The operator-trivy module: configuration

Requirements

To the Deckhouse Platform version: 1.76 and above.

Conversions

The module is configured using the ModuleConfig resource, the schema of which contains a version number. When you apply an old version of the ModuleConfig schema in a cluster, automatic transformations are performed. To manually update the ModuleConfig schema version, the following steps must be completed sequentially for each version:

• Updates from version 1 to 2:

  nodeScanning.scanners and nodeScanning.pkgTypes now use PascalCase values (Vuln/Secret, OS/Library). When upgrading to a new version, you need to change the values ​​of the parameters (vuln/secret, os/library), make the values ​​capitalized.

Parameters

Schema version: 2

• settings

  object
  • settings.additionalRegistryCA

    array of objects

    List of CA certificates of private container registries.

    To specify a certificate chain, for example a certificate with an intermediate CA, put all certificates of the chain one after another in one ca field, without blank lines between them. The module trusts the certificates from all entries of the list.

    Example:

    additionalRegistryCA:
      - name: example CA
        ca: |
          -----BEGIN CERTIFICATE-----
          .................
          -----END CERTIFICATE-----
      - name: CA with intermediate CA
        ca: |
          -----BEGIN CERTIFICATE-----
          .................
          -----END CERTIFICATE-----
          -----BEGIN CERTIFICATE-----
          .................
          -----END CERTIFICATE-----

    • settings.additionalRegistryCA.ca

      string

      CA certificate or certificate chain in PEM format.
    • settings.additionalRegistryCA.name

      string

      Arbitrary name of the entry.
  • settings.additionalVulnerabilityReportFields

    array of strings

    List of additional fields from the vulnerability database to add to VulnerabilityReport objects.

    Example:

    additionalVulnerabilityReportFields:
    - Class
    - Target
    

  • settings.apiServerStorageClass

    string

    Name of the StorageClass used to store the security-storage data: the scan reports served through the trivy.deckhouse.io API and, if nodeAgent.enabled is true, the runtime map objects.

    If the value is not specified, the StorageClass will be used according to the global storageClass parameter setting.

    The global storageClass parameter is only considered when the module is enabled. Changing the global storageClass parameter while the module is enabled will not trigger disk re-provisioning.

    Warning. Specifying a value different from the one currently used (in the existing PVC) will result in disk re-provisioning and all data will be deleted.

    If false is specified, emptyDir will be forced to be used.

    Examples:

    apiServerStorageClass: ceph-ssd
    

    apiServerStorageClass: 'false'
    

  • settings.complianceReports

    object

    Settings of the compliance reports deployed by the module.

    Default: {}

    • settings.complianceReports.enabled

      array of strings

      List of compliance frameworks for which the module deploys ClusterComplianceReport objects:

      • CIS: CIS Kubernetes Benchmark v1.12.
      • PCI-DSS: PCI DSS v4.0 (key controls for protecting cardholder data).
      • NSA: NSA-CISA Kubernetes Hardening Guidance v1.0.
      • GDPR: General Data Protection Regulation (key security-relevant articles).
      • HIPAA: HIPAA Security Rule (key technical safeguards).
      • FSTEC-21: Order of FSTEC of Russia No. 21 (personal data protection in personal data information systems).
      • FZ-187: Order of FSTEC of Russia No. 239 (security requirements for significant CII objects, Federal Law 187-FZ).

      Default: [ "CIS", "PCI-DSS", "NSA", "FSTEC-21", "FZ-187" ]

      Examples:

      enabled:
      - CIS
      - NSA
      

      enabled:
      - CIS
      - PCI-DSS
      - NSA
      - GDPR
      - HIPAA
      - FSTEC-21
      - FZ-187
      

      • settings.complianceReports.enabled.Element of the array

        string

        Allowed values: CIS, PCI-DSS, NSA, GDPR, HIPAA, FSTEC-21, FZ-187

    • settings.complianceReports.skipSystemResources

      boolean

      Exclusion of system objects from configuration audit and RBAC assessment reports.

