alexlebens/infrastructure
1
0
Fork 0
Code Issues 1 Pull Requests 2 Actions Activity

Automated Manifest Update (#2259)

Browse Source 
This PR contains newly rendered Kubernetes manifests automatically generated by the CI workflow.

Reviewed-on: #2259
Co-authored-by: gitea-bot <gitea-bot@alexlebens.net>
Co-committed-by: gitea-bot <gitea-bot@alexlebens.net>
This commit was merged in pull request #2259.
This commit is contained in:
gitea-bot
2025-12-04 21:47:46 +00:00
committed by Alex Lebens
parent d008c08479
commit 7a96d06727
2100 changed files with 365994 additions and 380674 deletions
Download Patch File Download Diff File Expand all files Collapse all files

801
clusters/cl01tl/manifests/trivy/ClusterComplianceReport-k8s-cis-1.23.yaml Normal file
View File

@@ -0,0 +1,801 @@
---
# Source: trivy/charts/trivy-operator/templates/specs/k8s-cis-1.23.yaml
apiVersion: aquasecurity.github.io/v1alpha1
kind: ClusterComplianceReport
metadata:
name: k8s-cis-1.23
labels:
app.kubernetes.io/name: trivy-operator
app.kubernetes.io/instance: trivy-operator
app.kubernetes.io/version: 0.29.0
app.kubernetes.io/managed-by: kubectl
spec:
cron: "0 5 * * *"
reportType: "summary"
compliance:
id: k8s-cis-1.23
title: CIS Kubernetes Benchmarks v1.23
description: CIS Kubernetes Benchmarks
platform: k8s
type: cis
relatedResources:
- https://www.cisecurity.org/benchmark/kubernetes
version: "1.23"
controls:
- id: 1.1.1
name: Ensure that the API server pod specification file permissions are set to 600 or more restrictive
description: Ensure that the API server pod specification file has permissions of 600 or more restrictive
checks:
- id: AVD-KCV-0048
commands:
- id: CMD-0001
severity: HIGH
- id: 1.1.2
name: Ensure that the API server pod specification file ownership is set to root:root
description: Ensure that the API server pod specification file ownership is set to root:root
checks:
- id: AVD-KCV-0049
commands:
- id: CMD-0002
severity: HIGH
- id: 1.1.3
name: Ensure that the controller manager pod specification file permissions are set to 600 or more restrictive
description: Ensure that the controller manager pod specification file has permissions of 600 or more restrictive
checks:
- id: AVD-KCV-0050
commands:
- id: CMD-0003
severity: HIGH
- id: 1.1.4
name: Ensure that the controller manager pod specification file ownership is set to root:root
description: Ensure that the controller manager pod specification file ownership is set to root:root
checks:
- id: AVD-KCV-0051
commands:
- id: CMD-0004
severity: HIGH
- id: 1.1.5
name: Ensure that the scheduler pod specification file permissions are set to 600 or more restrictive
description: Ensure that the scheduler pod specification file has permissions of 600 or more restrictive
checks:
- id: AVD-KCV-0052
commands:
- id: CMD-0005
severity: HIGH
- id: 1.1.6
name: Ensure that the scheduler pod specification file ownership is set to root:root
description: Ensure that the scheduler pod specification file ownership is set to root:root
checks:
- id: AVD-KCV-0053
commands:
- id: CMD-0006
severity: HIGH
- id: 1.1.7
name: Ensure that the etcd pod specification file permissions are set to 600 or more restrictive
description: Ensure that the etcd pod specification file has permissions of 600 or more restrictive
checks:
- id: AVD-KCV-0054
commands:
- id: CMD-0007
severity: HIGH
- id: 1.1.8
name: Ensure that the etcd pod specification file ownership is set to root:root
description: Ensure that the etcd pod specification file ownership is set to root:root.
checks:
- id: AVD-KCV-0055
commands:
- id: CMD-0008
severity: HIGH
- id: 1.1.9
name: Ensure that the Container Network Interface file permissions are set to 600 or more restrictive
description: Ensure that the Container Network Interface files have permissions of 600 or more restrictive
checks:
- id: AVD-KCV-0056
commands:
- id: CMD-0009
severity: HIGH
- id: 1.1.10
name: Ensure that the Container Network Interface file ownership is set to root:root
description: Ensure that the Container Network Interface files have ownership set to root:root
checks:
- id: AVD-KCV-0057
commands:
- id: CMD-0010
severity: HIGH
- id: 1.1.11
name: Ensure that the etcd data directory permissions are set to 700 or more restrictive
description: Ensure that the etcd data directory has permissions of 700 or more restrictive
checks:
- id: AVD-KCV-0058
commands:
- id: CMD-0011
severity: HIGH
- id: 1.1.12
name: Ensure that the etcd data directory ownership is set to etcd:etcd
description: Ensure that the etcd data directory ownership is set to etcd:etcd
checks:
- id: AVD-KCV-0059
commands:
- id: CMD-0012
severity: LOW
- id: 1.1.13
name: Ensure that the admin.conf file permissions are set to 600
description: Ensure that the admin.conf file has permissions of 600
checks:
- id: AVD-KCV-0060
commands:
- id: CMD-0013
severity: CRITICAL
- id: 1.1.14
name: Ensure that the admin.conf file ownership is set to root:root
description: Ensure that the admin.conf file ownership is set to root:root
checks:
- id: AVD-KCV-0061
commands:
- id: CMD-0014
severity: CRITICAL
- id: 1.1.15
name: Ensure that the scheduler.conf file permissions are set to 600 or more restrictive
description: Ensure that the scheduler.conf file has permissions of 600 or more restrictive
checks:
- id: AVD-KCV-0062
commands:
- id: CMD-0015
severity: HIGH
- id: 1.1.16
name: Ensure that the scheduler.conf file ownership is set to root:root
description: Ensure that the scheduler.conf file ownership is set to root:root
checks:
- id: AVD-KCV-0063
commands:
- id: CMD-0016
severity: HIGH
- id: 1.1.17
name: Ensure that the controller-manager.conf file permissions are set to 600 or more restrictive
description: Ensure that the controller-manager.conf file has permissions of 600 or more restrictive
checks:
- id: AVD-KCV-0064
commands:
- id: CMD-0017
severity: HIGH
- id: 1.1.18
name: Ensure that the controller-manager.conf file ownership is set to root:root
description: Ensure that the controller-manager.conf file ownership is set to root:root.
checks:
- id: AVD-KCV-0065
commands:
- id: CMD-0018
severity: HIGH
- id: 1.1.19
name: Ensure that the Kubernetes PKI directory and file ownership is set to root:root
description: Ensure that the Kubernetes PKI directory and file ownership is set to root:root
checks:
- id: AVD-KCV-0066
commands:
- id: CMD-0019
severity: CRITICAL
- id: 1.1.20
name: Ensure that the Kubernetes PKI certificate file permissions are set to 600 or more restrictive
description: Ensure that Kubernetes PKI certificate files have permissions of 600 or more restrictive
checks:
- id: AVD-KCV-0068
commands:
- id: CMD-0020
severity: CRITICAL
- id: 1.1.21
name: Ensure that the Kubernetes PKI key file permissions are set to 600
description: Ensure that Kubernetes PKI key files have permissions of 600
checks:
- id: AVD-KCV-0067
commands:
- id: CMD-0021
severity: CRITICAL
- id: 1.2.1
name: Ensure that the --anonymous-auth argument is set to false
description: Disable anonymous requests to the API server
checks:
- id: AVD-KCV-0001
severity: MEDIUM
- id: 1.2.2
name: Ensure that the --token-auth-file parameter is not set
description: Do not use token based authentication
checks:
- id: AVD-KCV-0002
severity: LOW
- id: 1.2.3
name: Ensure that the --DenyServiceExternalIPs is not set
description: This admission controller rejects all net-new usage of the Service field externalIPs
checks:
- id: AVD-KCV-0003
severity: LOW
- id: 1.2.4
name: Ensure that the --kubelet-https argument is set to true
description: Use https for kubelet connections
checks:
- id: AVD-KCV-0004
severity: LOW
- id: 1.2.5
name: Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate
description: Enable certificate based kubelet authentication
checks:
- id: AVD-KCV-0005
severity: HIGH
- id: 1.2.6
name: Ensure that the --kubelet-certificate-authority argument is set as appropriate
description: Verify kubelets certificate before establishing connection
checks:
- id: AVD-KCV-0006
severity: HIGH
- id: 1.2.7
name: Ensure that the --authorization-mode argument is not set to AlwaysAllow
description: Do not always authorize all requests
checks:
- id: AVD-KCV-0007
severity: LOW
- id: 1.2.8
name: Ensure that the --authorization-mode argument includes Node
description: Restrict kubelet nodes to reading only objects associated with them
checks:
- id: AVD-KCV-0008
severity: HIGH
- id: 1.2.9
name: Ensure that the --authorization-mode argument includes RBAC
description: Turn on Role Based Access Control
checks:
- id: AVD-KCV-0009
severity: HIGH
- id: 1.2.10
name: Ensure that the admission control plugin EventRateLimit is set
description: Limit the rate at which the API server accepts requests
checks:
- id: AVD-KCV-0010
severity: HIGH
- id: 1.2.11
name: Ensure that the admission control plugin AlwaysAdmit is not set
description: Do not allow all requests
checks:
- id: AVD-KCV-0011
severity: LOW
- id: 1.2.12
name: Ensure that the admission control plugin AlwaysPullImages is set
description: Always pull images
checks:
- id: AVD-KCV-0012
severity: MEDIUM
- id: 1.2.13
name: Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used
description: The SecurityContextDeny admission controller can be used to deny pods which make use of some SecurityContext fields which could allow for privilege escalation in the cluster. This should be used where PodSecurityPolicy is not in place within the cluster
checks:
- id: AVD-KCV-0013
severity: MEDIUM
- id: 1.2.14
name: Ensure that the admission control plugin ServiceAccount is set
description: Automate service accounts management
checks:
- id: AVD-KCV-0014
severity: LOW
- id: 1.2.15
name: Ensure that the admission control plugin NamespaceLifecycle is set
description: Reject creating objects in a namespace that is undergoing termination
checks:
- id: AVD-KCV-0015
severity: LOW
- id: 1.2.16
name: Ensure that the admission control plugin NodeRestriction is set
description: Limit the Node and Pod objects that a kubelet could modify
checks:
- id: AVD-KCV-0016
severity: LOW
- id: 1.2.17
name: Ensure that the --secure-port argument is not set to 0
description: Do not disable the secure port
checks:
- id: AVD-KCV-0017
severity: HIGH
- id: 1.2.18
name: Ensure that the --profiling argument is set to false
description: Disable profiling, if not needed
checks:
- id: AVD-KCV-0018
severity: LOW
- id: 1.2.19
name: Ensure that the --audit-log-path argument is set
description: Enable auditing on the Kubernetes API Server and set the desired audit log path.
checks:
- id: AVD-KCV-0019
severity: LOW
- id: 1.2.20
name: Ensure that the --audit-log-maxage argument is set to 30 or as appropriate
description: Retain the logs for at least 30 days or as appropriate
checks:
- id: AVD-KCV-0020
severity: LOW
- id: 1.2.21
name: Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate
description: Retain 10 or an appropriate number of old log file
checks:
- id: AVD-KCV-0021
severity: LOW
- id: 1.2.22
name: Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate
description: Rotate log files on reaching 100 MB or as appropriate
checks:
- id: AVD-KCV-0022
severity: LOW
- id: 1.2.24
name: Ensure that the --service-account-lookup argument is set to true
description: Validate service account before validating token
checks:
- id: AVD-KCV-0024
severity: LOW
- id: 1.2.25
name: Ensure that the --service-account-key-file argument is set as appropriate
description: Explicitly set a service account public key file for service accounts on the apiserver
checks:
- id: AVD-KCV-0025
severity: LOW
- id: 1.2.26
name: Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate
description: etcd should be configured to make use of TLS encryption for client connections
checks:
- id: AVD-KCV-0026
severity: LOW
- id: 1.2.27
name: Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate
description: Setup TLS connection on the API server
checks:
- id: AVD-KCV-0027
severity: MEDIUM
- id: 1.2.28
name: Ensure that the --client-ca-file argument is set appropriate
description: Setup TLS connection on the API server
checks:
- id: AVD-KCV-0028
severity: LOW
- id: 1.2.29
name: Ensure that the --etcd-cafile argument is set as appropriate
description: etcd should be configured to make use of TLS encryption for client connections.
checks:
- id: AVD-KCV-0029
severity: LOW
- id: 1.2.30
name: Ensure that the --encryption-provider-config argument is set as appropriate
description: Encrypt etcd key-value store
checks:
- id: AVD-KCV-0030
severity: LOW
- id: 1.3.1
name: Ensure that the --terminated-pod-gc-threshold argument is set as appropriate
description: Activate garbage collector on pod termination, as appropriate
checks:
- id: AVD-KCV-0033
severity: MEDIUM
- id: 1.3.3
name: Ensure that the --use-service-account-credentials argument is set to true
description: Use individual service account credentials for each controller
checks:
- id: AVD-KCV-0035
severity: MEDIUM
- id: 1.3.4
name: Ensure that the --service-account-private-key-file argument is set as appropriate
description: Explicitly set a service account private key file for service accounts on the controller manager
checks:
- id: AVD-KCV-0036
severity: MEDIUM
- id: 1.3.5
name: Ensure that the --root-ca-file argument is set as appropriate
description: Allow pods to verify the API servers serving certificate before establishing connections
checks:
- id: AVD-KCV-0037
severity: MEDIUM
- id: 1.3.6
name: Ensure that the RotateKubeletServerCertificate argument is set to true
description: Enable kubelet server certificate rotation on controller-manager
checks:
- id: AVD-KCV-0038
severity: MEDIUM
- id: 1.3.7
name: Ensure that the --bind-address argument is set to 127.0.0.1
description: Do not bind the scheduler service to non-loopback insecure addresses
checks:
- id: AVD-KCV-0039
severity: LOW
- id: 1.4.1
name: Ensure that the --profiling argument is set to false
description: Disable profiling, if not needed
checks:
- id: AVD-KCV-0034
severity: MEDIUM
- id: 1.4.2
name: Ensure that the --bind-address argument is set to 127.0.0.1
description: Do not bind the scheduler service to non-loopback insecure addresses
checks:
- id: AVD-KCV-0041
severity: CRITICAL
- id: "2.1"
name: Ensure that the --cert-file and --key-file arguments are set as appropriate
description: Configure TLS encryption for the etcd service
checks:
- id: AVD-KCV-0042
severity: MEDIUM
- id: "2.2"
name: Ensure that the --client-cert-auth argument is set to true
description: Enable client authentication on etcd service
checks:
- id: AVD-KCV-0043
severity: CRITICAL
- id: "2.3"
name: Ensure that the --auto-tls argument is not set to true
description: Do not use self-signed certificates for TLS
checks:
- id: AVD-KCV-0044
severity: CRITICAL
- id: "2.4"
name: Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate
description: etcd should be configured to make use of TLS encryption for peer connections.
checks:
- id: AVD-KCV-0045
severity: CRITICAL
- id: "2.5"
name: Ensure that the --peer-client-cert-auth argument is set to true
description: etcd should be configured for peer authentication
checks:
- id: AVD-KCV-0046
severity: CRITICAL
- id: "2.6"
name: Ensure that the --peer-auto-tls argument is not set to true
description: Do not use self-signed certificates for TLS
checks:
- id: AVD-KCV-0047
severity: HIGH
- id: 3.1.1
name: Client certificate authentication should not be used for users (Manual)
description: Kubernetes provides the option to use client certificates for user authentication. However as there is no way to revoke these certificates when a user leaves an organization or loses their credential, they are not suitable for this purpose
severity: HIGH
- id: 3.2.1
name: Ensure that a minimal audit policy is created (Manual)
description: Kubernetes can audit the details of requests made to the API server. The --audit- policy-file flag must be set for this logging to be enabled.
severity: HIGH
- id: 3.2.2
name: Ensure that the audit policy covers key security concerns (Manual)
description: Ensure that the audit policy created for the cluster covers key security concerns
severity: HIGH
- id: 4.1.1
name: Ensure that the kubelet service file permissions are set to 600 or more restrictive
description: Ensure that the kubelet service file has permissions of 600 or more restrictive.
checks:
- id: AVD-KCV-0069
commands:
- id: CMD-0022
severity: HIGH
- id: 4.1.2
name: Ensure that the kubelet service file ownership is set to root:root
description: Ensure that the kubelet service file ownership is set to root:root
checks:
- id: AVD-KCV-0070
commands:
- id: CMD-0023
severity: HIGH
- id: 4.1.3
name: If proxy kubeconfig file exists ensure permissions are set to 600 or more restrictive
description: If kube-proxy is running, and if it is using a file-based kubeconfig file, ensure that the proxy kubeconfig file has permissions of 600 or more restrictive
checks:
- id: AVD-KCV-0071
commands:
- id: CMD-0024
severity: HIGH
- id: 4.1.4
name: If proxy kubeconfig file exists ensure ownership is set to root:root
description: If kube-proxy is running, ensure that the file ownership of its kubeconfig file is set to root:root
checks:
- id: AVD-KCV-0072
commands:
- id: CMD-0025
severity: HIGH
- id: 4.1.5
name: Ensure that the --kubeconfig kubelet.conf file permissions are set to 600 or more restrictive
description: Ensure that the kubelet.conf file has permissions of 600 or more restrictive
checks:
- id: AVD-KCV-0073
commands:
- id: CMD-0026
severity: HIGH
- id: 4.1.6
name: Ensure that the --kubeconfig kubelet.conf file ownership is set to root:root
description: Ensure that the kubelet.conf file ownership is set to root:root
checks:
- id: AVD-KCV-0074
commands:
- id: CMD-0027
severity: HIGH
- id: 4.1.7
name: Ensure that the certificate authorities file permissions are set to 600 or more restrictive
description: Ensure that the certificate authorities file has permissions of 600 or more restrictive
checks:
- id: AVD-KCV-0075
commands:
- id: CMD-0028
severity: CRITICAL
- id: 4.1.8
name: Ensure that the client certificate authorities file ownership is set to root:root
description: Ensure that the certificate authorities file ownership is set to root:root
checks:
- id: AVD-KCV-0076
commands:
- id: CMD-0029
severity: CRITICAL
- id: 4.1.9
name: If the kubelet config.yaml configuration file is being used validate permissions set to 600 or more restrictive
description: Ensure that if the kubelet refers to a configuration file with the --config argument, that file has permissions of 600 or more restrictive
checks:
- id: AVD-KCV-0077
commands:
- id: CMD-0030
severity: HIGH
- id: 4.1.10
name: If the kubelet config.yaml configuration file is being used validate file ownership is set to root:root
description: Ensure that if the kubelet refers to a configuration file with the --config argument, that file is owned by root:root
checks:
- id: AVD-KCV-0078
commands:
- id: CMD-0031
severity: HIGH
- id: 4.2.1
name: Ensure that the --anonymous-auth argument is set to false
description: Disable anonymous requests to the Kubelet server
checks:
- id: AVD-KCV-0079
commands:
- id: CMD-0032
severity: CRITICAL
- id: 4.2.2
name: Ensure that the --authorization-mode argument is not set to AlwaysAllow
description: Do not allow all requests. Enable explicit authorization
checks:
- id: AVD-KCV-0080
commands:
- id: CMD-0033
severity: CRITICAL
- id: 4.2.3
name: Ensure that the --client-ca-file argument is set as appropriate
description: Enable Kubelet authentication using certificates
checks:
- id: AVD-KCV-0081
commands:
- id: CMD-0034
severity: CRITICAL
- id: 4.2.4
name: Verify that the --read-only-port argument is set to 0
description: Disable the read-only port
checks:
- id: AVD-KCV-0082
commands:
- id: CMD-0035
severity: HIGH
- id: 4.2.5
name: Ensure that the --streaming-connection-idle-timeout argument is not set to 0
description: Do not disable timeouts on streaming connections
checks:
- id: AVD-KCV-0085
commands:
- id: CMD-0036
severity: HIGH
- id: 4.2.6
name: Ensure that the --protect-kernel-defaults argument is set to true
description: Protect tuned kernel parameters from overriding kubelet default kernel parameter values
checks:
- id: AVD-KCV-0083
commands:
- id: CMD-0037
severity: HIGH
- id: 4.2.7
name: Ensure that the --make-iptables-util-chains argument is set to true
description: Allow Kubelet to manage iptables
checks:
- id: AVD-KCV-0084
commands:
- id: CMD-0038
severity: HIGH
- id: 4.2.8
name: Ensure that the --hostname-override argument is not set
description: Do not override node hostnames
checks:
- id: AVD-KCV-0086
commands:
- id: CMD-0039
severity: HIGH
- id: 4.2.9
name: Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture
description: Security relevant information should be captured. The --event-qps flag on the Kubelet can be used to limit the rate at which events are gathered
checks:
- id: AVD-KCV-0087
commands:
- id: CMD-0040
severity: HIGH
- id: 4.2.10
name: Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate
description: Setup TLS connection on the Kubelets
checks:
- id: AVD-KCV-0088
- id: AVD-KCV-0089
commands:
- id: CMD-0041
- id: CMD-0042
severity: CRITICAL
- id: 4.2.11
name: Ensure that the --rotate-certificates argument is not set to false
description: Enable kubelet client certificate rotation
checks:
- id: AVD-KCV-0090
commands:
- id: CMD-0043
severity: CRITICAL
- id: 4.2.12
name: Verify that the RotateKubeletServerCertificate argument is set to true
description: Enable kubelet server certificate rotation
checks:
- id: AVD-KCV-0091
commands:
- id: CMD-0044
severity: CRITICAL
- id: 4.2.13
name: Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers
description: Ensure that the Kubelet is configured to only use strong cryptographic ciphers
checks:
- id: AVD-KCV-0092
commands:
- id: CMD-0045
severity: CRITICAL
- id: 5.1.1
name: Ensure that the cluster-admin role is only used where required
description: The RBAC role cluster-admin provides wide-ranging powers over the environment and should be used only where and when needed
checks:
- id: AVD-KSV-0111
severity: HIGH
- id: 5.1.2
name: Minimize access to secrets
description: The Kubernetes API stores secrets, which may be service account tokens for the Kubernetes API or credentials used by workloads in the cluster
checks:
- id: AVD-KSV-0041
severity: HIGH
- id: 5.1.3
name: Minimize wildcard use in Roles and ClusterRoles
description: Kubernetes Roles and ClusterRoles provide access to resources based on sets of objects and actions that can be taken on those objects. It is possible to set either of these to be the wildcard "*" which matches all items
checks:
- id: AVD-KSV-0044
- id: AVD-KSV-0045
- id: AVD-KSV-0046
severity: HIGH
- id: 5.1.6
name: Ensure that Service Account Tokens are only mounted where necessary
description: Service accounts tokens should not be mounted in pods except where the workload running in the pod explicitly needs to communicate with the API server
checks:
- id: AVD-KSV-0036
severity: HIGH
- id: 5.1.8
name: Limit use of the Bind, Impersonate and Escalate permissions in the Kubernetes cluster
description: Cluster roles and roles with the impersonate, bind or escalate permissions should not be granted unless strictly required
checks:
- id: AVD-KSV-0043
severity: HIGH
- id: 5.2.2
name: Minimize the admission of privileged containers
description: Do not generally permit containers to be run with the securityContext.privileged flag set to true
checks:
- id: AVD-KSV-0017
severity: HIGH
- id: 5.2.3
name: Minimize the admission of containers wishing to share the host process ID namespace
description: Do not generally permit containers to be run with the hostPID flag set to true.
checks:
- id: AVD-KSV-0010
severity: HIGH
- id: 5.2.4
name: Minimize the admission of containers wishing to share the host IPC namespace
description: Do not generally permit containers to be run with the hostIPC flag set to true
checks:
- id: AVD-KSV-0008
severity: HIGH
- id: 5.2.5
name: Minimize the admission of containers wishing to share the host network namespace
description: Do not generally permit containers to be run with the hostNetwork flag set to true
checks:
- id: AVD-KSV-0009
severity: HIGH
- id: 5.2.6
name: Minimize the admission of containers with allowPrivilegeEscalation
description: Do not generally permit containers to be run with the allowPrivilegeEscalation flag set to true
checks:
- id: AVD-KSV-0001
severity: HIGH
- id: 5.2.7
name: Minimize the admission of root containers
description: Do not generally permit containers to be run as the root user
checks:
- id: AVD-KSV-0012
severity: MEDIUM
- id: 5.2.8
name: Minimize the admission of containers with the NET_RAW capability
description: Do not generally permit containers with the potentially dangerous NET_RAW capability
checks:
- id: AVD-KSV-0022
severity: MEDIUM
- id: 5.2.9
name: Minimize the admission of containers with added capabilities
description: Do not generally permit containers with capabilities assigned beyond the default set
checks:
- id: AVD-KSV-0004
severity: LOW
- id: 5.2.10
name: Minimize the admission of containers with capabilities assigned
description: Do not generally permit containers with capabilities
checks:
- id: AVD-KSV-0003
severity: LOW
- id: 5.2.11
name: Minimize the admission of containers with capabilities assigned
description: Do not generally permit containers with capabilities
checks:
- id: AVD-KSV-0103
severity: MEDIUM
- id: 5.2.12
name: Minimize the admission of HostPath volumes
description: Do not generally admit containers which make use of hostPath volumes
checks:
- id: AVD-KSV-0023
severity: MEDIUM
- id: 5.2.13
name: Minimize the admission of containers which use HostPorts
description: Do not generally permit containers which require the use of HostPorts
checks:
- id: AVD-KSV-0024
severity: MEDIUM
- id: 5.3.1
name: Ensure that the CNI in use supports Network Policies (Manual)
description: There are a variety of CNI plugins available for Kubernetes. If the CNI in use does not support Network Policies it may not be possible to effectively restrict traffic in the cluster
severity: MEDIUM
- id: 5.3.2
name: Ensure that all Namespaces have Network Policies defined
description: Use network policies to isolate traffic in your cluster network
checks:
- id: AVD-KSV-0038
severity: MEDIUM
- id: 5.4.1
name: Prefer using secrets as files over secrets as environment variables (Manual)
description: Kubernetes supports mounting secrets as data volumes or as environment variables. Minimize the use of environment variable secrets
severity: MEDIUM
- id: 5.4.2
name: Consider external secret storage (Manual)
description: Consider the use of an external secrets storage and management system, instead of using Kubernetes Secrets directly, if you have more complex secret management needs
severity: MEDIUM
- id: 5.5.1
name: Configure Image Provenance using ImagePolicyWebhook admission controller (Manual)
description: Configure Image Provenance for your deployment
severity: MEDIUM
- id: 5.7.1
name: Create administrative boundaries between resources using namespaces (Manual)
description: Use namespaces to isolate your Kubernetes objects
severity: MEDIUM
- id: 5.7.2
name: Ensure that the seccomp profile is set to docker/default in your pod definitions
description: Enable docker/default seccomp profile in your pod definitions
checks:
- id: AVD-KSV-0104
severity: MEDIUM
- id: 5.7.3
name: Apply Security Context to Your Pods and Containers
description: Apply Security Context to Your Pods and Containers
checks:
- id: AVD-KSV-0021
- id: AVD-KSV-0020
- id: AVD-KSV-0005
- id: AVD-KSV-0025
- id: AVD-KSV-0104
- id: AVD-KSV-0030
severity: HIGH
- id: 5.7.4
name: The default namespace should not be used
description: Kubernetes provides a default namespace, where objects are placed if no namespace is specified for them
checks:
- id: AVD-KSV-0110
severity: MEDIUM

186
clusters/cl01tl/manifests/trivy/ClusterComplianceReport-k8s-nsa-1.0.yaml Normal file
View File

@@ -0,0 +1,186 @@
---
# Source: trivy/charts/trivy-operator/templates/specs/k8s-nsa-1.0.yaml
apiVersion: aquasecurity.github.io/v1alpha1
kind: ClusterComplianceReport
metadata:
name: k8s-nsa-1.0
labels:
app.kubernetes.io/name: trivy-operator
app.kubernetes.io/instance: trivy-operator
app.kubernetes.io/version: 0.29.0
app.kubernetes.io/managed-by: kubectl
spec:
cron: "0 5 * * *"
reportType: "summary"
compliance:
id: k8s-nsa-1.0
platform: k8s
type: nsa
title: National Security Agency - Kubernetes Hardening Guidance v1.0
description: National Security Agency - Kubernetes Hardening Guidance
relatedResources:
- https://www.nsa.gov/Press-Room/News-Highlights/Article/Article/2716980/nsa-cisa-release-kubernetes-hardening-guidance/
version: "1.0"
controls:
- name: Non-root containers
description: Check that container is not running as root
id: "1.0"
checks:
- id: AVD-KSV-0012
severity: MEDIUM
- name: Immutable container file systems
description: Check that container root file system is immutable
id: "1.1"
checks:
- id: AVD-KSV-0014
severity: LOW
- name: Preventing privileged containers
description: Controls whether Pods can run privileged containers
id: "1.2"
checks:
- id: AVD-KSV-0017
severity: HIGH
- name: Share containers process namespaces
description: Controls whether containers can share process namespaces
id: "1.3"
checks:
- id: AVD-KSV-0008
severity: HIGH
- name: Share host process namespaces
description: Controls whether share host process namespaces
id: "1.4"
checks:
- id: AVD-KSV-0009
severity: HIGH
- name: Use the host network
description: Controls whether containers can use the host network
id: "1.5"
checks:
- id: AVD-KSV-0010
severity: HIGH
- name: Run with root privileges or with root group membership
description: Controls whether container applications can run with root privileges or with root group membership
id: "1.6"
checks:
- id: AVD-KSV-0029
severity: LOW
- name: Restricts escalation to root privileges
description: Control check restrictions escalation to root privileges
id: "1.7"
checks:
- id: AVD-KSV-0001
severity: MEDIUM
- name: Sets the SELinux context of the container
description: Control checks if pod sets the SELinux context of the container
id: "1.8"
checks:
- id: AVD-KSV-0002
severity: MEDIUM
- name: Restrict a container's access to resources with AppArmor
description: Control checks the restriction of containers access to resources with AppArmor
id: "1.9"
checks:
- id: AVD-KSV-0030
severity: MEDIUM
- name: Sets the seccomp profile used to sandbox containers.
description: Control checks the sets the seccomp profile used to sandbox containers
id: "1.10"
checks:
- id: AVD-KSV-0030
severity: LOW
- name: Protecting Pod service account tokens
description: "Control check whether disable secret token been mount ,automountServiceAccountToken: false"
id: "1.11"
checks:
- id: AVD-KSV-0036
severity: MEDIUM
- name: Namespace kube-system should not be used by users
description: Control check whether Namespace kube-system is not be used by users
id: "1.12"
defaultStatus: FAIL
checks:
- id: AVD-KSV-0037
severity: MEDIUM
- name: Pod and/or namespace Selectors usage
description: Control check validate the pod and/or namespace Selectors usage
id: "2.0"
defaultStatus: FAIL
checks:
- id: AVD-KSV-0038
severity: MEDIUM
- name: Use CNI plugin that supports NetworkPolicy API (Manual)
description: Control check whether check cni plugin installed
id: "3.0"
defaultStatus: FAIL
severity: CRITICAL
- name: Use ResourceQuota policies to limit resources
description: Control check the use of ResourceQuota policy to limit aggregate resource usage within namespace
id: "4.0"
defaultStatus: FAIL
checks:
- id: AVD-KSV-0040
severity: MEDIUM
- name: Use LimitRange policies to limit resources
description: Control check the use of LimitRange policy limit resource usage for namespaces or nodes
id: "4.1"
defaultStatus: FAIL
checks:
- id: AVD-KSV-0039
severity: MEDIUM
- name: Control plan disable insecure port (Manual)
description: Control check whether control plan disable insecure port
id: "5.0"
defaultStatus: FAIL
severity: CRITICAL
- name: Encrypt etcd communication
description: Control check whether etcd communication is encrypted
id: "5.1"
checks:
- id: AVD-KCV-0030
severity: CRITICAL
- name: Ensure kube config file permission (Manual)
description: Control check whether kube config file permissions
id: "6.0"
defaultStatus: FAIL
severity: CRITICAL
- name: Check that encryption resource has been set
description: Control checks whether encryption resource has been set
id: "6.1"
checks:
- id: AVD-KCV-0029
severity: CRITICAL
- name: Check encryption provider
description: Control checks whether encryption provider has been set
id: "6.2"
checks:
- id: AVD-KCV-0004
severity: CRITICAL
- name: Make sure anonymous-auth is unset
description: Control checks whether anonymous-auth is unset
id: "7.0"
checks:
- id: AVD-KCV-0001
severity: CRITICAL
- name: Make sure -authorization-mode=RBAC
description: Control check whether RBAC permission is in use
id: "7.1"
checks:
- id: AVD-KCV-0008
severity: CRITICAL
- name: Audit policy is configure (Manual)
description: Control check whether audit policy is configure
id: "8.0"
defaultStatus: FAIL
severity: HIGH
- name: Audit log path is configure
description: Control check whether audit log path is configure
id: "8.1"
checks:
- id: AVD-KCV-0019
severity: MEDIUM
- name: Audit log aging
description: Control check whether audit log aging is configure
id: "8.2"
checks:
- id: AVD-KCV-0020
severity: MEDIUM

90
clusters/cl01tl/manifests/trivy/ClusterComplianceReport-k8s-pss-baseline-0.1.yaml Normal file
View File

@@ -0,0 +1,90 @@
---
# Source: trivy/charts/trivy-operator/templates/specs/k8s-pss-baseline-0.1.yaml
apiVersion: aquasecurity.github.io/v1alpha1
kind: ClusterComplianceReport
metadata:
name: k8s-pss-baseline-0.1
labels:
app.kubernetes.io/name: trivy-operator
app.kubernetes.io/instance: trivy-operator
app.kubernetes.io/version: 0.29.0
app.kubernetes.io/managed-by: kubectl
spec:
cron: "0 5 * * *"
reportType: "summary"
compliance:
id: k8s-pss-baseline-0.1
platform: eks
type: pss-baseline
title: Kubernetes Pod Security Standards - Baseline
description: Kubernetes Pod Security Standards - Baseline
relatedResources:
- https://kubernetes.io/docs/concepts/security/pod-security-standards/#baseline
version: "0.1"
controls:
- name: HostProcess
description: Windows pods offer the ability to run HostProcess containers which enables privileged access to the Windows node. Privileged access to the host is disallowed in the baseline policy
id: "1"
checks:
- id: AVD-KSV-0103
severity: HIGH
- name: Host Namespaces
description: Sharing the host namespaces must be disallowed.
id: "2"
checks:
- id: AVD-KSV-0008
severity: HIGH
- name: Privileged Containers
description: Privileged Pods disable most security mechanisms and must be disallowed.
id: "3"
checks:
- id: AVD-KSV-0017
severity: HIGH
- name: Capabilities
description: Adding additional capabilities beyond those listed below must be disallowed.
id: "4"
checks:
- id: AVD-KSV-0022
severity: MEDIUM
- name: HostPath Volumes
description: HostPath volumes must be forbidden.
id: "5"
checks:
- id: AVD-KSV-0023
severity: MEDIUM
- name: host ports
description: hostports should be disallowed, or at minimum restricted to a known list.
id: "6"
checks:
- id: avd-ksv-0024
severity: HIGH
- name: AppArmor
description: On supported hosts, the runtime/default AppArmor profile is applied by default. The baseline policy should prevent overriding or disabling the default AppArmor profile, or restrict overrides to an allowed set of profiles.
id: "7"
checks:
- id: avd-ksv-0002
severity: HIGH
- name: SELinux
description: Setting the SELinux type is restricted, and setting a custom SELinux user or role option is forbidden.
id: "8"
checks:
- id: avd-ksv-0025
severity: MEDIUM
- name: /proc Mount Type
description: The default /proc masks are set up to reduce attack surface, and should be required.
id: "9"
checks:
- id: avd-ksv-0027
severity: MEDIUM
- name: Seccomp
description: Seccomp profile must not be explicitly set to Unconfined.
id: "10"
checks:
- id: avd-ksv-0104
severity: MEDIUM
- name: Sysctls
description: Sysctls can disable security mechanisms or affect all containers on a host, and should be disallowed except for an allowed 'safe' subset. A sysctl is considered safe if it is namespaced in the container or the Pod, and it is isolated from other Pods or processes on the same Node.
id: "11"
checks:
- id: avd-ksv-0026
severity: MEDIUM

126
clusters/cl01tl/manifests/trivy/ClusterComplianceReport-k8s-pss-restricted-0.1.yaml Normal file
View File

@@ -0,0 +1,126 @@
---
# Source: trivy/charts/trivy-operator/templates/specs/k8s-pss-restricted-0.1.yaml
apiVersion: aquasecurity.github.io/v1alpha1
kind: ClusterComplianceReport
metadata:
name: k8s-pss-restricted-0.1
labels:
app.kubernetes.io/name: trivy-operator
app.kubernetes.io/instance: trivy-operator
app.kubernetes.io/version: 0.29.0
app.kubernetes.io/managed-by: kubectl
spec:
cron: "0 5 * * *"
reportType: "summary"
compliance:
id: k8s-pss-restricted-0.1
platform: k8s
type: pss-restricted
title: Kubernetes Pod Security Standards - Restricted
description: Kubernetes Pod Security Standards - Restricted
relatedResources:
- https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
version: "0.1"
controls:
- name: HostProcess
description: Windows pods offer the ability to run HostProcess containers which enables privileged access to the Windows node. Privileged access to the host is disallowed in the baseline policy
id: "1"
checks:
- id: AVD-KSV-0103
severity: HIGH
- name: Host Namespaces
description: Sharing the host namespaces must be disallowed.
id: "2"
checks:
- id: AVD-KSV-0008
severity: HIGH
- name: Privileged Containers
description: Privileged Pods disable most security mechanisms and must be disallowed.
id: "3"
checks:
- id: AVD-KSV-0017
severity: HIGH
- name: Capabilities
description: Adding additional capabilities beyond those listed below must be disallowed.
id: "4"
checks:
- id: AVD-KSV-0022
severity: MEDIUM
- name: HostPath Volumes
description: HostPath volumes must be forbidden.
id: "5"
checks:
- id: AVD-KSV-0023
severity: MEDIUM
- name: host ports
description: hostports should be disallowed, or at minimum restricted to a known list.
id: "6"
checks:
- id: avd-ksv-0024
severity: HIGH
- name: AppArmor
description: On supported hosts, the runtime/default AppArmor profile is applied by default. The baseline policy should prevent overriding or disabling the default AppArmor profile, or restrict overrides to an allowed set of profiles.
id: "7"
checks:
- id: avd-ksv-0002
severity: HIGH
- name: SELinux
description: Setting the SELinux type is restricted, and setting a custom SELinux user or role option is forbidden.
id: "8"
checks:
- id: avd-ksv-0025
severity: MEDIUM
- name: /proc Mount Type
description: The default /proc masks are set up to reduce attack surface, and should be required.
id: "9"
checks:
- id: avd-ksv-0027
severity: MEDIUM
- name: Seccomp
description: Seccomp profile must not be explicitly set to Unconfined.
id: "10"
checks:
- id: avd-ksv-0104
severity: MEDIUM
- name: Sysctls
description: Sysctls can disable security mechanisms or affect all containers on a host, and should be disallowed except for an allowed 'safe' subset. A sysctl is considered safe if it is namespaced in the container or the Pod, and it is isolated from other Pods or processes on the same Node.
id: "11"
checks:
- id: avd-ksv-0026
severity: MEDIUM
- name: Volume Types
description: The restricted policy only permits specific volume types.
id: "12"
checks:
- id: avd-ksv-0028
severity: LOW
- name: Privilege Escalation
description: Privilege escalation (such as via set-user-ID or set-group-ID file mode) should not be allowed.
id: "13"
checks:
- id: avd-ksv-0001
severity: MEDIUM
- name: Running as Non-root
description: Containers must be required to run as non-root users.
id: "14"
checks:
- id: avd-ksv-0012
severity: MEDIUM
- name: Running as Non-root user
description: Containers must not set runAsUser to 0
id: "15"
checks:
- id: avd-ksv-0105
severity: LOW
- name: Seccomp
description: Seccomp profile must be explicitly set to one of the allowed values. Both the Unconfined profile and the absence of a profile are prohibited
id: "16"
checks:
- id: avd-ksv-0030
severity: LOW
- name: Capabilities
description: Containers must drop ALL capabilities, and are only permitted to add back the NET_BIND_SERVICE capability.
id: "17"
checks:
- id: avd-ksv-0106
severity: LOW

26
clusters/cl01tl/manifests/trivy/ClusterRole-aggregate-config-audit-reports-view.yaml Normal file
View File

@@ -0,0 +1,26 @@
---
# Source: trivy/charts/trivy-operator/templates/rbac/view-configauditreports-clusterrole.yaml
# permissions for end users to view configauditreports
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: aggregate-config-audit-reports-view
labels:
helm.sh/chart: trivy-operator-0.31.0
app.kubernetes.io/name: trivy-operator
app.kubernetes.io/instance: trivy
app.kubernetes.io/version: "0.29.0"
app.kubernetes.io/managed-by: Helm
rbac.authorization.k8s.io/aggregate-to-view: "true"
rbac.authorization.k8s.io/aggregate-to-edit: "true"
rbac.authorization.k8s.io/aggregate-to-admin: "true"
rbac.authorization.k8s.io/aggregate-to-cluster-reader: "true"
rules:
- apiGroups:
- aquasecurity.github.io
resources:
- configauditreports
verbs:
- get
- list
- watch

26
clusters/cl01tl/manifests/trivy/ClusterRole-aggregate-exposed-secret-reports-view.yaml Normal file
View File

@@ -0,0 +1,26 @@
---
# Source: trivy/charts/trivy-operator/templates/rbac/view-exposedsecretreports-clusterrole.yaml
# permissions for end users to view exposedsecretreports
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: aggregate-exposed-secret-reports-view
labels:
helm.sh/chart: trivy-operator-0.31.0
app.kubernetes.io/name: trivy-operator
app.kubernetes.io/instance: trivy
app.kubernetes.io/version: "0.29.0"
app.kubernetes.io/managed-by: Helm
rbac.authorization.k8s.io/aggregate-to-view: "true"
rbac.authorization.k8s.io/aggregate-to-edit: "true"
rbac.authorization.k8s.io/aggregate-to-admin: "true"
rbac.authorization.k8s.io/aggregate-to-cluster-reader: "true"
rules:
- apiGroups:
- aquasecurity.github.io
resources:
- exposedsecretreports
verbs:
- get
- list
- watch

26
clusters/cl01tl/manifests/trivy/ClusterRole-aggregate-vulnerability-reports-view.yaml Normal file
View File

@@ -0,0 +1,26 @@
---
# Source: trivy/charts/trivy-operator/templates/rbac/view-vulnerabilityreports-clusterrole.yaml
# permissions for end users to view vulnerabilityreports
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: aggregate-vulnerability-reports-view
labels:
helm.sh/chart: trivy-operator-0.31.0
app.kubernetes.io/name: trivy-operator
app.kubernetes.io/instance: trivy
app.kubernetes.io/version: "0.29.0"
app.kubernetes.io/managed-by: Helm
rbac.authorization.k8s.io/aggregate-to-view: "true"
rbac.authorization.k8s.io/aggregate-to-edit: "true"
rbac.authorization.k8s.io/aggregate-to-admin: "true"
rbac.authorization.k8s.io/aggregate-to-cluster-reader: "true"
rules:
- apiGroups:
- aquasecurity.github.io
resources:
- vulnerabilityreports
verbs:
- get
- list
- watch

374
clusters/cl01tl/manifests/trivy/ClusterRole-trivy-operator.yaml Normal file
View File

@@ -0,0 +1,374 @@
---
# Source: trivy/charts/trivy-operator/templates/rbac/clusterrole.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: trivy-operator
rules:
- apiGroups:
- ""
resources:
- configmaps
verbs:
- get
- list
- watch
- apiGroups:
- ""
resources:
- limitranges
verbs:
- get
- list
- watch
- apiGroups:
- ""
resources:
- namespaces
verbs:
- get
- apiGroups:
- ""
resources:
- nodes
verbs:
- get
- list
- watch
- apiGroups:
- ""
resources:
- pods
verbs:
- get
- list
- watch
- apiGroups:
- ""
resources:
- pods/log
verbs:
- get
- list
- apiGroups:
- ""
resources:
- replicationcontrollers
verbs:
- get
- list
- watch
- apiGroups:
- ""
resources:
- resourcequotas
verbs:
- get
- list
- watch
- apiGroups:
- ""
resources:
- services
verbs:
- get
- list
- watch
- apiGroups:
- apiextensions.k8s.io
resources:
- customresourcedefinitions
verbs:
- get
- list
- watch
- apiGroups:
- apps
resources:
- daemonsets
verbs:
- get
- list
- watch
- apiGroups:
- apps
resources:
- deployments
verbs:
- get
- list
- watch
- apiGroups:
- apps
resources:
- replicasets
verbs:
- get
- list
- watch
- apiGroups:
- apps
resources:
- statefulsets
verbs:
- get
- list
- watch
- apiGroups:
- apps.openshift.io
resources:
- deploymentconfigs
verbs:
- get
- list
- watch
- apiGroups:
- aquasecurity.github.io
resources:
- clustercompliancedetailreports
verbs:
- create
- delete
- get
- list
- patch
- update
- watch
- apiGroups:
- aquasecurity.github.io
resources:
- clustercompliancereports
verbs:
- create
- delete
- get
- list
- patch
- update
- watch
- apiGroups:
- aquasecurity.github.io
resources:
- clustercompliancereports/status
verbs:
- get
- patch
- update
- apiGroups:
- aquasecurity.github.io
resources:
- clusterconfigauditreports
verbs:
- create
- delete
- get
- list
- patch
- update
- watch
- apiGroups:
- aquasecurity.github.io
resources:
- clusterinfraassessmentreports
verbs:
- create
- delete
- get
- list
- patch
- update
- watch
- apiGroups:
- aquasecurity.github.io
resources:
- clusterrbacassessmentreports
verbs:
- create
- delete
- get
- list
- patch
- update
- watch
- apiGroups:
- aquasecurity.github.io
resources:
- clustersbomreports
verbs:
- create
- delete
- get
- list
- patch
- update
- watch
- apiGroups:
- aquasecurity.github.io
resources:
- clustervulnerabilityreports
verbs:
- create
- delete
- get
- list
- patch
- update
- watch
- apiGroups:
- aquasecurity.github.io
resources:
- configauditreports
verbs:
- create
- delete
- get
- list
- patch
- update
- watch
- apiGroups:
- aquasecurity.github.io
resources:
- exposedsecretreports
verbs:
- create
- delete
- get
- list
- patch
- update
- watch
- apiGroups:
- aquasecurity.github.io
resources:
- infraassessmentreports
verbs:
- create
- delete
- get
- list
- patch
- update
- watch
- apiGroups:
- aquasecurity.github.io
resources:
- rbacassessmentreports
verbs:
- create
- delete
- get
- list
- patch
- update
- watch
- apiGroups:
- aquasecurity.github.io
resources:
- sbomreports
verbs:
- create
- delete
- get
- list
- patch
- update
- watch
- apiGroups:
- aquasecurity.github.io
resources:
- vulnerabilityreports
verbs:
- create
- delete
- get
- list
- patch
- update
- watch
- apiGroups:
- batch
resources:
- cronjobs
verbs:
- get
- list
- watch
- apiGroups:
- batch
resources:
- jobs
verbs:
- create
- delete
- get
- list
- watch
- apiGroups:
- networking.k8s.io
resources:
- ingresses
verbs:
- get
- list
- watch
- apiGroups:
- networking.k8s.io
resources:
- networkpolicies
verbs:
- get
- list
- watch
- apiGroups:
- rbac.authorization.k8s.io
resources:
- clusterrolebindings
verbs:
- get
- list
- watch
- apiGroups:
- rbac.authorization.k8s.io
resources:
- clusterroles
verbs:
- get
- list
- watch
- apiGroups:
- rbac.authorization.k8s.io
resources:
- rolebindings
verbs:
- get
- list
- watch
- apiGroups:
- rbac.authorization.k8s.io
resources:
- roles
verbs:
- get
- list
- watch
- apiGroups:
- ""
resources:
- secrets
verbs:
- create
- get
- update
- apiGroups:
- ""
resources:
- serviceaccounts
verbs:
- get
- apiGroups:
- ""
resources:
- nodes/proxy
verbs:
- get

20
clusters/cl01tl/manifests/trivy/ClusterRoleBinding-trivy-trivy-operator.yaml Normal file
View File

@@ -0,0 +1,20 @@
---
# Source: trivy/charts/trivy-operator/templates/rbac/clusterrolebinding.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: trivy-trivy-operator
labels:
helm.sh/chart: trivy-operator-0.31.0
app.kubernetes.io/name: trivy-operator
app.kubernetes.io/instance: trivy
app.kubernetes.io/version: "0.29.0"
app.kubernetes.io/managed-by: Helm
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: trivy-operator
subjects:
- kind: ServiceAccount
name: trivy-trivy-operator
namespace: trivy

55
clusters/cl01tl/manifests/trivy/ConfigMap-trivy-operator-config.yaml Normal file
View File

@@ -0,0 +1,55 @@
---
# Source: trivy/charts/trivy-operator/templates/configmaps/trivy-operator-config.yaml
kind: ConfigMap
apiVersion: v1
metadata:
name: trivy-operator-config
namespace: trivy
labels:
helm.sh/chart: trivy-operator-0.31.0
app.kubernetes.io/name: trivy-operator
app.kubernetes.io/instance: trivy
app.kubernetes.io/version: "0.29.0"
app.kubernetes.io/managed-by: Helm
data:
OPERATOR_LOG_DEV_MODE: "false"
OPERATOR_SCAN_JOB_TTL: ""
OPERATOR_SCAN_JOB_TIMEOUT: "5m"
OPERATOR_CONCURRENT_SCAN_JOBS_LIMIT: "10"
OPERATOR_CONCURRENT_NODE_COLLECTOR_LIMIT: "1"
OPERATOR_SCAN_JOB_RETRY_AFTER: "30s"
OPERATOR_BATCH_DELETE_LIMIT: "10"
OPERATOR_BATCH_DELETE_DELAY: "10s"
OPERATOR_METRICS_BIND_ADDRESS: ":8080"
OPERATOR_METRICS_FINDINGS_ENABLED: "true"
OPERATOR_METRICS_VULN_ID_ENABLED: "false"
OPERATOR_HEALTH_PROBE_BIND_ADDRESS: ":9090"
OPERATOR_PPROF_BIND_ADDRESS: ""
OPERATOR_VULNERABILITY_SCANNER_ENABLED: "false"
OPERATOR_SBOM_GENERATION_ENABLED: "false"
OPERATOR_CLUSTER_SBOM_CACHE_ENABLED: "false"
OPERATOR_VULNERABILITY_SCANNER_SCAN_ONLY_CURRENT_REVISIONS: "true"
OPERATOR_SCANNER_REPORT_TTL: "24h"
OPERATOR_CACHE_REPORT_TTL: "120h"
CONTROLLER_CACHE_SYNC_TIMEOUT: "5m"
OPERATOR_CONFIG_AUDIT_SCANNER_ENABLED: "true"
OPERATOR_RBAC_ASSESSMENT_SCANNER_ENABLED: "true"
OPERATOR_INFRA_ASSESSMENT_SCANNER_ENABLED: "false"
OPERATOR_CONFIG_AUDIT_SCANNER_SCAN_ONLY_CURRENT_REVISIONS: "true"
OPERATOR_EXPOSED_SECRET_SCANNER_ENABLED: "true"
OPERATOR_METRICS_EXPOSED_SECRET_INFO_ENABLED: "false"
OPERATOR_METRICS_CONFIG_AUDIT_INFO_ENABLED: "false"
OPERATOR_METRICS_RBAC_ASSESSMENT_INFO_ENABLED: "false"
OPERATOR_METRICS_INFRA_ASSESSMENT_INFO_ENABLED: "false"
OPERATOR_METRICS_IMAGE_INFO_ENABLED: "false"
OPERATOR_METRICS_CLUSTER_COMPLIANCE_INFO_ENABLED: "false"
OPERATOR_WEBHOOK_BROADCAST_URL: ""
OPERATOR_WEBHOOK_BROADCAST_TIMEOUT: "30s"
OPERATOR_WEBHOOK_BROADCAST_CUSTOM_HEADERS: ""
OPERATOR_SEND_DELETED_REPORTS: "false"
OPERATOR_PRIVATE_REGISTRY_SCAN_SECRETS_NAMES: "{}"
OPERATOR_ACCESS_GLOBAL_SECRETS_SERVICE_ACCOUNTS: "true"
OPERATOR_BUILT_IN_TRIVY_SERVER: "false"
TRIVY_SERVER_HEALTH_CHECK_CACHE_EXPIRATION: "10h"
OPERATOR_MERGE_RBAC_FINDING_WITH_CONFIG_AUDIT: "false"
OPERATOR_CLUSTER_COMPLIANCE_ENABLED: "false"

44
clusters/cl01tl/manifests/trivy/ConfigMap-trivy-operator-trivy-config.yaml Normal file
View File

@@ -0,0 +1,44 @@
---
# Source: trivy/charts/trivy-operator/templates/configmaps/trivy.yaml
apiVersion: v1
kind: ConfigMap
metadata:
name: trivy-operator-trivy-config
namespace: trivy
labels:
helm.sh/chart: trivy-operator-0.31.0
app.kubernetes.io/name: trivy-operator
app.kubernetes.io/instance: trivy
app.kubernetes.io/version: "0.29.0"
app.kubernetes.io/managed-by: Helm
data:
trivy.repository: "mirror.gcr.io/aquasec/trivy"
trivy.tag: "0.68.1"
trivy.imagePullPolicy: "IfNotPresent"
trivy.additionalVulnerabilityReportFields: ""
trivy.registry.mirror.gcr.io: "proxy-gcr.io"
trivy.registry.mirror.ghcr.io: "proxy-ghcr.io"
trivy.registry.mirror.hub.docker: "proxy-hub.docker"
trivy.registry.mirror.quay.io: "proxy-quay.io"
trivy.registry.mirror.registry-1.docker.io: "proxy-registry-1.docker.io"
trivy.registry.mirror.registry.k8s.io: "proxy-registry.k8s"
trivy.severity: "UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL"
trivy.slow: "true"
trivy.skipJavaDBUpdate: "false"
trivy.includeDevDeps: "false"
trivy.imageScanCacheDir: "/tmp/trivy/.cache"
trivy.filesystemScanCacheDir: "/var/trivyoperator/trivy-db"
trivy.dbRepository: "mirror.gcr.io/aquasec/trivy-db"
trivy.javaDbRepository: "mirror.gcr.io/aquasec/trivy-java-db"
trivy.command: "image"
trivy.sbomSources: ""
trivy.dbRepositoryInsecure: "false"
trivy.useBuiltinRegoPolicies: "false"
trivy.useEmbeddedRegoPolicies: "true"
trivy.supportedConfigAuditKinds: "Workload,Service,Role,ClusterRole,NetworkPolicy,Ingress,LimitRange,ResourceQuota"
trivy.timeout: "5m0s"
trivy.mode: "Standalone"
trivy.resources.requests.cpu: "100m"
trivy.resources.requests.memory: "128M"
trivy.resources.limits.cpu: "500m"
trivy.resources.limits.memory: "500M"

28
clusters/cl01tl/manifests/trivy/ConfigMap-trivy-operator.yaml Normal file
View File

@@ -0,0 +1,28 @@
---
# Source: trivy/charts/trivy-operator/templates/configmaps/operator.yaml
apiVersion: v1
kind: ConfigMap
metadata:
name: trivy-operator
namespace: trivy
labels:
helm.sh/chart: trivy-operator-0.31.0
app.kubernetes.io/name: trivy-operator
app.kubernetes.io/instance: trivy
app.kubernetes.io/version: "0.29.0"
app.kubernetes.io/managed-by: Helm
data:
nodeCollector.tolerations: "[{\"effect\":\"NoSchedule\",\"key\":\"node-role.kubernetes.io/control-plane\",\"operator\":\"Exists\"}]"
nodeCollector.volumes: "[{\"hostPath\":{\"path\":\"/var/lib/etcd\"},\"name\":\"var-lib-etcd\"},{\"hostPath\":{\"path\":\"/var/lib/kubelet\"},\"name\":\"var-lib-kubelet\"},{\"hostPath\":{\"path\":\"/var/lib/kube-scheduler\"},\"name\":\"var-lib-kube-scheduler\"},{\"hostPath\":{\"path\":\"/var/lib/kube-controller-manager\"},\"name\":\"var-lib-kube-controller-manager\"},{\"hostPath\":{\"path\":\"/etc/kubernetes\"},\"name\":\"etc-kubernetes\"},{\"hostPath\":{\"path\":\"/etc/cni/net.d/\"},\"name\":\"etc-cni-netd\"}]"
nodeCollector.volumeMounts: "[{\"mountPath\":\"/var/lib/etcd\",\"name\":\"var-lib-etcd\",\"readOnly\":true},{\"mountPath\":\"/var/lib/kubelet\",\"name\":\"var-lib-kubelet\",\"readOnly\":true},{\"mountPath\":\"/var/lib/kube-scheduler\",\"name\":\"var-lib-kube-scheduler\",\"readOnly\":true},{\"mountPath\":\"/var/lib/kube-controller-manager\",\"name\":\"var-lib-kube-controller-manager\",\"readOnly\":true},{\"mountPath\":\"/etc/kubernetes\",\"name\":\"etc-kubernetes\",\"readOnly\":true},{\"mountPath\":\"/etc/cni/net.d/\",\"name\":\"etc-cni-netd\",\"readOnly\":true}]"
scanJob.useGCRServiceAccount: "true"
scanJob.podTemplateContainerSecurityContext: "{\"allowPrivilegeEscalation\":false,\"capabilities\":{\"drop\":[\"ALL\"]},\"privileged\":false,\"readOnlyRootFilesystem\":true}"
scanJob.compressLogs: "true"
vulnerabilityReports.scanner: "Trivy"
vulnerabilityReports.scanJobsInSameNamespace: "false"
configAuditReports.scanner: "Trivy"
report.recordFailedChecksOnly: "true"
node.collector.imageRef: "ghcr.io/aquasecurity/node-collector:0.3.1"
policies.bundle.oci.ref: "mirror.gcr.io/aquasec/trivy-checks:1"
policies.bundle.insecure: "false"
node.collector.nodeSelector: "true"

267
clusters/cl01tl/manifests/trivy/CustomResourceDefinition-clustercompliancereports.aquasecurity.github.io.yaml Normal file
View File

@@ -0,0 +1,267 @@
---
# Source: trivy/charts/trivy-operator/crds/aquasecurity.github.io_clustercompliancereports.yaml
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
controller-gen.kubebuilder.io/version: v0.14.0
name: clustercompliancereports.aquasecurity.github.io
spec:
group: aquasecurity.github.io
names:
kind: ClusterComplianceReport
listKind: ClusterComplianceReportList
plural: clustercompliancereports
shortNames:
- compliance
singular: clustercompliancereport
scope: Cluster
versions:
- additionalPrinterColumns:
- description: The age of the report
jsonPath: .metadata.creationTimestamp
name: Age
type: date
- description: The number of checks that failed
jsonPath: .status.summary.failCount
name: Fail
priority: 1
type: integer
- description: The number of checks that passed
jsonPath: .status.summary.passCount
name: Pass
priority: 1
type: integer
name: v1alpha1
schema:
openAPIV3Schema:
description: ClusterComplianceReport is a specification for the ClusterComplianceReport resource.
properties:
apiVersion:
description: |-
APIVersion defines the versioned schema of this representation of an object.
Servers should convert recognized schemas to the latest internal value, and
may reject unrecognized values.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
type: string
kind:
description: |-
Kind is a string value representing the REST resource this object represents.
Servers may infer this from the endpoint the client submits requests to.
Cannot be updated.
In CamelCase.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
type: string
metadata:
type: object
spec:
description: ReportSpec represent the compliance specification
properties:
compliance:
properties:
controls:
description: Control represent the cps controls data and mapping checks
items:
description: Control represent the cps controls data and mapping checks
properties:
checks:
items:
description: SpecCheck represent the scanner who perform the control check
properties:
id:
description: id define the check id as produced by scanner
type: string
required:
- id
type: object
type: array
commands:
items:
description: Commands represent the commands to be executed by the node-collector
properties:
id:
description: id define the commands id
type: string
required:
- id
type: object
type: array
defaultStatus:
description: define the default value for check status in case resource not found
enum:
- PASS
- WARN
- FAIL
type: string
description:
type: string
id:
description: id define the control check id
type: string
name:
type: string
severity:
description: define the severity of the control
enum:
- CRITICAL
- HIGH
- MEDIUM
- LOW
- UNKNOWN
type: string
required:
- id
- name
- severity
type: object
type: array
description:
type: string
id:
type: string
platform:
type: string
relatedResources:
items:
type: string
type: array
title:
type: string
type:
type: string
version:
type: string
required:
- controls
- description
- id
- platform
- relatedResources
- title
- type
- version
type: object
cron:
description: cron define the intervals for report generation
pattern: ^(((([\*]{1}){1})|((\*\/){0,1}(([0-9]{1}){1}|(([1-5]{1}){1}([0-9]{1}){1}){1}))) ((([\*]{1}){1})|((\*\/){0,1}(([0-9]{1}){1}|(([1]{1}){1}([0-9]{1}){1}){1}|([2]{1}){1}([0-3]{1}){1}))) ((([\*]{1}){1})|((\*\/){0,1}(([1-9]{1}){1}|(([1-2]{1}){1}([0-9]{1}){1}){1}|([3]{1}){1}([0-1]{1}){1}))) ((([\*]{1}){1})|((\*\/){0,1}(([1-9]{1}){1}|(([1-2]{1}){1}([0-9]{1}){1}){1}|([3]{1}){1}([0-1]{1}){1}))|(jan|feb|mar|apr|may|jun|jul|aug|sep|okt|nov|dec)) ((([\*]{1}){1})|((\*\/){0,1}(([0-7]{1}){1}))|(sun|mon|tue|wed|thu|fri|sat)))$
type: string
reportType:
enum:
- summary
- all
type: string
required:
- compliance
- cron
- reportType
type: object
status:
properties:
detailReport:
description: ComplianceReport represents a kubernetes scan report
properties:
description:
type: string
id:
type: string
relatedVersion:
items:
type: string
type: array
results:
items:
properties:
checks:
items:
description: ComplianceCheck provides the result of conducting a single compliance step.
properties:
category:
type: string
checkID:
type: string
description:
type: string
messages:
items:
type: string
type: array
remediation:
description: Remediation provides description or links to external resources to remediate failing check.
type: string
severity:
description: Severity level of a vulnerability or a configuration audit check.
type: string
success:
type: boolean
target:
type: string
title:
type: string
required:
- checkID
- severity
- success
type: object
type: array
description:
type: string
id:
type: string
name:
type: string
severity:
type: string
status:
type: string
required:
- checks
type: object
type: array
title:
type: string
version:
type: string
type: object
x-kubernetes-preserve-unknown-fields: true
summary:
properties:
failCount:
type: integer
passCount:
type: integer
type: object
summaryReport:
description: SummaryReport represents a kubernetes scan report with consolidated findings
properties:
controlCheck:
items:
properties:
id:
type: string
name:
type: string
severity:
type: string
totalFail:
type: integer
type: object
type: array
id:
type: string
title:
type: string
type: object
x-kubernetes-preserve-unknown-fields: true
updateTimestamp:
format: date-time
type: string
required:
- updateTimestamp
type: object
type: object
x-kubernetes-preserve-unknown-fields: true
served: true
storage: true
subresources:
status: {}

166
clusters/cl01tl/manifests/trivy/CustomResourceDefinition-clusterconfigauditreports.aquasecurity.github.io.yaml Normal file
View File

@@ -0,0 +1,166 @@
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
controller-gen.kubebuilder.io/version: v0.14.0
name: clusterconfigauditreports.aquasecurity.github.io
spec:
group: aquasecurity.github.io
names:
kind: ClusterConfigAuditReport
listKind: ClusterConfigAuditReportList
plural: clusterconfigauditreports
shortNames:
- clusterconfigaudit
singular: clusterconfigauditreport
scope: Cluster
versions:
- additionalPrinterColumns:
- description: The name of the config audit scanner
jsonPath: .report.scanner.name
name: Scanner
type: string
- description: The age of the report
jsonPath: .metadata.creationTimestamp
name: Age
type: date
- description: The number of failed checks with critical severity
jsonPath: .report.summary.criticalCount
name: Critical
priority: 1
type: integer
- description: The number of failed checks with high severity
jsonPath: .report.summary.highCount
name: High
priority: 1
type: integer
- description: The number of failed checks with medium severity
jsonPath: .report.summary.mediumCount
name: Medium
priority: 1
type: integer
- description: The number of failed checks with low severity
jsonPath: .report.summary.lowCount
name: Low
priority: 1
type: integer
name: v1alpha1
schema:
openAPIV3Schema:
description: ClusterConfigAuditReport is a specification for the ClusterConfigAuditReport resource.
properties:
apiVersion:
description: |-
APIVersion defines the versioned schema of this representation of an object.
Servers should convert recognized schemas to the latest internal value, and
may reject unrecognized values.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
type: string
kind:
description: |-
Kind is a string value representing the REST resource this object represents.
Servers may infer this from the endpoint the client submits requests to.
Cannot be updated.
In CamelCase.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
type: string
metadata:
type: object
report:
properties:
checks:
description: Checks provides results of conducting audit steps.
items:
description: Check provides the result of conducting a single audit step.
properties:
category:
type: string
checkID:
type: string
description:
type: string
messages:
items:
type: string
type: array
remediation:
description: Remediation provides description or links to external resources to remediate failing check.
type: string
scope:
description: Scope indicates the section of config that was audited.
properties:
type:
description: Type indicates type of this scope, e.g. Container, ConfigMapKey or JSONPath.
type: string
value:
description: Value indicates value of this scope that depends on Type, e.g. container name, ConfigMap key or JSONPath expression
type: string
required:
- type
- value
type: object
severity:
description: Severity level of a vulnerability or a configuration audit check.
type: string
success:
type: boolean
title:
type: string
required:
- checkID
- severity
- success
type: object
type: array
scanner:
description: Scanner is the spec for a scanner generating a security assessment report.
properties:
name:
description: Name the name of the scanner.
type: string
vendor:
description: Vendor the name of the vendor providing the scanner.
type: string
version:
description: Version the version of the scanner.
type: string
required:
- name
- vendor
- version
type: object
summary:
description: ConfigAuditSummary counts failed checks by severity.
properties:
criticalCount:
description: CriticalCount is the number of failed checks with critical severity.
type: integer
highCount:
description: HighCount is the number of failed checks with high severity.
type: integer
lowCount:
description: LowCount is the number of failed check with low severity.
type: integer
mediumCount:
description: MediumCount is the number of failed checks with medium severity.
type: integer
required:
- criticalCount
- highCount
- lowCount
- mediumCount
type: object
updateTimestamp:
format: date-time
type: string
required:
- checks
type: object
required:
- report
type: object
x-kubernetes-preserve-unknown-fields: true
served: true
storage: true
subresources: {}

165
clusters/cl01tl/manifests/trivy/CustomResourceDefinition-clusterinfraassessmentreports.aquasecurity.github.io.yaml Normal file
View File

@@ -0,0 +1,165 @@
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
controller-gen.kubebuilder.io/version: v0.14.0
name: clusterinfraassessmentreports.aquasecurity.github.io
spec:
group: aquasecurity.github.io
names:
kind: ClusterInfraAssessmentReport
listKind: ClusterInfraAssessmentReportList
plural: clusterinfraassessmentreports
shortNames:
- clusterinfraassessment
singular: clusterinfraassessmentreport
scope: Cluster
versions:
- additionalPrinterColumns:
- description: The name of the infra assessement scanner
jsonPath: .report.scanner.name
name: Scanner
type: string
- description: The age of the report
jsonPath: .metadata.creationTimestamp
name: Age
type: date
- description: The number of failed checks with critical severity
jsonPath: .report.summary.criticalCount
name: Critical
priority: 1
type: integer
- description: The number of failed checks with high severity
jsonPath: .report.summary.highCount
name: High
priority: 1
type: integer
- description: The number of failed checks with medium severity
jsonPath: .report.summary.mediumCount
name: Medium
priority: 1
type: integer
- description: The number of failed checks with low severity
jsonPath: .report.summary.lowCount
name: Low
priority: 1
type: integer
name: v1alpha1
schema:
openAPIV3Schema:
description: ClusterInfraAssessmentReport is a specification for the ClusterInfraAssessmentReport resource.
properties:
apiVersion:
description: |-
APIVersion defines the versioned schema of this representation of an object.
Servers should convert recognized schemas to the latest internal value, and
may reject unrecognized values.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
type: string
kind:
description: |-
Kind is a string value representing the REST resource this object represents.
Servers may infer this from the endpoint the client submits requests to.
Cannot be updated.
In CamelCase.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
type: string
metadata:
type: object
report:
properties:
checks:
description: Checks provides results of conducting audit steps.
items:
description: Check provides the result of conducting a single audit step.
properties:
category:
type: string
checkID:
type: string
description:
type: string
messages:
items:
type: string
type: array
remediation:
description: Remediation provides description or links to external resources to remediate failing check.
type: string
scope:
description: Scope indicates the section of config that was audited.
properties:
type:
description: Type indicates type of this scope, e.g. Container, ConfigMapKey or JSONPath.
type: string
value:
description: Value indicates value of this scope that depends on Type, e.g. container name, ConfigMap key or JSONPath expression
type: string
required:
- type
- value
type: object
severity:
description: Severity level of a vulnerability or a configuration audit check.
type: string
success:
type: boolean
title:
type: string
required:
- checkID
- severity
- success
type: object
type: array
scanner:
description: Scanner is the spec for a scanner generating a security assessment report.
properties:
name:
description: Name the name of the scanner.
type: string
vendor:
description: Vendor the name of the vendor providing the scanner.
type: string
version:
description: Version the version of the scanner.
type: string
required:
- name
- vendor
- version
type: object
summary:
description: InfraAssessmentSummary counts failed checks by severity.
properties:
criticalCount:
description: CriticalCount is the number of failed checks with critical severity.
type: integer
highCount:
description: HighCount is the number of failed checks with high severity.
type: integer
lowCount:
description: LowCount is the number of failed check with low severity.
type: integer
mediumCount:
description: MediumCount is the number of failed checks with medium severity.
type: integer
required:
- criticalCount
- highCount
- lowCount
- mediumCount
type: object
required:
- checks
- scanner
- summary
type: object
required:
- report
type: object
x-kubernetes-preserve-unknown-fields: true
served: true
storage: true
subresources: {}

165
clusters/cl01tl/manifests/trivy/CustomResourceDefinition-clusterrbacassessmentreports.aquasecurity.github.io.yaml Normal file
View File

@@ -0,0 +1,165 @@
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
controller-gen.kubebuilder.io/version: v0.14.0
name: clusterrbacassessmentreports.aquasecurity.github.io
spec:
group: aquasecurity.github.io
names:
kind: ClusterRbacAssessmentReport
listKind: ClusterRbacAssessmentReportList
plural: clusterrbacassessmentreports
shortNames:
- clusterrbacassessmentreport
singular: clusterrbacassessmentreport
scope: Cluster
versions:
- additionalPrinterColumns:
- description: The name of the rbac assessment scanner
jsonPath: .report.scanner.name
name: Scanner
type: string
- description: The age of the report
jsonPath: .metadata.creationTimestamp
name: Age
type: date
- description: The number of failed checks with critical severity
jsonPath: .report.summary.criticalCount
name: Critical
priority: 1
type: integer
- description: The number of failed checks with high severity
jsonPath: .report.summary.highCount
name: High
priority: 1
type: integer
- description: The number of failed checks with medium severity
jsonPath: .report.summary.mediumCount
name: Medium
priority: 1
type: integer
- description: The number of failed checks with low severity
jsonPath: .report.summary.lowCount
name: Low
priority: 1
type: integer
name: v1alpha1
schema:
openAPIV3Schema:
description: ClusterRbacAssessmentReport is a specification for the ClusterRbacAssessmentReport resource.
properties:
apiVersion:
description: |-
APIVersion defines the versioned schema of this representation of an object.
Servers should convert recognized schemas to the latest internal value, and
may reject unrecognized values.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
type: string
kind:
description: |-
Kind is a string value representing the REST resource this object represents.
Servers may infer this from the endpoint the client submits requests to.
Cannot be updated.
In CamelCase.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
type: string
metadata:
type: object
report:
properties:
checks:
description: Checks provides results of conducting audit steps.
items:
description: Check provides the result of conducting a single audit step.
properties:
category:
type: string
checkID:
type: string
description:
type: string
messages:
items:
type: string
type: array
remediation:
description: Remediation provides description or links to external resources to remediate failing check.
type: string
scope:
description: Scope indicates the section of config that was audited.
properties:
type:
description: Type indicates type of this scope, e.g. Container, ConfigMapKey or JSONPath.
type: string
value:
description: Value indicates value of this scope that depends on Type, e.g. container name, ConfigMap key or JSONPath expression
type: string
required:
- type
- value
type: object
severity:
description: Severity level of a vulnerability or a configuration audit check.
type: string
success:
type: boolean
title:
type: string
required:
- checkID
- severity
- success
type: object
type: array
scanner:
description: Scanner is the spec for a scanner generating a security assessment report.
properties:
name:
description: Name the name of the scanner.
type: string
vendor:
description: Vendor the name of the vendor providing the scanner.
type: string
version:
description: Version the version of the scanner.
type: string
required:
- name
- vendor
- version
type: object
summary:
description: RbacAssessmentSummary counts failed checks by severity.
properties:
criticalCount:
description: CriticalCount is the number of failed checks with critical severity.
type: integer
highCount:
description: HighCount is the number of failed checks with high severity.
type: integer
lowCount:
description: LowCount is the number of failed check with low severity.
type: integer
mediumCount:
description: MediumCount is the number of failed checks with medium severity.
type: integer
required:
- criticalCount
- highCount
- lowCount
- mediumCount
type: object
required:
- checks
- scanner
- summary
type: object
required:
- report
type: object
x-kubernetes-preserve-unknown-fields: true
served: true
storage: true
subresources: {}

389
clusters/cl01tl/manifests/trivy/CustomResourceDefinition-clustersbomreports.aquasecurity.github.io.yaml Normal file
View File

@@ -0,0 +1,389 @@
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
controller-gen.kubebuilder.io/version: v0.14.0
name: clustersbomreports.aquasecurity.github.io
spec:
group: aquasecurity.github.io
names:
kind: ClusterSbomReport
listKind: ClusterSbomReportList
plural: clustersbomreports
shortNames:
- clustersbom
singular: clustersbomreport
scope: Cluster
versions:
- additionalPrinterColumns:
- description: The name of image repository
jsonPath: .report.artifact.repository
name: Repository
type: string
- description: The name of image tag
jsonPath: .report.artifact.tag
name: Tag
type: string
- description: The name of the sbom generation scanner
jsonPath: .report.scanner.name
name: Scanner
type: string
- description: The age of the report
jsonPath: .metadata.creationTimestamp
name: Age
type: date
- description: The number of dependencies in bom
jsonPath: .report.summary.componentsCount
name: Components
priority: 1
type: integer
- description: The the number of components in bom
jsonPath: .report.summary.dependenciesCount
name: Dependencies
priority: 1
type: integer
name: v1alpha1
schema:
openAPIV3Schema:
description: ClusterSbomReport summarizes components and dependencies found in container image
properties:
apiVersion:
description: |-
APIVersion defines the versioned schema of this representation of an object.
Servers should convert recognized schemas to the latest internal value, and
may reject unrecognized values.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
type: string
kind:
description: |-
Kind is a string value representing the REST resource this object represents.
Servers may infer this from the endpoint the client submits requests to.
Cannot be updated.
In CamelCase.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
type: string
metadata:
type: object
report:
description: Report is the actual sbom report data.
properties:
artifact:
description: |-
Artifact represents a standalone, executable package of software that includes everything needed to
run an application.
properties:
digest:
description: Digest is a unique and immutable identifier of an Artifact.
type: string
mimeType:
description: MimeType represents a type and format of an Artifact.
type: string
repository:
description: Repository is the name of the repository in the Artifact registry.
type: string
tag:
description: Tag is a mutable, human-readable string used to identify an Artifact.
type: string
type: object
components:
description: Bom is artifact bill of materials.
properties:
bomFormat:
type: string
components:
items:
properties:
bom-ref:
type: string
group:
type: string
hashes:
items:
properties:
alg:
type: string
content:
type: string
type: object
type: array
licenses:
items:
properties:
expression:
type: string
license:
properties:
id:
type: string
name:
type: string
url:
type: string
type: object
type: object
type: array
name:
type: string
properties:
items:
properties:
name:
type: string
value:
type: string
type: object
type: array
purl:
type: string
supplier:
properties:
contact:
items:
properties:
email:
type: string
name:
type: string
phone:
type: string
type: object
type: array
name:
type: string
url:
items:
type: string
type: array
type: object
type:
type: string
version:
type: string
type: object
type: array
dependencies:
items:
properties:
dependsOn:
items:
type: string
type: array
ref:
type: string
type: object
type: array
metadata:
properties:
component:
properties:
bom-ref:
type: string
group:
type: string
hashes:
items:
properties:
alg:
type: string
content:
type: string
type: object
type: array
licenses:
items:
properties:
expression:
type: string
license:
properties:
id:
type: string
name:
type: string
url:
type: string
type: object
type: object
type: array
name:
type: string
properties:
items:
properties:
name:
type: string
value:
type: string
type: object
type: array
purl:
type: string
supplier:
properties:
contact:
items:
properties:
email:
type: string
name:
type: string
phone:
type: string
type: object
type: array
name:
type: string
url:
items:
type: string
type: array
type: object
type:
type: string
version:
type: string
type: object
timestamp:
type: string
tools:
properties:
components:
items:
properties:
bom-ref:
type: string
group:
type: string
hashes:
items:
properties:
alg:
type: string
content:
type: string
type: object
type: array
licenses:
items:
properties:
expression:
type: string
license:
properties:
id:
type: string
name:
type: string
url:
type: string
type: object
type: object
type: array
name:
type: string
properties:
items:
properties:
name:
type: string
value:
type: string
type: object
type: array
purl:
type: string
supplier:
properties:
contact:
items:
properties:
email:
type: string
name:
type: string
phone:
type: string
type: object
type: array
name:
type: string
url:
items:
type: string
type: array
type: object
type:
type: string
version:
type: string
type: object
type: array
type: object
type: object
serialNumber:
type: string
specVersion:
type: string
version:
type: integer
required:
- bomFormat
- specVersion
type: object
registry:
description: Registry is the registry the Artifact was pulled from.
properties:
server:
description: Server the FQDN of registry server.
type: string
type: object
scanner:
description: Scanner is the scanner that generated this report.
properties:
name:
description: Name the name of the scanner.
type: string
vendor:
description: Vendor the name of the vendor providing the scanner.
type: string
version:
description: Version the version of the scanner.
type: string
required:
- name
- vendor
- version
type: object
summary:
description: Summary is a summary of sbom report.
properties:
componentsCount:
description: ComponentsCount is the number of components in bom.
minimum: 0
type: integer
dependenciesCount:
description: DependenciesCount is the number of dependencies in bom.
minimum: 0
type: integer
required:
- componentsCount
- dependenciesCount
type: object
updateTimestamp:
description: UpdateTimestamp is a timestamp representing the server time in UTC when this report was updated.
format: date-time
type: string
required:
- artifact
- components
- scanner
- summary
- updateTimestamp
type: object
required:
- report
type: object
served: true
storage: true
subresources: {}

279
clusters/cl01tl/manifests/trivy/CustomResourceDefinition-clustervulnerabilityreports.aquasecurity.github.io.yaml Normal file
View File

@@ -0,0 +1,279 @@
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
controller-gen.kubebuilder.io/version: v0.14.0
name: clustervulnerabilityreports.aquasecurity.github.io
spec:
group: aquasecurity.github.io
names:
kind: ClusterVulnerabilityReport
listKind: ClusterVulnerabilityReportList
plural: clustervulnerabilityreports
shortNames:
- clustervuln
singular: clustervulnerabilityreport
scope: Cluster
versions:
- additionalPrinterColumns:
- description: The name of image repository
jsonPath: .report.artifact.repository
name: Repository
type: string
- description: The name of image tag
jsonPath: .report.artifact.tag
name: Tag
type: string
- description: The name of the vulnerability scanner
jsonPath: .report.scanner.name
name: Scanner
type: string
- description: The age of the report
jsonPath: .metadata.creationTimestamp
name: Age
type: date
- description: The number of critical vulnerabilities
jsonPath: .report.summary.criticalCount
name: Critical
priority: 1
type: integer
- description: The number of high vulnerabilities
jsonPath: .report.summary.highCount
name: High
priority: 1
type: integer
- description: The number of medium vulnerabilities
jsonPath: .report.summary.mediumCount
name: Medium
priority: 1
type: integer
- description: The number of low vulnerabilities
jsonPath: .report.summary.lowCount
name: Low
priority: 1
type: integer
- description: The number of unknown vulnerabilities
jsonPath: .report.summary.unknownCount
name: Unknown
priority: 1
type: integer
name: v1alpha1
schema:
openAPIV3Schema:
description: |-
ClusterVulnerabilityReport summarizes vulnerabilities in application dependencies and operating system packages
built into container images.
properties:
apiVersion:
description: |-
APIVersion defines the versioned schema of this representation of an object.
Servers should convert recognized schemas to the latest internal value, and
may reject unrecognized values.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
type: string
kind:
description: |-
Kind is a string value representing the REST resource this object represents.
Servers may infer this from the endpoint the client submits requests to.
Cannot be updated.
In CamelCase.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
type: string
metadata:
type: object
report:
description: Report is the actual vulnerability report data.
properties:
artifact:
description: |-
Artifact represents a standalone, executable package of software that includes everything needed to
run an application.
properties:
digest:
description: Digest is a unique and immutable identifier of an Artifact.
type: string
mimeType:
description: MimeType represents a type and format of an Artifact.
type: string
repository:
description: Repository is the name of the repository in the Artifact registry.
type: string
tag:
description: Tag is a mutable, human-readable string used to identify an Artifact.
type: string
type: object
os:
description: OS information of the artifact
properties:
eosl:
description: Eosl is true if OS version has reached end of service life
type: boolean
family:
description: Operating System Family
type: string
name:
description: Name or version of the OS
type: string
type: object
registry:
description: Registry is the registry the Artifact was pulled from.
properties:
server:
description: Server the FQDN of registry server.
type: string
type: object
scanner:
description: Scanner is the scanner that generated this report.
properties:
name:
description: Name the name of the scanner.
type: string
vendor:
description: Vendor the name of the vendor providing the scanner.
type: string
version:
description: Version the version of the scanner.
type: string
required:
- name
- vendor
- version
type: object
summary:
description: Summary is a summary of Vulnerability counts grouped by Severity.
properties:
criticalCount:
description: CriticalCount is the number of vulnerabilities with Critical Severity.
minimum: 0
type: integer
highCount:
description: HighCount is the number of vulnerabilities with High Severity.
minimum: 0
type: integer
lowCount:
description: LowCount is the number of vulnerabilities with Low Severity.
minimum: 0
type: integer
mediumCount:
description: MediumCount is the number of vulnerabilities with Medium Severity.
minimum: 0
type: integer
noneCount:
description: NoneCount is the number of packages without any vulnerability.
minimum: 0
type: integer
unknownCount:
description: UnknownCount is the number of vulnerabilities with unknown severity.
minimum: 0
type: integer
required:
- criticalCount
- highCount
- lowCount
- mediumCount
- unknownCount
type: object
updateTimestamp:
description: UpdateTimestamp is a timestamp representing the server time in UTC when this report was updated.
format: date-time
type: string
vulnerabilities:
description: Vulnerabilities is a list of operating system (OS) or application software Vulnerability items found in the Artifact.
items:
description: Vulnerability is the spec for a vulnerability record.
properties:
class:
type: string
cvss:
additionalProperties:
properties:
V2Score:
type: number
V2Vector:
type: string
V3Score:
type: number
V3Vector:
type: string
V40Score:
type: number
V40Vector:
type: string
type: object
type: object
cvsssource:
type: string
description:
type: string
fixedVersion:
description: FixedVersion indicates the version of the Resource in which this vulnerability has been fixed.
type: string
installedVersion:
description: InstalledVersion indicates the installed version of the Resource.
type: string
lastModifiedDate:
description: LastModifiedDate indicates the last date CVE has been modified.
type: string
links:
items:
type: string
type: array
packagePURL:
type: string
packagePath:
type: string
packageType:
type: string
primaryLink:
type: string
publishedDate:
description: PublishedDate indicates the date of published CVE.
type: string
resource:
description: Resource is a vulnerable package, application, or library.
type: string
score:
type: number
severity:
description: Severity level of a vulnerability or a configuration audit check.
enum:
- CRITICAL
- HIGH
- MEDIUM
- LOW
- UNKNOWN
type: string
target:
type: string
title:
type: string
vulnerabilityID:
description: VulnerabilityID the vulnerability identifier.
type: string
required:
- fixedVersion
- installedVersion
- lastModifiedDate
- publishedDate
- resource
- severity
- title
- vulnerabilityID
type: object
type: array
required:
- artifact
- os
- scanner
- summary
- updateTimestamp
- vulnerabilities
type: object
required:
- report
type: object
x-kubernetes-preserve-unknown-fields: true
served: true
storage: true
subresources: {}

167
clusters/cl01tl/manifests/trivy/CustomResourceDefinition-configauditreports.aquasecurity.github.io.yaml Normal file
View File

@@ -0,0 +1,167 @@
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
controller-gen.kubebuilder.io/version: v0.14.0
name: configauditreports.aquasecurity.github.io
spec:
group: aquasecurity.github.io
names:
kind: ConfigAuditReport
listKind: ConfigAuditReportList
plural: configauditreports
shortNames:
- configaudit
- configaudits
singular: configauditreport
scope: Namespaced
versions:
- additionalPrinterColumns:
- description: The name of the config audit scanner
jsonPath: .report.scanner.name
name: Scanner
type: string
- description: The age of the report
jsonPath: .metadata.creationTimestamp
name: Age
type: date
- description: The number of failed checks with critical severity
jsonPath: .report.summary.criticalCount
name: Critical
priority: 1
type: integer
- description: The number of failed checks with high severity
jsonPath: .report.summary.highCount
name: High
priority: 1
type: integer
- description: The number of failed checks with medium severity
jsonPath: .report.summary.mediumCount
name: Medium
priority: 1
type: integer
- description: The number of failed checks with low severity
jsonPath: .report.summary.lowCount
name: Low
priority: 1
type: integer
name: v1alpha1
schema:
openAPIV3Schema:
description: ConfigAuditReport is a specification for the ConfigAuditReport resource.
properties:
apiVersion:
description: |-
APIVersion defines the versioned schema of this representation of an object.
Servers should convert recognized schemas to the latest internal value, and
may reject unrecognized values.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
type: string
kind:
description: |-
Kind is a string value representing the REST resource this object represents.
Servers may infer this from the endpoint the client submits requests to.
Cannot be updated.
In CamelCase.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
type: string
metadata:
type: object
report:
properties:
checks:
description: Checks provides results of conducting audit steps.
items:
description: Check provides the result of conducting a single audit step.
properties:
category:
type: string
checkID:
type: string
description:
type: string
messages:
items:
type: string
type: array
remediation:
description: Remediation provides description or links to external resources to remediate failing check.
type: string
scope:
description: Scope indicates the section of config that was audited.
properties:
type:
description: Type indicates type of this scope, e.g. Container, ConfigMapKey or JSONPath.
type: string
value:
description: Value indicates value of this scope that depends on Type, e.g. container name, ConfigMap key or JSONPath expression
type: string
required:
- type
- value
type: object
severity:
description: Severity level of a vulnerability or a configuration audit check.
type: string
success:
type: boolean
title:
type: string
required:
- checkID
- severity
- success
type: object
type: array
scanner:
description: Scanner is the spec for a scanner generating a security assessment report.
properties:
name:
description: Name the name of the scanner.
type: string
vendor:
description: Vendor the name of the vendor providing the scanner.
type: string
version:
description: Version the version of the scanner.
type: string
required:
- name
- vendor
- version
type: object
summary:
description: ConfigAuditSummary counts failed checks by severity.
properties:
criticalCount:
description: CriticalCount is the number of failed checks with critical severity.
type: integer
highCount:
description: HighCount is the number of failed checks with high severity.
type: integer
lowCount:
description: LowCount is the number of failed check with low severity.
type: integer
mediumCount:
description: MediumCount is the number of failed checks with medium severity.
type: integer
required:
- criticalCount
- highCount
- lowCount
- mediumCount
type: object
updateTimestamp:
format: date-time
type: string
required:
- checks
type: object
required:
- report
type: object
x-kubernetes-preserve-unknown-fields: true
served: true
storage: true
subresources: {}

201
clusters/cl01tl/manifests/trivy/CustomResourceDefinition-exposedsecretreports.aquasecurity.github.io.yaml Normal file
View File

@@ -0,0 +1,201 @@
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
controller-gen.kubebuilder.io/version: v0.14.0
name: exposedsecretreports.aquasecurity.github.io
spec:
group: aquasecurity.github.io
names:
kind: ExposedSecretReport
listKind: ExposedSecretReportList
plural: exposedsecretreports
shortNames:
- exposedsecret
- exposedsecrets
singular: exposedsecretreport
scope: Namespaced
versions:
- additionalPrinterColumns:
- description: The name of image repository
jsonPath: .report.artifact.repository
name: Repository
type: string
- description: The name of image tag
jsonPath: .report.artifact.tag
name: Tag
type: string
- description: The name of the exposed secret scanner
jsonPath: .report.scanner.name
name: Scanner
type: string
- description: The age of the report
jsonPath: .metadata.creationTimestamp
name: Age
type: date
- description: The number of critical exposed secrets
jsonPath: .report.summary.criticalCount
name: Critical
priority: 1
type: integer
- description: The number of high exposed secrets
jsonPath: .report.summary.highCount
name: High
priority: 1
type: integer
- description: The number of medium exposed secrets
jsonPath: .report.summary.mediumCount
name: Medium
priority: 1
type: integer
- description: The number of low exposed secrets
jsonPath: .report.summary.lowCount
name: Low
priority: 1
type: integer
name: v1alpha1
schema:
openAPIV3Schema:
description: ExposedSecretReport summarizes exposed secrets in plaintext files built into container images.
properties:
apiVersion:
description: |-
APIVersion defines the versioned schema of this representation of an object.
Servers should convert recognized schemas to the latest internal value, and
may reject unrecognized values.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
type: string
kind:
description: |-
Kind is a string value representing the REST resource this object represents.
Servers may infer this from the endpoint the client submits requests to.
Cannot be updated.
In CamelCase.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
type: string
metadata:
type: object
report:
description: Report is the actual exposed secret report data.
properties:
artifact:
description: |-
Artifact represents a standalone, executable package of software that includes everything needed to
run an application.
properties:
digest:
description: Digest is a unique and immutable identifier of an Artifact.
type: string
mimeType:
description: MimeType represents a type and format of an Artifact.
type: string
repository:
description: Repository is the name of the repository in the Artifact registry.
type: string
tag:
description: Tag is a mutable, human-readable string used to identify an Artifact.
type: string
type: object
registry:
description: Registry is the registry the Artifact was pulled from.
properties:
server:
description: Server the FQDN of registry server.
type: string
type: object
scanner:
description: Scanner is the scanner that generated this report.
properties:
name:
description: Name the name of the scanner.
type: string
vendor:
description: Vendor the name of the vendor providing the scanner.
type: string
version:
description: Version the version of the scanner.
type: string
required:
- name
- vendor
- version
type: object
secrets:
description: Exposed secrets is a list of passwords, api keys, tokens and others items found in the Artifact.
items:
description: ExposedSecret is the spec for a exposed secret record.
properties:
category:
type: string
match:
description: Match where the exposed rule matched.
type: string
ruleID:
description: RuleID is rule the identifier.
type: string
severity:
description: Severity level of a vulnerability or a configuration audit check.
enum:
- CRITICAL
- HIGH
- MEDIUM
- LOW
type: string
target:
description: Target is where the exposed secret was found.
type: string
title:
type: string
required:
- category
- match
- ruleID
- severity
- target
- title
type: object
type: array
summary:
description: Summary is the exposed secrets counts grouped by Severity.
properties:
criticalCount:
description: CriticalCount is the number of exposed secrets with Critical Severity.
minimum: 0
type: integer
highCount:
description: HighCount is the number of exposed secrets with High Severity.
minimum: 0
type: integer
lowCount:
description: LowCount is the number of exposed secrets with Low Severity.
minimum: 0
type: integer
mediumCount:
description: MediumCount is the number of exposed secrets with Medium Severity.
minimum: 0
type: integer
required:
- criticalCount
- highCount
- lowCount
- mediumCount
type: object
updateTimestamp:
description: UpdateTimestamp is a timestamp representing the server time in UTC when this report was updated.
format: date-time
type: string
required:
- artifact
- scanner
- secrets
- summary
- updateTimestamp
type: object
required:
- report
type: object
x-kubernetes-preserve-unknown-fields: true
served: true
storage: true
subresources: {}

165
clusters/cl01tl/manifests/trivy/CustomResourceDefinition-infraassessmentreports.aquasecurity.github.io.yaml Normal file
View File

@@ -0,0 +1,165 @@
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
controller-gen.kubebuilder.io/version: v0.14.0
name: infraassessmentreports.aquasecurity.github.io
spec:
group: aquasecurity.github.io
names:
kind: InfraAssessmentReport
listKind: InfraAssessmentReportList
plural: infraassessmentreports
shortNames:
- infraassessment
- infraassessments
singular: infraassessmentreport
scope: Namespaced
versions:
- additionalPrinterColumns:
- description: The name of the infra assessment scanner
jsonPath: .report.scanner.name
name: Scanner
type: string
- description: The age of the report
jsonPath: .metadata.creationTimestamp
name: Age
type: date
- description: The number of failed checks with critical severity
jsonPath: .report.summary.criticalCount
name: Critical
priority: 1
type: integer
- description: The number of failed checks with high severity
jsonPath: .report.summary.highCount
name: High
priority: 1
type: integer
- description: The number of failed checks with medium severity
jsonPath: .report.summary.mediumCount
name: Medium
priority: 1
type: integer
- description: The number of failed checks with low severity
jsonPath: .report.summary.lowCount
name: Low
priority: 1
type: integer
name: v1alpha1
schema:
openAPIV3Schema:
description: InfraAssessmentReport is a specification for the InfraAssessmentReport resource.
properties:
apiVersion:
description: |-
APIVersion defines the versioned schema of this representation of an object.
Servers should convert recognized schemas to the latest internal value, and
may reject unrecognized values.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
type: string
kind:
description: |-
Kind is a string value representing the REST resource this object represents.
Servers may infer this from the endpoint the client submits requests to.
Cannot be updated.
In CamelCase.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
type: string
metadata:
type: object
report:
properties:
checks:
description: Checks provides results of conducting audit steps.
items:
description: Check provides the result of conducting a single audit step.
properties:
category:
type: string
checkID:
type: string
description:
type: string
messages:
items:
type: string
type: array
remediation:
description: Remediation provides description or links to external resources to remediate failing check.
type: string
scope:
description: Scope indicates the section of config that was audited.
properties:
type:
description: Type indicates type of this scope, e.g. Container, ConfigMapKey or JSONPath.
type: string
value:
description: Value indicates value of this scope that depends on Type, e.g. container name, ConfigMap key or JSONPath expression
type: string
required:
- type
- value
type: object
severity:
description: Severity level of a vulnerability or a configuration audit check.
type: string
success:
type: boolean
title:
type: string
required:
- checkID
- severity
- success
type: object
type: array
scanner:
description: Scanner is the spec for a scanner generating a security assessment report.
properties:
name:
description: Name the name of the scanner.
type: string
vendor:
description: Vendor the name of the vendor providing the scanner.
type: string
version:
description: Version the version of the scanner.
type: string
required:
- name
- vendor
- version
type: object
summary:
description: InfraAssessmentSummary counts failed checks by severity.
properties:
criticalCount:
description: CriticalCount is the number of failed checks with critical severity.
type: integer
highCount:
description: HighCount is the number of failed checks with high severity.
type: integer
lowCount:
description: LowCount is the number of failed check with low severity.
type: integer
mediumCount:
description: MediumCount is the number of failed checks with medium severity.
type: integer
required:
- criticalCount
- highCount
- lowCount
- mediumCount
type: object
required:
- checks
- scanner
- summary
type: object
required:
- report
type: object
served: true
storage: true
subresources: {}

166
clusters/cl01tl/manifests/trivy/CustomResourceDefinition-rbacassessmentreports.aquasecurity.github.io.yaml Normal file
View File

@@ -0,0 +1,166 @@
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
controller-gen.kubebuilder.io/version: v0.14.0
name: rbacassessmentreports.aquasecurity.github.io
spec:
group: aquasecurity.github.io
names:
kind: RbacAssessmentReport
listKind: RbacAssessmentReportList
plural: rbacassessmentreports
shortNames:
- rbacassessment
- rbacassessments
singular: rbacassessmentreport
scope: Namespaced
versions:
- additionalPrinterColumns:
- description: The name of the rbac assessment scanner
jsonPath: .report.scanner.name
name: Scanner
type: string
- description: The age of the report
jsonPath: .metadata.creationTimestamp
name: Age
type: date
- description: The number of failed checks with critical severity
jsonPath: .report.summary.criticalCount
name: Critical
priority: 1
type: integer
- description: The number of failed checks with high severity
jsonPath: .report.summary.highCount
name: High
priority: 1
type: integer
- description: The number of failed checks with medium severity
jsonPath: .report.summary.mediumCount
name: Medium
priority: 1
type: integer
- description: The number of failed checks with low severity
jsonPath: .report.summary.lowCount
name: Low
priority: 1
type: integer
name: v1alpha1
schema:
openAPIV3Schema:
description: RbacAssessmentReport is a specification for the RbacAssessmentReport resource.
properties:
apiVersion:
description: |-
APIVersion defines the versioned schema of this representation of an object.
Servers should convert recognized schemas to the latest internal value, and
may reject unrecognized values.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
type: string
kind:
description: |-
Kind is a string value representing the REST resource this object represents.
Servers may infer this from the endpoint the client submits requests to.
Cannot be updated.
In CamelCase.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
type: string
metadata:
type: object
report:
properties:
checks:
description: Checks provides results of conducting audit steps.
items:
description: Check provides the result of conducting a single audit step.
properties:
category:
type: string
checkID:
type: string
description:
type: string
messages:
items:
type: string
type: array
remediation:
description: Remediation provides description or links to external resources to remediate failing check.
type: string
scope:
description: Scope indicates the section of config that was audited.
properties:
type:
description: Type indicates type of this scope, e.g. Container, ConfigMapKey or JSONPath.
type: string
value:
description: Value indicates value of this scope that depends on Type, e.g. container name, ConfigMap key or JSONPath expression
type: string
required:
- type
- value
type: object
severity:
description: Severity level of a vulnerability or a configuration audit check.
type: string
success:
type: boolean
title:
type: string
required:
- checkID
- severity
- success
type: object
type: array
scanner:
description: Scanner is the spec for a scanner generating a security assessment report.
properties:
name:
description: Name the name of the scanner.
type: string
vendor:
description: Vendor the name of the vendor providing the scanner.
type: string
version:
description: Version the version of the scanner.
type: string
required:
- name
- vendor
- version
type: object
summary:
description: RbacAssessmentSummary counts failed checks by severity.
properties:
criticalCount:
description: CriticalCount is the number of failed checks with critical severity.
type: integer
highCount:
description: HighCount is the number of failed checks with high severity.
type: integer
lowCount:
description: LowCount is the number of failed check with low severity.
type: integer
mediumCount:
description: MediumCount is the number of failed checks with medium severity.
type: integer
required:
- criticalCount
- highCount
- lowCount
- mediumCount
type: object
required:
- checks
- scanner
- summary
type: object
required:
- report
type: object
x-kubernetes-preserve-unknown-fields: true
served: true
storage: true
subresources: {}

391
clusters/cl01tl/manifests/trivy/CustomResourceDefinition-sbomreports.aquasecurity.github.io.yaml Normal file
View File

@@ -0,0 +1,391 @@
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
controller-gen.kubebuilder.io/version: v0.14.0
name: sbomreports.aquasecurity.github.io
spec:
group: aquasecurity.github.io
names:
kind: SbomReport
listKind: SbomReportList
plural: sbomreports
shortNames:
- sbom
- sboms
singular: sbomreport
scope: Namespaced
versions:
- additionalPrinterColumns:
- description: The name of image repository
jsonPath: .report.artifact.repository
name: Repository
type: string
- description: The name of image tag
jsonPath: .report.artifact.tag
name: Tag
type: string
- description: The name of the sbom generation scanner
jsonPath: .report.scanner.name
name: Scanner
type: string
- description: The age of the report
jsonPath: .metadata.creationTimestamp
name: Age
type: date
- description: The number of dependencies in bom
jsonPath: .report.summary.componentsCount
name: Components
priority: 1
type: integer
- description: The the number of components in bom
jsonPath: .report.summary.dependenciesCount
name: Dependencies
priority: 1
type: integer
name: v1alpha1
schema:
openAPIV3Schema:
description: SbomReport summarizes components and dependencies found in container image
properties:
apiVersion:
description: |-
APIVersion defines the versioned schema of this representation of an object.
Servers should convert recognized schemas to the latest internal value, and
may reject unrecognized values.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
type: string
kind:
description: |-
Kind is a string value representing the REST resource this object represents.
Servers may infer this from the endpoint the client submits requests to.
Cannot be updated.
In CamelCase.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
type: string
metadata:
type: object
report:
description: Report is the actual sbom report data.
properties:
artifact:
description: |-
Artifact represents a standalone, executable package of software that includes everything needed to
run an application.
properties:
digest:
description: Digest is a unique and immutable identifier of an Artifact.
type: string
mimeType:
description: MimeType represents a type and format of an Artifact.
type: string
repository:
description: Repository is the name of the repository in the Artifact registry.
type: string
tag:
description: Tag is a mutable, human-readable string used to identify an Artifact.
type: string
type: object
components:
description: Bom is artifact bill of materials.
properties:
bomFormat:
type: string
components:
items:
properties:
bom-ref:
type: string
group:
type: string
hashes:
items:
properties:
alg:
type: string
content:
type: string
type: object
type: array
licenses:
items:
properties:
expression:
type: string
license:
properties:
id:
type: string
name:
type: string
url:
type: string
type: object
type: object
type: array
name:
type: string
properties:
items:
properties:
name:
type: string
value:
type: string
type: object
type: array
purl:
type: string
supplier:
properties:
contact:
items:
properties:
email:
type: string
name:
type: string
phone:
type: string
type: object
type: array
name:
type: string
url:
items:
type: string
type: array
type: object
type:
type: string
version:
type: string
type: object
type: array
dependencies:
items:
properties:
dependsOn:
items:
type: string
type: array
ref:
type: string
type: object
type: array
metadata:
properties:
component:
properties:
bom-ref:
type: string
group:
type: string
hashes:
items:
properties:
alg:
type: string
content:
type: string
type: object
type: array
licenses:
items:
properties:
expression:
type: string
license:
properties:
id:
type: string
name:
type: string
url:
type: string
type: object
type: object
type: array
name:
type: string
properties:
items:
properties:
name:
type: string
value:
type: string
type: object
type: array
purl:
type: string
supplier:
properties:
contact:
items:
properties:
email:
type: string
name:
type: string
phone:
type: string
type: object
type: array
name:
type: string
url:
items:
type: string
type: array
type: object
type:
type: string
version:
type: string
type: object
timestamp:
type: string
tools:
properties:
components:
items:
properties:
bom-ref:
type: string
group:
type: string
hashes:
items:
properties:
alg:
type: string
content:
type: string
type: object
type: array
licenses:
items:
properties:
expression:
type: string
license:
properties:
id:
type: string
name:
type: string
url:
type: string
type: object
type: object
type: array
name:
type: string
properties:
items:
properties:
name:
type: string
value:
type: string
type: object
type: array
purl:
type: string
supplier:
properties:
contact:
items:
properties:
email:
type: string
name:
type: string
phone:
type: string
type: object
type: array
name:
type: string
url:
items:
type: string
type: array
type: object
type:
type: string
version:
type: string
type: object
type: array
type: object
type: object
serialNumber:
type: string
specVersion:
type: string
version:
type: integer
required:
- bomFormat
- specVersion
type: object
registry:
description: Registry is the registry the Artifact was pulled from.
properties:
server:
description: Server the FQDN of registry server.
type: string
type: object
scanner:
description: Scanner is the scanner that generated this report.
properties:
name:
description: Name the name of the scanner.
type: string
vendor:
description: Vendor the name of the vendor providing the scanner.
type: string
version:
description: Version the version of the scanner.
type: string
required:
- name
- vendor
- version
type: object
summary:
description: Summary is a summary of sbom report.
properties:
componentsCount:
description: ComponentsCount is the number of components in bom.
minimum: 0
type: integer
dependenciesCount:
description: DependenciesCount is the number of dependencies in bom.
minimum: 0
type: integer
required:
- componentsCount
- dependenciesCount
type: object
updateTimestamp:
description: UpdateTimestamp is a timestamp representing the server time in UTC when this report was updated.
format: date-time
type: string
required:
- artifact
- components
- scanner
- summary
- updateTimestamp
type: object
required:
- report
type: object
x-kubernetes-preserve-unknown-fields: true
served: true
storage: true
subresources: {}

280
clusters/cl01tl/manifests/trivy/CustomResourceDefinition-vulnerabilityreports.aquasecurity.github.io.yaml Normal file
View File

@@ -0,0 +1,280 @@
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
controller-gen.kubebuilder.io/version: v0.14.0
name: vulnerabilityreports.aquasecurity.github.io
spec:
group: aquasecurity.github.io
names:
kind: VulnerabilityReport
listKind: VulnerabilityReportList
plural: vulnerabilityreports
shortNames:
- vuln
- vulns
singular: vulnerabilityreport
scope: Namespaced
versions:
- additionalPrinterColumns:
- description: The name of image repository
jsonPath: .report.artifact.repository
name: Repository
type: string
- description: The name of image tag
jsonPath: .report.artifact.tag
name: Tag
type: string
- description: The name of the vulnerability scanner
jsonPath: .report.scanner.name
name: Scanner
type: string
- description: The age of the report
jsonPath: .metadata.creationTimestamp
name: Age
type: date
- description: The number of critical vulnerabilities
jsonPath: .report.summary.criticalCount
name: Critical
priority: 1
type: integer
- description: The number of high vulnerabilities
jsonPath: .report.summary.highCount
name: High
priority: 1
type: integer
- description: The number of medium vulnerabilities
jsonPath: .report.summary.mediumCount
name: Medium
priority: 1
type: integer
- description: The number of low vulnerabilities
jsonPath: .report.summary.lowCount
name: Low
priority: 1
type: integer
- description: The number of unknown vulnerabilities
jsonPath: .report.summary.unknownCount
name: Unknown
priority: 1
type: integer
name: v1alpha1
schema:
openAPIV3Schema:
description: |-
VulnerabilityReport summarizes vulnerabilities in application dependencies and operating system packages
built into container images.
properties:
apiVersion:
description: |-
APIVersion defines the versioned schema of this representation of an object.
Servers should convert recognized schemas to the latest internal value, and
may reject unrecognized values.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
type: string
kind:
description: |-
Kind is a string value representing the REST resource this object represents.
Servers may infer this from the endpoint the client submits requests to.
Cannot be updated.
In CamelCase.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
type: string
metadata:
type: object
report:
description: Report is the actual vulnerability report data.
properties:
artifact:
description: |-
Artifact represents a standalone, executable package of software that includes everything needed to
run an application.
properties:
digest:
description: Digest is a unique and immutable identifier of an Artifact.
type: string
mimeType:
description: MimeType represents a type and format of an Artifact.
type: string
repository:
description: Repository is the name of the repository in the Artifact registry.
type: string
tag:
description: Tag is a mutable, human-readable string used to identify an Artifact.
type: string
type: object
os:
description: OS information of the artifact
properties:
eosl:
description: Eosl is true if OS version has reached end of service life
type: boolean
family:
description: Operating System Family
type: string
name:
description: Name or version of the OS
type: string
type: object
registry:
description: Registry is the registry the Artifact was pulled from.
properties:
server:
description: Server the FQDN of registry server.
type: string
type: object
scanner:
description: Scanner is the scanner that generated this report.
properties:
name:
description: Name the name of the scanner.
type: string
vendor:
description: Vendor the name of the vendor providing the scanner.
type: string
version:
description: Version the version of the scanner.
type: string
required:
- name
- vendor
- version
type: object
summary:
description: Summary is a summary of Vulnerability counts grouped by Severity.
properties:
criticalCount:
description: CriticalCount is the number of vulnerabilities with Critical Severity.
minimum: 0
type: integer
highCount:
description: HighCount is the number of vulnerabilities with High Severity.
minimum: 0
type: integer
lowCount:
description: LowCount is the number of vulnerabilities with Low Severity.
minimum: 0
type: integer
mediumCount:
description: MediumCount is the number of vulnerabilities with Medium Severity.
minimum: 0
type: integer
noneCount:
description: NoneCount is the number of packages without any vulnerability.
minimum: 0
type: integer
unknownCount:
description: UnknownCount is the number of vulnerabilities with unknown severity.
minimum: 0
type: integer
required:
- criticalCount
- highCount
- lowCount
- mediumCount
- unknownCount
type: object
updateTimestamp:
description: UpdateTimestamp is a timestamp representing the server time in UTC when this report was updated.
format: date-time
type: string
vulnerabilities:
description: Vulnerabilities is a list of operating system (OS) or application software Vulnerability items found in the Artifact.
items:
description: Vulnerability is the spec for a vulnerability record.
properties:
class:
type: string
cvss:
additionalProperties:
properties:
V2Score:
type: number
V2Vector:
type: string
V3Score:
type: number
V3Vector:
type: string
V40Score:
type: number
V40Vector:
type: string
type: object
type: object
cvsssource:
type: string
description:
type: string
fixedVersion:
description: FixedVersion indicates the version of the Resource in which this vulnerability has been fixed.
type: string
installedVersion:
description: InstalledVersion indicates the installed version of the Resource.
type: string
lastModifiedDate:
description: LastModifiedDate indicates the last date CVE has been modified.
type: string
links:
items:
type: string
type: array
packagePURL:
type: string
packagePath:
type: string
packageType:
type: string
primaryLink:
type: string
publishedDate:
description: PublishedDate indicates the date of published CVE.
type: string
resource:
description: Resource is a vulnerable package, application, or library.
type: string
score:
type: number
severity:
description: Severity level of a vulnerability or a configuration audit check.
enum:
- CRITICAL
- HIGH
- MEDIUM
- LOW
- UNKNOWN
type: string
target:
type: string
title:
type: string
vulnerabilityID:
description: VulnerabilityID the vulnerability identifier.
type: string
required:
- fixedVersion
- installedVersion
- lastModifiedDate
- publishedDate
- resource
- severity
- title
- vulnerabilityID
type: object
type: array
required:
- artifact
- os
- scanner
- summary
- updateTimestamp
- vulnerabilities
type: object
required:
- report
type: object
x-kubernetes-preserve-unknown-fields: true
served: true
storage: true
subresources: {}

86
clusters/cl01tl/manifests/trivy/Deployment-trivy-trivy-operator.yaml Normal file
View File

@@ -0,0 +1,86 @@
---
# Source: trivy/charts/trivy-operator/templates/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: trivy-trivy-operator
namespace: trivy
labels:
helm.sh/chart: trivy-operator-0.31.0
app.kubernetes.io/name: trivy-operator
app.kubernetes.io/instance: trivy
app.kubernetes.io/version: "0.29.0"
app.kubernetes.io/managed-by: Helm
spec:
replicas: 1
strategy:
type: Recreate
selector:
matchLabels:
app.kubernetes.io/name: trivy-operator
app.kubernetes.io/instance: trivy
template:
metadata:
labels:
app.kubernetes.io/name: trivy-operator
app.kubernetes.io/instance: trivy
spec:
serviceAccountName: trivy-trivy-operator
automountServiceAccountToken: true
containers:
- name: "trivy-operator"
image: "mirror.gcr.io/aquasec/trivy-operator:0.29.0"
imagePullPolicy: IfNotPresent
env:
- name: OPERATOR_NAMESPACE
value: trivy
- name: OPERATOR_TARGET_NAMESPACES
value: ""
- name: OPERATOR_EXCLUDE_NAMESPACES
value: ""
- name: OPERATOR_TARGET_WORKLOADS
value: "pod,replicaset,replicationcontroller,statefulset,daemonset,cronjob,job"
- name: OPERATOR_SERVICE_ACCOUNT
value: "trivy-trivy-operator"
envFrom:
- configMapRef:
name: trivy-operator-config
ports:
- name: metrics
containerPort: 8080
- name: probes
containerPort: 9090
readinessProbe:
httpGet:
path: /readyz/
port: probes
initialDelaySeconds: 5
periodSeconds: 10
successThreshold: 1
failureThreshold: 3
livenessProbe:
httpGet:
path: /healthz/
port: probes
initialDelaySeconds: 5
periodSeconds: 10
successThreshold: 1
failureThreshold: 10
resources:
requests:
cpu: 100m
memory: 128Mi
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
privileged: false
readOnlyRootFilesystem: true
volumeMounts:
- mountPath: /tmp
name: cache-policies
readOnly: false
volumes:
- emptyDir: {}
name: cache-policies

13
clusters/cl01tl/manifests/trivy/Namespace-trivy.yaml Normal file
View File

@@ -0,0 +1,13 @@
---
# Source: trivy/templates/namespace.yaml
apiVersion: v1
kind: Namespace
metadata:
name: trivy
labels:
app.kubernetes.io/name: trivy
app.kubernetes.io/instance: trivy
app.kubernetes.io/part-of: trivy
pod-security.kubernetes.io/audit: privileged
pod-security.kubernetes.io/enforce: privileged
pod-security.kubernetes.io/warn: privileged

29
clusters/cl01tl/manifests/trivy/Role-trivy-trivy-operator-leader-election.yaml Normal file
View File

@@ -0,0 +1,29 @@
---
# Source: trivy/charts/trivy-operator/templates/rbac/leader-election-role.yaml
# permissions to do leader election.
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: trivy-trivy-operator-leader-election
namespace: trivy
labels:
helm.sh/chart: trivy-operator-0.31.0
app.kubernetes.io/name: trivy-operator
app.kubernetes.io/instance: trivy
app.kubernetes.io/version: "0.29.0"
app.kubernetes.io/managed-by: Helm
rules:
- apiGroups:
- coordination.k8s.io
resources:
- leases
verbs:
- create
- get
- update
- apiGroups:
- ""
resources:
- events
verbs:
- create

32
clusters/cl01tl/manifests/trivy/Role-trivy-trivy-operator.yaml Normal file
View File

@@ -0,0 +1,32 @@
---
# Source: trivy/charts/trivy-operator/templates/rbac/role.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: trivy-trivy-operator
namespace: trivy
labels:
helm.sh/chart: trivy-operator-0.31.0
app.kubernetes.io/name: trivy-operator
app.kubernetes.io/instance: trivy
app.kubernetes.io/version: "0.29.0"
app.kubernetes.io/managed-by: Helm
rules:
- apiGroups:
- ""
resources:
- configmaps
verbs:
- create
- get
- list
- watch
- apiGroups:
- ""
resources:
- secrets
verbs:
- create
- get
- delete
- update

21
clusters/cl01tl/manifests/trivy/RoleBinding-trivy-trivy-operator-leader-election.yaml Normal file
View File

@@ -0,0 +1,21 @@
---
# Source: trivy/charts/trivy-operator/templates/rbac/leader-election-rolebinding.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: trivy-trivy-operator-leader-election
namespace: trivy
labels:
helm.sh/chart: trivy-operator-0.31.0
app.kubernetes.io/name: trivy-operator
app.kubernetes.io/instance: trivy
app.kubernetes.io/version: "0.29.0"
app.kubernetes.io/managed-by: Helm
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: trivy-trivy-operator-leader-election
subjects:
- kind: ServiceAccount
name: trivy-trivy-operator
namespace: trivy

21
clusters/cl01tl/manifests/trivy/RoleBinding-trivy-trivy-operator.yaml Normal file
View File

@@ -0,0 +1,21 @@
---
# Source: trivy/charts/trivy-operator/templates/rbac/rolebinding.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: trivy-trivy-operator
namespace: trivy
labels:
helm.sh/chart: trivy-operator-0.31.0
app.kubernetes.io/name: trivy-operator
app.kubernetes.io/instance: trivy
app.kubernetes.io/version: "0.29.0"
app.kubernetes.io/managed-by: Helm
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: trivy-trivy-operator
subjects:
- kind: ServiceAccount
name: trivy-trivy-operator
namespace: trivy

14
clusters/cl01tl/manifests/trivy/Secret-trivy-operator-trivy-config.yaml Normal file
View File

@@ -0,0 +1,14 @@
---
# Source: trivy/charts/trivy-operator/templates/secrets/trivy.yaml
apiVersion: v1
kind: Secret
metadata:
name: trivy-operator-trivy-config
namespace: trivy
labels:
helm.sh/chart: trivy-operator-0.31.0
app.kubernetes.io/name: trivy-operator
app.kubernetes.io/instance: trivy
app.kubernetes.io/version: "0.29.0"
app.kubernetes.io/managed-by: Helm
data:

14
clusters/cl01tl/manifests/trivy/Secret-trivy-operator.yaml Normal file
View File

@@ -0,0 +1,14 @@
---
# Source: trivy/charts/trivy-operator/templates/secrets/operator.yaml
apiVersion: v1
kind: Secret
metadata:
name: trivy-operator
namespace: trivy
labels:
helm.sh/chart: trivy-operator-0.31.0
app.kubernetes.io/name: trivy-operator
app.kubernetes.io/instance: trivy
app.kubernetes.io/version: "0.29.0"
app.kubernetes.io/managed-by: Helm
data:

25
clusters/cl01tl/manifests/trivy/Service-trivy-trivy-operator.yaml Normal file
View File

@@ -0,0 +1,25 @@
---
# Source: trivy/charts/trivy-operator/templates/monitor/service.yaml
apiVersion: v1
kind: Service
metadata:
name: trivy-trivy-operator
namespace: trivy
labels:
helm.sh/chart: trivy-operator-0.31.0
app.kubernetes.io/name: trivy-operator
app.kubernetes.io/instance: trivy
app.kubernetes.io/version: "0.29.0"
app.kubernetes.io/managed-by: Helm
spec:
clusterIP: None
ports:
- name: metrics
port: 80
targetPort: metrics
protocol: TCP
appProtocol: TCP
selector:
app.kubernetes.io/name: trivy-operator
app.kubernetes.io/instance: trivy
type: ClusterIP

13
clusters/cl01tl/manifests/trivy/ServiceAccount-trivy-trivy-operator.yaml Normal file
View File

@@ -0,0 +1,13 @@
---
# Source: trivy/charts/trivy-operator/templates/serviceaccount.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
name: trivy-trivy-operator
namespace: trivy
labels:
helm.sh/chart: trivy-operator-0.31.0
app.kubernetes.io/name: trivy-operator
app.kubernetes.io/instance: trivy
app.kubernetes.io/version: "0.29.0"
app.kubernetes.io/managed-by: Helm

22
clusters/cl01tl/manifests/trivy/ServiceMonitor-trivy-trivy-operator.yaml Normal file
View File

@@ -0,0 +1,22 @@
---
# Source: trivy/charts/trivy-operator/templates/monitor/servicemonitor.yaml
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
name: trivy-trivy-operator
namespace: trivy
labels:
helm.sh/chart: trivy-operator-0.31.0
app.kubernetes.io/name: trivy-operator
app.kubernetes.io/instance: trivy
app.kubernetes.io/version: "0.29.0"
app.kubernetes.io/managed-by: Helm
spec:
selector:
matchLabels:
app.kubernetes.io/name: trivy-operator
app.kubernetes.io/instance: trivy
endpoints:
- honorLabels: true
port: metrics
scheme: http

5222
clusters/cl01tl/manifests/trivy/trivy.yaml
View File

File diff suppressed because it is too large Load Diff