trivy-operator - Kubernetes Operator based on the open-source conta

项目说明

Tri

The goal of this project is to provide a scanner that continuously scans containers deployed in a Kubernetes cluster. Built with kopf

It works as

Operator

- Scheduled Image scans on running pods

Admission Controller

- protecting unsafe images from being deployed

Inspirated by knqyf263's tri and fleeto's tri.

Scheduled Image scans

Default tri execute a scan script every 5 minutes. It will get images from all the namespaces with the label tri=true, and then check these images with trivy for . Finally we will get metrics on ]:9115/metrics

Tri

The admission controller function can be configured as a in a k8s cluster. Kubernetes will send requests to the admission server when a Pod creation is initiated. The admission controller checks the image using trivy if it is in a namespace with the label tri=true.

Install

User the helm Chert

Usage

~~~text
curl -s | grep tri

HELP tri Container

TYPE tri gauge

tri{exported_namespace="tri",image="docker.io/openshift/mysql-56-centos7:latest",se="scanning_error"} 1.0
tri{exported_namespace="tri",image="docker.io/nginxinc/nginx-unpri:latest",se="UNKNOWN"} 0.0
tri{exported_namespace="tri",image="docker.io/nginxinc/nginx-unpri:latest",se="LOW"} 83.0
tri{exported_namespace="tri",image="docker.io/nginxinc/nginx-unpri:latest",se="MEDIUM"} 5.0
tri{exported_namespace="tri",image="docker.io/nginxinc/nginx-unpri:latest",se="HIGH"} 7.0
tri{exported_namespace="tri",image="docker.io/nginxinc/nginx-unpri:latest",se="CRITICAL"} 4.0
tri{exported_namespace="tri",image="docker.io/library/nginx:1.18",se="UNKNOWN"} 0.0
tri{exported_namespace="tri",image="docker.io/library/nginx:1.18",se="LOW"} 126.0
tri{exported_namespace="tri",image="docker.io/library/nginx:1.18",se="MEDIUM"} 25.0
tri{exported_namespace="tri",image="docker.io/library/nginx:1.18",se="HIGH"} 43.0
tri{exported_namespace="tri",image="docker.io/library/nginx:1.18",se="CRITICAL"} 21.0

HELP tri Container

TYPE tri gauge

tri{exported_namespace="tri",image="docker.io/nginxinc/nginx-unpri:latest",installed="2.2.4",pkgName="pkgName",se="LOW",="C"} 1.0
tri{exported_namespace="tri",image="docker.io/nginxinc/nginx-unpri:latest",installed="8.32-4",pkgName="pkgName",se="LOW",="C"} 1.0
tri{exported_namespace="tri",image="docker.io/nginxinc/nginx-unpri:latest",installed="8.32-4",pkgName="pkgName",se="LOW",="C"} 1.0
tri{exported_namespace="tri",image="docker.io/nginxinc/nginx-unpri:latest",installed="7.74.0-1.3",pkgName="pkgName",se="CRITICAL",="C"} 1.0
tri{exported_namespace="tri",image="docker.io/nginxinc/nginx-unpri:latest",installed="7.74.0-1.3",pkgName="pkgName",se="HIGH",="C"} 1.0
tri{exported_namespace="tri",image="docker.io/nginxinc/nginx-unpri:latest",installed="7.74.0-1.3",pkgName="pkgName",se="MEDIUM",="C"} 1.0
tri{exported_namespace="tri",image="docker.io/nginxinc/nginx-unpri:latest",installed="7.74.0-1.3",pkgName="pkgName",se="LOW",="C"} 1.0
~~~

~~~text
curl -s | grep ac_

HELP ac_ Admission Controller

TYPE ac_ gauge

ac_{exported_namespace="tri",image="nginxinc/nginx-unpri:latest",se="UNKNOWN"} 0.0
ac_{exported_namespace="tri",image="nginxinc/nginx-unpri:latest",se="LOW"} 83.0
ac_{exported_namespace="tri",image="nginxinc/nginx-unpri:latest",se="MEDIUM"} 6.0
