Project: Trivy-Operator (Provisioning / Security & Compliance)
File: managed-registries.md

You must create an IAM OIDC identity provider for your cluster: ``` eksctl utils associate-iam-oidc-provider \ --cluster <cluster_name> \ --approve ``` Override the existing `trivy-operator` service account and attach the IAM policy to grant it permission to pull images from the ECR: ``` eksctl create iamserviceaccount \ --name trivy-operator \ --namespace trivy-system \ --cluster <cluster_name> \ --attach-policy-arn arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly \ --approve \ --override-existing-serviceaccounts ``` Please make sure the following is set up before using operator User steps to setup an AKS cluster and delegate access to specific private ACR. The official steps for setting up Workload Identity on AKS can be found . Managed clusters or self-managed clusters installed, Mutating admission webhook installed, Update trivy-operator service account to include workload identity annotation. Example (replace `<client-id>` with the one of the ) ```yaml apiVersion: v1 kind: ServiceAccount metadata: name: trivy-operator namespace: trivy-system annotations: azure.workload.identity/client-id: "<client-id>" ``` Add the following label to podTemplateLabels in helm values. Example using `values.yaml`: ```yaml serviceAccount: name: <service-account-name> create: false # Optional trivyOperator: scanJobPodTemplateLabels: azure.workload.identity/use=true ``` We can deploy the operator inside our cluster with referencing our new `values.yaml` manifest to override the default values: (replace `<service-account-name>` with the name of the service account you created ) ```sh helm upgrade --install trivy-operator aqua/trivy-operator \ --namespace trivy-system \ --create-namespace \ --version {{ var.chart_version }} --values ./values.yaml ``` Create an IAM service account for your application or use an existing IAM service account instead. You can use any IAM service account in any project in your organization. For Config Connector, apply the IAMServiceAccount object for your selected service account. ```yaml apiVersion: iam.cnrm.cloud.google.com/v1beta1 kind: IAMServiceAccount metadata: name: trivy-operator-gsa spec: displayName: trivy-operator-google-service-account ``` Ensure that your IAM service account has the roles you need. You can grant additional roles using the following command: ```shell gcloud projects add-iam-policy-binding <PROJECT_ID> \ --member "serviceAccount: trivy-operator-gsa@<GSA_PROJECT>.iam.gserviceaccount.com" \ --role <ROLE_NAME> ``` Allow the Kubernetes service account to impersonate the IAM service account by adding an IAM policy binding between the two service accounts. This binding allows the Kubernetes service account to act as the IAM service account. ```yaml gcloud iam service-accounts add-iam-policy-binding trivy-operator-gsa@<GSA_PROJECT>.iam.gserviceaccount.com \ --role roles/iam.workloadIdentityUser \ --member "serviceAccount:<PROJECT_ID>.svc.id.goog[trivy-system/trivy-operator]" ``` Annotate the Kubernetes service account with the email address of the IAM service account. ```yaml apiVersion: v1 kind: ServiceAccount metadata: annotations: iam.gke.io/gcp-service-account: trivy-operator-gsa@<PROJECT_ID>.iam.gserviceaccount.com name: trivy-operator namespace: trivy-system ``` Update your Pod spec to schedule the workloads on nodes that use Workload Identity and to use the annotated Kubernetes service account. ```yaml spec: serviceAccountName: trivy-operator-service nodeSelector: iam.gke.io/gke-metadata-server-enabled: "true" ``` Replace the following : PROJECT_ID: your Google Cloud project ID. GSA_PROJECT: the project ID of the Google Cloud project of your IAM service account. ROLE_NAME: the IAM role to assign to your service account, like roles/spanner.viewer.