Project: Trivy-Operator (Provisioning / Security & Compliance)
File: metrics.md

`trivy-operator` exposes a `/metrics` endpoint by default with metrics for vulnerabilities, exposed secrets, rbacassessment and configaudits. A report summary series exposes the count of checks of each status reported in a given `VulnerabilityReport`. For example: ```shell trivyimagevulnerabilities{ containername="coredns",imagedigest="",imageregistry="index.docker.io",imageoseosl="",imageosfamily="",imageosname="",imagerepository="rancher/coredns-coredns",imagetag="1.8.3",name="replicaset-coredns-6488c6fcc6-coredns",namespace="kube-system",resourcekind="ReplicaSet",resource_name="coredns-6488c6fcc6",severity="High" } 10 ``` A report summary series exposes the count of checks of each status reported in a given `ConfigAuditReport`. For example: ```shell trivyresourceconfigaudits{ name="daemonset-svclb-traefik",namespace="kube-system",resourcekind="DaemonSet",resourcename="svclb-traefik",severity="High" } 2 ``` Exposes details about ConfigAudit that were discovered in images, enable by setting the EnvVar: `OPERATORMETRICSCONFIGAUDITINFO_ENABLED" envDefault:"false"` . For example: ```shell trivyconfigauditsinfo{ configauditcategory="car1 category for config audit",configauditdescription="car1 description for config audit",configauditid="car1 Id",configauditsuccess="false",configaudittitle="car1 config audit title",name="replicaset-nginx-6d4cf56db6",namespace="default",resourcekind="ReplicaSet",resourcename="nginx-6d4cf56db6",severity="Critical"} 1 ``` A report summary series exposes the count of checks of each status reported in a given `RbacAssessmentsReport`. For example: ```shell trivyrolerbacassessments{ name="role-6fbccbcb9d",namespace="kube-system",resourcekind="Role",resourcename="6fbccbcb9d",severity="Medium" } 1 ``` Exposes details about RbacAssessments that were discovered in images, enable by setting the EnvVar: `OPERATORMETRICSRBACASSESSMENTINFO_ENABLED" envDefault:"false"`. For example: ```shell trivyrbacassessmentsinfo{ name="role-admin-6d4cf56db6",namespace="default",rbacassessmentcategory="car1 category for rbac assessment",rbacassessmentdescription="car1 description for rbac assessment",rbacassessmentid="car1 Id",rbacassessmentsuccess="true",rbacassessmenttitle="car1 rbac assessment title",resourcekind="Role",resourcename="admin-6d4cf56db6",severity="Critical"} 1 ``` A report summary series exposes the count of checks of each status reported in a given `ExposedsSecretsReport`. For example: ```shell trivyimageexposedsecrets{ containername="trivy",imagedigest="",imageregistry="index.docker.io",imagerepository="josedonizetti/trivy",imagetag="secrettest",name="pod-tt-reg-test",namespace="default",resourcekind="Pod",resource_name="tt-reg-test",severity="Critical" } 1 ``` Exposes details about secrets that were discovered in images, enable by setting the EnvVar: `OPERATORMETRICSEXPOSEDSECRETINFO_ENABLED" envDefault:"false"`. For example: ```shell trivyexposedsecretsinfo{ containername="trivy",imagedigest="",imageregistry="index.docker.io",imagerepository="josedonizetti/trivy",imagetag="secrettest",name="pod-tt-reg-test",namespace="default",resourcekind="Pod",resourcename="tt-reg-test",secretcategory="AWS",secretruleid="aws-access-key-id",secrettarget="/etc/apt/s3auth.conf",secrettitle="AWS Access Key ID",severity="Critical" } 1 ``` A report summary series exposes the count of checks of each status reported in a given `InfraAssessmentsReport`. For example: ```shell trivyresourceinfraassessments{ name="pod-kube-controller-manager-minikube",namespace="kube-system",resourcekind="Pod",resourcename="kube-controller-manager-minikube",severity="Low" } 3 ``` Exposes details about InfraAssessments that were discovered in images, enable by setting the EnvVar: `OPERATORMETRICSINFRAASSESSMENTINFO_ENABLED" envDefault:"false"`. For example: ```shell trivyinfraassessmentsinfo{ name="pod-kube-apiserver-minikube-6d4cf56db6",namespace="kube-system",infraassessmentcategory="car1 category for infra assessment",infraassessmentdescription="car1 description for infra assessment",infraassessmentid="car1 Id",infraassessmentsuccess="true",infraassessmenttitle="car1 infra assessment title",resourcekind="Pod",resourcename="kube-apiserver-minikube-6d4cf56db6",severity="Critical" } 1 ``` A report summary series exposes the count of checks of each status reported in a given `ClusterComplianceReport`. For example: ```shell trivyclustercompliance{description="National Security Agency - Kubernetes Hardening Guidance",status="Fail",title="nsa"} 12 trivyclustercompliance{description="National Security Agency - Kubernetes Hardening Guidance",status="Pass",title="nsa"} 17 ``` Exposes details about ClusterCompliance that were discovered in images, enable by setting the EnvVar: `OPERATORMETRICSCLUSTERCOMPLIANCEINFO_ENABLED" envDefault:"false"`. For example: ```shell trivycomplianceinfo{complianceid="car1 Id",compliancename="car1 cluster compliance name", description="National Security Agency - Kubernetes Hardening Guidance",severity="MEDIUM",status="Fail",title="nsa"} 1 trivycomplianceinfo{complianceid="car1 Id",compliancename="car1 cluster compliance name", description="National Security Agency - Kubernetes Hardening Guidance",severity="LOW",status="Pass",title="nsa"} 1 ``` Exposing vulnerability ID on metrics by setting the EnvVar: `OPERATORMETRICSVULNIDENABLED" envDefault:"false"`. For example: ```shell trivyvulnerabilityid{ class="os-pkgs",containername="nginx",fixedversion="",imagedigest="",imageregistry="index.docker.io",imagerepository="library/nginx",imagetag="1.16.1",installedversion="5.3.28+dfsg1-0.5",lastmodifieddate="2023-06-28T21:16:00Z",name="replicaset-nginx-deployment-559d658b74-nginx",namespace="default",packagetype="debian",pkgpath="/app/local",publisheddate="2023-06-28T21:15:00Z",resource="libdb5.3",resourcekind="ReplicaSet",resourcename="nginx-deployment-559d658b74",severity="Critical",vulnid="CVE-2019-8457",vulnscore="7.5",vuln_title="sqlite: heap out-of-bound read in function rtreenode()" } 1 ``` User might wants to include custom labels to resources that can be exposed and associated with the Prometheus metrics. This capability can be added by setting the following helm param. Example: `--set="trivyOperator.reportResourceLabels": "owner"` `k8slabel` prefix will be added to custom label ```shell trivyresourceconfigaudits{k8slabelowner="platform",name="daemonset-svclb-traefik",namespace="kube-system",resourcekind="DaemonSet",resourcename="svclb-traefik",severity="Critical"} 2 ```