chart repository

Add the Aqua chart repository:

   helm repo add aqua https://aquasecurity.github.io/helm-charts/
   helm repo update

Install the Helm Chart:

   helm install trivy-operator aqua/trivy-operator \
     --namespace trivy-system \
     --create-namespace \
     --version 0.21.4

Option 2: Install from OCI registry (supported in Helm v3.8.0+)

Install the Helm Chart:

   helm install trivy-operator oci://ghcr.io/aquasecurity/helm-charts/trivy-operator \
     --namespace trivy-system \
     --create-namespace \
     --version 0.21.4

This will install the Trivy Helm Chart into the trivy-system namespace and start triggering the scans.

Status

Although we are trying to keep new releases backward compatible with previous versions, this project is still incubating, and some APIs and Custom Resource Definitions may change.

Contributing

At this early stage we would love your feedback on the overall concept of Trivy-Operator. Over time, we'd love to see contributions integrating different security tools so that users can access security information in standard, Kubernetes-native ways.

• See Contributing for information about setting up your development environment, and the contribution workflow that we expect.
• Please ensure that you are following our Code Of Conduct during any interaction with the Aqua projects and their community.

---

Trivy-Operator is an Aqua Security open source project.
Learn about our Open Source Work and Portfolio.
Join the community, and talk to us about any matter in GitHub Discussions or Slack.