trivy

func CheckAwsEcrPrivateRegistry ¶

func CheckAwsEcrPrivateRegistry(ImageUrl string) string

func CheckGcpCrOrPrivateRegistry ¶ added in v0.19.0

func CheckGcpCrOrPrivateRegistry(imageUrl string) bool

func ConfigWorkloadAnnotationEnvVars ¶ added in v0.14.0

func ConfigWorkloadAnnotationEnvVars(workload client.Object, annotation string, envVarName string, trivyConfigName string, configKey string) corev1.EnvVar

func CreateSbomDataAsSecret ¶ added in v0.17.0

func CreateSbomDataAsSecret(bom v1alpha1.BOM, secretName string) (corev1.Secret, error)

CreateSbomDataAsSecret creates a secret with the BOM data

func CreateVolumeSbomFiles ¶ added in v0.17.0

func CreateVolumeSbomFiles(volumeMounts *[]corev1.VolumeMount, volumes *[]corev1.Volume, secretName *string, fileName string, mountPath string, cname string)

CreateVolumeSbomFiles creates a volume and volume mount for the sbom data

func GetFSScanningArgs ¶ added in v0.18.0

func GetFSScanningArgs(ctx trivyoperator.PluginContext, command Command, mode Mode, trivyServerURL string) []string

func GetMirroredImage ¶

func GetMirroredImage(image string, mirrors map[string]string) (string, error)

func GetPodSpecForClientServerFSMode ¶ added in v0.16.4

func GetPodSpecForClientServerFSMode(ctx trivyoperator.PluginContext, config Config, workload client.Object, _ map[string]docker.Auth, securityContext *corev1.SecurityContext, p *plugin, clusterSboms map[string]v1alpha1.SbomReportData) (corev1.PodSpec, []*corev1.Secret, error)

FileSystem scan option with ClientServer mode. The only difference is that instead of scanning the resource by name, We scanning the resource place on a specific file system location using the following command.

trivy --quiet fs  --server TRIVY_SERVER  --format json --ignore-unfixed  file/system/location

func GetPodSpecForClientServerMode ¶ added in v0.16.4

func GetPodSpecForClientServerMode(ctx trivyoperator.PluginContext, config Config, workload client.Object, credentials map[string]docker.Auth, securityContext *corev1.SecurityContext, p *plugin, clusterSboms map[string]v1alpha1.SbomReportData) (corev1.PodSpec, []*corev1.Secret, error)

In the ClientServer mode the number of containers of the pod created by the scan job equals the number of containers defined for the scanned workload. Each container runs Trivy image scan command and refers to Trivy server URL returned by Config.GetServerURL:

trivy image --server <server URL> \
  --format json <container image>

func GetPodSpecForStandaloneFSMode ¶ added in v0.16.4

func GetPodSpecForStandaloneFSMode(ctx trivyoperator.PluginContext, config Config, workload client.Object, _ map[string]docker.Auth, securityContext *corev1.SecurityContext, p *plugin, clusterSboms map[string]v1alpha1.SbomReportData) (corev1.PodSpec, []*corev1.Secret, error)

FileSystem scan option with standalone mode. The only difference is that instead of scanning the resource by name, We are scanning the resource place on a specific file system location using the following command.

trivy --quiet fs  --format json --ignore-unfixed  file/system/location

func GetPodSpecForStandaloneMode ¶ added in v0.16.4

func GetPodSpecForStandaloneMode(ctx trivyoperator.PluginContext,
	config Config,
	workload client.Object,
	credentials map[string]docker.Auth,
	securityContext *corev1.SecurityContext,
	p *plugin,
	clusterSboms map[string]v1alpha1.SbomReportData) (corev1.PodSpec, []*corev1.Secret, error)

In the Standalone mode there is the init container responsible for downloading the latest Trivy DB file from GitHub and storing it to the emptyDir volume shared with main containers. In other words, the init container runs the following Trivy command:

trivy --cache-dir /tmp/trivy/.cache image --download-db-only

The number of main containers correspond to the number of containers defined for the scanned workload. Each container runs the Trivy image scan command and skips the database download:

trivy --cache-dir /tmp/trivy/.cache image --skip-update \
  --format json <container image>

func GetSbomFSScanningArgs ¶ added in v0.17.0

func GetSbomFSScanningArgs(ctx trivyoperator.PluginContext, mode Mode, trivyServerURL string, sbomFile string) ([]string, []string)

func GetSbomScanCommandAndArgs ¶ added in v0.17.0

func GetSbomScanCommandAndArgs(ctx trivyoperator.PluginContext, mode Mode, sbomFile string, trivyServerURL string, resultFileName string) ([]string, []string)

func MultiSecretSupport ¶ added in v0.12.0

func MultiSecretSupport(c Config) bool

MultiSecretSupport validate if trivy multi secret support

func NewPlugin ¶

func NewPlugin(clock ext.Clock, idGenerator ext.IDGenerator, objectResolver *kube.ObjectResolver) vulnerabilityreport.Plugin

NewPlugin constructs a new vulnerabilityreport.Plugin, which is using an upstream Trivy container image to scan Kubernetes workloads.

The plugin supports Image and Filesystem commands. The Filesystem command may be used to scan workload images cached on cluster nodes by scheduling scan jobs on a particular node.

The Image command supports both Standalone and ClientServer modes depending on the settings returned by Config.GetMode. The ClientServer mode is usually more performant, however it requires a Trivy server accessible at the configurable Config.GetServerURL.

func NewTrivyConfigAuditPlugin ¶

func NewTrivyConfigAuditPlugin(clock ext.Clock, idGenerator ext.IDGenerator, objectResolver *kube.ObjectResolver) configauditreport.PluginInMemory

NewTrivyConfigAuditPlugin constructs a new configAudit.Plugin, which is using an upstream Trivy config audit scanner lib.

func Scanners ¶ added in v0.12.0

func Scanners(c Config) string

Scanners use scanners flag

func SkipDBUpdate ¶ added in v0.12.0

func SkipDBUpdate(c Config) string

SkipDBUpdate skip update flag

func SkipJavaDBUpdate ¶ added in v0.16.0

func SkipJavaDBUpdate(c Config) string

SkipJavaDBUpdate skip update flag

func Slow ¶ added in v0.12.0

func Slow(c Config) string

Slow determine if to use the slow flag (improve memory footprint)