Trivy Operator
SecurityKubernetes-native security toolkit
Release history
v0.32.0
CompareGitHub
Changelog
🐛 Notable Fixes 🐛
- 9e6aa0b: fix: handle missing report CRDs during old report cleanup (#3018) (@LaibaBareera)
🔧 Miscellaneous 🔧
👷 Other work 👷
- 39b5203: build(deps): bump github.com/onsi/ginkgo/v2 in the common group (#3004) (@dependabot[bot])
- d74f1c3: build(deps): bump golang.org/x/text in the golang group (#3005) (@dependabot[bot])
- 508e7a4: build(deps): bump the k8s group across 1 directory with 5 updates (#3003) (@dependabot[bot])
- daf91cf: build(deps): bump ubi9/ubi-minimal in /build/trivy-operator (#3015) (@dependabot[bot])
v0.31.2
CompareGitHub
Changelog
✨ Notable Changes ✨
- 559fdc2: feat: add Persistent Volume and Persistent Volume Claim resources (#2999) (@LaibaBareera)
🔧 Miscellaneous 🔧
- 213bb92: chore: bump up Go version to 1.26.4 (#2990) (@afdesk)
- 1717439: chore: bump up Trivy version to 0.71.1 (#2998) (@afdesk)
👷 Other work 👷
- 0dc9aee: build(deps): bump alpine from 3.23.4 to 3.24.0 in /build/trivy-operator (#2996) (@dependabot[bot])
- 347ad2c: build(deps): bump alpine from 3.24.0 to 3.24.1 in /build/trivy-operator (#3000) (@dependabot[bot])
- 1583506: build(deps): bump the common group across 1 directory with 2 updates (#2982) (@dependabot[bot])
- 5c5d062: build(deps): bump the common group across 1 directory with 2 updates (#2994) (@dependabot[bot])
- a8fff0a: build(deps): bump the k8s group across 1 directory with 4 updates (#2993) (@dependabot[bot])
- c8b610b: build(deps): bump ubi9/ubi-minimal in /build/trivy-operator (#2986) (@dependabot[bot])
- 4910168: build(deps): bump ubi9/ubi-minimal in /build/trivy-operator (#2997) (@dependabot[bot])
v0.30.1
CompareGitHub
<!-- Release notes generated using configuration in .github/release.yml at main -->
What's Changed
🐛 Notable Fixes 🐛
- fix: vulnerability metric export fails because of duplicate entries by @sbreitf1 in https://github.com/aquasecurity/trivy-operator/pull/2884
📝 Documentation && Miscellaneous 🔧
- chore: bump up KinD and K8s versions by @afdesk in https://github.com/aquasecurity/trivy-operator/pull/2802
- chore(deps): bump up cloudflare/circl to version 1.6.3 by @afdesk in https://github.com/aquasecurity/trivy-operator/pull/2900
- chore: bump up Trivy to version v0.69.2 by @afdesk in https://github.com/aquasecurity/trivy-operator/pull/2905
- chore: bump up Trivy to version v0.69.3 by @afdesk in https://github.com/aquasecurity/trivy-operator/pull/2918
👒 Dependencies 👒
- build(deps): bump ubi9/ubi-minimal from
759f5f4toc7d4414in /build/trivy-operator by @dependabot[bot] in https://github.com/aquasecurity/trivy-operator/pull/2892 - build(deps): bump github.com/onsi/gomega from 1.39.0 to 1.39.1 in the common group by @dependabot[bot] in https://github.com/aquasecurity/trivy-operator/pull/2876
- build(deps): bump golang.org/x/text from 0.33.0 to 0.34.0 in the golang group by @dependabot[bot] in https://github.com/aquasecurity/trivy-operator/pull/2877
- build(deps): bump github.com/google/go-containerregistry from 0.20.7 to 0.21.0 in the common group by @dependabot[bot] in https://github.com/aquasecurity/trivy-operator/pull/2894
- build(deps): bump github.com/aquasecurity/trivy from 0.69.1 to 0.69.2 in the aqua group by @dependabot[bot] in https://github.com/aquasecurity/trivy-operator/pull/2909
New Contributors
- @sbreitf1 made their first contribution in https://github.com/aquasecurity/trivy-operator/pull/2884
Full Changelog: https://github.com/aquasecurity/trivy-operator/compare/v0.30.0...v0.30.1
v0.30.0
CompareGitHub
<!-- Release notes generated using configuration in .github/release.yml at main -->
What's Changed
✨ Notable Changes ✨
- feat: add support for custom Trivy ignore file by @afdesk in https://github.com/aquasecurity/trivy-operator/pull/2750
- feat: automatically roll deployment in helm chart on configmap change by @jensloe-nhn in https://github.com/aquasecurity/trivy-operator/pull/2760
🐛 Notable Fixes 🐛
- fix(ci): clean up space for e2e tests by @afdesk in https://github.com/aquasecurity/trivy-operator/pull/2776
- fix: print logs if any error appears by @afdesk in https://github.com/aquasecurity/trivy-operator/pull/2725
