trivy-operator

Trivy Operator

Chainguard's redistribution of the Trivy Operator Helm chart, pre-configured with hardened Chainguard Images.

Prerequisites

Authentication is required to access this chart and its images. First, authenticate with Chainguard and configure your environment:

chainctl auth login
chainctl auth configure-docker --pull-token --save
helm registry login cgr.dev

Create an image pull secret:

kubectl create namespace trivy-system
kubectl create secret docker-registry cgr-pull-secret \
  --docker-server=cgr.dev \
  --docker-username="$(echo cgr.dev | docker-credential-cgr get | jq -r '.Username')" \
  --docker-password="$(echo cgr.dev | docker-credential-cgr get | jq -r '.Secret')" \
  --namespace trivy-system

Installation

helm install trivy-operator oci://cgr.dev/ORGANIZATION/charts/trivy-operator \
  --namespace trivy-system \
  --set image.pullSecrets[0].name=cgr-pull-secret \
  --set trivy.image.imagePullSecret=cgr-pull-secret

image.pullSecrets covers the operator Deployment. trivy.image.imagePullSecret covers the Trivy scan jobs and the optional built-in Trivy server, which pull the Chainguard trivy image.

About This Chart

This is a redistribution of the upstream Trivy Operator Helm chart. All upstream configuration options apply.

The node-collector image used by the infra-assessment scanner (operator.infraAssessmentScannerEnabled) is not replaced and still defaults to the upstream ghcr.io/aquasecurity/node-collector image. This chart does not publish a FIPS variant because the optional node-collector feature uses an upstream image with no Chainguard FIPS equivalent. The trivy-operator-fips image is tested independently, but it is not a FIPS-qualified chart deployment.

For full documentation, see: https://aquasecurity.github.io/trivy-operator/