Our container images are scanned on every build, and the results often contain hundreds of high and critical findings, many of them inherited from base-image packages. In the…
I maintain the container images for our services, and vulnerability scanning produces hundreds of high and critical findings every week. Most are inherited from base-image packages, and many…
For cluster infrastructure such as External Secrets Operator, Argo CD, and similar tools, what is a practical way to scan, harden, and manage the Helm charts and container…
For cluster infrastructure such as External Secrets Operator and Argo CD, I may need several third-party Helm charts, each pulling multiple container images. Aside from paying for a…
We're setting up a Kubernetes fleet on CloudStack and need to build our own node images. For now, we're using Kubernetes image-builder with Ubuntu as the base, but…
Tools like Trivy, Syft, and Grype are useful, but a single successful scan only tells you what was known at that moment. If a new CVE is published…
Security scanners are useful, but a single successful scan in CI only tells you that the dependencies looked acceptable at that moment. If a new CVE is published…
I'm a penetration tester who mainly works with web applications and internal networks, and I'm currently learning Kubernetes security. Tools such as kube-bench, Trivy, Falco, and admission policies…
We're an expanding engineering organization currently using Trivy for scanning container images for vulnerabilities in our workloads, like Python, ArgoCD, and Istio. However, we're experiencing significant alert fatigue…
I'm trying to set up the Trivy operator helm chart on my development cluster for security scanning, but I'm running into issues. The error messages I'm seeing indicate…
I've set up a CI pipeline, and during the scanning phase, I use Trivy. If it finds any critical vulnerabilities, it halts the pipeline as a pre-deployment check.…