$ show aquasecurity/trivy-operator

[account ↗] [repo ↗] APPLICATION ★ 1935 285 ● active (last update 1 month ago)

── AI DEEP ANALYSIS ──

reviewed by: deepseek/deepseek-v4-flash

This is a Kubernetes-native security operator that automates vulnerability scanning, configuration auditing, secret scanning, RBAC assessment, infrastructure assessment, and compliance reporting for container workloads. It uses Aqua Security's Trivy as the scanning engine and stores results as custom resource definitions (VulnerabilityReport, ConfigAuditReport, ExposedSecretReport, RbacAssessmentReport, InfraAssessmentReport, SbomReport, ClusterComplianceReport). The operator runs as a controller-manager pod, watches Kubernetes resources, and creates scan jobs in-cluster. It supports multiple scan modes (standalone, client/server, filesystem, rootfs) and integrates with Prometheus for metrics, webhooks for alerting, and OPA/Rego for configurable policy evaluation. The codebase is well-structured with a plugin architecture for scanning, builder patterns for report generation, and extensive test coverage including unit, envtest, integration, and e2e tests.

── METRICS ──

RATING8.8/10

QUALITY8.0/10

MAINTENANCEactive

DRIFTlow

CONTRIBUTORS155

VELOCITY0.81

OPEN ISSUES219

CLOSED ISSUES688

LAST COMMIT1 month ago

── TAGS ──

#kubernetes #operator #security #vulnerability-scanning #trivy #devsecops #opa #rego #cloud-native #golang #misconfiguration #octoberfest #vulnerability-detection #vulnerability-scanners #security-tools

── GITHUB TOPICS ──

cloud-native golang kubernetes operator security misconfiguration octoberfest vulnerability-detection vulnerability-scanners security-tools

