Skip to content

Commit f1ffdef

Browse files
devopstalesdevopstales
committed
add trivy-operator 2.5.0
1 parent 2fdc9a5 commit f1ffdef

20 files changed

Lines changed: 3222 additions & 165 deletions

‎charts/trivy-operator-2.5.0.tgz‎

17.4 KB
Binary file not shown.

‎charts/trivy-operator/Chart.yaml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,18 @@
11
apiVersion: v2
22
name: trivy-operator
3-
description: A Helm chart for trivy-operator
3+
description: "This chart deploys an operator that default every 5 minutes execute a scan script. It will get image list from all namespaces with the label `trivy-scan=true`, and then scan this images with trivy, finally we will get metrics on `http://[pod-ip]:9115/metrics`"
44
type: application
5-
version: 2.4.3
6-
appVersion: "1.16.0"
5+
version: 2.5.0
6+
appVersion: "0.23.0"
77
kubeVersion: ">=1.19.x-0"
88
keywords:
99
- Trivy
1010
- Admission Controller
1111
- Operator
1212
- Image Secutity
13-
home: https://devopstales.github.io/trivy-operator/
13+
home: https://github.com/devopstales/trivy-operator
1414
icon: https://github.com/devopstales/helm-charts/raw/main/icons/trivy.png
1515
sources:
1616
- https://github.com/devopstales/trivy-operator
1717
- https://github.com/devopstales/helm-charts
18-
deprecated: false
18+
deprecated: false

‎charts/trivy-operator/README.md‎

Lines changed: 69 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -1,43 +1,77 @@
11
### Trivy Operator
22

3+
![Version: 2.5.0](https://img.shields.io/badge/Version-2.5.0-informational?style=for-the-badge)
4+
![Type: application](https://img.shields.io/badge/Type-application-informational?style=for-the-badge)
5+
![AppVersion: 1.16.0](https://img.shields.io/badge/AppVersion-1.16.0-informational?style=for-the-badge)
6+
7+
## Description
8+
39
This chart deploys an operator that default every 5 minutes execute a scan script. It will get image list from all namespaces with the label `trivy-scan=true`, and then scan this images with trivy, finally we will get metrics on `http://[pod-ip]:9115/metrics`
410

