trivy-ci-test VS trivy

- Use trivy or grype with software installed without package manager (via tar) e.g. eclipse-temurin in the alpine version. The java executable gets unpacked into /opt but is not recognized.

https://github.com/aquasecurity/trivy/issues/2098

Yup, an Admission Controller is not the right tool to perform container image scans. That's where Trivy comes into play.

Kubernetes manifest needs to be secure and ValidKube helps us to achieve that with the help of the Aquasec team. The same YAML file mentioned above, we will run it through the "Secure" feature of ValidKube and let's see the results: It's Open source repository is named as trivy and it's repository is https://github.com/aquasecurity/trivy

It's an open-source project by Aqua Security and you might have already known them because of their other project trivy which is a scanner for vulnerabilities in container images, file systems, and Git repositories, as well as for configuration issues.

Another one I would recommend looking at, if you want to do scanning of workload manifests (e.g. deployments) is Trivy (https://github.com/aquasecurity/trivy) which has some cool IaC scanning features.

- task: [email protected] displayName: Trivvy Scan for vunerabilties in both docker image and repository condition: succeeded() continueOnError: true inputs: targetType: inLine script: | set +x wget https://github.com/aquasecurity/trivy/releases/download/v0.18.3/trivy_0.18.3_Linux-64bit.deb sudo dpkg -i trivy_0.18.3_Linux-64bit.deb trivy fs --exit-code 1 --security-checks vuln,config $(System.DefaultWorkingDirectory) trivy image --exit-code 1 --timeout 15m $(imageRepo):$(imageTag)

have a look at the repo, Trivy is all open source but let us know if you have any questions :) https://github.com/aquasecurity/trivy

If you're looking for a good OS / library vulnerability scanner, I would recommend trivy.

The idea behind Validkube is to fuse together the capabilities of three other popular open-source projects (kubeval, kubectl-neat & trivy) and present them in a single view, providing users with a way to ensure YAML code hygiene and security, in one place, with just a few clicks of the button.