Skip to content

Reduce Trivy Operator permissions #1224

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jakub-racek-swi merged 7 commits into from
Dec 10, 2025
Merged

Reduce Trivy Operator permissions #1224

Changes from 4 commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
d0f4629
update values with extended trivy configuration
jakub-racek-swi Dec 4, 2025
c5e22e8
fix typo
jakub-racek-swi Dec 4, 2025
545fdd1
update comments
jakub-racek-swi Dec 4, 2025
85cb698
make scan job resources configurable
jakub-racek-swi Dec 4, 2025
fd2e717
Update mem units
jakub-racek-swi Dec 10, 2025
4a9aad3
Merge branch 'master' into trivy-permissions
jakub-racek-swi Dec 10, 2025
76c555d
Merge branch 'master' into trivy-permissions
jakub-racek-swi Dec 10, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
31 changes: 31 additions & 0 deletions deploy/helm/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1325,9 +1325,40 @@ trivy-operator:
targetWorkloads: pod,replicaset,statefulset,daemonset,cronjob,job
trivy:
severity: LOW,MEDIUM,HIGH,CRITICAL

# Resources for scan job containers
resources:
requests:
cpu: 100m
memory: 100M
limits:
cpu: 500m
memory: 500M

trivyOperator:
scanJobNodeSelector:
kubernetes.io/os: linux
operator:
# Currently only Image Vulnerability Scanning is supported, other features are TBD
vulnerabilityScannerEnabled: true

# Disabled features
configAuditScannerEnabled: false
rbacAssessmentScannerEnabled: false
infraAssessmentScannerEnabled: false
clusterComplianceEnabled: false
exposedSecretScannerEnabled: false

# Access to global secrets and service account tokens is disabled by default
accessGlobalSecretsAndServiceAccount: false

# Map of namespace:secrets, secrets are comma separated
# This setting is to be used to authenticate in private registries if accessGlobalSecretsAndServiceAccount is set to false
# see https://github.com/aquasecurity/trivy-operator/tree/main/deploy/helm for configuration reference
privateRegistryScanSecretsNames: {}

# Another option of providing access to private registries is to use managed registries, which will involve modifying the operator's service account
# See https://aquasecurity.github.io/trivy-operator/v0.29.0/docs/vulnerability-scanning/managed-registries/ for configuration steps

# Configuration for migration jobs that handle upgrades between chart versions
migrations:
Expand Down
Loading