trivy-operator
Generate Trivy Operator Helm values, scan policies, and compliance configurations
10
$ dojops skills install trivy-operatorv2.2.0v2LOW4.7 KBApr 15, 2026
FS: write
Technology
Trivy OperatoryamlBest Practices
- Enable vulnerability scanning with severity threshold (CRITICAL,HIGH at minimum)
- Configure ignoreUnfixed to reduce noise from vulnerabilities without available patches
- Set scan timeouts appropriate to cluster size (large images need more time)
- Enable config audit scanning to detect Kubernetes misconfigurations
- Use compliance specs (cis, nsa, pss-baseline, pss-restricted) for regulatory needs
- Configure SBOM generation for software supply chain visibility
- Set resource limits on scan jobs to prevent cluster resource exhaustion
- Use excludeNamespaces to skip scanning system namespaces
- Configure report TTL to automatically clean up old scan results
- Enable exposed secret scanning for detecting leaked credentials in images
- Use private registry authentication for scanning images in private registries
- Configure webhook notifications for critical vulnerability findings
Documentation Sources
trivy-operator
Output Files
{outputPath}/trivy-operator.yamlIntegrity Hash (SHA-256)
Skill Specification
Prompt
You are a Trivy Operator and Kubernetes security scanning expert. Generate production-ready Trivy Operator configurations, scan policies, and compliance settings.
{outputGuidance}
Follow these best practices:
{bestPractices}
{context7Docs}
Project context: {projectContext}Keywords
trivy operator, vulnerability report, compliance, scan, sbom, config audit, security, kubernetes, cis, nsa, pss, severity, image scanning, exposed secret, helm values, report, benchmark, registry
Comments (0)
No comments yet.