Project: Trivy-Operator (Provisioning / Security & Compliance)
File: helm.md

[Helm], which is the de facto standard package manager for Kubernetes, allows installing applications from parameterized YAML manifests called Helm [charts]. To address shortcomings of we provide the Helm chart to deploy the Trivy-Operator. The Helm chart supports all . As an example, let's install the operator in the `trivy-system` namespace and configure it to select all namespaces, except `kube-system` and `trivy-system`: Clone the chart directory: ```sh git clone --depth 1 --branch {{ git.tag }} https://github.com/aquasecurity/trivy-operator.git cd trivy-operator ``` Or add Aqua chart repository: ```sh helm repo add aqua https://aquasecurity.github.io/helm-charts/ helm repo update ``` Install the chart from a local directory: ```sh helm install trivy-operator ./deploy/helm \ --namespace trivy-system \ --create-namespace ``` Or install the chart from the Aqua chart repository: ```sh helm install trivy-operator aqua/trivy-operator \ --namespace trivy-system \ --create-namespace \ --version {{ var.chart_version }} ``` Or install the chart from the Aqua chart repository using the OCI registry: ```sh helm install trivy-operator oci://ghcr.io/aquasecurity/helm-charts/trivy-operator \ --namespace trivy-system \ --create-namespace \ --version {{ var.chart_version }} ``` Configuration options can be passed using the `--set` parameter. To list only the fixed vulnerabilities in the cluster, one can use the following command. ```sh helm install trivy-operator ./deploy/helm \ --namespace trivy-system \ --create-namespace \ --set="trivy.ignoreUnfixed=true" ``` There are many [values] in the chart that can be set to configure Trivy-Operator. See the [customising] section for more details. Check that the `trivy-operator` Helm release is created in the `trivy-system` namespace, and it has status `deployed`: ```sh $ helm list -n trivy-system NAME NAMESPACE REVISION UPDATED STATUS CHART APP VERSION trivy-operator trivy-system 1 2021-01-27 20:09:53.158961 +0100 CET deployed trivy-operator-{{ var.chart_version }} {{

}} ``` To confirm that the operator is running, check that the `trivy-operator` Deployment in the `trivy-system` namespace is available and all its containers are ready: ```sh $ kubectl get deployment -n trivy-system NAME READY UP-TO-DATE AVAILABLE AGE trivy-operator 1/1 1 1 11m ``` If for some reason it's not ready yet, check the logs of the Deployment for errors: ```sh kubectl logs deployment/trivy-operator -n trivy-system ``` There are cases, when potential chart developers want to add the operator as a dependency. An example would be the creation of an umbrella chart for an application, which depends on 3d-party charts. In this case, it maybe not suitable to install the Trivy Operator in the same namespace as the main application. Instead, we can use the Helm value `operator.namespace` to define a namespace where only the operator will be installed. The Operator chart will then either create a new namespace if not existing or use the existing one. You can uninstall the operator with the following command: ``` helm uninstall trivy-operator -n trivy-system ``` You have to manually delete custom resource definitions created by the `helm install` command: !!! danger Deleting custom resource definitions will also delete all security reports generated by the operator. ```sh kubectl delete crd vulnerabilityreports.aquasecurity.github.io kubectl delete crd exposedsecretreports.aquasecurity.github.io kubectl delete crd configauditreports.aquasecurity.github.io kubectl delete crd clusterconfigauditreports.aquasecurity.github.io kubectl delete crd rbacassessmentreports.aquasecurity.github.io kubectl delete crd infraassessmentreports.aquasecurity.github.io kubectl delete crd clusterrbacassessmentreports.aquasecurity.github.io kubectl delete crd clustercompliancereports.aquasecurity.github.io kubectl delete crd clusterinfraassessmentreports.aquasecurity.github.io kubectl delete crd sbomreports.aquasecurity.github.io kubectl delete crd clustersbomreports.aquasecurity.github.io kubectl delete crd clustervulnerabilityreports.aquasecurity.github.io ``` The Trivy Operator Helm Chart can be customised in the same way as other Helm Charts, by overwriting values in the `values.yaml` files. You can find all the values that can be customised in the README of There are two ways to overwrite values in a Helm chart upon installation: Create a custom values.yaml file with your changes and give Helm the file upon installation e.g. to specfy that Trivy should ignore all unfixed vulnerabilities: ```yaml trivy: ignoreUnfixed: true ``` The file can be passed into Trivy with the `--values` flag in Helm: ```yaml helm install trivy-operator aqua/trivy-operator \ --namespace trivy-system \ --create-namespace \ --values values.yaml ``` This is done with the `--set` command in Helm: ```yaml helm install trivy-operator aqua/trivy-operator \ --namespace trivy-system \ --create-namespace \ --set="trivy.ignoreUnfixed=true" \ ```