      If the parameter is true, the module does not create the following reports:

      • ConfigAuditReport and RbacAssessmentReport in namespaces that match d8-*, kube-* or default
      • ClusterConfigAuditReport and ClusterRbacAssessmentReport for cluster-scoped objects with the heritage=deckhouse label (objects managed by Deckhouse Platform (DP)) or the kubernetes.io/bootstrapping=rbac-defaults label (built-in Kubernetes RBAC objects, such as cluster-admin and the system:* roles)

      Findings for objects with these labels are also excluded from ClusterComplianceReport objects.

      The parameter does not affect VulnerabilityReport, ExposedSecretReport, SbomReport and InfraAssessmentReport objects.

      To exclude a namespace from configuration audit and RBAC assessment reports regardless of this parameter, add the security.deckhouse.io/skip-compliance=true label to the Namespace.

      Default: true

      Examples:

      skipSystemResources: true
      

      skipSystemResources: false
      

  • settings.concurrentScanJobsLimit

    integer

    Maximum number of scan jobs that the operator can run concurrently.

    Default: 10

    Allowed values: 1 <= X

    Examples:

    concurrentScanJobsLimit: 3
    

    concurrentScanJobsLimit: 5
    

    concurrentScanJobsLimit: 10
    

  • settings.denyVulnerableImages

    object

    Settings for blocking the creation of Pod, Deployment, StatefulSet, DaemonSet and OpenKruise DaemonSet objects with vulnerable images in namespaces with the security.deckhouse.io/trivy-provider: "" label.

    Note. The check runs only when an object is created or updated. The Gatekeeper audit does not check existing objects against this constraint.

    Default: {}

    • settings.denyVulnerableImages.allowedSeverityLevels

      array of strings

      Severity levels of vulnerabilities that do not block an image.

      An image that contains only vulnerabilities of these levels is not blocked.

      • settings.denyVulnerableImages.allowedSeverityLevels.Element of the array

        string

        Allowed values: UNKNOWN, LOW, MEDIUM, HIGH, CRITICAL

    • settings.denyVulnerableImages.enabled

      boolean

      Enables blocking of vulnerable images in namespaces with the security.deckhouse.io/trivy-provider: "" label.

      Default: false

    • settings.denyVulnerableImages.registrySecrets

      array of objects

      List of additional Secrets with credentials of private container registries, used to download images for scanning.

      Each Secret must be of type kubernetes.io/dockerconfigjson. The credentials of the container registry that Deckhouse Platform (DP) is installed from are always used.

      Default: []

      • settings.denyVulnerableImages.registrySecrets.name

        string

        Name of the Secret.
      • settings.denyVulnerableImages.registrySecrets.namespace

        string

        Namespace of the Secret.
  • settings.disableSBOMGeneration

    boolean

    Disables SBOM reports generation.

    Warning. When this option is set to true, all current SBOM reports are deleted from the cluster. The cleanup is executed only once.

    Default: false

    Examples:

    disableSBOMGeneration: true
    

    disableSBOMGeneration: false
    

  • settings.insecureDbRegistry

    boolean

    Allows Trivy to download vulnerability databases using insecure HTTPS connections (not passed TLS certificate verification) or HTTP connections.

    Default: false

    Examples:

    insecureDbRegistry: true
    

    insecureDbRegistry: false
    

  • settings.insecureRegistries

    array of strings

    List of container registry addresses to which insecure HTTPS connections (not passed TLS certificate verification) or HTTP connections are allowed.

    Example:

    insecureRegistries:
    - my.registry.com
    - http-only.registry.io
    

  • settings.linkCVEtoBDU

    boolean

    Replaces CVE identifiers in VulnerabilityReport objects with the matching identifiers from the FSTEC of Russia Data Bank of Security Threats (BDU).

    A vulnerability without a BDU match keeps its CVE identifier.