- fix: Add config file volume to client server mode by @bh-tt in https://github.com/aquasecurity/trivy-operator/pull/2751
- fix: prefer vendor score if both nvd and vendor cvss v3 scores exist by @afdesk in https://github.com/aquasecurity/trivy-operator/pull/2774
- fix: error "creating secret used by scan job failed: /sbom-k8s-cluste… by @dcoppa in https://github.com/aquasecurity/trivy-operator/pull/2759
- fix: validation SBOM reports by @afdesk in https://github.com/aquasecurity/trivy-operator/pull/2792
- fix: always generate the compliance report by @afdesk in https://github.com/aquasecurity/trivy-operator/pull/2804
- fix: delete completed scan jobs in any case by @afdesk in https://github.com/aquasecurity/trivy-operator/pull/2788
- fix: avoid re-mounting GCR volume with credentials by @afdesk in https://github.com/aquasecurity/trivy-operator/pull/2801
- fix: use login to private registry by @afdesk in https://github.com/aquasecurity/trivy-operator/pull/2595
- fix: alternateReportStorage PVC no longer ignores namespace from values.yaml by @ml-qc in https://github.com/aquasecurity/trivy-operator/pull/2864
📝 Documentation && Miscellaneous 🔧
- chore: bump up Trivy to version v0.67.0 by @afdesk in https://github.com/aquasecurity/trivy-operator/pull/2764
- chore: bump up inderect deps to fix vulns by @afdesk in https://github.com/aquasecurity/trivy-operator/pull/2805
- chore: enable non-interactively mode for UBI9 image by @afdesk in https://github.com/aquasecurity/trivy-operator/pull/2814
- chore: bump up x/crypto to v0.45.0 by @afdesk in https://github.com/aquasecurity/trivy-operator/pull/2821
- chore: image apk upgrade optimization by @daanschipper in https://github.com/aquasecurity/trivy-operator/pull/2826
- chore(ubi9): update metadata for UBI9 image by @afdesk in https://github.com/aquasecurity/trivy-operator/pull/2846
- chore: bump up Trivy to version v0.69.0 by @afdesk in https://github.com/aquasecurity/trivy-operator/pull/2870
- chore: bump up Trivy to version v0.69.1 by @afdesk in https://github.com/aquasecurity/trivy-operator/pull/2875
- ci: added extra_file LICENSE for Dockerfile.ubi9 by @afdesk in https://github.com/aquasecurity/trivy-operator/pull/2879
- chore: bump up go-git deps to fix CVE-2026-25934 by @afdesk in https://github.com/aquasecurity/trivy-operator/pull/2882
👒 Dependencies 👒
- build(deps): bump ubi9/ubi-minimal from
7c5495dto34880b6in /build/trivy-operator by @dependabot[bot] in https://github.com/aquasecurity/trivy-operator/pull/2784 - build(deps): bump alpine from 3.22.1 to 3.22.2 in /build/trivy-operator by @dependabot[bot] in https://github.com/aquasecurity/trivy-operator/pull/2778
- build(deps): bump ubi9/ubi-minimal from
34880b6to61d5ad4in /build/trivy-operator by @dependabot[bot] in https://github.com/aquasecurity/trivy-operator/pull/2816 - build(deps): bump ubi9/ubi-minimal from
61d5ad4to6fc28bcin /build/trivy-operator by @dependabot[bot] in https://github.com/aquasecurity/trivy-operator/pull/2832 - build(deps): bump alpine from 3.22.2 to 3.23.0 in /build/trivy-operator by @dependabot[bot] in https://github.com/aquasecurity/trivy-operator/pull/2833
- build(deps): bump alpine from 3.23.0 to 3.23.3 in /build/trivy-operator by @dependabot[bot] in https://github.com/aquasecurity/trivy-operator/pull/2866
- build(deps): bump ubi9/ubi-minimal from
6fc28bctobb08f23in /build/trivy-operator by @dependabot[bot] in https://github.com/aquasecurity/trivy-operator/pull/2862 - build(deps): bump golang.org/x/text from 0.31.0 to 0.32.0 in the golang group by @dependabot[bot] in https://github.com/aquasecurity/trivy-operator/pull/2844
- build(deps): bump ubi9/ubi-minimal from
bb08f23toecd4751in /build/trivy-operator by @dependabot[bot] in https://github.com/aquasecurity/trivy-operator/pull/2873 - build(deps): bump ubi9/ubi-minimal from
ecd4751to759f5f4in /build/trivy-operator by @dependabot[bot] in https://github.com/aquasecurity/trivy-operator/pull/2874 - build(deps): bump the common group across 1 directory with 4 updates by @dependabot[bot] in https://github.com/aquasecurity/trivy-operator/pull/2872
New Contributors
- @bh-tt made their first contribution in https://github.com/aquasecurity/trivy-operator/pull/2751
