88 lines
2.5 KiB
YAML
88 lines
2.5 KiB
YAML
trivy-operator:
|
|
targetWorkloads: "pod,replicaset,replicationcontroller,statefulset,daemonset,cronjob,job"
|
|
operator:
|
|
replicas: 1
|
|
scanJobsConcurrentLimit: 3
|
|
vulnerabilityScannerEnabled: true
|
|
sbomGenerationEnabled: true
|
|
clusterSbomCacheEnabled: true
|
|
configAuditScannerEnabled: true
|
|
rbacAssessmentScannerEnabled: true
|
|
infraAssessmentScannerEnabled: true
|
|
clusterComplianceEnabled: false
|
|
vulnerabilityScannerScanOnlyCurrentRevisions: true
|
|
accessGlobalSecretsAndServiceAccount: true
|
|
metricsFindingsEnabled: true
|
|
exposedSecretScannerEnabled: true
|
|
serviceMonitor:
|
|
enabled: true
|
|
trivy:
|
|
createConfig: true
|
|
image:
|
|
registry: mirror.gcr.io
|
|
repository: aquasec/trivy
|
|
tag: 0.69.3
|
|
storageClassEnabled: true
|
|
storageClassName: ceph-block
|
|
storageSize: "10Gi"
|
|
registry:
|
|
mirror:
|
|
"registry-1.docker.io": proxy-registry-1.docker.io
|
|
"quay.io": proxy-quay.io
|
|
"registry.k8s.io": proxy-registry.k8s
|
|
"gcr.io": proxy-gcr.io
|
|
"ghcr.io": proxy-ghcr.io
|
|
"hub.docker": proxy-hub.docker
|
|
severity: UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL
|
|
slow: true
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 128M
|
|
supportedConfigAuditKinds: "Workload,Service,Role,ClusterRole,NetworkPolicy,Ingress,LimitRange,ResourceQuota"
|
|
server:
|
|
resources:
|
|
requests:
|
|
cpu: 200m
|
|
memory: 512Mi
|
|
replicas: 1
|
|
nodeCollector:
|
|
volumeMounts:
|
|
- name: var-lib-etcd
|
|
mountPath: /var/lib/etcd
|
|
readOnly: true
|
|
- name: var-lib-kubelet
|
|
mountPath: /var/lib/kubelet
|
|
readOnly: true
|
|
- name: var-lib-kube-scheduler
|
|
mountPath: /var/lib/kube-scheduler
|
|
readOnly: true
|
|
- name: var-lib-kube-controller-manager
|
|
mountPath: /var/lib/kube-controller-manager
|
|
readOnly: true
|
|
- name: etc-kubernetes
|
|
mountPath: /etc/kubernetes
|
|
readOnly: true
|
|
- name: etc-cni-netd
|
|
mountPath: /etc/cni/net.d/
|
|
readOnly: true
|
|
volumes:
|
|
- name: var-lib-etcd
|
|
hostPath:
|
|
path: /var/lib/etcd
|
|
- name: var-lib-kubelet
|
|
hostPath:
|
|
path: /var/lib/kubelet
|
|
- name: var-lib-kube-scheduler
|
|
hostPath:
|
|
path: /var/lib/kube-scheduler
|
|
- name: var-lib-kube-controller-manager
|
|
hostPath:
|
|
path: /var/lib/kube-controller-manager
|
|
- name: etc-kubernetes
|
|
hostPath:
|
|
path: /etc/kubernetes
|
|
- name: etc-cni-netd
|
|
hostPath:
|
|
path: /etc/cni/net.d/
|