511
## Configuration
612

713
The following tables lists configurable parameters of the trivy-operator chart and their default values.
814

9-
| Parameter | Description | Default |
10-
| ----------------------------------- | ------------------------------------------- | -----------------------------------------|
11-
| image.repository | image | devopstales/trivy-operator |
12-
| image.pullPolicy | pullPolicy | Always |
13-
| image.tag | image tag | 2.4.1 |
14-
| imagePullSecrets | imagePullSecrets list | [] |
15-
| podSecurityContext.fsGroup | mount id | 10001 |
16-
| serviceAccount.create | create serviceAccount | true |
17-
| serviceAccount.annotations | add annotation to serviceAccount | {} |
18-
| serviceAccount.name | name of the serviceAccount | trivy-operator |
19-
| monitoring.port | prometheus endpoint port | 9115 |
20-
| serviceMonitor.enabled | enable serviceMonitor object creation | false |
21-
| serviceMonitor.namespace | where to create serviceMonitor object | kube-system |
22-
| serviceMonitor.interval | set interval to serviceMonitor | 60s |
23-
| serviceMonitor.scrapeTimeout | set scrapeTimeout to serviceMonitor | 30s |
24-
| serviceMonitor.relabelings | set relabelings to serviceMonitor | [] |
25-
| serviceMonitor.metricRelabelings | set metricRelabelings to serviceMonitor | [] |
26-
| persistence.enabled | enable pv to store trivy database | true |
27-
| persistence.size | pv size | 1Gi |
28-
| persistence.storageClass | storageClass | Not defined |
29-
| persistence.accessMode | accessMode | ReadWriteOnce |
30-
| persistence.annotations | add extra annotations | No value |
31-
| NamespaceScanner.crontab | cronjob scheduler | "*/5 * * * *" |
32-
| NamespaceScanner.namespaceSelector | Namespace Selector | "trivy-scan" |
33-
| NamespaceScanner.clusterWide | scan all namespaces | "false" |
34-
| NamespaceScanner.policyreport | generate policy reports | "false" |
35-
| registryAuth.enabled | enable registry authentication in operator | false |
36-
| registryAuth.registry | registry name for authentication |
37-
| registryAuth.user | username for authentication |
38-
| registryAuth.password | password for authentication |
39-
| githubToken.enabled | Enable githubToken usage for trivy database update | false |
40-
| githubToken.token | githubToken value | "" |
41-
| nodeSelector | Select node where deploy | "" |
42-
| tolerations | Tolerations for use with node taints | [] |
43-
| affinity | Assign custom affinity rules to the trivy operator | {} |
15+
<fill out>
16+
17+
## Values
18+
19+
| Key | Type | Default | Description |
20+
|-----|------|---------|-------------|
21+
| TimeZone | string | `"UTC"` | Time Zone in container |
22+
| admissionController.enabled | bool | `false` | enable adission controller |
23+
| affinity | object | `{}` | Set the affinity for the pod. |
24+
| cache.enabled | bool | `false` | enable redis cache |
25+
| clusterScanner.crontab | string | `"*/1 * * * *"` | crontab for scheduled scan |
26+
| clusterScanner.enabled | bool | `false` | enable clusterScanner cr creation |
27+
| clusterScanner.integrations | object | `{}` | configure defectdojo integration |
28+
| clusterScanner.scanProfileName | string | `"cis-1.23"` | kube-hunter scan profile |
29+
| githubToken.enabled | bool | `false` | enable github authentiation token |
30+
| githubToken.token | string | `""` | github authentiation token value |
31+
| grafana.dashboards.enabled | bool | `true` | Enable the deployment of grafana dashboards |
32+
| grafana.dashboards.label | string | `"grafana_dashboard"` | Label to find dashboards using the k8s sidecar |
33+
| grafana.dashboards.value | string | `"1"` | Label value to find dashboards using the k8s sidecar |
34+
| grafana.folder.annotation | string | `"grafana_folder"` | Annotation to enable folder storage using the k8s sidecar |
35+
| grafana.folder.name | string | `"Policy Reporter"` | Grafana folder in which to store the dashboards |
36+
| grafana.namespace | string | `nil` | namespace for configMap of grafana dashboards |
37+
| image.pullPolicy | string | `"Always"` | The docker image pull policy |
38+
| image.repository | string | `"devopstales/trivy-operator"` | The docker image repository to use |
39+
| image.tag | string | `"2.5.0"` | The docker image tag to use |
40+
| imagePullSecrets | list | `[]` | list of secrets to use for imae pull |
41+
| kube_bench_scnner.image.pullPolicy | string | `"Always"` | The docker image pull policy |
42+
| kube_bench_scnner.image.repository | string | `"devopstales/kube-bench-scnner"` | The docker image repository to use |
43+
| kube_bench_scnner.image.tag | string | `"2.5"` | The docker image tag to use |
44+
| log_level | string | `"INFO"` | Log level |
45+
| monitoring.port | string | `"9115"` | configure prometheus monitoring port |
46+
| namespaceScanner.clusterWide | bool | `false` | |
47+
| namespaceScanner.crontab | string | `"*/5 * * * *"` | |
48+
| namespaceScanner.integrations.policyreport | bool | `false` | |
49+
| namespaceScanner.namespaceSelector | string | `"trivy-scan"` | |
50+
| nodeSelector | object | `{}` | Set the node selector for the pod. |
51+
| offline.db_repository | string | `"localhost:5000/trivy-db"` | repository to use for download trivy vuln db |
52+
| offline.db_repository_insecure | bool | `false` | insecure repository |
53+
| offline.enabled | bool | `false` | enable air-gapped mode |
54+
| persistence.accessMode | string | `"ReadWriteOnce"` | Volumes mode |
55+
| persistence.annotations | object | `{}` | Volumes annotations |
56+
| persistence.enabled | bool | `true` | Volumes for the pod |
57+
| persistence.size | string | `"1Gi"` | Volumes size |
58+
| podSecurityContext | object | `{"fsGroup":10001,"fsGroupChangePolicy":"OnRootMismatch"}` | security options for the pod |
59+
| registryAuth.enabled | bool | `false` | enable registry authentication |
60+
| registryAuth.image_pull_secrets | list | `["regcred"]` | list of image pull secrets for authentication |
61+
| serviceAccount.annotations | object | `{}` | serviceAccount annotations |
62+
| serviceAccount.create | bool | `true` | Enable serviceAccount creation |
63+
| serviceAccount.name | string | `"trivy-operator"` | Name of the serviceAccount |
64+
| serviceMonitor.enabled | bool | `false` | allow to override the namespace for serviceMonitor |
65+
| serviceMonitor.labels.release | string | `"prometheus"` | labels to match the serviceMonitorSelector of the Prometheus Resource |
66+
| serviceMonitor.metricRelabelings | list | `[]` | metricRelabeling config for serviceMonitor |
67+
| serviceMonitor.namespace | object | `{}` | Name of the namespace for serviceMonitor |
68+
| serviceMonitor.relabelings | list | `[]` | relabel config for serviceMonitor |
69+
| tolerations | list | `[]` | Set the tolerations for the pod. |
70+
71+
**Homepage:** <https://github.com/devopstales/trivy-operator>
72+
73+
## Source Code
74+
75+
* <https://github.com/devopstales/trivy-operator>
76+
* <https://github.com/devopstales/helm-charts>
77+

‎charts/trivy-operator/crds/0-crd.yaml‎

Lines changed: 0 additions & 52 deletions
This file was deleted.

