Trivy-operator v0.11.0 Released!

[chen-keinan]

🧾 Complete CIS Kubernetes Benchmark (include host-level checks ) ⎈

This release provides the complete CIS Kubernetes Benchmark report including "host-level checks" which bring Trivy-operator compatible with kube-bench.

  "summary": {
    "failCount": 38,
    "passCount": 78
  },
  "summaryReport": {
    "controlCheck": [
      {
        "id": "1.1.12",
        "name": "Ensure that the etcd data directory ownership is set to etcd:etcd",
        "severity": "LOW",
        "totalFail": 1
      },
      {
        "id": "4.1.1",
        "name": "Ensure that the kubelet service file permissions are set to 600 or more restrictive",
        "severity": "HIGH",
        "totalFail": 3
      },
      {
        "id": "4.1.9",
        "name": "If the kubelet config.yaml configuration file is being used validate permissions set to 600 or more restrictive",
        "severity": "HIGH",
        "totalFail": 3
      },
      {
        "id": "4.2.1",
        "name": "Ensure that the --anonymous-auth argument is set to false",
        "severity": "CRITICAL",
        "totalFail": 3
      },
      {
        "id": "4.2.2",
        "name": "Ensure that the --authorization-mode argument is not set to AlwaysAllow",
        "severity": "CRITICAL",
        "totalFail": 2
      },
      {
        "id": "4.2.3",
        "name": "Ensure that the --client-ca-file argument is set as appropriate",
        "severity": "CRITICAL",
        "totalFail": 2
      },

Additional changes

• Advance Ignore policy via rego (Expose trivy --ignore-policy feature #870)
• Additional Labels (resource_kind, resource_name & container_name) to vulnerability metrics (add resource_kind, resource_name & container_name lables to vulnerability metrics #841)
• Add end to End testing

Notable fixes

• Migrate rbac policies to kubernetes (feat: migrate rbac policies to kubernetes #880)
• Helm chart privateRegistryScanSecretsNames should allow for multiple secrets in same namespace (Helm chart privateRegistryScanSecretsNames should allow for multiple secrets in same namespace #908 )
• Adding grafana tutorial to documentation (adding grafana tutorial to documentation #832)