Available in:  EE

Experimental version. The functionality may undergo significant changes. Compatibility with future versions is not guaranteed.

The module allows you to run periodic vulnerability scans. The module uses the Trivy project.

Scanning is performed every 24 hours in namespaces that contain the label security-scanning.deckhouse.io/enabled="". If there are no namespaces with this label in the cluster, the default namespace is scanned.

Once a namespace with the label security-scanning.deckhouse.io/enabled="" is detected in the cluster, scanning of the default namespace stops. To re-enable scanning for the default namespace, use the following command to set the label to the namespace:

kubectl label namespace default security-scanning.deckhouse.io/enabled=""