ac_{exported_namespace="tri",image="nginxinc/nginx-unpri:latest",se="HIGH"} 6.0
ac_{exported_namespace="tri",image="nginxinc/nginx-unpri:latest",se="CRITICAL"} 4.0
~~~

~~~text
kubectl logs

[2021-10-02 09:38:38,598] kopf.acti.star [INFO ] Activity 'startup_fn_crd' succeeded.
[2021-10-02 09:38:38,687] kopf.acti.star [INFO ] tri created...
[2021-10-02 09:38:38,687] kopf.acti.star [INFO ] Activity 'startup_fn_tri' succeeded.
[2021-10-02 09:38:38,689] kopf._core.engines.a [INFO ] Initial authentication has been initiated.
[2021-10-02 09:38:38,696] kopf.acti.auth [INFO ] Activity 'login_' succeeded.
[2021-10-02 09:38:38,697] kopf._core.engines.a [INFO ] Initial authentication has finished.
[2021-10-02 09:38:46,726] kopf.objects [INFO ] [tri/main-config] Prometheus Exporter started...
[2021-10-02 09:40:01,831] kopf.objects [INFO ] [tri/main-config] Scanning Image: docker.io/library/nginx:1.18
[2021-10-02 09:40:05,245] kopf.objects [INFO ] [tri/main-config] Scanning Image: docker.io/library/nginx:latest
[2021-10-02 09:40:23,817] kopf.objects [INFO ] [tri/main-config] Scanning Image: docker.io/library/nginx:1.18
[2021-10-02 09:40:26,947] kopf.objects [INFO ] [tri/main-config] Scanning Image: docker.io/library/nginx:latest
[2021-10-02 09:40:45,428] kopf.objects [INFO ] [tri/main-config] Scanning Image: docker.io/library/nginx:1.18
[2021-10-02 09:40:48,949] kopf.objects [INFO ] [tri/main-config] Scanning Image: docker.io/library/nginx:latest

[2021-10-02 09:45:08,229] kopf.objects [INFO ] [tri/main-config] Scanning Image: docker.io/library/nginx:1.18
[2021-10-02 09:45:11,922] kopf.objects [INFO ] [tri/main-config] Scanning Image: docker.io/library/nginx:latest
[2021-10-02 09:45:30,381] kopf.objects [INFO ] [tri/main-config] Scanning Image: docker.io/library/nginx:1.18
[2021-10-02 09:45:33,881] kopf.objects [INFO ] [tri/main-config] Scanning Image: docker.io/library/nginx:latest
[2021-10-02 09:45:52,227] kopf.objects [INFO ] [tri/main-config] Scanning Image: docker.io/library/nginx:1.18
[2021-10-02 09:45:55,556] kopf.objects [INFO ] [tri/main-config] Scanning Image: docker.io/library/nginx:latest

[2021-10-02 18:33:32,742] kopf.objects [INFO ] [tri/app-85ddd4585b-sdt4t] Admission Controller is working
[2021-10-02 18:33:32,755] kopf.objects [INFO ] [tri/app-85ddd4585b-sdt4t] Scanning Image: nginxinc/nginx-unpri:latest
[2021-10-02 18:33:34,967] kopf.objects [INFO ] [tri/app-85ddd4585b-sdt4t] se: {'UNKNOWN': 0, 'LOW': 83, 'MEDIUM': 6, 'HIGH':6, 'CRITICAL': 4}
[2021-10-02 18:33:34,969] kopf.objects [ERROR ] [tri/app-85ddd4585b-sdt4t] Webhook '' failed permanently: Too much in the image: nginxinc/nginx-unpri:latest
[2021-10-02 18:33:34,971] aiohttp.access [INFO ] 10.244.0.1 [17/Dec/2021:18:33:32 +0000] "POST /?timeout=30s HTTP/1.1" 200 417"-" "kube-apiser"
~~~

Example Deploy:

You can define policy to the Admission Controller, by adding annotation to the pod through the deployment:

De

Install trivy:

To run kopf de you need to install the fallowing packages to the k3s host:

The admission webhook try to call the host with the domain name host.k3d.internal so I added to the host's /etc/host file.

项目信息

开发语言：Python

Star 数：52

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Kubernetes Operator based on the open-source container vulnerability scanner Trivy.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。