docs: restructure docs and add tutorials (#2883)

Co-authored-by: knqyf263 <knqyf263@gmail.com>

docs/tutorials/additional-resources/cks.md

@@ -0,0 +1,26 @@
+# CKS preparation resources
+
+The [Certified Kubernetes Security Specialist (CKS) Exam](https://training.linuxfoundation.org/certification/certified-kubernetes-security-specialist/) is offered by The Linux Foundation. It provides assurance that a CKS has the skills, knowledge, and competence on a broad range of best practices for securing container-based applications and Kubernetes platforms during build, deployment and runtime. CKA certification is required to sit for this exam.
+
+### Community Resources
+
+- [Trivy Video overview (short)][overview]
+- [Example questions from the exam][exam]
+- [More example questions][questions]
+- [CKS exam study guide](study-guide)
+- [Docker Image Vulnerabilities & Trivy Image Scanning Demo | K21Academy](https://youtu.be/gHz10UsEdys)
+
+### Aqua Security Blog posts to learn more
+
+- Supply chain security best [practices][supply-chain-best-practices]
+- Supply chain [attacks][supply-chain-attacks]
+
+If you know of interesting resources, please start a PR to add those to the list.
+
+[overview]: https://youtu.be/2cjH6Zkieys
+[exam]: https://jonathan18186.medium.com/certified-kubernetes-security-specialist-cks-preparation-part-7-supply-chain-security-9cf62c34cf6a
+[questions]: https://github.com/kodekloudhub/certified-kubernetes-security-specialist-cks-course/blob/main/docs/06-Supply-Chain-Security/09-Scan-images-for-known-vulnerabilities-(Trivy).md
+[study-guide]: https://devopscube.com/cks-exam-guide-tips/
+
+[supply-chain-best-practices]: https://blog.aquasec.com/supply-chain-security-best-practices
+[supply-chain-attacks]: https://blog.aquasec.com/supply-chain-threats-using-container-images

docs/tutorials/additional-resources/community.md

@@ -0,0 +1,37 @@
+# Community References
+Below is a list of additional resources from the community.
+
+## Vulnderability Scanning
+
+- [Detecting Spring4Shell with Trivy and Grype](https://youtu.be/mOfBcpJWwSs)
+
+## CI/CD Pipelines
+
+- [How to use Tekton to set up a CI pipeline with OpenShift Pipelines](https://www.redhat.com/architect/cicd-pipeline-openshift-tekton)
+- [Continuous Container Vulnerability Testing with Trivy](https://semaphoreci.com/blog/continuous-container-vulnerability-testing-with-trivy)
+- [Getting Started With Trivy and Jenkins](https://youtu.be/MWe01VdwuMA)
+- [How to use Tekton to set up a CI pipeline with OpenShift Pipelines](https://www.redhat.com/architect/cicd-pipeline-openshift-tekton)
+
+## Misconfiguration Scanning
+
+- [Identifying Misconfigurations in your Terraform](https://youtu.be/cps1V5fOHtE)
+- [How to write custom policies for Trivy](https://blog.ediri.io/how-to-write-custom-policies-for-trivy)
+
+## SBOM, Attestation & related
+
+- [Attesting Image Scans With Kyverno](https://neonmirrors.net/post/2022-07/attesting-image-scans-kyverno/)
+
+## Trivy Kubernetes
+
+- [Using Trivy Kubernetes in OVHCloud documentation.](https://docs.ovh.com/gb/en/kubernetes/installing-trivy/)
+
+## Comparisons
+
+- [the vulnerability remediation lifecycle of Alpine containers](https://ariadne.space/2021/06/08/the-vulnerability-remediation-lifecycle-of-alpine-containers/)
+- [Open Source CVE Scanner Round-Up: Clair vs Anchore vs Trivy](https://boxboat.com/2020/04/24/image-scanning-tech-compared/)
+- [Docker Image Security: Static Analysis Tool Comparison – Anchore Engine vs Clair vs Trivy](https://www.a10o.net/devsecops/docker-image-security-static-analysis-tool-comparison-anchore-engine-vs-clair-vs-trivy/)
+
+### Evaluations
+
+- [Istio evaluating to use Trivy](https://github.com/istio/release-builder/pull/687#issuecomment-874938417)
+- [Research Spike: evaluate Trivy for scanning running containers](https://gitlab.com/gitlab-org/gitlab/-/issues/270888)

docs/tutorials/additional-resources/references.md

@@ -0,0 +1,38 @@
+# Additional Resources and Tutorials
+Below is a list of additional resources from Aqua Security.
+
+## Announcements
+
+- [Trivy Vulnerability Scanner Joins the Aqua Open-source Family](https://blog.aquasec.com/trivy-vulnerability-scanner-joins-aqua-family)
+- [Trivy Image Vulnerability Scanner Now Under Apache 2.0 License](https://blog.aquasec.com/trivy-open-source-vulnerability-scanner-apache2.0-license)
+
+## Vulnderability Scanning
+
+- [Using Trivy to Discover Vulnerabilities in VS Code Projects](https://blog.aquasec.com/trivy-open-source-vulnerability-scanner-vs-code)
+- [How does a vulnerability scanner identify packages?](https://youtu.be/PaMnzeHBa8M)
+- [Handling Container Vulnerabilities with Open Policy Agent - Teppei Fukuda, Aqua Security](https://youtu.be/WKE2XNZ2zr4)
+
+## CI/CD Pipelines
+
+- [DevSecOps with Trivy and GitHub Actions](https://blog.aquasec.com/devsecops-with-trivy-github-actions)
+- [Find Image Vulnerabilities Using GitHub and Aqua Security Trivy Action](https://blog.aquasec.com/github-vulnerability-scanner-trivy)
+
+## Misconfiguration Scanning
+
+- [Identifying Misconfigurations in your Terraform](https://youtu.be/cps1V5fOHtE)
+
+## Client/Server
+
+- [Using Trivy in client server mode](https://youtu.be/tNQ-VlahtYM)
+ 
+## Workshops
+
+- [Trivy Live Demo & Q&A](https://youtu.be/6Vw0QgJ-k5o)
+- [First Steps to Full Lifecycle Security with Open Source Tools - Rory McCune & Anais Urlichs](https://youtu.be/nwJ0366rs6s)
+
+
+## Older Resources
+
+- [Webinar: Trivy Open Source Scanner for Container Images – Just Download and Run!](https://youtu.be/XnYxX9uueoQ)
+- [Kubernetes Security through GitOps Best Practices: ArgoCD and Starboard](https://youtu.be/YvMY8to9aHI)
+- [Get started with Kubernetes Security and Starboard](https://youtu.be/QgctrpTpJec)