Trivy-operator v0.2.0 Released!

[chen-keinan]

Prepare Release v0.2.0

Notable changes

⎈ Kubernetes resources for deprecated and removal APIs 💀

When Trivy-operator scans Kubernetes resources it can now alert when the resource is using a deprecated (or about to be) API, and will also suggest the recommended newer version.

apiVersion: aquasecurity.github.io/v1alpha1
kind: ConfigAuditReport
metadata:
  creationTimestamp: "2022-09-15T08:04:05Z"
  generation: 1
  labels:
    plugin-config-hash: 659b7b9c46
    resource-spec-hash: 6d6758cbf6
    trivy-operator.resource.kind: CronJob
    trivy-operator.resource.name: hello
    trivy-operator.resource.namespace: default
  name: cronjob-hello
  namespace: default
  ownerReferences:
  - apiVersion: batch/v1beta1
    blockOwnerDeletion: false
    controller: true
    kind: CronJob
    name: hello
    uid: 9ec85f25-c95d-451e-860a-16113756e555
  resourceVersion: "1239"
  uid: 289083f7-b2d9-4672-8e71-ce467b15a183
report:
  checks:
  - category: Kubernetes Security Check
    checkID: KSV107
    description: 'apiVersion ''batch/v1beta1'' and kind ''CronJob'' has been deprecated
      on: ''v1.21'' and planned for removal on:''v1.25'''
    messages:
    - apiVersion 'batch/v1beta1' and kind ‘CronJob' should be replaced with the new
      API ‘batch.v1.CronJob'
    severity: HIGH
    success: false
    title: Evaluate k8s deprecated and removed APIs
 

🪝 Add support for sending reports externally via webhook 🪝

Trivy Operator allows you to send reports externally to a webhook as they get produced.
It's very useful when you have to make decisions based on a report, e.g. prune a vulnerable image, remove a deployment with exposed secrets etc.

This use case can be fulfilled by using a SOAR tool Postee. Out of the box, Postee offers a variety of integrations with other third party services such as ServiceNow, Slack, AWS Security Hub and many more.

🚀 Extend for VulnerabilityReports data 🚀

The additional cvss information is now available as part of vulnerability report by configuration

- cvss:
      nvd:
        V2Score: 4.6
        V2Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
        V3Score: 5.7
        V3Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
      redhat:
        V3Score: 5.7
        V3Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
    description: 'APT had several integer overflows and underflows while parsing .deb
      packages, aka GHSL-2020-168 GHSL-2020-169, in files apt-pkg/contrib/extracttar.cc,
      apt-pkg/deb/debfile.cc, and apt-pkg/contrib/arfile.cc. This issue affects: apt
      1.2.32ubuntu0 versions prior to 1.2.32ubuntu0.2; 1.6.12ubuntu0 versions prior
      to 1.6.12ubuntu0.2; 2.0.2ubuntu0 versions prior to 2.0.2ubuntu0.2; 2.1.10ubuntu0
      versions prior to 2.1.10ubuntu0.1;'

Notable fixes

• Compress trivy scan result
• Update secret verb to Role
• Ignore workload scanning when replicaSet=0

Notable Doc

• Private registry tutorial

Notable Configuration additions

• automountServiceAccountToken is now configurable on operator helm chart
• Add flag to disable secret scan
• Allow configuration of operator pod labels
• Allow configuration of operator pod priorityClass
• Allow configuration of securityContext
• Allow configuration of nodeSelector on scanJobs