    Default: false

    Examples:

    linkCVEtoBDU: true
    

    linkCVEtoBDU: false
    

  • settings.nodeAgent

    object

    Runtime application and network map (in preview).

    When enabled, a privileged eBPF agent runs on every node and observes the runtime behaviour of each workload: the processes it launches, the files it opens, the Linux capabilities and system calls it uses, and the network connections it makes. The observations are aggregated per workload into ApplicationProfile and NetworkNeighborhood objects.

    Requirements. Node kernels must be Linux 5.4 or newer and expose BTF at /sys/kernel/btf/vmlinux. The agent runs privileged with host PID access.

    Default: {}

    • settings.nodeAgent.enabled

      boolean

      Enables runtime observation and building of the application/network map.

      Default: false

      Examples:

      enabled: true
      

      enabled: false
      

    • settings.nodeAgent.generatePolicies

      object

      Generation of least-privilege policies from the runtime map.

      The map itself (ApplicationProfile and NetworkNeighborhood objects) is always built when nodeAgent is enabled. These parameters additionally publish policies generated from it.

      Default: {}

      • settings.nodeAgent.generatePolicies.networkPolicy

        boolean

        Enables publishing of GeneratedNetworkPolicy objects: NetworkPolicy definitions computed from the NetworkNeighborhood of each workload.

        Review a generated policy and apply it to allow the workload only the observed network connections.

        Default: false

        Examples:

        networkPolicy: true
        

        networkPolicy: false
        

      • settings.nodeAgent.generatePolicies.seccomp

        boolean

        Enables generation and publishing of SeccompProfile objects from the system calls observed for each workload.

        Attach a profile to the workload pods to restrict the allowed system calls.

        Default: false

        Examples:

        seccomp: true
        

        seccomp: false
        

    • settings.nodeAgent.learningPeriod

      string

      Duration of workload observation before the workload profile is considered complete.

      During this period, new behaviour of the workload is added to the profile. After the period ends, the profile is finalized.

      Default: 1h

      Examples:

      learningPeriod: 1h
      

      learningPeriod: 24h
      

    • settings.nodeAgent.nodeSelector

      object

      Labels of the nodes to run the eBPF agent on.

      By default, the agent runs on every Linux node. Use this parameter to limit it to a subset of nodes, for example nodes whose kernels meet the BTF requirement.

      Default: {}

      Example:

      node-role.kubernetes.io/worker: ''
      

    • settings.nodeAgent.tolerations

      array of objects

      Tolerations for the eBPF agent DaemonSet.

      The same as spec.tolerations for the Kubernetes pod.

      If the parameter is not set, the agent tolerates the standard Deckhouse Platform (DP) taints: control plane and etcd arbiter taints, dedicated.deckhouse.io, dedicated, cluster autoscaler and DRBD taints, and the keys from the global customTolerationKeys parameter.

      Example:

      tolerations:
      - operator: Exists
      

      • settings.nodeAgent.tolerations.effect

        string
      • settings.nodeAgent.tolerations.key

        string
      • settings.nodeAgent.tolerations.operator

        string
      • settings.nodeAgent.tolerations.tolerationSeconds

        integer
      • settings.nodeAgent.tolerations.value

        string
  • settings.nodeScanning

    object

    Configuration for node (host filesystem) vulnerability scanning.

    This feature scans the host filesystem of each Kubernetes node to detect OS package vulnerabilities.

    Default: {}

    • settings.nodeScanning.concurrentLimit

      integer

      Maximum number of concurrent node scan jobs.

      Each running node scan job uses up to 1 CPU and 2 GiB of memory on its node. A higher value increases the total load on the cluster.

      Default: 1

      Allowed values: 1 <= X

      Examples:

      concurrentLimit: 1
      

      concurrentLimit: 2
      

      concurrentLimit: 3
      

    • settings.nodeScanning.enabled

      boolean

      Enables node vulnerability scanning.

