Kubernetes-native security toolkit.
There are lots of security tools in the cloud native world, created by Aqua and by others, for identifying and informing users about security issues in Kubernetes workloads and infrastructure components. However powerful and useful they might be, they tend to sit alongside Kubernetes, with each new product requiring users to learn a separate set of commands and installation steps in order to operate them and find critical security information.
Trivy-Operator attempts to integrate heterogeneous security tools by incorporating their outputs into Kubernetes CRDs (Custom Resource Definitions) and from there, making security reports accessible through the Kubernetes API. This way users can find and view the risks that relate to different resources in what we call a Kubernetes-native way.
- Automated vulnerability scanning for Kubernetes workloads.
- Automated configuration audits for Kubernetes resources with predefined rules or custom Open Policy Agent (OPA) policies.
- Automated infrastructures scanning and compliance checks with CIS Benchmarks published by the Center for Internet Security (CIS).
- Automated compliance report – NSA, CISA Kubernetes Hardening Kubernetes Guidance v1.0
- Penetration test results for a Kubernetes cluster.
- Custom Resource Definitions and a Go module to work with and integrate a range of security scanners.
- The Octant Plugin and the Lens Extension that make security reports available through familiar Kubernetes interfaces.
Trivy-Operator can be used:
As a Kubernetes operator to automatically update security reports in response to workload and other changes on a Kubernetes cluster – for example, initiating a vulnerability scan when a new Pod is started or running CIS Benchmarks when a new Node is added.
As a command, so you can trigger scans and view the risks in a kubectl-compatible way or as part of your CI/CD pipeline.
Although we are trying to keep new releases backward compatible with previous versions, this project is still incubating, and some APIs and Custom Resource Definitions may change.
The official Documentation provides detailed installation, configuration, troubleshooting, and quick start guides.
Read more about the motivations for the project in the Starboard: The Kubernetes-Native Toolkit for Unifying Security blog.
At this early stage we would love your feedback on the overall concept of Trivy-Operator. Over time, we’d love to see contributions integrating different security tools so that users can access security information in standard, Kubernetes-native ways.
- See Contributing for information about setting up your development environment, and the contribution workflow that we expect.
- See Roadmap for tentative features in a 1.0.0 release.