Settings

Trivy Operator reads configuration settings from ConfigMaps, as well as Secrets that hold confidential settings (such as a GitHub token). Trivy-Operator plugins read configuration and secret data from ConfigMaps and Secrets named after the plugin. For example, Trivy configuration is stored in the ConfigMap and Secret named trivy-operator-trivy-config.

You can change the default settings with kubectl patch or kubectl edit commands. For example, by default Trivy displays vulnerabilities with all severity levels (UNKNOWN, LOW, MEDIUM, HIGH, CRITICAL). However, you can display only HIGH and CRITICAL vulnerabilities by patching the trivy.severity value in the trivy-operator-trivy-config ConfigMap:

TRIVY_OPERATOR_NAMESPACE=<your trivy operator namespace>

kubectl patch cm trivy-operator-trivy-config -n $TRIVY_OPERATOR_NAMESPACE \
  --type merge \
  -p "$(cat <<EOF
{
  "data": {
    "trivy.severity": "HIGH,CRITICAL"
  }
}
EOF
)"

To set the GitHub token used by Trivy add the trivy.githubToken value to the trivy-operator-trivy-config Secret:

TRIVY_OPERATOR_NAMESPACE=<your trivy opersator namespace>
GITHUB_TOKEN=<your token>

kubectl patch secret trivy-operator-trivy-config -n $TRIVY_OPERATOR_NAMESPACE \
  --type merge \
  -p "$(cat <<EOF
{
  "data": {
    "trivy.githubToken": "$(echo -n $GITHUB_TOKEN | base64)"
  }
}
EOF
)"

The following table lists available settings with their default values. Check plugins' documentation to see configuration settings for common use cases. For example, switch Trivy from Standalone to ClientServer mode.

CONFIG KEY	DEFAULT	DESCRIPTION
`vulnerabilityReports.scanner`	`Trivy`	The name of the plugin that generates vulnerability reports. Either `Trivy` or `Aqua`.
`vulnerabilityReports.scanJobsInSameNamespace`	`"false"`	Whether to run vulnerability scan jobs in same namespace of workload. Set `"true"` to enable.
`configAuditReports.scanner`	`Trivy`	The name of the plugin that generates config audit reports.
`scanJob.affinity`	N/A	JSON representation of the [affinity] to be applied to the scanner pods and node-collector. Example: `'{"nodeAffinity":{"requiredDuringSchedulingIgnoredDuringExecution":{"nodeSelectorTerms":[{"matchExpressions":[{"key":"kubernetes.io/os","operator":"In","values":["linux"]}]},{"matchExpressions":[{"key":"virtual-kubelet.io/provider","operator":"DoesNotExist"}]}]}}}'`
`scanJob.tolerations`	N/A	JSON representation of the tolerations to be applied to the scanner pods and node-collector so that they can run on nodes with matching taints. Example: `'[{"key":"key1", "operator":"Equal", "value":"value1", "effect":"NoSchedule"}]'`
`nodeCollector.volumeMounts`	see helm/values.yaml	node-collector pod volumeMounts definition for collecting config files information
`nodeCollector.volumes`	see helm/values.yaml	node-collector pod volumes definition for collecting config files information
`scanJob.nodeSelector`	N/A	JSON representation of the [nodeSelector] to be applied to the scanner pods so that they can run on nodes with matching labels. Example: `'{"example.com/node-type":"worker", "cpu-type": "sandylake"}'`
`scanJob.annotations`	N/A	One-line comma-separated representation of the annotations which the user wants the scanner pods to be annotated with. Example: `foo=bar,env=stage` will annotate the scanner pods with the annotations `foo: bar` and `env: stage`
`scanJob.templateLabel`	N/A	One-line comma-separated representation of the template labels which the user wants the scanner pods to be labeled with. Example: `foo=bar,env=stage` will labeled the scanner pods with the labels `foo: bar` and `env: stage`
`scanJob.podTemplatePodSecurityContext`	N/A	One-line JSON representation of the template securityContext which the user wants the scanner and node collector pods to be secured with. Example: `{"RunAsUser": 1000, "RunAsGroup": 1000, "RunAsNonRoot": true}`
`scanJob.podTemplateContainerSecurityContext`	N/A	One-line JSON representation of the template securityContext which the user wants the scanner and node collector containers (and their initContainers) to be amended with. Example: `{"allowPrivilegeEscalation": false, "capabilities": { "drop": ["ALL"]},"privileged": false, "readOnlyRootFilesystem": true }`
`scanJob.podPriorityClassName`	`""`	The value of the priorityClassName for job
`compliance.failEntriesLimit`	`"10"`	Limit the number of fail entries per control check in the cluster compliance detail report.
`compliance.reportType`	`summary`	this flag control the type of report generated summary or all
`compliance.cron`	`0 /6 * *`	this flag control the cron interval for compliance report generation
`scanJob.compressLogs`	`"true"`	Control whether scanjob output should be compressed
`nodeCollector.excludeNodes`	`""`	excludeNodes comma-separated node labels that the node-collector job should exclude from scanning (example kubernetes.io/arch=arm64,team=dev)

Tip

You can delete a configuration key.For example, the following kubectl patch command deletes the trivy.httpProxy key:

TRIVY_OPERATOR_NAMESPACE=<your trivy operator namespace>

kubectl patch cm trivy-operator-trivy-config -n $TRIVY_OPERATOR_NAMESPACE \
  --type json \
  -p '[{"op": "remove", "path": "/data/trivy.httpProxy"}]'