trivy

func CheckAwsEcrPrivateRegistry ¶

func CheckAwsEcrPrivateRegistry(imageURL string) string

func CheckGcpCrOrPrivateRegistry ¶ added in v0.19.0

func CheckGcpCrOrPrivateRegistry(imageUrl string) bool

func ConfigWorkloadAnnotationEnvVars ¶ added in v0.14.0

func ConfigWorkloadAnnotationEnvVars(workload client.Object, annotation, envVarName, trivyConfigName, configKey string) corev1.EnvVar

func CreateSbomDataAsSecret ¶ added in v0.17.0

func CreateSbomDataAsSecret(bom v1alpha1.BOM, secretName string) (corev1.Secret, error)

CreateSbomDataAsSecret creates a secret with the BOM data

func CreateVolumeSbomFiles ¶ added in v0.17.0

func CreateVolumeSbomFiles(volumeMounts *[]corev1.VolumeMount, volumes *[]corev1.Volume, secretName *string, fileName, mountPath, cname string)

CreateVolumeSbomFiles creates a volume and volume mount for the sbom data

func ExcludeImage ¶ added in v0.21.0

func ExcludeImage(excludeImagePattern []string, imageName string) bool

ExcludeImage checks if the image should be excluded from scanning based on the excludeImagePattern (glob pattern)

func GetFSScanningArgs ¶ added in v0.18.0

func GetFSScanningArgs(ctx trivyoperator.PluginContext, command Command, mode Mode, trivyServerURL string) []string

func GetMirroredImage ¶

func GetMirroredImage(image string, mirrors map[string]string) (string, error)

func GetPodSpecForClientServerFSMode ¶ added in v0.16.4

func GetPodSpecForClientServerFSMode(ctx trivyoperator.PluginContext, config Config, workload client.Object, _ map[string]docker.Auth, securityContext *corev1.SecurityContext, p *plugin, clusterSboms map[string]v1alpha1.SbomReportData) (corev1.PodSpec, []*corev1.Secret, error)

FileSystem scan option with ClientServer mode. The only difference is that instead of scanning the resource by name, We scanning the resource place on a specific file system location using the following command.

trivy --quiet fs  --server TRIVY_SERVER  --format json --ignore-unfixed  file/system/location

func GetPodSpecForImageScan ¶ added in v0.30.0

func GetPodSpecForImageScan(ctx trivyoperator.PluginContext,
	config Config,
	workload client.Object,
	credentials map[string]docker.Auth,
	securityContext *corev1.SecurityContext,
	p *plugin,
	clusterSboms map[string]v1alpha1.SbomReportData) (corev1.PodSpec, []*corev1.Secret, error)

GetPodSpec creates a PodSpec for the Trivy image scan job.

The number of main containers correspond to the number of containers defined for the scanned workload. Each container runs the Trivy image scan command and skips the database download.

trivy --cache-dir /tmp/trivy/.cache image --skip-update \
  --format json <container image>

In the Standalone mode there is the init container responsible for downloading the latest Trivy DB file from GitHub and storing it to the emptyDir volume shared with main containers. In other words, the init container runs the following Trivy command:

trivy --cache-dir /tmp/trivy/.cache image --download-db-only

In the ClientServer each container runs Trivy image scan command and refers to Trivy server URL returned by Config.GetServerURL:

	trivy image --server <server URL> \
	  --format json <container image>

 Also there is the init container responsible for downloading the latest Trivy Java DB for both modes

	trivy --cache-dir /tmp/trivy/.cache image --download-java-db-only

func GetPodSpecForStandaloneFSMode ¶ added in v0.16.4

func GetPodSpecForStandaloneFSMode(ctx trivyoperator.PluginContext, config Config, workload client.Object, _ map[string]docker.Auth, securityContext *corev1.SecurityContext, p *plugin, clusterSboms map[string]v1alpha1.SbomReportData) (corev1.PodSpec, []*corev1.Secret, error)

FileSystem scan option with standalone mode. The only difference is that instead of scanning the resource by name, We are scanning the resource place on a specific file system location using the following command.

trivy --quiet fs  --format json --ignore-unfixed  file/system/location

func GetSbomFSScanningArgs ¶ added in v0.17.0

func GetSbomFSScanningArgs(ctx trivyoperator.PluginContext, mode Mode, trivyServerURL, sbomFile string) ([]string, []string)

func GetSbomScanCommandAndArgs ¶ added in v0.17.0

func GetSbomScanCommandAndArgs(ctx trivyoperator.PluginContext, mode Mode, sbomFile, trivyServerURL, resultFileName string) ([]string, []string)

func MultiSecretSupport ¶ added in v0.12.0

func MultiSecretSupport(c Config) bool

MultiSecretSupport validate if trivy multi secret support

func NewPlugin ¶

func NewPlugin(clock ext.Clock, idGenerator ext.IDGenerator, objectResolver *kube.ObjectResolver) vulnerabilityreport.Plugin

NewPlugin constructs a new vulnerabilityreport.Plugin, which is using an upstream Trivy container image to scan Kubernetes workloads.

The plugin supports Image and Filesystem commands. The Filesystem command may be used to scan workload images cached on cluster nodes by scheduling scan jobs on a particular node.

The Image command supports both Standalone and ClientServer modes depending on the settings returned by Config.GetMode. The ClientServer mode is usually more performant, however it requires a Trivy server accessible at the configurable Config.GetServerURL.

func NewTrivyConfigAuditPlugin ¶

func NewTrivyConfigAuditPlugin(clock ext.Clock, idGenerator ext.IDGenerator, objectResolver *kube.ObjectResolver) configauditreport.PluginInMemory

NewTrivyConfigAuditPlugin constructs a new configAudit.Plugin, which is using an upstream Trivy config audit scanner lib.

func ParseImageRef ¶ added in v0.25.0

func ParseImageRef(imageRef, imageDigest string) (v1alpha1.Registry, v1alpha1.Artifact, error)

func Scanners ¶ added in v0.12.0

func Scanners(c Config) string

Scanners use scanners flag

func SkipDBUpdate ¶ added in v0.12.0

func SkipDBUpdate(c Config) string

SkipDBUpdate skip update flag

func SkipJavaDBUpdate ¶ added in v0.16.0

func SkipJavaDBUpdate(c Config) string

SkipJavaDBUpdate skip update flag

func Slow ¶ added in v0.12.0

func Slow(c Config) string

Slow determine if to use the slow flag (improve memory footprint)