‎charts/trivy-operator/crds/ClusterScanner.yaml‎

Lines changed: 97 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,97 @@
1+
apiVersion: apiextensions.k8s.io/v1
2+
kind: CustomResourceDefinition
3+
metadata:
4+
name: cluster-scanners.trivy-operator.devopstales.io
5+
spec:
6+
conversion:
7+
strategy: None
8+
group: trivy-operator.devopstales.io
9+
names:
10+
kind: ClusterScanner
11+
listKind: ClusterScannerList
12+
plural: cluster-scanners
13+
shortNames:
14+
- cs-scan
15+
singular: cluster-scanner
16+
scope: Cluster
17+
versions:
18+
- additionalPrinterColumns:
19+
- description: Kubernetes Scan Profile
20+
jsonPath: .spec.scanProfileName
21+
name: ClusterScanProfile
22+
type: string
23+
- description: crontab value
24+
jsonPath: .spec.crontab
25+
name: Crontab
26+
type: string
27+
name: v1
28+
schema:
29+
openAPIV3Schema:
30+
properties:
31+
crontab:
32+
pattern: ^(\d+|\*)(/\d+)?(\s+(\d+|\*)(/\d+)?){4}$
33+
type: string
34+
scanProfileName:
35+
type: string
36+
enum:
37+
- ack-1.0
38+
- aks-1.0
39+
- gke-1.0
40+
- gke-1.2.0
41+
- eks-1.0.1
42+
- cis-1.5
43+
- cis-1.6
44+
- cis-1.20
45+
- cis-1.23
46+
- rh-0.7
47+
- rh-1.0
48+
- k3s-cis-1.6-permissive
49+
- k3s-cis-1.6-hardened
50+
- k3s-cis-1.20-hardened
51+
- k3s-cis-1.20-permissive
52+
- k3s-cis-1.23-hardened
53+
- k3s-cis-1.23-permissive
54+
- rke-cis-1.4
55+
- rke-cis-1.5-hardened
56+
- rke-cis-1.5-permissive
57+
- rke-cis-1.6-hardened
58+
- rke-cis-1.6-permissive
59+
- rke-cis-1.20-hardened
60+
- rke-cis-1.20-permissive
61+
- rke-cis-1.23-hardened
62+
- rke-cis-1.23-permissive
63+
- rke2-cis-1.5-hardened
64+
- rke2-cis-1.5-permissive
65+
- rke2-cis-1.6-hardened
66+
- rke2-cis-1.6-permissive
67+
- rke2-cis-1.20-hardened
68+
- rke2-cis-1.20-permissive
69+
- rke2-cis-1.23-hardened
70+
- rke2-cis-1.23-permissive
71+
integrations:
72+
type: object
73+
properties:
74+
defectdojo:
75+
description: DefectDojo integration options
76+
type: object
77+
properties:
78+
host:
79+
description: URL of the DefectDojo server.
80+
type: string
81+
api_key:
82+
description: Api key for DefectDojo api authentication.
83+
type: string
84+
k8s-cluster-name:
85+
description: Name of the Kubernetes Cluster in defectdojo.
86+
type: string
87+
spec:
88+
type: object
89+
x-kubernetes-preserve-unknown-fields: true
90+
status:
91+
type: object
92+
x-kubernetes-preserve-unknown-fields: true
93+
type: object
94+
served: true
95+
storage: true
96+
subresources:
97+
status: {}

‎charts/trivy-operator/crds/NamespaceScanner.yaml‎

Lines changed: 31 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,12 +35,42 @@ spec:
3535
openAPIV3Schema:
3636
properties:
3737
crontab:
38+
description: Crontab format expression for scheduling scans.
3839
pattern: ^(\d+|\*)(/\d+)?(\s+(\d+|\*)(/\d+)?){4}$
3940
type: string
4041
namespace_selector:
42+
description: NamespaceSelector selects the namespaces to scan
43+
images.
4144
type: string
4245
clusterWide:
43-
type: string
46+
description: Selector for cluster wide scan.
47+
type: boolean
48+
integrations:
49+
type: object
50+
properties:
51+
policyreport:
52+
description: Selector to enable policy report object creation
53+
and integration wit plicy-reporter.
54+
type: boolean
55+
defectdojo:
56+
description: DefectDojo integration options
57+
type: object
58+
properties:
59+
host:
60+
description: URL of the DefectDojo server.
61+
type: string
62+
api_key:
63+
description: Api key for DefectDojo api authentication.
64+
type: string
65+
k8s-cluster-name:
66+
description: Name of the Kubernetes Cluster in defectdojo.
67+
type: string
68+
image_pull_secrets:
69+
description: List of image pull secret names in the operator's
70+
namespace for image pulls.
71+
type: array
72+
items:
73+
type: string
4474
spec:
4575
type: object
4676
x-kubernetes-preserve-unknown-fields: true

0 commit comments

Comments
 (0)