      When enabled, the operator scans the host filesystem of each node for OS package vulnerabilities. Results are stored in NodeVulnerabilityReport objects.

      Default: false

      Examples:

      enabled: true
      

      enabled: false
      

    • settings.nodeScanning.hideUnfixedCVEs

      boolean

      Whether to report only vulnerabilities that have a fix available.

      This reduces the report size but hides vulnerabilities that have no fix yet.

      Default: false

      Examples:

      hideUnfixedCVEs: true
      

      hideUnfixedCVEs: false
      

    • settings.nodeScanning.nodeSelector

      object

      Labels of the nodes to scan.

      Only nodes that have all the listed labels are scanned.

      Default: {}

      Examples:

      node-role.kubernetes.io/worker: ''
      

      env: production
      

    • settings.nodeScanning.pkgTypes

      array of strings

      List of package types to include in node scanning:

      • OS: Operating system packages (rpm, deb, apk, etc.).
      • Library: Application-level libraries (jars, npm modules, Python packages, etc.) found on the node filesystem.

      Default: [ "OS" ]

      Examples:

      pkgTypes:
      - OS
      

      pkgTypes:
      - OS
      - Library
      

      • settings.nodeScanning.pkgTypes.Element of the array

        string

        Allowed values: OS, Library

    • settings.nodeScanning.resources

      object

      Resource requests/limits for node scan jobs (scan-noderootfs pods).

      Unlike scanJobResources, each omitted field keeps its default value: 100m/256Mi requests and 1/2Gi limits. A default request above the limit you set is lowered to that limit. A ModuleConfig with an explicit request above the limit, set or default, is rejected. Zero values are not allowed.

      A scan of the entire node filesystem can take up to 2 GiB of memory, and a scan job that exceeds the memory limit is terminated (OOMKilled) without a report. A lower CPU limit slows the scan down; raise nodeScanning.timeout accordingly. A request that does not fit the free resources of the node fails the job (OutOfmemory, OutOfcpu).

      Default: {}

      Example:

      limits:
        memory: 3Gi
      

      • settings.nodeScanning.resources.limits

        object

        Default: {}

        • settings.nodeScanning.resources.limits.cpu

          string

          Default: 1

          Pattern: ^([1-9][0-9]*(\.[0-9]+)?|0\.[0-9]*[1-9][0-9]*)m?$

          Examples:

          cpu: 500m
          

          cpu: '1'
          

        • settings.nodeScanning.resources.limits.memory

          string

          Default: 2Gi

          Pattern: ^([1-9][0-9]*(\.[0-9]+)?|0\.[0-9]*[1-9][0-9]*)(k|M|G|T|Ki|Mi|Gi|Ti)?$

          Examples:

          memory: 1Gi
          

          memory: 2Gi
          

      • settings.nodeScanning.resources.requests

        object

        Default: {}

        • settings.nodeScanning.resources.requests.cpu

          string

          Default: 100m

          Pattern: ^([1-9][0-9]*(\.[0-9]+)?|0\.[0-9]*[1-9][0-9]*)m?$

          Examples:

          cpu: 100m
          

          cpu: 250m
          

        • settings.nodeScanning.resources.requests.memory

          string

          Default: 256Mi

          Pattern: ^([1-9][0-9]*(\.[0-9]+)?|0\.[0-9]*[1-9][0-9]*)(k|M|G|T|Ki|Mi|Gi|Ti)?$

          Examples:

          memory: 256Mi
          

          memory: 512Mi
          

    • settings.nodeScanning.scanners

      array of strings

      List of scanners to enable on each node:

      • Vuln: Vulnerability scanner (matches known CVEs in OS and library packages of the node host filesystem).
      • Secret: Secret scanner (detects hardcoded credentials such as AWS keys, GitHub tokens, etc. in files on the node).

