Run Trivy CIS Scan without requiring any Download/Proxy access?

[ssurovich]

I didnt see this in the docs as per say, so I was hoping that someone may have an idea - or let me know it cant be done.

I need to run a CIS scan against a cluster using Trivy but it's an air-gapped environment so I do not have Internet access. Since the scan-vulnerabilityreport pods are trying to pull the DB's from the Internet they are crashing.

Is there any way to run just a CIS benchmark without the the DB's and an Internet connection?

Thanks!

[chen-keinan]

@ssurovich yes it can be done, you'll need to upload your the node collector / trivy image to private repo and set it in helm
node-collector trivy image

let me know if you need more details

[robotica72]

Hi Chen - I have it working with pulling images, my issue is that I cant download the CVE DB and for this particular use-case, I only want CIS results. I was hoping to disable any attempted download of the DB - or, at the wost case, download the DB manually so I can stop the pod from crashing?