- @jensloe-nhn made their first contribution in https://github.com/aquasecurity/trivy-operator/pull/2760
- @ml-qc made their first contribution in https://github.com/aquasecurity/trivy-operator/pull/2864
Full Changelog: https://github.com/aquasecurity/trivy-operator/compare/v0.29.0...v0.30.0
v0.29.0
CompareGitHub
<!-- Release notes generated using configuration in .github/release.yml at main -->
What's Changed
✨ Notable Changes ✨
- feat(dev): add support for pprof by @simar7 in https://github.com/aquasecurity/trivy-operator/pull/2666
- feat(clientServer): add support for extraVolumes in trivy-server by @hichem-belhocine in https://github.com/aquasecurity/trivy-operator/pull/2738
- feat: add labels to operator resources by @cHiv0rz in https://github.com/aquasecurity/trivy-operator/pull/2667
🐛 Notable Fixes 🐛
- fix: Ensure configFile volume is mounted for initContainer by @bananasplit393 in https://github.com/aquasecurity/trivy-operator/pull/2713
- fix(helm): always attempt to create ServiceMonitor when it is enabled by @mdusher in https://github.com/aquasecurity/trivy-operator/pull/2745
- fix: add missing permission to get namespaces by @dcoppa in https://github.com/aquasecurity/trivy-operator/pull/2728
📝 Documentation && Miscellaneous 🔧
- chore: improve release notes by @simar7 in https://github.com/aquasecurity/trivy-operator/pull/2692
- chore: migrate to aws-go v2 by @afdesk in https://github.com/aquasecurity/trivy-operator/pull/2694
- chore: bump up Go to version 1.24.6 by @afdesk in https://github.com/aquasecurity/trivy-operator/pull/2700
- chore: bump up Trivy to version v0.66.0 by @afdesk in https://github.com/aquasecurity/trivy-operator/pull/2742
- chore: bump up common k8s deps by @afdesk in https://github.com/aquasecurity/trivy-operator/pull/2746
👒 Dependencies 👒
- build(deps): bump ubi9/ubi-minimal from
295f920toe6b39b0in /build/trivy-operator by @dependabot[bot] in https://github.com/aquasecurity/trivy-operator/pull/2696 - build(deps): bump ubi9/ubi-minimal from
e6b39b0to8d905a9in /build/trivy-operator by @dependabot[bot] in https://github.com/aquasecurity/trivy-operator/pull/2701 - build(deps): bump helm.sh/helm/v3 from 3.18.4 to 3.18.5 by @dependabot[bot] in https://github.com/aquasecurity/trivy-operator/pull/2709
- build(deps): bump github.com/hashicorp/go-getter from 1.7.8 to 1.7.9 by @dependabot[bot] in https://github.com/aquasecurity/trivy-operator/pull/2714
- build(deps): bump ubi9/ubi-minimal from
8d905a9to2f06ae0in /build/trivy-operator by @dependabot[bot] in https://github.com/aquasecurity/trivy-operator/pull/2719 - build(deps): bump github.com/go-viper/mapstructure/v2 from 2.3.0 to 2.4.0 by @dependabot[bot] in https://github.com/aquasecurity/trivy-operator/pull/2721
- build(deps): bump github.com/ulikunitz/xz from 0.5.12 to 0.5.15 by @dependabot[bot] in https://github.com/aquasecurity/trivy-operator/pull/2729
- build(deps): bump ubi9/ubi-minimal from
2f06ae0to7c5495din /build/trivy-operator by @dependabot[bot] in https://github.com/aquasecurity/trivy-operator/pull/2753
New Contributors
- @bananasplit393 made their first contribution in https://github.com/aquasecurity/trivy-operator/pull/2713
- @hichem-belhocine made their first contribution in https://github.com/aquasecurity/trivy-operator/pull/2738
- @mdusher made their first contribution in https://github.com/aquasecurity/trivy-operator/pull/2745
- @cHiv0rz made their first contribution in https://github.com/aquasecurity/trivy-operator/pull/2667
Full Changelog: https://github.com/aquasecurity/trivy-operator/compare/v0.28.0...v0.29.0
v0.28.0
CompareGitHub
<!-- Release notes generated using configuration in .github/release.yml at main -->
What's Changed
✨ Notable Changes ✨
- feat: support storageClassName for alternatReportStorage by @cyrinux in https://github.com/aquasecurity/trivy-operator/pull/2633
🐛 Notable Fixes 🐛
- fix: bump ubi9 image to latest release by @simar7 in https://github.com/aquasecurity/trivy-operator/pull/2651
- fix: correct output for uncompressed logs by @afdesk in https://github.com/aquasecurity/trivy-operator/pull/2652
- fix: Do not error out on invalid rego policies if any by @simar7 in https://github.com/aquasecurity/trivy-operator/pull/2670
📝 Documentation && Miscellaneous 🔧
- chore: bump up Trivy to version 0.64.1 by @afdesk in https://github.com/aquasecurity/trivy-operator/pull/2654
- chore: bump up UBI 9 version to 9.6-1752587672 by @afdesk in https://github.com/aquasecurity/trivy-operator/pull/2660
- chore: update for CVE-2025-6965 by @simar7 in https://github.com/aquasecurity/trivy-operator/pull/2678
- chore: bump up docker for CVE-2025-54388 by @simar7 in https://github.com/aquasecurity/trivy-operator/pull/2679
- chore: update ubi image by @simar7 in https://github.com/aquasecurity/trivy-operator/pull/2681
- chore: bump up Trivy to version 0.65.0 by @afdesk in https://github.com/aquasecurity/trivy-operator/pull/2686
👒 Dependencies 👒
- build(deps): bump ubi9/ubi-minimal from
0d7cfb0to295f920in /build/trivy-operator by @dependabot[bot] in https://github.com/aquasecurity/trivy-operator/pull/2688 - build(deps): bump alpine from 3.20.6 to 3.22.1 in /build/trivy-operator by @dependabot[bot] in https://github.com/aquasecurity/trivy-operator/pull/2687
New Contributors
- @cyrinux made their first contribution in https://github.com/aquasecurity/trivy-operator/pull/2633
Full Changelog: https://github.com/aquasecurity/trivy-operator/compare/v0.27.3...v0.28.0
v0.27.3
CompareGitHub
<!-- Release notes generated using configuration in .github/release.yml at main -->
What's Changed
🐛 Notable Fixes 🐛
- fix: bump helm to v3.18.4 by @simar7 in https://github.com/aquasecurity/trivy-operator/pull/2647
- fix: correct predicate logic to allow whitelisted ConfigMaps by @nikpivkin in https://github.com/aquasecurity/trivy-operator/pull/2631
- fix: Deletion of scanjob before ttl expires by @tom1299 in https://github.com/aquasecurity/trivy-operator/pull/2632
- fix(deploy): remove hardcoded namespace from pvc-template by @SamuelWy in https://github.com/aquasecurity/trivy-operator/pull/2646
- fix: add ubi9 images for nightly testing by @simar7 in https://github.com/aquasecurity/trivy-operator/pull/2650
New Contributors
- @SamuelWy made their first contribution in https://github.com/aquasecurity/trivy-operator/pull/2646
Full Changelog: https://github.com/aquasecurity/trivy-operator/compare/v0.27.2...v0.27.3
v0.27.2
GitHub
<!-- Release notes generated using configuration in .github/release.yml at main -->
What's Changed
🐛 Notable Fixes 🐛
- fix(ci): use multiline syntax to print logs on failure by @nikpivkin in https://github.com/aquasecurity/trivy-operator/pull/2637
📝 Documentation && Miscellaneous 🔧
- chore: update UBI to version 9.6-1750782676 by @afdesk in https://github.com/aquasecurity/trivy-operator/pull/2625
- chore: bump up some deps by @afdesk in https://github.com/aquasecurity/trivy-operator/pull/2618
- chore: use a correct default repo for node-collector by @afdesk in https://github.com/aquasecurity/trivy-operator/pull/2619
- docs: fix typo in RELEASING.md for Helm chart file name by @nikpivkin in https://github.com/aquasecurity/trivy-operator/pull/2642
- chore: bump up UBI version to 9.6-1751286687 by @afdesk in https://github.com/aquasecurity/trivy-operator/pull/2643
👒 Dependencies 👒
- build(deps): bump github.com/go-viper/mapstructure/v2 from 2.2.1 to 2.3.0 by @dependabot in https://github.com/aquasecurity/trivy-operator/pull/2630
Full Changelog: https://github.com/aquasecurity/trivy-operator/compare/v0.27.1...v0.27.2
README
Kubernetes-native security toolkit. (Documentation)
GitHub Release Build Action Release snapshot Action Go Report Card GitHub All Releases <a href="https://slack.aquasec.com/?_ga=2.51428586.2119512742.1655808394-1739877964.1641199050"> <img src="https://img.shields.io/static/v1?label=Slack&message=Join+our+Community&color=4a154b&logo=slack"> </a> Artifact Hub
Introduction
The Trivy Operator leverages Trivy to continuously scan your Kubernetes cluster for security issues. The scans are summarised in security reports as Kubernetes Custom Resource Definitions, which become accessible through the Kubernetes API. The Operator does this by watching Kubernetes for state changes and automatically triggering security scans in response. For example, a vulnerability scan is initiated when a new Pod is created.
