[//]: # (Confidential document)
[//]: # (01/05/2025)
[//]: # (v 1.7.3)


# Kubernetes  labs v1.7.3
## Security :   Trivy


Trivy is a comprehensive and versatile security scanner. Trivy has scanners that look for security issues, and targets where it can find those issues.

Targets (what Trivy can scan):
- Container Image
- Filesystem
- Git Repository (remote)
- Virtual Machine Image
- Kubernetes
- AWS

Scanners (what Trivy can find there):
- OS packages and software dependencies in use (SBOM)
- Known vulnerabilities (CVEs)
- IaC issues and misconfigurations
- Sensitive information and secrets
- Software licenses


Usage:
  
    trivy k8s [flags] { cluster | all | specific resources like kubectl. eg: pods, pod/NAME }
  
	--scanners (default "vuln,config,secret,rbac")
	
	--compliance(k8s-nsa,k8s-cis, k8s-pss-baseline, k8s-pss-restricted)
	
	--format(table, json, template, sarif, cyclonedx, spdx, spdx-json, github, cosign-vuln) (default "table")
	
	--severity (default "UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL")
	
	--vuln-type(default "os,library")
	
	--components(default [workload,infra])
	
	--parallel (between 1-20, default 5)
	

## Lab1: Cluster

  - Scan the entire Kubernetes cluster for vulnerabilities and get a summary of the scan 
  - Receive additional details, use the ‘--report=all’ flag
  - 


```bash

trivy k8s --report summary 
trivy k8s --severity=CRITICAL --report=all
trivy k8s --scanners vuln  --report all
trivy k8s --scanners=secret --report=summary
trivy k8s --scanners=misconfig --report=summary
trivy k8s --report summary --skip-images
trivy k8s --report summary --exclude-kinds node,pod

```

## Lab2: Namespaces

  - Scan the entire Kubernetes Namespace for vulnerabilities and get a summary of the scan 
  - Scan deployments in a specific namespace, with a filter for critical vulnerability
  - Scan deployments and configmaps

```
trivy k8s --include-namespaces kube-system --severity=CRITICAL --report summary
trivy k8s --include-kinds pod --include-namespaces kube-system --report summary
trivy k8s --include-kinds configmap --include-namespaces kube-system --report summary

```

## Lab3: Scanners

  - Scan vuln,misconfig,secret,rbac
  
```
trivy k8s  --report summary --scanners=config 
trivy k8s  --report all  --scanners=config
trivy k8s  --report summary  --scanners=config
```

## Lab4: image

  - Scan image vuln, misconfig, license
  - Check image compliance
  - Generate image sbom
  
```
trivy image python:3.4-alpine

trivy image --scanners vuln centos:7
trivy image --scanners misconfig centos:7
trivy image --scanners license  centos:7
trivy image --compliance docker-cis centos:7
trivy image --format spdx-json --output result.json alpine:3.15
```