masahiro331/kube-trivyTrivy for Kubernetes
一个简单而全面的 Kubernetes 漏洞扫描器
KubeTrivy 是 Trivy 在 Kubernetes 上的扩展。
KubeTrivy 是一个简单而全面的 Kubernetes 漏洞扫描器。
KubeTrivy 可以检测操作系统包（Alpine、RHEL、CentOS 等）和应用程序依赖（Bundler、Composer、npm、yarn 等）中的漏洞。
KubeTrivy 易于使用。只需安装二进制文件即可开始扫描。扫描时您需要做的只是指定 Kubernetes 上容器的镜像名称。
查看关于 Trivy 的更多信息
kubectl get vulnerability 或 kubetrivy get ${resourceName}$ brew tap masahiro331/kube-tirvy
$ brew install kube-trivy
$ kubetrivy -h
$ go get -u github.com/masahiro331/kube-trivy
$ kubetrivy -h
$ cat << EOS > crd.yaml
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
name: vulnerabilities.kubetrivy.io
spec:
group: kubetrivy.io
version: v1
names:
kind: Vulnerability
plural: vulnerabilities
scope: Namespaced
additionalPrinterColumns:
- name: UNKNOWN
type: integer
description: The total of vulnerabilities launched by the kubetrivy
JSONPath: .spec.statistics.UNKNOWN
- name: LOW
type: integer
description: The total of vulnerabilities launched by the kubetrivy
JSONPath: .spec.statistics.LOW
- name: MEDIUM
type: integer
description: The total of vulnerabilities launched by the kubetrivy
JSONPath: .spec.statistics.MEDIUM
- name: HIGH
type: integer
description: The total of vulnerabilities launched by the kubetrivy
JSONPath: .spec.statistics.HIGH
- name: CRITICAL
type: integer
description: The total of vulnerabilities launched by the kubetrivy
JSONPath: .spec.statistics.CRITICAL
EOS
$ kubectl apply -f crd.yaml
$ kubectl get vulnerability
$ kubetrivy -n default scan
$ kubetrivy -n default scan
$ kubectl get vulnerability -n default
$ kubetrivy -n default get ${resourceName}