Trivy is an open-source vulnerability scanner for containers that can detect vulnerabilities in OS packages and application dependencies. The Trivy Operator is a Kubernetes operator that automates the process of scanning container images for vulnerabilities using Trivy.
This integration utilizes the logzio-trivy Helm Chart to deploy:
- Trivy-Operator Helm Chart that scans the cluster and creates Trivy reports.
- A deployment that looks for the Trivy reports in the cluster, processes them, and sends them to Logz.io
At present, only vulnerability reports are being collected.
This integration is presently in its beta phase and may be subject to modifications.
Before you begin, you'll need:
- an active account with Logz.io
- Kubernetes cluster to send reports from
helm repo add logzio-helm https://logzio.github.io/logzio-helm
helm repo update
Run the Helm deployment code
helm install -n monitoring --create-namespace \
--set env_id="<<ENV-ID>>" \
--set secrets.logzioShippingToken="<<LOG-SHIPPING-TOKEN>>" \
--set secrets.logzioListener="<<LISTENER-HOST>>" \
With this command, we instruct Helm to create the monitoring namespace if it does not already exist.
|A unique name assigned to your environment's identifier, to differentiate telemetry data across various environments. If you're collecting metrics, this should match the env-id/p8s_logzio_name you used for the metrics.|
Check Logz.io for your reports
Give your reports some time to get from your system to ours, and then open Open Search Dashboards.
Customizing Helm chart parameters
Configure customization options
You can use the following options to update the Helm chart parameters:
Specify parameters using the
--set key=value[,key=value]argument to
Overide default values with your own
my_values.yamland apply it in the
|Determines whether to display only fixed vulnerabilities in the reports generated by Trivy.|
|Overrides the Chart name for resources.|
|Overrides the full name of the resources.|
|Time for daily scanning for security reports and sending them to Logz.io, in the "HH:MM" format.|
|Container restart policy|
|Container image tag|
|A unique name assigned to your environment's identifier, to differentiate telemetry data across various environments.|
|Termination period (in seconds) to wait before killing Fluentd pod process on pod shutdown.|
|Specifies whether to create a service account for the cron job.|
|Name of the service account.|
|Specifies wheter to create a secret for the deployment|
|Your logz.io log shipping token|
|Your logz.io listener host|
|Log level of the script that sends security risk to Logz.io. Can be one of: |
Uninstalling the Chart
The Uninstall command is used to remove all the Kubernetes components associated with the chart and to delete the release.
To uninstall the
logzio-trivy deployment, use the following command:
helm uninstall logzio-trivy -n monitoring
Handling image pull rate limit
In certain cases, such as spot clusters, where pods or nodes are frequently replaced, the pull rate limit for images retrieved from Docker Hub may be reached, resulting in an error:
You have reached your pull rate limit. You may increase the limit by authenticating and upgrading: https://www.docker.com/increase-rate-limits.
In these cases we can use the following
--set command to use an alternative image repository: