Covestro Deutschland AG

[qcserestipy]

How do you use Trivy?

We use the trivy operator to scan for vulnerable images in our production K8s cluster. We use vulnerability reports and config audit reports as source for policy decisions of our Open Policy Agent Gatekeeper to prevent further potentially vulnerable workloads running in our cluster. Additionally, we use the trivy scanner in our harbor container registry to ensure safe deployments to various production workloads such as apache airflow or gitlab runner.

Which targets are you scanning with Trivy?

• Container Image
• Filesystem
• Git Repository
• Virtual Machine Image
• Kubernetes
• AWS
• SBOM

What kind of issues are scanning with Trivy?

• Software Bill of Materials (SBOM)
• Known vulnerabilities (CVEs)
• IaC issues and misconfigurations
• Sensitive information and secrets
• Software licenses

[AnaisUrlichs]

Thank you so much for sharing! 😊