      Default: [ "Vuln" ]

      Examples:

      scanners:
      - Vuln
      

      scanners:
      - Vuln
      - Secret
      

      • settings.nodeScanning.scanners.Element of the array

        string

        Allowed values: Vuln, Secret

    • settings.nodeScanning.severities

      array of strings

      Severity levels of vulnerabilities included in node vulnerability reports.

      Warning. LOW and MEDIUM levels might increase total report size by an order of magnitude and valuable findings will become harder to spot. If securityStorageForReports is false, a report on a node with many packages can exceed the 3 MB object size limit of etcd.

      Default: [ "CRITICAL", "HIGH" ]

      Examples:

      severities:
      - CRITICAL
      - HIGH
      

      severities:
      - CRITICAL
      - HIGH
      - MEDIUM
      

      • settings.nodeScanning.severities.Element of the array

        string

        Allowed values: UNKNOWN, LOW, MEDIUM, HIGH, CRITICAL

    • settings.nodeScanning.skipDirs

      array of strings

      List of directories to skip during node scanning.

      Default: [ "/proc", "/sys", "/dev", "/run", "/var/lib/containerd", "/var/lib/docker", "/var/lib/kubelet/pods" ]

      Example:

      skipDirs:
      - /proc
      - /sys
      - /dev
      

    • settings.nodeScanning.timeout

      string

      Timeout for node scan jobs.

      If the parameter is not set, the timeout is 5 minutes.

      Default: ‘’

      Examples:

      timeout: 10m
      

      timeout: 30m
      

  • settings.nodeSelector

    object

    Node selector for the module components (the operator, trivy-server, trivy-provider, registry-scanner, security-storage and report-updater) and image scan jobs.

    The same as spec.nodeSelector for the Kubernetes pod.

    Node scan jobs and the eBPF agent (nodeAgent) do not use this parameter.

    If the parameter is omitted, it will be determined automatically.

    Example:

    disktype: ssd
    

  • settings.registryScanning

    object

    Configuration for periodic CVE scanning of container images stored in external registries.

    Scan targets are defined in RegistryScanTarget objects, and scan results are stored in RegistryImageVulnerabilityReport objects.

    Default: {}

    • settings.registryScanning.concurrentScans

      integer

      Maximum number of image scans that the registry scanner runs in parallel across all targets.

      Default: 5

      Allowed values: 1 <= X

      Examples:

      concurrentScans: 3
      

      concurrentScans: 5
      

      concurrentScans: 10
      

    • settings.registryScanning.enabled

      boolean

      Enables the registry CVE scanner.

      Default: false

      Examples:

      enabled: true
      

      enabled: false
      

  • settings.reportResourceLabels

    array of strings

    List of labels of the scanned objects to copy to the module reports, such as VulnerabilityReport, ConfigAuditReport and RbacAssessmentReport.

    A report gets each listed label with the value it has on the scanned object.

    Examples:

    reportResourceLabels: app
    

    reportResourceLabels: env
    

  • settings.scanJobResources

    object

    CPU and memory requests/limits of the Trivy container in image scan job pods.

    If the parameter is omitted, the module uses the default values: 100m/100M requests and 500m/500M limits. If specified, only some of the fields may be set (for example, only memory). Unspecified fields are not filled in by the module.

    Node scan jobs are not affected.

    Default: {}

    Example:

    limits:
      cpu: 500m
      memory: 500M
    requests:
      cpu: 100m
      memory: 100M
    

    • settings.scanJobResources.limits

      object

      Resource limits of the Trivy container.

      Default: {}

      • settings.scanJobResources.limits.cpu

        string

        CPU limit.

        Examples:

        cpu: 500m
        

        cpu: '1'
        

      • settings.scanJobResources.limits.memory

        string

        Memory limit.

        Examples:

        memory: 500M
        

        memory: 1Gi
        

    • settings.scanJobResources.requests

      object

      Resource requests of the Trivy container.

      Default: {}

      • settings.scanJobResources.requests.cpu

        string

        CPU request.