── DEPENDENCY GRAPH ──

github.com/CycloneDX/cyclonedx-go (go) v0.11.0

github.com/aquasecurity/go-version (go) v0.0.1

github.com/aquasecurity/trivy (go) v0.74.0

github.com/aquasecurity/trivy-checks (go) v1.12.2-0.20251219190323-79d27547baf5

github.com/aquasecurity/trivy-db (go) v0.0.0-20260813095258-0e0340a01b57

github.com/aquasecurity/trivy-kubernetes (go) v0.9.1

github.com/aws/aws-sdk-go-v2 (go) v1.43.6

github.com/bluele/gcache (go) v0.0.2

github.com/caarlos0/env/v6 (go) v6.10.1

github.com/davecgh/go-spew (go) v1.1.2-0.20180830191138-d8f796af33cc

github.com/dsnet/compress (go) v0.0.2-0.20230904184137-39efe44ab707

github.com/emirpasic/gods (go) v1.18.1

github.com/go-logr/logr (go) v1.4.4

github.com/google/go-containerregistry (go) v0.21.9

github.com/google/uuid (go) v1.6.0

github.com/gorhill/cronexpr (go) v0.0.0-20180427100037-88b0669f7d75

github.com/liamg/memoryfs (go) v1.6.0

github.com/magefile/mage (go) v1.17.2

github.com/onsi/ginkgo/v2 (go) v2.32.1

github.com/onsi/gomega (go) v1.42.1

github.com/openshift/api (go) v0.0.0-20231025170628-b8a18fdc040d

github.com/prometheus/client_golang (go) v1.24.1

github.com/quasilyte/go-ruleguard/dsl (go) v0.3.23

github.com/samber/lo (go) v1.53.0

github.com/stretchr/testify (go) v1.12.0

go.uber.org/automaxprocs (go) v1.6.0

go.uber.org/multierr (go) v1.11.0

golang.org/x/text (go) v0.41.0

golang.org/x/xerrors (go) v0.0.0-20240903120638-7835f813f4da

k8s.io/api (go) v0.36.3

k8s.io/apiextensions-apiserver (go) v0.36.3

k8s.io/apimachinery (go) v0.36.3

k8s.io/cli-runtime (go) v0.36.3

k8s.io/client-go (go) v0.36.3

k8s.io/utils (go) v0.0.0-20260319190234-28399d86e0b5

sigs.k8s.io/controller-runtime (go) v0.24.1

sigs.k8s.io/yaml (go) v1.6.0

cel.dev/expr (go) v0.25.2

cloud.google.com/go (go) v0.123.0

cloud.google.com/go/auth (go) v0.22.0

cloud.google.com/go/auth/oauth2adapt (go) v0.2.8

cloud.google.com/go/compute/metadata (go) v0.9.0

cloud.google.com/go/iam (go) v1.11.0

cloud.google.com/go/monitoring (go) v1.25.0

cloud.google.com/go/storage (go) v1.62.2

dario.cat/mergo (go) v1.0.2

github.com/Azure/azure-sdk-for-go/sdk/azcore (go) v1.22.0

github.com/Azure/azure-sdk-for-go/sdk/azidentity (go) v1.14.0

github.com/Azure/azure-sdk-for-go/sdk/containers/azcontainerregistry (go) v0.2.3

github.com/Azure/azure-sdk-for-go/sdk/internal (go) v1.12.0

github.com/Azure/go-ansiterm (go) v0.0.0-20250102033503-faa5f7b0171c

github.com/AzureAD/microsoft-authentication-library-for-go (go) v1.7.2

github.com/BurntSushi/toml (go) v1.6.0

github.com/DataDog/zstd (go) v1.5.5

github.com/GoogleCloudPlatform/docker-credential-gcr/v2 (go) v2.2.1

github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp (go) v1.32.0

github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric (go) v0.55.0

github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping (go) v0.55.0

github.com/Intevation/gval (go) v1.3.0

github.com/Intevation/jsonpath (go) v0.2.1

github.com/MakeNowJust/heredoc (go) v1.0.0

github.com/Masterminds/goutils (go) v1.1.1

github.com/Masterminds/semver/v3 (go) v3.5.0

github.com/Masterminds/sprig/v3 (go) v3.3.0

github.com/Masterminds/squirrel (go) v1.5.4

github.com/Microsoft/hcsshim (go) v0.15.0-rc.1

github.com/VividCortex/ewma (go) v1.2.0

github.com/anchore/go-struct-converter (go) v0.1.0

github.com/apparentlymart/go-cidr (go) v1.1.1

github.com/apparentlymart/go-textseg/v15 (go) v15.0.0

github.com/apparentlymart/go-textseg/v17 (go) v17.0.1

github.com/aquasecurity/go-gem-version (go) v0.0.0-20201115065557-8eed6fe000ce

github.com/aquasecurity/go-npm-version (go) v0.0.2

github.com/aquasecurity/go-pep440-version (go) v0.0.2-0.20260224065243-f9bba28c51a4

github.com/aquasecurity/iamgo (go) v0.0.10

github.com/aquasecurity/jfather (go) v0.0.8

github.com/aquasecurity/table (go) v1.11.0

github.com/aquasecurity/tml (go) v0.6.1

github.com/aquasecurity/trivy-java-db (go) v0.0.0-20240109071736-184bd7481d48

github.com/asaskevich/govalidator (go) v0.0.0-20230301143203-a9d515a09cc2

github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream (go) v1.7.16

github.com/aws/aws-sdk-go-v2/config (go) v1.32.35

github.com/aws/aws-sdk-go-v2/credentials (go) v1.19.34

github.com/aws/aws-sdk-go-v2/feature/ec2/imds (go) v1.18.35

github.com/aws/aws-sdk-go-v2/internal/configsources (go) v1.4.35

github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 (go) v2.7.35

github.com/aws/aws-sdk-go-v2/internal/v4a (go) v1.4.36

github.com/aws/aws-sdk-go-v2/service/ebs (go) v1.22.1

github.com/bgentry/go-netrc (go) v0.0.0-20140422174119-9fd32a8b3d3d

github.com/bitnami/go-version (go) v0.0.0-20231130084017-bb00604d650c

github.com/blang/semver/v4 (go) v4.0.0

github.com/bmatcuk/doublestar/v4 (go) v4.10.0

github.com/briandowns/spinner (go) v1.23.0

github.com/cenkalti/backoff/v5 (go) v5.0.3

github.com/cenkalti/backoff/v6 (go) v6.0.1

github.com/chai2010/gettext-go (go) v1.0.2

github.com/cheggaaa/pb/v3 (go) v3.2.0

github.com/clipperhouse/uax29/v2 (go) v2.6.0

github.com/cloudflare/circl (go) v1.6.4

github.com/cncf/xds/go (go) v0.0.0-20260202195803-dba9d589def2

── FILE BREAKDOWN ──

Files by Type (count)

158

YAML

151

Markdown

Other (.rego)

Other (.png)

Other (.excalidraw)

JSON

Other (no ext)

Text

Shell

Git Ignore

Dockerfile

Files by Type (size)

Other (.png)

13MB

Other (.pdf)

1MB

YAML

1MB

Other (.excalidraw)

967KB

Markdown

502KB

Other (.sum)

115KB

JSON

54KB

Other (.rego)

46KB

Other (.mod)

21KB

Other (no ext)

11KB

Other (.svg)

5KB

── KEY FINDINGS: REUSABLE CODE ──

The LLM identified 3 files worth highlighting for reuse:

Implements the plugin interface for Trivy scanning. Builds pod specs for scan jobs in multiple modes (standalone, client/server, filesystem, rootfs) and parses Trivy JSON output into CRD-based reports. Demonstrates a clean separation between scanner adapters and the core operator logic, making it possible to swap or extend scanners with minimal changes.

file: pkg/plugins/trivy/plugin.go ↗ | tags: #plugin-architecture #kubernetes

Provides reusable predicate functions for controller-runtime event filtering, such as ignoring resources managed by Trivy, checking install modes and namespaces, and filtering on resource termination. These predicates reduce unnecessary reconciliation and are easily composed (e.g., predicate.Not, predicate.Or) to build precise watch configurations.

file: pkg/operator/predicate/predicate.go ↗ | tags: #predicate-pattern #event-filtering

Implements a custom Prometheus collector that scrapes security report CRDs and exposes them as gauge metrics. Supports configurable label inclusion, multiple metric families per report type, and namespace filtering. The collector dynamically rebuilds metric descriptors when configuration changes, demonstrating a robust pattern for integrating Kubernetes resources with observability systems.

file: pkg/metrics/collector.go ↗ | tags: #prometheus #custom-collector

── HISTORY ──

Last analyzed: 2026-09-10 15:39:40.372644

Next check: 2026-09-17 15:39:40.355979