This way, users can find and view the risks that relate to different resources in a Kubernetes-native way.
In-cluster Security Scans
The Trivy Operator automatically generates and updates security reports. These reports are generated in response to new workload and other changes on a Kubernetes cluster, generating the following reports:
- Vulnerability Scans: Automated vulnerability scanning for Kubernetes workloads, control-plane and node components (api-server, controller-manager, kubelet and etc)
- ConfigAudit Scans: Automated configuration audits for Kubernetes resources with predefined rules or custom Open Policy Agent (OPA) policies.
- Exposed Secret Scans: Automated secret scans which find and detail the location of exposed Secrets within your cluster.
- RBAC scans: Role Based Access Control scans provide detailed information on the access rights of the different resources installed.
- K8s core component infra assessment scan Kubernetes infra core components (etcd,apiserver,scheduler,controller-manager and etc) setting and configuration.
- k8s outdated api validation - a configaudit check will validate if the resource api has been deprecated and planned for removal
- Compliance reports
- NSA, CISA Kubernetes Hardening Guidance v1.1 cybersecurity technical report is produced.
- CIS Kubernetes Benchmark v1.23 cybersecurity technical report is produced.
- Kubernetes pss-baseline, Pod Security Standards
- Kubernetes pss-restricted, Pod Security Standards
- SBOM (Software Bill of Materials genertations) for Kubernetes workloads.
<p align="center"> <img src="docs/images/trivy-operator-overview.png" alt="Trivy-operator Overview"/> </p>
Please star ⭐ the repo if you want us to continue developing and improving trivy-operator! 😀
Usage
The official Documentation provides detailed installation, configuration, troubleshooting, and quick start guides.
You can install the Trivy-operator Operator with Static YAML Manifests and follow the Getting Started guide to see how vulnerability and configuration audit reports are generated automatically.
Quick Start
The Trivy Operator can be installed easily through the Helm Chart. The Helm Chart can be downloaded by one of the two options:
Option 1: Install from traditional helm chart repository
Add the Aqua chart repository:
helm repo add aqua https://aquasecurity.github.io/helm-charts/
helm repo updateInstall the Helm Chart:
helm install trivy-operator aqua/trivy-operator \
--namespace trivy-system \
--create-namespace \
--version 0.35.0Option 2: Install from OCI registry (supported in Helm v3.8.0+)
Install the Helm Chart:
helm install trivy-operator oci://ghcr.io/aquasecurity/helm-charts/trivy-operator \
--namespace trivy-system \
--create-namespace \
--version 0.35.0This will install the Trivy Helm Chart into the trivy-system namespace and start triggering the scans.
Status
Although we are trying to keep new releases backward compatible with previous versions, this project is still incubating, and some APIs and Custom Resource Definitions may change.
Contributing
At this early stage we would love your feedback on the overall concept of Trivy-Operator. Over time, we'd love to see contributions integrating different security tools so that users can access security information in standard, Kubernetes-native ways.
- See Contributing for information about setting up your development environment, and the contribution workflow that we expect.
- Please ensure that you are following our Code Of Conduct during any interaction with the Aqua projects and their community.
Trivy-Operator is an Aqua Security open source project. Learn about our Open Source Work and Portfolio. Join the community, and talk to us about any matter in GitHub Discussions or Slack.