Continuous CVE Scanning with Trivy Operator
summary
Introduces Trivy Operator for continuous cluster scanning across production-critical Kubernetes, integrating with Terraform, Helm, Jenkins, Prometheus/Grafana and Matrix for alerts. Runs three Trivy operators per cluster scanning daily across 35 namespaces and ~100 apps, finds 73 critical CVEs in dev during rollout. Builds a 20-line Jenkins pipeline to update a cluster-wide ignore list, trims large YAML fields to avoid Kubernetes API timeouts, and reshapes metrics into usable Prometheus labels. Outcome: continuous visibility and a closed production scanning gap, with false positives and developer alert fatigue still to tune.
AI-written summary · about
chapters (7)
- 0:00Introduction and motivation
- 4:00Initial CVE scanning challenges
- 5:48Evaluating Trivy Operator solution
- 6:32Implementation process
- 8:22Custom problems and fixes
- 12:39Results and security improvements
- 14:02Q&A session
related talks
34mIntegrating Cloud Native Security into the SRE culture
01h 21mFirst Steps to Full Lifecycle Security with Open Source Tools
32mClimbing high — getting started with cloud native security through open source
07mImplementing a Continuous & Proactive Security Mechanism to Protect K8s
31mIntegrating Cloud Native Security into the SRE culture
27mSurviving Day2 : Picking the Right Tool To Secure Your Kubernetes Habitat
32mStrengthening Kubernetes Security
22mIntegrating Security in the Build Pipeline