# Addon: Trivy

**URL:** <https://discuss.kubernetes.io/t/addon-trivy/23797>\
**Category:** microk8s\
**Tags:** docs\
**Created:** [April 11, 2023, 11:51am UTC](https://discuss.kubernetes.io/t/addon-trivy/23797 "2023-04-11T11:51:14Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Konstantinos\_Tsakalo](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.kubernetes.io/konstantinos_tsakalo/32/3387_2.png) [@Konstantinos\_Tsakalo](https://discuss.kubernetes.io/u/Konstantinos_Tsakalo)\
**Post date:** [April 11, 2023, 11:51am UTC](https://discuss.kubernetes.io/t/addon-trivy/23797/1 "2023-04-11T11:51:14Z")

</div>

![1.26](https://img.shields.io/badge/From%20version-1.26-brightgreen?style=for-the-badge&logo=kubernetes&labelColor=ddd)  
**Compatibility** : ![amd64](https://img.shields.io/badge/amd64-%E2%9C%93-383) ![arm64](https://img.shields.io/badge/arm64-%E2%9C%93-orange) ![classic](https://img.shields.io/badge/classic-%E2%9C%93-338) ![strict](https://img.shields.io/badge/strict-%E2%9C%93-33f)  
**Source** : See [Trivy](https://trivy.dev/) website for details.

Trivy is an all-in-one open source security scanner that can help you identify vulnerabilities and IaC misconfigurations, discover SBOMs, perform cloud scanning, identify Kubernetes security risks, and much more. With Trivy, you have access to a powerful tool that can help you keep your systems secure and your data protected.

Trivy has two components:

- The Trivy Operator , which scans workloads already running in the cluster. The scan is performed internally to the cluster, running continuously and happening in the background.
- The Trivy CLI is for manual or CI triggered scanning of the Kubernetes cluster and workloads.

Using a combination of these approaches, scans can be run under any circumstances to ensure security throughout the cluster.

## Usage

To enable the addon:

```auto
microk8s enable trivy

```

The addon can be disabled at any time with:

```auto
microk8s disable trivy

```

## The Trivy Operator

The Trivy operator automatically updates security reports in response to workload and other changes on a Kubernetes cluster, generating the following reports:

- Vulnerability Scans: Automated vulnerability scanning for Kubernetes workloads.
- ConfigAudit Scans: Automated configuration audits for Kubernetes resources with predefined rules or custom Open Policy Agent (OPA) policies.
- Exposed Secret Scans: Automated secret scans which find and detail the location of exposed Secrets within your cluster.
- RBAC scans: Role Based Access Control scans provide detailed information on the access rights of the different resources installed.
- K8s core component infra assessment scan Kubernetes infra core components (etcd,apiserver,scheduler,controller-manager and etc) setting and configuration.
- k8s outdated api validation - a configaudit check will validate if the resource api has been deprecated and planned for removal
- Compliance reports
  - NSA, CISA Kubernetes Hardening Guidance v1.1 cybersecurity technical report is produced.
  - CIS Kubernetes Benchmark v1.23 cybersecurity technical report is produced.
  - Kubernetes pss-baseline, Pod Security Standards
  - Kubernetes pss-restricted, Pod Security Standards

- SBOM (software bill of materials genertations) for Kubernetes workloads.

For more on how to use the Trivy operator (and the Trivy CLI tool), see this [how to guide](https://discuss.kubernetes.io/t/how-to-run-a-security-scan-with-trivy/24812).

## Links

To learn more about Trivy visit:

- the [Trivy official](https://trivy.dev/) website
- the project’s [github repository](https://github.com/aquasecurity/trivy)