Trivy-operator v0.7.0 Released!

[chen-keinan]

⎈ Scan Kubernetes cluster components 🔧 (#653 )

Kubernetes Infrastructure assessment helps you check Kubernetes core components (such as etcd, apiserver, scheduler, controller-manager) for security and misconfiguration issues. The current infra checks are based on the CIS Benchmark for Kubernetes.
Infrastructure assessment creates a report based on a new CRD InfraAssessmentReport.

Here's an example of an Infra Assessment Report with a violation on the api-server that needs to ensure --authorization-mode argument is not set to AlwaysAllow.

apiVersion: aquasecurity.github.io/v1alpha1
kind: InfraAssessmentReport
metadata:
  name: pod-kube-apiserver-minikube
  namespace: kube-system
    kind: Pod
    name: kube-apiserver-minikube
    uid: 60587bf5-1b24-4167-8b77-fe7fa42c0216
  resourceVersion: "11046"
  uid: 00f2214a-31c8-4e7c-b0ba-23c7ed0eec2b
report:
  checks:
  - category: Kubernetes Security Check
    checkID: KCV0020
    description: Retain the logs for at least 30 days or as appropriate.
    messages:
    - Ensure that the --audit-log-maxage argument is set to 30 or as appropriate
    severity: LOW
    success: false
    title: Ensure that the --audit-log-maxage argument is set to 30 or as appropriate
  - category: Kubernetes Security Check
    checkID: KCV0010
    description: Limit the rate at which the API server accepts requests.
    messages:
    - Ensure that the admission control plugin EventRateLimit is set
    severity: LOW
    success: false
    title: Ensure that the admission control plugin EventRateLimit is set

💻 Automatic in-cluster embedded trivy-server (#692)

Trivy has a client/server mode that moves the vulnerability analysis work to a remote server, where a single vulnerability database can be maintained (instead of every scan pulling it's own local copy of the database). You can read more about it in the Trivy docs.

In this release we introduce a new experimental mode of Trivy Operator that works with Trivy's client/server mode by default. It will be installed and maintained automatically by Trivy Operator. The benefits of this new mode are:

• Less memory footprint , no need to load DB for each scan-job
• Faster scanning process , due to component graph caching on trivy-server

You can enable client\server mode with the operator.builtInTrivyServer flag. For example:

helm install trivy-operator aqua/trivy-operator \
--namespace trivy-system \
 --create-namespace \
 --set="trivy.ignoreUnfixed=true" \
 --set="operator.builtInTrivyServer=true" \
 --version 0.7.0-rc

Other Notable changes

• Add installed version and library to metrics (Add installed version and resource to trivy_vulnerability_id metrics #697)
• Add Config option to use trivy in offline-scan mode (feat: add option to use trivy in offline-scan mode #677)
• Record only mis-configuration failed checks on config/rbac/infra reports (feat: record misconfig failed checks only #681)
• skip workload scanning by resource label (feat: skip workload scanning by resource label #674)

Notable fixes

• Failure when using an existing trivy-operator-trivy-config secret (fix(helm): fixes the install failure when using an existing trivy-operator-trivy-config secret #691)