Trivy Operator for Kubernetes

Helm-based setup of Trivy Operator with Terraform. Trivy Operator is a tool that leverages Trivy for scanning a Kubernetes cluster for security issues. The scans are summarised in security reports as Kubernetes Custom Resource Definitions, which become accessible through the Kubernetes API. The Operator does this by watching Kubernetes for state changes and automatically triggering security scans in response. For example, a vulnerability scan is initiated when a new Pod is created. This way, users can find and view the risks that relate to different resources in a Kubernetes-native way. Additionally, Trivy Operator exposes metrics related to the discovered issues in a Prometheus-native format, allowing users to visualise and/or alert on found vulnerabilities.

NOTE: To allow Trivy Operator permissions to scan the images from private Docker registries follow the official tutorial

Once you have a Corewide Solutions Portal account, this one-time action will use your browser session to retrieve credentials:

 shellterraform login solutions.corewide.com

Provision instructions

Initialize mandatory providers:

Copy and paste into your Terraform configuration and insert the variables:

 hclmodule "tf_k8s_trivy_operator" {
  source  = "solutions.corewide.com/kubernetes/tf-k8s-trivy-operator/helm"
  version = "~> 1.1.0"

  # specify module inputs here or try one of the examples below
  ...
}

Initialize the setup:

 shellterraform init

Define update strategy

Corewide DevOps team strictly follows Semantic Versioning Specification to provide our clients with products that have predictable upgrades between versions. We recommend pinning patch versions of our modules using pessimistic constraint operator (~>) to prevent breaking changes during upgrades.

To get new features during the upgrades (without breaking compatibility), use ~> 1.1 and run terraform init -upgrade

For the safest setup, use strict pinning with version = "1.1.0"

Module 35% off	~~$450~~ $292
TOTAL	$292

BUY

Corewide Proprietary License

v1.1.0 released 1 week, 1 day ago

New version approx. every 16 weeks

Changelog

NOTE: To allow Trivy Operator permissions to scan the images from private Docker registries follow the official tutorial

Minimal setup with default parameters:

 hclmodule "trivy_operator" {
  source  = "solutions.corewide.com/kubernetes/tf-k8s-trivy-operator/helm"
  version = "~> 1.1"
}

Trivy Operator setup with full customization:

 hclmodule "trivy_operator" {
  source  = "solutions.corewide.com/kubernetes/tf-k8s-trivy-operator/helm"
  version = "~> 1.1"

  name                 = "trivy-operator-prod"
  namespace            = "security-scanner"
  chart_version        = "0.37.0"
  service_account_name = "trivy"

  node_selector = {
    "production/node-pool-name" = "maintenance"
  }

  service_account_annotations = {
    # Allow read-only access to the Container Registry
    "eks.amazonaws.com/role-arn" = "arn:aws:iam::012345678910:role/trivy-operator-prod"
  }

  excluded_images = [
    "ghcr.io/groundnuty/k8s-wait-for:*",
  ]

  enabled_metrics = [
    "metricsVulnIdEnabled",
    "metricsExposedSecretInfo",
    "metricsConfigAuditInfo",
    "metricsRbacAssessmentInfo",
    "metricsImageInfo",
  ]

  custom_values = {
    trivy = {
      resources = {
        requests = {
          cpu    = "10m"
          memory = "10M"
        }
      }
    }
  }
}

Variable	Description	Type	Default	Required	Sensitive
`chart_version`	Version of the Trivy Operator Helm chart	`string`	`0.37.0`	no	no
`create_namespace`	Enable dedicated namespace creation for the Trivy Operator deployment	`bool`	`true`	no	no
`custom_values`	Custom values to pass to the Trivy Operator Helm chart as nested maps	`any`	`{}`	no	no
`enabled_metrics`	Enabled metrics exposed for scraping by Prometheus. Possible values are: `metricsVulnIdEnabled`, `metricsExposedSecretInfo`, `metricsConfigAuditInfo`, `metricsRbacAssessmentInfo`, `metricsInfraAssessmentInfo`,`metricsImageInfo`, and `metricsClusterComplianceInfo`	`list(string)`		no	no
`excluded_images`	Glob patterns for excluding images from scanning	`list(string)`	`[]`	no	no
`name`	Name to override the Trivy Operator release name	`string`	`trivy-operator`	no	no
`namespace`	Namespace to install Trivy Operator into	`string`	`trivy-operator`	no	no
`node_selector`	Node Selectors to configure for the Trivy Operator services	`map(string)`	`{}`	no	no
`service_account_annotations`	Annotations to add to the Trivy Operator controller's `ServiceAccount`	`map(string)`	`{}`	no	no
`service_account_name`	Name of the Trivy Operator controller's `ServiceAccount`	`string`	`trivy-operator`	no	no
`service_annotations`	Annotations to add to the Trivy Operator controller's `Service`	`map(string)`	`{}`	no	no