        Examples:

        cpu: 100m
        

        cpu: 250m
        

      • settings.scanJobResources.requests.memory

        string

        Memory request.

        Examples:

        memory: 100M
        

        memory: 256Mi
        

  • settings.scanPeriods

    object

    Controls how often the operator rescans workloads and regenerates compliance reports.

    Default: {}

    • settings.scanPeriods.complianceRescanCron

      string

      Cron schedule that controls how frequently ClusterComplianceReport objects are regenerated.

      Uses standard five-field cron syntax (minute hour day-of-month month day-of-week).

      Default: 0 */6 * * *

      Pattern: ^(((([\*]{1}){1})|((\*\/){0,1}(([0-9]{1}){1}|(([1-5]{1}){1}([0-9]{1}){1}){1}))) ((([\*]{1}){1})|((\*\/){0,1}(([0-9]{1}){1}|(([1]{1}){1}([0-9]{1}){1}){1}|([2]{1}){1}([0-3]{1}){1}))) ((([\*]{1}){1})|((\*\/){0,1}(([1-9]{1}){1}|(([1-2]{1}){1}([0-9]{1}){1}){1}|([3]{1}){1}([0-1]{1}){1}))) ((([\*]{1}){1})|((\*\/){0,1}(([1-9]{1}){1}|(([1-2]{1}){1}([0-9]{1}){1}){1}|([3]{1}){1}([0-1]{1}){1}))|(jan|feb|mar|apr|may|jun|jul|aug|sep|okt|nov|dec)) ((([\*]{1}){1})|((\*\/){0,1}(([0-7]{1}){1}))|(sun|mon|tue|wed|thu|fri|sat)))$

      Examples:

      complianceRescanCron: 0 0 * * sat
      

      complianceRescanCron: 0 */6 * * *
      

    • settings.scanPeriods.workloadRescanPeriod

      string

      Maximum age of a vulnerability report before it is considered stale and queued for rescanning.

      Once a report exceeds this age, the operator deletes it and schedules a new scan job to regenerate it. Set to "" to disable periodic rescanning entirely (reports are generated once and never refreshed automatically).

      Default: 24h

      Pattern: ^([0-9]+h)?([0-9]+m)?([0-9]+s)?$

      Examples:

      workloadRescanPeriod: 2h50m30s
      

      workloadRescanPeriod: 12h30m
      

      workloadRescanPeriod: 24h
      

  • settings.securityEvents

    object

    Settings of the security events the module sends to the security-events-manager module.

    The events are created only when the security-events-manager module is enabled.

    Default: {}

    • settings.securityEvents.minimumSeverity

      string

      Lowest finding severity that produces a security event.

      A scan report produces an event when its most severe finding is at this level or above, and the event takes the severity of that finding. The parameter applies to vulnerabilities in workloads, nodes and registry images, exposed secrets, misconfigurations and RBAC issues. Rejected images, registry scan failures and failed compliance controls always produce an event.

      A report with LOW or UNKNOWN findings only counts as LOW.

      Default: HIGH

      Allowed values: CRITICAL, HIGH, MEDIUM, LOW

      Examples:

      minimumSeverity: HIGH
      

      minimumSeverity: CRITICAL
      

      minimumSeverity: LOW
      

  • settings.securityStorageForReports

    boolean

    Stores scan reports in security-storage instead of etcd.

    If true, reports are served by the security-storage aggregated API server under the trivy.deckhouse.io API group and are not limited by the etcd object size. If false, reports are stored in etcd as custom resources of the aquasecurity.github.io API group.

    Warning. Changing the value does not move existing reports. The operator rescans workloads and nodes and recreates the reports in the new storage.

    Default: true

    Examples:

    securityStorageForReports: true
    

    securityStorageForReports: false
    

  • settings.securityStoragePVCRequest

    integer

    Size of the PersistentVolumeClaim used by security-storage to store scan results, in GiB.

