Scan k8s cluster

Security audit of the whole cluster: images, configs, RBAC

trivy k8s --report summary cluster
tool
trivy15 commands
tags
trivysecurity

More trivy commands

  • Scan specific namespace
    trivy k8s --namespace production --report summary all

    Scan workloads only in a specific namespace

  • Scan Helm chart
    trivy config ./my-chart

    Check Helm chart templates for security misconfigurations

  • Scan with JSON output
    trivy image --format json -o results.json img:tag

    Machine-readable vulnerability scan results

  • Scan IaC directory
    trivy config --severity MEDIUM,HIGH,CRITICAL ./terraform

    Find misconfigurations in Terraform/Kubernetes/Helm code

  • Ignore unfixed CVEs
    trivy image --ignore-unfixed --severity HIGH,CRITICAL img:tag

    Skip vulnerabilities that have no fix available yet

all 15 trivy commands