    The claim is never shrunk: if the existing claim requests more than the value, the module keeps its size. The module expands a smaller claim only if its StorageClass allows volume expansion. The parameter has no effect if apiServerStorageClass is "false".

    Default: 10

    Allowed values: 1 <= X

  • settings.severities

    array of strings

    Severity levels of vulnerabilities included in vulnerability reports.

    Default: [ "UNKNOWN", "LOW", "MEDIUM", "HIGH", "CRITICAL" ]

    Examples:

    severities:
    - CRITICAL
    - HIGH
    - MEDIUM
    - LOW
    - UNKNOWN
    

    severities:
    - CRITICAL
    - HIGH
    

    • settings.severities.Element of the array

      string

      Allowed values: UNKNOWN, LOW, MEDIUM, HIGH, CRITICAL

  • settings.storageClass

    string

    Name of the StorageClass used to store the module data.

    If the value is not specified, the StorageClass will be used according to the global storageClass parameter setting.

    The global storageClass parameter is only considered when the module is enabled. Changing the global storageClass parameter while the module is enabled will not trigger disk re-provisioning.

    Warning. Specifying a value different from the one currently used (in the existing PVC) will result in disk re-provisioning and all data will be deleted.

    If false is specified, emptyDir will be forced to be used.

    Examples:

    storageClass: ceph-ssd
    

    storageClass: 'false'
    

  • settings.tolerations

    array of objects

    Tolerations for the module components: the operator, trivy-server, trivy-provider, registry-scanner, security-storage and report-updater.

    The same as spec.tolerations for the Kubernetes pod.

    Scan jobs and the eBPF agent (nodeAgent) do not use this parameter.

    If the parameter is omitted, it will be determined automatically.

    Example:

    tolerations:
    - effect: NoSchedule
      key: key1
      operator: Equal
      value: value1
    

    • settings.tolerations.effect

      string
    • settings.tolerations.key

      string
    • settings.tolerations.operator

      string
    • settings.tolerations.tolerationSeconds

      integer
    • settings.tolerations.value

      string
  • settings.useVEXFromOCI

    boolean

    Enables the use of VEX attestations of the scanned images stored in the OCI registry.

    Vulnerabilities declared in the attestations are not reported. The attestations are fetched with the certificates from additionalRegistryCA. Images from the registries in insecureRegistries, and in registry scanning images of a RegistryScanTarget with insecure: true, are scanned without VEX attestations.

    Default: false

    Examples:

    useVEXFromOCI: true
    

    useVEXFromOCI: false
    

  • settings.vulnerabilityDatabaseMaxAge

    string

    Maximum age of the Trivy vulnerability database (trivy-db) before the TrivyVulnerabilityDatabaseOutdated alert fires.

    Age is measured from the database UpdatedAt timestamp published in the trivy-db-info ConfigMap by the trivy-db-info sidecar (only trivy-db is checked; trivy-java-db is not).

    The related TrivyVulnerabilityDatabaseMissing alert fires when that ConfigMap is absent or has no trivy-db.updatedAt for 30 minutes (for example, registry/network issues or an incomplete air-gapped installation).

    Set to "" to disable both database freshness alerts (outdated and missing). Zero durations such as 0s or 0h are invalid — use "" to disable.

    Default: 168h

    Pattern: ^(?:[0-9]*[1-9][0-9]*h(?:[0-9]+m)?(?:[0-9]+s)?|(?:[0-9]+h)?[0-9]*[1-9][0-9]*m(?:[0-9]+s)?|(?:[0-9]+h)?(?:[0-9]+m)?[0-9]*[1-9][0-9]*s)?$

    Examples:

    vulnerabilityDatabaseMaxAge: 168h
    

    vulnerabilityDatabaseMaxAge: 336h
    

    vulnerabilityDatabaseMaxAge: 720h
    

    vulnerabilityDatabaseMaxAge: ''